what must the hosting of my product passport comply with
Hosting must keep data permanently available and accessible
Hosting of a digital product passport must ensure that the data it contains persists, remains current, and can be accessed by those who have the right to it under the rules — consumers, market actors, and supervisory authorities. Article 10 of the ESPR (Regulation (EU) 2024/1781) establishes that the passport must be accessible via the data carrier on the product (usually a QR code), that the data it contains is accurate and can be updated, and that the storage is arranged so that the passport lasts for the prescribed period. In addition, Article 13 requires that a reference to each passport is entered in a central European register, and Article 14 provides that the Commission shall establish a web portal through which those registered data can be consulted. Hosting is therefore not merely "a page that opens when you scan" — it is a technical and organisational responsibility that continues for as long as the passport must exist.
For whom this applies, and for whom it does not
These requirements apply to whoever offers the digital product passport: in practice, the manufacturer, importer or authorised representative responsible for placing the product on the market, or a party carrying out this task on their behalf. It concerns the hosting of the passport itself — the location where the product data are stored and accessed via the data carrier. It does not concern the data carrier as such: how the QR code is affixed to the product and what technical form it takes is a separate matter, detailed on the page on how the QR code is affixed to the product. It also does not concern the question of which data must be in the passport or in which file format they must be provided — that is determined separately per product category and is described on the page on submitting product passport data. Hosting is specifically the infrastructure: where the data is located, for how long, and how it remains accessible.
The precise requirements follow per product category, from a date that has yet to be established
The ESPR itself describes the main principles — accessibility, currency, linking to the register — but the detailed technical and operational requirements for hosting are laid down per product category in delegated acts. For electronics and ICT equipment it has not yet been published when that obligation enters into force. The ESPR work plan 2025-2030 lists these categories, and delegated acts are expected from 2027 onwards, but there is no fixed date for electronics and ICT yet. Until a delegated act for a specific product group is published, there is no concrete hosting obligation under the ESPR for that group. Once the delegated act for electronics and ICT is published, the date will appear here.
What this means for hosting arrangements
Those who are already thinking about hosting a product passport should do well to start with the duration: the passport must remain available for a period determined per product category, and this requirement directly affects the choice of hosting provider and infrastructure — this is further explained on the page on how long a product passport must remain available. A second point of attention is continuity: hosting must continue to function even if something changes at the company offering the passport, which becomes relevant in the event of business closure or takeover — see the page on what happens to the passport when a company closes. A third point is the link with the European register: the hosting environment must be arranged so that the reference to the passport is correct and current in the register, as is explained on the page on the register of digital product passports. If you already manage product data in an ERP or inventory system, you can also look ahead to how that connection will be arranged in practice. Finally, when choosing a hosting partner, it is advisable to pay attention to what happens in the event of a failure, a takeover of the hosting partner itself, or the expiration of a contract — points that are not explicitly stated in the ESPR, but which in practice determine whether the underlying requirement of continued accessibility is met.
What this is based on: Article 10, 13 and 14 of the ESPR
Article 10 of the ESPR (Regulation (EU) 2024/1781) describes the general requirements for the digital product passport, including accessibility and up-to-dateness of the data. Article 13 regulates the central register in which a reference to each passport is entered, and Article 14 regulates the web portal through which the Commission discloses that register data. Together, these articles form the framework within which hosting of a passport must function; the product category-specific details follow in later delegated acts.
If you are already preparing a product passport now, it is best to start by identifying your own product category and the status of the corresponding delegated act, and from there to incorporate the requirements for retention period and register coupling into the choice of a hosting solution.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 13 (register of digital product passports)
- Regulation (EU) 2024/1781 (ESPR), Article 14 (web portal for data in the digital product passport)
The regulation itself is on EUR-Lex. We provide references per statement; you do not have to take our word for it.
What you must concretely do
What is expected of you
The ESPR does not prescribe which hosting partner a product passport must be with, but it does prescribe the characteristics to which the storage and disclosure of the data must comply. Article 10 of the ESPR (Regulation (EU) 2024/1781) sets out the requirements for the digital product passport itself; Article 13 concerns the register in which passports are registered; Article 14 regulates the web portal through which supervisory authorities and other parties can access the data. For a company with 10 to 100 employees, this amounts to a number of separate, concrete obligations.
