Mid-July 2026 was the most consequential fortnight the Digital Product Passport has had since the Ecodesign for Sustainable Products Regulation entered into force two years ago. On 15 July the Commission harmonised six CEN/CENELEC standards, including the one that governs data carriers. On 17 July it published Implementing Regulation (EU) 2026/1778, the operating rules for the DPP Registry. On 20 July the registry itself went live, one day after the statutory deadline in ESPR Article 13(1). On 6 August the implementing regulation entered into force, twenty days after publication, and passed without a Commission announcement of any kind.
So the architecture is now legally real. What it is not yet is usable. As of mid-August, no brand, manufacturer or solution provider has publicly confirmed a completed registration in the EU DPP Registry, and for the first mandated product group they could not have done so even if they wanted to. The registry’s semantic catalogue for batteries has not been defined, so battery passport submissions fail validation outright. The Commission’s own user guide for economic operators says so in plain language. What is open today is organisation enrolment, identity verification and rehearsal in the test environment.
That gap between a live system and a usable one is where the interesting decisions are being made, and most of them are carrier decisions. The regulation itself will not make those for you. It goes out of its way not to.
What Implementing Regulation 2026/1778 actually does
The first thing to understand about the registry is that it is not a passport database. It is a registration ledger and a directory. Article 3 sets out what it consists of: a web interface, an API, a verification platform, a mechanism for generating unique registration identifiers, storage of unique product identifiers and commodity codes, a public list of verified DPP service providers, a semantic repository, logging, and identification and authorisation schemes. The passport data itself stays with the economic operator or its appointed DPP service provider. The registry holds the pointer, the identifier and the back-up link.
The scope in Article 1 is wider than most coverage has acknowledged. This is not an ESPR-only registry. It serves products covered by ESPR delegated acts, batteries under Article 77 of the Battery Regulation (EU) 2023/1542, construction products under the new Construction Products Regulation, toys under the Toy Safety Regulation, detergents and surfactants under Regulation (EU) 2026/405, and any other Union law that requires DPP registration in future. Article 2 states flatly that for registry purposes, a battery passport is a Digital Product Passport. One registry, many regimes. That matters for anyone building infrastructure, because it means the integration you build for batteries is the same integration you will use for textiles and tyres.
Article 8 is the article that touches hardware. Registration happens at model, batch or item level, depending on what the applicable product act requires, and an item-level registration must also carry the batch and model identifiers alongside it. On submission the registry runs automatic checks: semantic conformity against the product group’s catalogue, granularity, commodity code validity, and the presence of a working link to the back-up passport. Pass those and you get a unique and persistent registration identifier.
Article 9 gives you a downloadable proof of registration, sealed with a Commission qualified electronic seal and timestamp, containing the product identifier, commodity code, operator identity, date and time, and a hash of the passport version. It is valid for 90 days per generation. Read one caveat carefully before anyone in your organisation starts calling this a compliance certificate: ESPR Article 13(5) says registry confirmation is not to be deemed proof of compliance. The checks are structural. They confirm the passport is well formed and reachable, not that its contents are true.
The seal, not the chip, is the first real bottleneck
Before you can register anything you must become a verified economic operator, and this is where companies are getting stuck right now. Articles 4 and 5 require EU-established legal persons to submit evidence of identity and establishment using a qualified electronic seal supported by a qualified certificate issued by a qualified trust service provider under eIDAS. Sole traders use a qualified electronic signature or a high-assurance eID. In practice that means procuring a QSeal certificate from a qualified trust service provider and applying it in PAdES format to a Commission-generated declaration PDF, which is a procurement and IT task that most product and packaging teams have never had to run before.
Verified status lasts a maximum of three years. Let it lapse and you cannot register or modify passports until you are re-verified. Article 5 extends the same process to value chain actors: repairers, refurbishers, remanufacturers and recyclers. In other words, the people you most want reading and writing to the passport in the field are subject to the same identity regime as the brand owner. Member States have until 18 February 2027 to appoint their designated national administrators under Article 7, which is the same day the first passports become mandatory. Default data retention is ten years.
