A QR code is not compliance. A verifiable credential is.
Most DPP tools hand you a QR code linked to a PDF, and assume your data is already clean. It rarely is. PassportLab turns your raw spreadsheets and spec sheets into complete, machine-readable passports — signed so any change is detectable — and keeps them current as the implementing acts are adopted.
This is a real, signed Digital Product Passport
Not a mockup. Open the link below on your phone and scan it like an inspector would.
Every PassportLab passport is a W3C Verifiable Credential, resolvable via a GS1 Digital Link, with a full EPCIS event history and cryptographic proof of who issued it and when. What you see on the phone is exactly what a customs officer or market surveillance authority sees.
- Cryptographically signed Ed25519 signature, verifiable by any third party without contacting PassportLab.
- GS1 Digital Link Resolves from the same QR code printed on the product label.
- Full audit trail Every change to the passport is logged in a tamper-evident, timestamped audit trail.
- Registry-ready Structured to the format the live EU DPP Registry expects at submission.
A QR code pointing at a PDF is not what the regulation asks for
ESPR and the Battery Regulation both specify machine-readable, structured, verifiable data — not a static document behind a link.
PDFs disguised as passports
A QR code that opens a PDF or a marketing page satisfies nobody once an inspector actually checks it against the regulation's data model.
No cryptographic proof
Without a signed credential, there's no way to prove the data hasn't been altered after issuance — or who actually issued it.
Dead links at audit time
Passports hosted on throwaway infrastructure or a vendor that shuts down leave you with a broken link exactly when an authority asks for it.
Locked-in data
Some tools won't export your structured data at all, leaving you unable to switch providers or self-host once you've built up your catalogue.
No update path
Delegated acts under ESPR and the Battery Regulation are still being finalized. A static PDF can't absorb a schema change; a versioned passport can.
Four pillars regulators actually check
Every one of these is independently verifiable — by an auditor, a customs system, or a competitor's engineer — without ever talking to PassportLab.
Verifiable identity & signatures
Every passport is a W3C Verifiable Credential 2.0, signed with Ed25519 and with a DID:Web identity — add your organisation's own signing key and every passport also carries your signature. Selective disclosure via SD-JWT lets you share only the fields a given party needs to see.
Open interoperability
Passports resolve via GS1 Digital Link — the same identifier layer customs and retail systems already use — and expose their event history through GS1 EPCIS 2.0, mapped to the UNTP DPP 0.7.0 data model for cross-registry compatibility.
Tamper-evident by design
Every passport version is fingerprinted with a SHA-256 snapshot and written to an immutable audit trail enforced at the database level — not just in application code that can be bypassed.
Full supply chain context
Passports track every economic operator and stakeholder role in the chain, linked to EORI numbers and NANDO-listed conformity bodies where relevant, via EPCIS 2.0 events.
Everything PassportLab issues, checked against a published spec
Every passport is built on open standards — W3C Verifiable Credentials, GS1 Digital Link, UNTP, EPCIS and the Battery Regulation data model — so you're never locked in. See the full standards and interoperability list →
The 5 questions that separate a real DPP from a QR code
These are the exact questions we'd want answered if we were buying a compliance tool instead of building one.
Is the passport a signed credential, or a link to a hosted page?
Can I export my structured data and leave, at any time?
What happens when the delegated acts change the schema?
Does the passport track the full supply chain, or just my product?
Is the audit trail enforced at the database level, or just in the app?
Features by role
Compliance & legal teams
- Guided data collection mapped to Annex XIII fields
- Gap reports showing exactly what's missing before a submission
- Audit-ready export of every passport version and change
- Regulatory update tracking as delegated acts are finalized
Engineering & IT teams
- REST API and webhooks for ERP and PLM integration
- Standards-native output — W3C VC, GS1 EPCIS 2.0, UNTP — no proprietary SDK to learn
- Role-based access control and stakeholder API keys
- Sandbox environment for testing before go-live
Supply chain & operations
- Supplier data request templates that cite the exact regulation article
- Stakeholder roles for manufacturers, importers, and recyclers
- GS1 Digital Link QR codes ready for label printing
- EU DPP Registry-ready payloads and proof-of-registration tracking
What it actually takes to do this in-house
Most teams underestimate this by months, not weeks.
