Everyone writing about Digital Product Passports is still writing about the delegated act that hasn’t arrived. The more useful story is the one that already has: eight European standards — EN 18216, 18219, 18220, 18221, 18222, 18223, 18239 and 18246 — that define how any passport is identified, carried, exchanged, stored, exposed and secured. They are product-agnostic, which means they apply whether the passport is for a battery, a mattress or a garment, and six of them are now cited as harmonised standards in the Official Journal. That single word — harmonised — is the difference between a Digital Product Passport build that’s defensible and one that’s a rebuild waiting to happen.
The Part of DPP Nobody Covers
Most coverage of Digital Product Passports focuses on disclosure — what a T-shirt must say about its fibres, dyes and supply chain. That’s the wrong layer to be anxious about right now, because it isn’t finished yet. The layer that is finished is the plumbing: how any passport, regardless of product, gets a unique identity, gets attached to a physical item, moves data between systems, gets stored for the long term, gets exposed through an API, interoperates across vendors, and keeps sensitive fields away from people who shouldn’t see them. That plumbing is now specified in eight EN standards, and an exporter who builds against it today is building on ground that won’t move.
The Eight Standards, in Plain Language
Each standard answers one exporter-side question:
- EN 18219 — Unique identifiers. Whether a passport is issued at the model level, the batch level, or the individual item level — a choice with real cost consequences, since item-level identity means tracking serials through production, not just styles.
- EN 18220 — Data carriers. How the identifier is physically attached — 2D codes, RFID, NFC — including encoding, read quality and durability. For garments this is the laundry-durability problem: a care-label QR code has to survive wash cycles the product itself is rated for, which most 2026 pilots still get wrong. See our guide to GS1 Digital Link for the identifier format these carriers resolve to.
- EN 18216 — Data exchange protocols. How systems — yours, your supplier’s, your buyer’s — pass passport data to each other without each pair needing a custom integration.
- EN 18221 — Storage, archiving, persistence. The “who keeps this alive for ten years” question. A passport that outlives the vendor who issued it is a requirement, not a nice extra.
- EN 18222 — APIs and lifecycle management. How a passport gets updated — by a repairer, a reseller, a recycler — after it’s first published, without breaking the record’s integrity.
- EN 18223 — System interoperability. Whether a passport built on one vendor’s platform can be read, verified and extended by a system that has never seen that vendor before.
- EN 18239 / EN 18246 — Access rights, security and business confidentiality. The one that answers “will my buyer see my mill’s pricing?” These two were due to publish after clearing a formal vote on 16 July 2026 — confirm current publication status against the CEN-CENELEC register before citing them as final.
Available vs. Harmonised — and Why 15 July Mattered
A standard can exist and still carry no regulatory weight until it is cited as harmonised in the Official Journal. That happened for six of the eight EN 1821x standards on 15 July 2026, via Implementing Decision (EU) 2026/1736. The practical effect: conformity with those cited standards now carries a presumption of conformity with ESPR Articles 10 and 11 — but only to the extent the cited standards cover those requirements. That scoping matters: presumption of conformity is not the same claim as “conformance equals compliance,” and no credible reading of the citation stretches it that far.
What an Exporter Can Build Today — Without the Textile Act
Four decisions don’t depend on the still-unwritten textile field list, because the EN 1821x standards already answer them:
- Identifier scheme: model, batch or item level, decided against EN 18219 rather than guessed.
- Carrier decision: which data-carrier technology and placement survives your product’s real-world handling, per EN 18220.
- Data custody: where and how passport records are stored and archived long-term, per EN 18221.
- Access tiers: which fields are public, which are buyer-only, and which stay internal, per EN 18239/18246.
Build those four against the standards now, and the eventual textile delegated act only has to supply a field list to slot into infrastructure that already exists — not a reason to rebuild it.
The Confidentiality Question, Answered Properly
The question exporters actually ask is narrower than “is my data safe” — it’s “will my buyer see what I pay for yarn.” EN 18239 and EN 18246 exist specifically to make that answerable: access-rights management and business-confidentiality controls are part of the standard, not a feature a vendor bolts on. A passport architecture that separates public, buyer-restricted and internal fields at the access layer — rather than relying on “we just won’t show that field” — is what the standards are asking for.
Where Tamper-Evidence Fits
Articles 10 and 11 require interoperability and data that is secure, authentic and reliable — the requirement is the outcome, not a named technology, and no EN 1821x standard mandates blockchain. StableDPP’s architecture is blockchain-anchored because tamper-evidence is the hardest part of that outcome to demonstrate with a record that can be silently edited after publication — that’s a design position, stated as architecture, not a claim about what the regulation mandates.