If you sell RFID or AutoID into brands, this is worth knowing simply because it reorders the conversation. The carrier question is not the first thing a compliance lead will be dealing with. It is the second. But the two are linked, because the verification cycle and the three-year re-verification are precisely the sort of overhead that pushes organisations towards a single carrier strategy across product lines rather than a per-SKU decision.
Why the registry says nothing about QR, RFID or NFC
Search the full text of Implementing Regulation 2026/1778 for “QR”, “RFID”, “NFC” or even “data carrier” and you will find nothing. That is deliberate, not an oversight. The registry rules are carrier-neutral because the carrier decision sits elsewhere, in the product-group delegated acts.
The ESPR’s own definition is broad enough to keep every AutoID technology in play. Article 2(29) defines a data carrier as “a linear barcode symbol, a two-dimensional symbol or other automatic identification data capture medium that can be read by a device”. That final clause is the one the RFID industry has been leaning on for two years, and it holds. The only carrier examples anywhere in the regulation appear in recital 37, which mentions a watermark and a QR code, and recitals are not operative text.
The operative choice, meaning which carrier or carriers must be used, plus layout and positioning, is made per product group under Article 9(2)(b) and (c). Article 10(1) requires the carrier to be physically present on the product, its packaging or accompanying documentation, and to comply with the ISO/IEC 15459 series or with harmonised standards. Article 12(6) obliges the Commission to keep identifier and carrier rules technologically neutral to the largest extent possible.
So the framework is genuinely open. Whether any given product ends up with a printed QR code, an NFC tag, a RAIN RFID inlay or some combination will be settled product group by product group, in acts that mostly do not exist yet. That is the single most important thing for RFID vendors to internalise: the carrier fight is not over, it has barely started, and it will be fought in the textile act, the tyre act and the furniture act rather than in the framework.
EN 18220 puts RFID on the harmonised list
Implementing Decision (EU) 2026/1736 of 14 July, published on 15 July, harmonised six standards drafted by CEN/CENELEC JTC 24: EN 18216 on data exchange protocols, EN 18219 on unique identifiers, EN 18220 on data carriers, EN 18221 on data storage, archiving and persistence, EN 18222 on APIs and EN 18223 on system interoperability. Two more from the family of eight, EN 18239 on access rights and security and EN 18246 on data authentication, are expected to be harmonised around September 2026. Note that 2026/1736 is an implementing Decision, not a Regulation, whatever some secondary coverage says. Compliance with a harmonised standard gives presumption of conformity with ESPR Articles 10 and 11, which is the practical value here.
EN 18220:2026 is the one that matters to this readership. It covers optical 2D symbologies, meaning QR Code and Data Matrix, and RFID in both HF/NFC and UHF/RAIN forms, with requirements on symbology, encoding, production quality, print quality, durability, placement and marking. The governing principle running through it is persistence: the carrier has to stay readable for the life of the product, which for a tyre or a construction product is a long time and a hostile environment. There is also a widely reported requirement that at least one carrier must be readable by an ordinary smartphone without a dedicated app, which is the clause that keeps a 2D symbol on almost everything regardless of what else is fitted.
One honest caveat. EN 18220 is a paywalled 44-page document and the exact enumerated carrier list is not something the trade press has verified against the standard text. The RAIN Alliance describes RAIN as one of five approved data carriers recognised by JTC 24. Other summaries count four families. If you are writing a carrier specification that will be audited, buy the standard rather than trusting anyone’s blog, this one included.
EN 18219, the companion identifier standard, reportedly admits several identifier schemes including GS1 Digital Link URIs, IEC 61406 identification links, W3C decentralised identifiers, RFID and 2D product identifiers, and DOIs, with operator identifiers including the GLEIF LEI. The important structural point is that GS1 Digital Link is one route among several rather than the only one, even though it is comfortably the most commercially entrenched.
The carrier decision determines what the passport can actually do
Regulatory neutrality has an unhelpful side effect. It lets people treat the carrier as a late-stage packaging detail, when in fact it decides the entire operational value of the passport. A DPP is only worth what it costs to read, multiplied by how often you can afford to read it. That calculation changes completely depending on the carrier.
