Somewhere in your supply chain, a product is being prepared for the European market. It carries your brand, your formulation, and your reputation. Starting from 2027, it will also need to carry a machine-readable data carrier — most likely a QR code — that links regulators, retailers, and consumers to a verified digital record of everything that went into making it. That requirement is the EU Digital Product Passport (DPP), and it is one of the most consequential product compliance mandates in decades.

The regulation affects far more businesses than most compliance teams currently realise. It applies not just to EU-based manufacturers but to any brand placing products on the EU market — including the vast majority of consumer goods, apparel, and industrial products manufactured across Asia. For operations managers and brand owners exporting to Europe, the question is no longer whether this applies to you. It is whether you will be ready in time, and whether the QR code you are required to deploy will do just the minimum — or whether it can simultaneously protect your brand against counterfeiting, control grey market activity, and build consumer trust at the point of scan.

This article explains what the EU DPP actually requires, which industries are affected and on what timeline, why QR codes have emerged as the primary delivery mechanism, and why a well-designed QR code programme can deliver compliance and brand protection in a single infrastructure investment.

What Is the EU Digital Product Passport?

The Digital Product Passport is a structured digital record linked to a physical product via a machine-readable identifier — typically a QR code — that holds verified information about that product’s materials, environmental impact, origin, repairability, and end-of-life handling. It is a central component of the EU’s Ecodesign for Sustainable Products Regulation (ESPR), which entered into force on 18 July 2024. The regulation’s goal is systemic: to make physical products traceable, circular, and environmentally accountable across their entire lifecycle.

The DPP is not a single centralised database. It is a distributed network of product records connected through a central EU registry. Each product receives a unique persistent identifier, and the QR code on the packaging links that physical product to its digital record in real time. Under ESPR Article 10, the data carrier must comply with international standards, be physically present on the product or its packaging, and use open, interoperable formats without vendor lock-in. Practically speaking, this means that a consumer, a customs inspector, or a recycler can scan the code and access verified product data — without needing specialist equipment or dedicated apps.

What makes the DPP genuinely significant is the breadth of its ambition. By 2030, the regulation is expected to cover virtually every manufactured product category sold in the EU. This is not a niche environmental reporting requirement — it is compliance infrastructure with hard deadlines and real market access consequences for any brand that misses them.

Who Must Comply — Including Brands That Manufacture Outside the EU

One of the most frequently misunderstood aspects of the DPP regulation is its geographic scope. The regulation applies to any company placing products on the EU market, regardless of where the manufacturer or brand owner is based. A business headquartered in Singapore, manufacturing in Vietnam, and shipping finished goods to Germany faces exactly the same DPP obligations as a German manufacturer. The compliance obligation sits with the entity that places the product on the EU market — typically the brand owner or importer.

This has significant practical implications for Asia-Pacific manufacturers and exporters. For businesses in Southeast Asia and other manufacturing hubs, the DPP changes the type and quality of documentation that must be provided to European buyers. Products entering Europe must carry a working, scannable identifier linked to a compliant digital record. If that record is missing, incomplete, or fails to resolve when scanned, the product may be blocked at EU customs. Importers in the EU are explicitly barred from placing non-compliant goods on the market and must independently verify that the foreign manufacturer has created a valid DPP with a functioning data carrier.

For brands that manufacture in Asia and export to Europe, the upstream challenge is data collection. Material composition data must come from suppliers. Carbon footprint figures require life cycle assessment methodology or certified third-party data. Chemical substance declarations require verified supplier documentation. The QR code itself is relatively straightforward to deploy — the harder work is assembling the data infrastructure that sits behind it.

The Rollout Timeline: Which Products, and When

The DPP mandate rolls out in phases by product category, with requirements defined in product-specific delegated acts published under ESPR. Once a delegated act is published, companies typically have 18 months to comply. The current timeline, based on the ESPR Working Plan 2025–2030 and the EU Battery Regulation, runs as follows:

• 2026: The EU’s central DPP registry is targeted for operational launch. Construction products, iron, and steel begin their compliance pathway.
• 18 February 2027: Battery passports become mandatory for all EV and industrial batteries over 2 kWh placed on the EU market — the first hard mandatory deadline.
• Mid-2027: Textiles, apparel, aluminium, and tyres are expected to follow.
• 2028–2029: Furniture, mattresses, and consumer electronics (smartphones, laptops, white goods) phase in.
• 2030: Near-universal coverage across almost all physical product categories, with packaging regulations adding further requirements under the separate Packaging and Packaging Waste Regulation (PPWR).