| Requirement | PassportLab | In-house build |
|---|---|---|
| Signed, verifiable credentials | Included — W3C VC 2.0 out of the box | Requires implementing a PKI and credential-issuance stack |
| GS1 Digital Link & EPCIS 2.0 | Included, pre-mapped | Requires a GS1 integration project, typically months |
| EU DPP Registry submission | Registry-ready payloads, operator-verification guidance and proof-of-registration tracking | Manual integration against the Registry API |
| Schema updates for delegated acts | Tracked centrally — passports are updated behind the same QR code | Manual redevelopment each time a delegated act is adopted |
| Data ingestion from messy sources | Human-reviewed mapping from PDFs, spreadsheets, ERP exports | Custom ETL pipeline your team has to build and maintain |
| Time to first compliant passport | Weeks, not quarters | Typically 6–12 months for a first working pipeline |
| Ongoing regulatory monitoring | Included via retainer | Requires a dedicated compliance hire or consultant |
Grounded in the process, not just the regulation text
We track the standards bodies and registries directly, not just the headline deadlines.
EU DPP Registry
Live since 20 July 2026. PassportLab passports are structured to its registration format and API from day one.
DIN DKE SPEC 99100
We track DIN DKE SPEC 99100 — the working basis for the coming delegated acts — and map our battery data model to its seven data clusters.
CEN/CLC JTC 24
We follow the six EN standards recognised in July 2026 for ESPR products, including EN 18222 for the interface and API layer. They are not yet cited in the Official Journal and do not apply to battery passports, but they show where the battery rules are heading.
BatteryPass-Ready test suite (our target)
Our target: JSON exports that pass all 11 BatteryPass-Ready scenarios (Fraunhofer IPK) for EV, LMT and stationary storage batteries. Validation against the test suite is in progress; Fraunhofer IPK has not tested or endorsed PassportLab.
Everything your compliance team needs
From your first SKU to 10,000 — manage the full DPP lifecycle without a dedicated technical team.
Built on Open Standards
Every passport is cryptographically signed and built on open standards for interoperability with supply chain verification systems.
Customs Verification
Standardized GS1 Digital Link protocols allow EU customs authorities, market surveillance bodies, and authorized stakeholders to access and verify product credentials interoperably — no proprietary middleware required.
10-Year Archival Hosting
Every passport is archived for at least 10 years, with structured JSON/CSV export available at any time — your data remains accessible and portable.
EU Data Sovereignty
Supports the data-portability rights of the EU Data Act. Export your entire DPP catalogue in structured JSON/CSV formats at any time. No proprietary format lock-in.
Regulatory Schema Alignment
Every battery passport is checked against Regulation (EU) 2023/1542 Annex XIII at creation and update, with missing fields flagged per battery category. Textile and electronics schemas are in active development and track the ESPR Working Plan.
Bulk Data Import
Import your entire product catalog in minutes using our structured JSON or CSV templates. No coding required.
Supply Chain Traceability
Full EPCIS 2.0 event repository for every product. Track shipping, receiving, and transformation events across your supply chain — including bulk RFID reader feeds — exportable as a standards-compliant EPCIS 2.0 document.
Frequently asked
Do I need a technical team to use PassportLab?
No. The platform is designed for compliance and operations teams. For messy source data — PDFs, spreadsheets, ERP exports — our team handles the mapping directly rather than asking you to self-serve a data model you don't have.
What happens if the delegated acts change after I've issued passports?
Passports are versioned and stay behind the same QR code. When a schema changes, your passports are updated in place — you never need to reprint labels.
Is my data locked into PassportLab?
No. Full structured export (JSON/CSV) of every product and passport is available on demand, with no lock-in.
How is this different from a QR-code generator?
A QR-code generator points at a hosted page. PassportLab issues a signed, standards-based Verifiable Credential with a full audit trail — the format regulators and market surveillance authorities are built to check.
Can this cover multiple product categories?
Yes. The schema is built per product category — batteries, textiles, electronics, iron & steel — each mapped to its own regulatory basis and deadline.
See your product's passport, not a mockup
Book a 20-minute call, or start with a free demo passport — no account required.
Standards notice: Standards status: EN 18216:2026–EN 18223:2026 — including the data-carrier standard EN 18220 and the data-persistence standard EN 18221 — were published by CEN/CENELEC on 27 May 2026. In July 2026, CEN/CLC JTC 24 formally recognised six of these EN standards, including EN 18222 (interface/API layer). They are not yet cited in the Official Journal of the EU, so they do not yet confer formal presumption of conformity. EN 18239 (access rights) and EN 18246 (data authentication) remain in draft, expected late 2026. ESPR (EU 2024/1781) delegated acts and per-category Annex I requirements are still being finalised. CBAM Reg. 2023/956 obligations continue to evolve under Commission guidance. Results are a readiness indication based on the latest available standards and drafts, and do not constitute legal advice.