QR and Data Matrix
Cheapest per unit by an enormous margin, effectively free if you are already printing a label. Universally readable by consumers with no additional hardware. Line of sight required, one item at a time, and the read has to be a deliberate human act. Vulnerable to abrasion, soiling, overprinting and being covered by a later label. For consumer-facing disclosure, which is what most of the DPP’s stated purpose is about, it is entirely adequate. For anything involving reading a hundred items in a tote or verifying a returned garment at a goods-in desk, it is a bottleneck.
NFC
Short range by design, typically a few centimetres, which is a feature rather than a limitation when the interaction is intentional. Readable by every modern smartphone with no app install, which is the property that makes it the natural upgrade path from QR for premium consumer goods. It supports authentication and tamper evidence in ways a printed symbol cannot: NXP’s NTAG X DNA line is explicitly positioned for DPP on that basis. NFC also survives being covered, which matters for garment care labels and anything that will be laundered or re-packed. The NFC Forum published its NFC Digital Product Passport candidate specification in March 2025 and folded DPP support into NFC Release 15 in June 2025, which the Forum says extends read range roughly fourfold. Per-unit cost is real but has fallen sharply, and dual-frequency inlays have made the marginal cost of adding NFC to an existing RAIN tag smaller than it was.
RAIN RFID
The only one of the three that scales to bulk reading. Metres of range, no line of sight, hundreds of items per second, and the ability to read a sealed carton or a full rail of garments without touching anything. That is the property that turns a passport from a disclosure document into an operational data source. It is also the one carrier a consumer cannot read today, which is the standing objection to RAIN as a primary DPP carrier and the reason EN 18220’s smartphone-readability principle effectively guarantees a 2D symbol alongside it.
That objection is eroding, though not quickly. Qualcomm’s Dragonwing Q-6690, announced in September 2025, is described as the first enterprise mobile processor with fully integrated UHF RAIN RFID, with Zebra, Honeywell and Urovo among the adopters. That is enterprise handheld territory rather than consumer phones, so it fixes the read problem for staff in a store, a warehouse or a repair shop without doing anything for the shopper. Useful, but it does not remove the case for a 2D fallback.
Dual frequency, which is where the market is actually going
The interesting product releases of the last year have not picked a side. Tageos launched the EOS-920 NFC inlay and the EOS-620 Seal dual-frequency RAIN plus NFC inlay on EM em|echo-V silicon in December 2025, explicitly for DPP. Xindeco IoT unveiled a RAIN UHF-powered DPP solution in January 2026 with a dual UHF plus NFC and QR architecture. The logic is straightforward: RAIN handles the supply chain, NFC handles the consumer and the field technician, and a printed 2D symbol handles the regulator and the person with a flat phone battery. Three carriers, one identifier, one passport. It costs more per unit, and for high-value or long-lived goods it is defensible.
Item level versus batch level, and the serialisation question underneath it
Article 8’s granularity rule is the quiet hinge in the whole implementing regulation. Model, batch or item, as the product act requires. Everything about carrier economics follows from where a given product group lands.
At model level, a passport is a document about a product design, and a printed symbol is plainly sufficient. At batch level, you get provenance and recall precision but no individual unit history. At item level, every physical unit carries its own identity and its own record, and the passport can genuinely accumulate a history: repairs, ownership transfers, refurbishment, eventual material recovery.
Item level is also the point at which serialisation stops being free. A GTIN identifies a product line. A GTIN plus a serial number, encoded as an SGTIN in EPC terms, identifies a thing. That means serial number allocation and management at production line speed, and it means a carrier that can hold a unique value per unit. A printed serialised QR code can do that, at the cost of variable data printing and the associated print verification. A RAIN tag does it natively, because unique serialisation is the entire premise of the technology.
This is the strongest argument the RFID industry has, and it is worth making precisely rather than loudly. The joint RAIN Alliance and GS1 position paper of September 2025 makes it: GS1 identifiers plus RAIN give automatic and scalable access at item-level precision. Decathlon is quoted in that paper calling RAIN with GS1 encoding a de-facto reference solution for any Digital Product Passport system, and Michelin describes its tyre work built on GS1 identifiers and ISO RFID standards. That is not marketing from tag vendors, it is brand owners who already tag at item level for inventory reasons and can see that the passport rides along at close to zero marginal cost.