It is worth noting that not all delegated acts have been finalised, and some dates may shift slightly. However, the direction of travel is clear: brands with EU exposure need to treat DPP preparation as an active project now, not a future planning item. Industry surveys consistently show that the majority of companies are not yet prepared, and the data collection groundwork alone can take 12 to 18 months to establish properly.

What Data Must a Digital Product Passport Contain?

The precise data fields required vary by product category and are defined in each delegated act. However, ESPR establishes a common framework that applies across all categories. At a minimum, a compliant DPP must include material composition, manufacturing origin, environmental impact data (including carbon footprint), repairability information, chemical substance declarations, recycling instructions, and unique product identifiers. For battery passports specifically — the earliest hard deadline — the requirements extend to electrochemical performance, state of health, charging cycles, and mine-level traceability for critical raw materials including cobalt, lithium, and nickel.

The regulation also establishes a tiered access model. Basic consumer-facing information (material composition, care instructions, recycling guidance) must be freely accessible without authentication. More detailed technical data — repair manuals, component specifications, compliance documentation — can be access-controlled for professional stakeholders such as repair technicians, recyclers, and regulators. This means the QR code on your product must connect to a system capable of serving different data to different users, depending on who is scanning and why.

The data must be accurate, up-to-date, and linked to the physical product for its entire commercial life. This is not a one-time compliance exercise. As formulations change, suppliers shift, or regulatory requirements evolve, the digital record must be updated — without recalling the physical product or reprinting the packaging. This is one of the core reasons why the QR code infrastructure chosen for DPP compliance matters considerably beyond the code itself.

Why QR Codes Are the Primary Delivery Mechanism

ESPR does not prescribe a single data carrier technology — it mandates compliance with international standards and requires open, interoperable formats. In practice, QR codes have emerged as the dominant choice for most product categories, for straightforward reasons. Every modern smartphone camera can scan a QR code without a dedicated app, making them universally accessible to consumers, regulators, and supply chain partners without additional infrastructure investment. RFID and NFC offer additional capabilities for automated scanning in warehouses and logistics environments, but their per-unit cost is significantly higher, making QR codes the practical default for consumer-facing products.

QR codes also align with GS1 global standards for product identification. The GS1 Digital Link standard — a URL-based QR code format that carries the Global Trade Item Number (GTIN) and links to structured product data — is explicitly recognised under ESPR’s interoperability requirements and is recommended by GS1 for DPP compliance. GS1 Digital Link QR codes are already interoperable with major retail scanning infrastructure, making them the preferred choice for brands with significant B2B and retail distribution in the EU.

For consumer-facing DPP implementation, dynamic QR codes — codes that redirect through a managed server, allowing the destination URL and linked data to be updated without reprinting — offer a critical operational advantage. As the EU’s delegated acts evolve and data requirements change over time, brands using dynamic codes can update their DPP records without physical product recalls or packaging reprints. A static QR code, which encodes a fixed URL that cannot be changed after printing, is effectively a dead end in a regulatory environment where data requirements will continue to develop through 2030 and beyond.

Plain QR Codes vs. Secure, Serialized QR Codes: Why the Difference Matters

There is a critical distinction that most DPP compliance guides overlook: not all QR codes offer the same level of integrity. A standard, dynamic QR code can link to a compliant DPP data record — but it does not, by itself, verify that the physical product carrying the code is genuine. This gap matters enormously for categories where counterfeiting is prevalent, such as pharmaceuticals, consumer goods, luxury apparel, and industrial components.

A standard QR code is straightforward to copy. A counterfeiter can photograph or scan a code from a genuine product and reproduce it at scale on fake packaging. The code will still resolve — consumers who scan it will see legitimate DPP data, falsely reassured that the product is genuine. This is not a hypothetical concern. As DPP adoption scales, the creation of fake digital passports using AI-assisted tools is an emerging threat that security researchers have already demonstrated in laboratory conditions.