The passport must remain accessible via the data carrier on the product
The passport is disclosed via a data carrier — in practice a QR code — which is placed on or with the product. Article 10 of the ESPR sets requirements for that link between carrier and passport: the link must continue to work, even if years pass. For a medium-sized company, this means that the choice of a hosting partner is not independent of the choice for the data carrier: both must be aligned with each other and must remain so for the long term. How that link is established in practice is described in how does the QR code for the product passport get onto my electronics.
The data must be consultable by the correct parties, without everyone seeing everything
Article 10 distinguishes between data that is visible to everyone — for example to a consumer who scans the QR code — and data that is intended only for supervisory authorities or other market operators. A hosting environment must be able to technically implement that distinction. For a company, this means that the chosen solution cannot simply be "everything public" or "everything behind a login": a layered access must be possible, tailored to who needs which part of the information.
The passport must be registered in the European register
Article 13 of the ESPR requires registration of the passport in a central European register, with a basic set of data on the product and the location of the passport. The hosting of the passport itself and the registration in that register are two separate things: the passport can be hosted at its own or external hosting partner, while the register only contains the reference and core data. What must be included and how that registration works is explained in what is the register of digital product passports and what must I enter in it.
The data must be aligned with the web portal for supervision
Article 14 of the ESPR introduces a web portal through which market surveillance authorities and customs can access data from digital product passports. For the hosting party, this means that the storage of passport data cannot be isolated: a technical connection to this portal must be possible, in a form to be determined by the Commission. A company that hosts itself or engages a hosting party is well advised to ask whether that party is aware of this connection obligation and how it is fulfilled.
The data must be in a recognizable and transferable format
Hosting is not just a question of "where is it", but also "in what form". Article 10 sets requirements for interoperability: the data must be machine-readable and transferable, so that they do not remain locked in one system of one supplier. For a company of limited size, this is often the point where the choice of a hosting party weighs most heavily: a closed system that is difficult to export conflicts with this requirement. The file format in which data is submitted is elaborated in in what format must I provide the product passport data.
Where things go wrong in practice
A common situation is that a company chooses a hosting party without asking whether that party can guarantee a technical connection to the web portal of Article 14. At the moment a supervisor wants to access data, the link turns out not to be in place.
Another situation arises when the distinction between public and non-public data is not properly arranged: all information is behind the same access, or conversely everything is completely open, while certain data is only intended for market participants or supervision.
It also happens that a company confuses the hosting of the passport with registration in the European register: they think the passport is "registered" because it is online, while registration in the register is a separate step that does not happen automatically.
A fourth situation is a hosting party that stops providing the service after a while or is taken over, whereby the data is not available in a transferable format. The company is then stuck with a system that is no longer accessible, while the QR code on the product is already in circulation.
A fifth, common mistake is that the link between the data carrier on the product and the hosting location is organized technically separately from each other — for example because a packaging supplier creates the QR code without coordination with the party hosting the data. If the hosting party changes, the code no longer works.
What you can document
- An overview of which data in the passport are public and which are only intended for supervision or market participants, so that the hosting party can organize this distinction technically.
- A written agreement with the hosting party on the connection to the web portal of Article 14, including who is responsible if that connection changes.
- A documented procedure for registration in the European register, separate from the hosting agreements — see also the explanation for what is the register of digital product passports and what must I enter in it.
- An export option or contractual guarantee that data can be requested in a transferable format upon termination of the hosting agreement.
- Documentation of the link between data carrier and hosting location, including what happens if the hosting party or system changes — also relevant is how this relates to can I link the product passport to my ERP or inventory system.
- An agreement on the duration of the hosting obligation, to be coordinated with what is known about how long must a product passport remain available.
This is not legal advice. This page provides general information about the regulations that this platform covers. We are not familiar with your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something not correct? Let us know — corrections take priority.