Where GS1 has actually landed, which is less favourable
It would be a mistake to read the joint paper as GS1 endorsing RFID as the primary DPP carrier. It has not. The GS1 in Europe position puts GTIN plus serial or lot as the product identifier and a GS1 Digital Link QR code as the primary carrier, aligned with the global Sunrise 2027 migration to 2D, with Data Matrix for space-constrained items. The provisional GS1 DPP application standard, GSCN-26-266 v2 of June 2026, is explicit: where EPC/RFID is used it shall be in addition to a QR Code or Data Matrix, and the barcode’s serial number must match the serial encoded in the SGTIN on the tag. NFC was added only in June 2026, and as an optional additional carrier.
In GS1’s scheme, then, RFID is supplementary. Not excluded, not discouraged, but never on its own. Anyone selling a RAIN-only DPP proposition into a GS1-aligned brand is going to lose that argument, and the sensible commercial position is the one the dual-frequency product launches have already taken: sell RAIN as the operational layer on top of a 2D baseline, not as a replacement for it.
The battery paradox
The first mandatory passport in Europe will not use RFID at all. Battery Regulation Article 13(6) requires that from 18 February 2027 all batteries are marked with a QR code as described in Part C of Annex VI, printed or engraved visibly, legibly and indelibly, or applied to packaging and documents where that is not possible. Article 77(3) makes that QR code the access route to the battery passport. From the same date, each LMT battery, each industrial battery above 2 kWh and each EV battery placed on the market must have a battery passport.
There is one door left open. Article 13(8) allows the Commission to adopt delegated acts providing for alternative types of smart labels for use instead of or in addition to the QR code, in view of technical and scientific progress. No such act exists and none is scheduled. If the RFID industry wants batteries, that article is the lever, and it will take evidence from deployed pilots rather than position papers.
Meanwhile the battery regime is running late in both directions. Registration is blocked by the missing semantic catalogue. And Article 77(9) required the Commission to adopt implementing acts specifying who counts as a person with legitimate interest in accessing restricted battery passport data by 18 August 2026. No such act appears to have been adopted, and the Commission’s own DPP timeline now shows it in Q4 2026. That is not a trivial slip. Legitimate-interest access is the mechanism by which a recycler or a second-life operator gets at the data that makes the passport worth having, and until it is defined, the three-tier access model in the Battery Regulation has a hole in the middle of it.
Four places the passport gets read, and why only one of them tolerates QR
The carrier argument becomes concrete the moment you follow a passport through its working life.
- In the warehouse, the read is bulk, unattended and high volume. Goods-in verification, cycle counting, dispatch confirmation. Line of sight is the enemy. RAIN is the only carrier that works here, and if the passport identifier is not on a RAIN tag, the warehouse simply will not use the passport, it will keep using whatever inventory system it already has.
- In the store, the read splits. Staff need bulk stock accuracy, which is RAIN, and is why apparel retailers already tag at item level. Shoppers need a self-service read, which today means QR or NFC. This is the clearest case for dual frequency, and it is not a DPP argument at all, it is an existing retail argument that the DPP happens to reinforce.
- In the repair shop, the read is deliberate, single item and needs authentication. Is this the genuine part, what is its service history, who is allowed to write to the record. NFC with cryptographic authentication is a better fit than either alternative, and the eIDAS verification requirement in Article 5 for repairers and refurbishers means the write side has an identity model attached to it.
- In the recycling facility, the read is the hardest problem in the whole chain. Items arrive damaged, soiled, compressed, mixed and often shredded. A printed symbol is frequently unreadable by the time it gets there, which is exactly when the material composition data in the passport is most valuable. Passive RFID at least degrades more gracefully. The RAIN Alliance and NFC Forum’s joint position on the WEEE Directive revision in March 2026 argued for passive RFID to remain outside the revised directive’s scope, and cited CIRPASS-2 testing passive RFID across textiles, electronics and batteries. Whether the tag survives the shredder is a separate and unsolved question.