The answer is serialized, secure QR codes — sometimes called anti-copy or anti-counterfeit QR codes. Rather than a single code applied to all units of a product, serialized codes assign every individual unit a unique, cryptographically protected identifier that is tied to a secure backend database. A counterfeiter can copy the packaging artwork, but they cannot mass-produce these unique digital identities without access to the secure database that validates them. When a consumer scans a serialized code, the system checks not just that the code resolves, but that this specific code, on this specific unit, has not been scanned before from an unexpected location or flagged as suspicious.

This approach means the QR code on a product serves two functions simultaneously: delivering the DPP data record required by regulation, and providing a real-time authenticity verification that protects against counterfeiting. For brands in industries with high counterfeit risk, this dual-function architecture is not optional — it is the minimum viable approach to deploying a QR code programme that is genuinely safe. Nabcore’s anti-copy security QR codes are built on exactly this principle, using encrypted data structures that cannot be reproduced by scanning or photocopying the printed code.

DPP as Brand Protection Infrastructure, Not Just Compliance

Forward-thinking brands are beginning to recognise the DPP not as a compliance burden to be minimised, but as an opportunity to build digital infrastructure that serves multiple business objectives from a single investment. The QR code that EU regulation requires you to place on your product is a direct, scannable channel to every consumer, distributor, and regulator who handles it. The question is what you choose to do with that channel beyond the mandatory data fields.

From a supply chain perspective, the same serialized code that delivers DPP data can power real-time track-and-trace. Every scan event — at the factory, at a distributor’s warehouse, at a retail point of sale, or by a consumer — generates a data point that reveals where the product is, who is handling it, and whether its movement matches authorised distribution patterns. Scans in unexpected geographies or by unexpected actors can trigger automatic alerts, flagging potential grey market diversion or unauthorized overruns before they become a larger problem. This capability — supply chain visibility derived from the same QR code infrastructure used for DPP compliance — is exactly what Nabcore’s smart tracking solution is designed to deliver.

At the consumer end, the scan moment that DPP creates is also a post-purchase engagement opportunity. A consumer who scans a QR code to check sustainability credentials can, in the same interaction, register their product, access exclusive content, receive care or usage guidance, or be directed toward a loyalty programme. Brands that build this engagement layer into their DPP QR code infrastructure convert a mandatory compliance touchpoint into a direct marketing channel. Nabcore’s consumer engagement solutions are specifically designed to activate this value from the scan event — turning compliance infrastructure into a genuine post-purchase experience.

What This Means for Asia-Pacific Manufacturers and Exporters

For brands and manufacturers based in the Asia-Pacific region with EU export exposure, the DPP creates a set of obligations that differ from those facing EU-based companies in one important respect: the compliance burden falls on the entity placing goods on the EU market, but the data that needs to go into the DPP must come from upstream — from the factories, component suppliers, and materials processors in the supply chain. Coordinating that data flow across a complex, multi-tier manufacturing network is where most of the practical difficulty lies.

A realistic DPP preparation programme for an Asia-Pacific exporter involves four parallel workstreams. First, a product portfolio audit to identify which categories and deadlines apply — batteries and textiles face the earliest deadlines, but most consumer goods categories will follow by 2029. Second, a supply chain data mapping exercise to identify what information exists, what is missing, and which suppliers will need to generate new documentation. Third, a data architecture decision — whether to host DPP records internally, use a third-party DPP platform, or a hybrid approach — with an eye on interoperability with the EU central registry. Fourth, the selection and deployment of a QR code solution that supports both compliance and the brand protection objectives that make sense for the specific risk profile of the product category and markets involved.

The “Brussels Effect” is also worth noting: as EU requirements become the de facto global standard for product transparency, the infrastructure built for DPP compliance increasingly serves other markets too. Brands that build robust serialized QR code and track-and-trace capability for EU compliance will find that same infrastructure directly applicable to brand protection programmes in their domestic and regional markets — where counterfeiting pressure is often more acute than in Europe.

Practical Steps to Build a DPP-Ready QR Code Programme

The following framework reflects what a realistic DPP preparation process looks like for a brand with EU market exposure. It is not a checklist to complete once — it is an ongoing programme that needs to be integrated into standard product development and supply chain operations.