What the pilots chose when they had a free hand
CIRPASS-2, the roughly 19 million euro Digital Europe programme project running to April 2027, has 49 partners and 13 lighthouse pilots across textiles, electronics, tyres and construction. Michelin’s tyre pilot is explicitly RFID, built on the ISO standard for electronic tyre identification plus the GDSO tyre industry dataspace, which is the single most convincing item-level RFID DPP deployment anyone can currently point at. Six textile pilots involve the usual traceability names, and the RAIN Alliance and NFC Forum claim up to 99 per cent identification accuracy with passive RFID in textile pilots, which is the Alliance’s own figure rather than an independently published CIRPASS-2 result.
Against that, Sweden’s Trace4Value textile pilot, run with TrusTrace, Kappahl, Marimekko and GS1 Sweden across more than 3,000 garments, used a plain GS1 Digital Link QR code and no RFID at all, and worked. That is the honest state of play. Where the operational case already exists independently of the regulation, as in tyres and in apparel inventory, RFID wins. Where the objective is disclosure to a consumer or a regulator, QR is sufficient and cheaper, and pilots keep choosing it.
There is also a design argument against putting much on the tag at all. The NFC Forum’s NDPP pitch is offline, on-tag passport data. The EU’s own CIRPASS project recommended the opposite in deliverable D3.3 back in February 2024: store an identifier URI in the carrier and nothing more, on the grounds that offline data storage adds cost and complexity without proportionate benefit. The harmonised standards, with their separate treatment of carriers, identifiers, storage and APIs, lean the same way. Sell the tag as the pointer, not the database.
Does any of this move tag volumes?
Be careful here, because the temptation to overclaim is considerable and the numbers do not support it. RAIN tag chip shipments fell in 2025 to 42.7 billion, down from a record 52.8 billion in 2024, which the RAIN Alliance attributed to inventory cycles, tariff uncertainty and retail destocking. The same announcement leaned on DPP qualification as a forward driver. VDC pushed its 115 billion unit milestone from 2028 out to 2029. IDTechEx forecasts the total RFID market at 23 billion US dollars by 2036 and names DPP as a growth support rather than a driver. ABI Research has projected 62.5 billion apparel DPPs created in 2030, but that counts passports, not tags, and gives no carrier split.
No analyst has published a figure isolating DPP-attributable RAIN or NFC tag volumes, and anyone quoting one is extrapolating. The realistic read is that the DPP does not create demand for tags on its own. What it does is remove objections. It gives a procurement case that was previously justified on shrink and inventory accuracy a second, regulatory-adjacent justification, and it makes item-level serialisation a compliance conversation rather than an operations one. That is worth something. It is not a step change in unit volumes.
Where this goes next
The Commission’s indicative timeline is now reasonably specific. Around September 2026, an implementing decision on the remaining two DPP standards, EN 18239 on access rights and security and EN 18246 on data authentication. Q4 2026, the ESPR delegated act for iron and steel, and the overdue battery access-rights implementing act. 18 February 2027, battery passports mandatory, QR marking mandatory on all batteries, and Member State national administrators appointed. Q2 to Q3 2027, delegated acts for construction products and for DPP service providers. Q3 to Q4 2027, the ESPR delegated acts for textiles, aluminium and tyres. Furniture in 2028. Mattresses and recycled content in 2029. Economic operators get at least 18 months of transition after each act, so textile obligations realistically bite around 2029. The ESPR Article 14 public web portal and the customs interconnection land at the far end, around 2029 to 2030, with the customs link legally due within four years of 2026/1778 entering into force.
Two of those dates deserve a ring on the calendar of anyone selling AutoID. The tyre delegated act, because tyres are the one ESPR priority product group with an established item-level RFID practice, an ISO electronic identification standard and a working industry dataspace, which makes it the most likely place for RFID to be named rather than merely permitted. And the textile act, because apparel is where item-level RAIN tagging already exists at enormous scale for entirely commercial reasons, and where the marginal cost of carrying a passport identifier on tags that are being applied anyway is close to zero.
Nothing in the framework will force that outcome. Carrier neutrality cuts both ways: it kept RAIN and NFC in scope when the obvious drafting instinct was to write QR into the text, and it also means neither will ever be mandated. The decision gets made product group by product group, in delegated acts drafted over the next eighteen months, and it gets made on evidence from deployments that either exist by then or do not. The registry going live changed the deadline. It did not change the argument, and the argument is being settled now in tooling quotes and label specifications, not in 2029.