1. Audit your product portfolio by DPP category. Identify which products fall under which ESPR categories and their applicable deadlines. Prioritise battery, textiles, and apparel lines for immediate action. Create a data availability inventory — mapping what information currently exists for each required DPP field and where the gaps are.
2. Engage your supply chain upstream. DPP compliance depends on data that originates with your raw material suppliers, component manufacturers, and processing facilities. Begin supplier engagement now to understand what documentation is available, what needs to be created, and what data exchange formats your supply chain partners can support.
3. Choose your data architecture carefully. The QR code is the visible part of the system, but the data infrastructure behind it carries the compliance weight. Ensure your chosen approach will be interoperable with the EU’s central registry and supports tiered access for different user types. Avoid any approach that creates vendor lock-in for the core digital record.
4. Select a QR code solution that matches your risk profile. For consumer goods with counterfeiting exposure, serialized anti-copy QR codes are the minimum viable approach. For supply chain visibility and grey market control, the code must be linked to a track-and-trace backend that logs every scan event. Nabcore’s product authentication solutions and integrated solutions hub cover both dimensions within a single implementation framework.
5. Build in ongoing compliance management. Monitor EU delegated acts for new data field requirements in your categories. Update linked data records as formulations, suppliers, or regulatory thresholds change. DPP compliance is a live programme, not a one-time project.

Brands that approach this process systematically — rather than scrambling to deploy a minimum-viable QR code before a deadline — will build infrastructure that serves brand protection and consumer engagement objectives alongside regulatory compliance. The investment horizon is the same; the return is substantially greater.

Frequently Asked Questions

Does the EU DPP apply to brands based outside Europe?

Yes. The regulation applies to any company placing products on the EU market, regardless of where the manufacturer or brand owner is headquartered. A brand manufacturing in Asia and exporting to any EU member state must comply with DPP requirements for those products when the applicable category deadlines arrive. EU importers are explicitly required to verify that a compliant DPP exists before placing goods on the market.

Is a standard QR code sufficient for DPP compliance?

Technically, any data carrier that meets ESPR’s interoperability and standards requirements can satisfy the regulation — including a standard dynamic QR code linking to a compliant data record. However, for products in categories with counterfeiting exposure, a standard QR code provides no authentication layer. Serialized, secure QR codes deliver DPP compliance and product authentication simultaneously, which is why they represent the more robust implementation choice for most consumer goods brands.

What are the consequences of non-compliance?

Non-compliant products cannot legally be placed on the EU market — which means they can be blocked at EU customs and denied CE marking. Fines are set by individual member states and are expected to be proportionate to company turnover. For high-volume exporters to the EU, market access restriction across all 27 member states represents a substantial commercial risk that far outweighs the cost of timely compliance preparation.

How does the DPP relate to existing brand protection measures?

The DPP creates a mandatory product-level digital identity infrastructure that, when implemented with serialized and secure QR codes, directly supports anti-counterfeiting, grey market prevention, and supply chain visibility. Brands that already have track-and-trace or authentication programmes can often extend those systems to cover DPP data requirements, making compliance an incremental investment rather than a standalone one. Brands without existing digital product identity infrastructure are building from scratch — making the architecture decisions they take now particularly consequential.

The EU Digital Product Passport will reshape how physical products carry and communicate information for the foreseeable future. For brands with EU market exposure — particularly those manufacturing across the Asia-Pacific region — it represents a genuine compliance obligation with hard deadlines and real market access consequences. But it is also an opportunity that extends well beyond regulatory tick-boxes. The QR code that EU law requires you to place on every product is also a potential authentication layer, a supply chain visibility tool, and a direct consumer engagement channel — if the underlying infrastructure is built with all three objectives in mind.

The brands that will navigate this well are those that start now, build a data collection programme that actually reaches into their supply chain, and choose QR code solutions that do more than the minimum. The deadline clock is running. The data groundwork takes longer than most teams anticipate. And the cost of scrambling to meet a regulatory deadline is always higher than the cost of building the right infrastructure from the outset.

Nabcore specialises in exactly the kind of integrated product authentication, track-and-trace, and consumer engagement infrastructure that the DPP demands — and has been protecting products across the Asia-Pacific region for over 14 years. If you are assessing your DPP readiness or looking to build a QR code programme that delivers compliance and brand protection in a single investment, the Nabcore solutions hub is a useful starting point for understanding what a well-designed system looks like in practice.