who is liable if the product passport contains incorrect information

The manufacturer who compiles the digital product passport bears the responsibility

The manufacturer is the one liable if the digital product passport contains incorrect data. This follows from Article 27 of the ESPR (Regulation (EU) 2024/1781), which governs the obligations of manufacturers: they are responsible for ensuring that the passport is correct, up-to-date and complete, regardless of who technically created or hosted the passport. A service provider that compiles and publishes the passport, such as a platform that supplies the QR data carrier, does so based on the data supplied by the manufacturer. The accuracy of that underlying data — the composition, the origin, the test results, the repair data — remains the responsibility of the person who places the product on the market.

For whom this applies, and for which errors it does not

This applies first and foremost to the manufacturer as defined by the ESPR: the person who designs or has manufactured the product and sells it under their own name or brand. Anyone who places products under their own brand on the market while another party carries out the manufacturing may still be considered a manufacturer under the law and thus bear the responsibility for the passport data. If the actual manufacturer is outside the EU, part of this responsibility often shifts to the importer; how this division of roles works out in detail is described on the page on a manufacturer outside the European Union.

Where this does not apply: a distributor, trader or marketplace that merely resells the product and leaves the passport unchanged is not the one who determined its content. Their obligations lie elsewhere — checking that a passport exists, not modifying it, keeping it visible — and these are explained on the page on obligations of a distributor or trader. Also, a technical error that occurs solely with the platform that hosts the passport or generates the QR code — that is, a malfunction where correctly supplied data is displayed incorrectly — is a different matter than an error in the data itself that the manufacturer supplied. The first is an execution error by the service provider, the second is an error in the source data for which the manufacturer is responsible.

From when this obligation applies

The obligation to maintain a correct digital product passport arises at the moment the ESPR and the associated product-specific implementing regulation come into force for a product category, as specified in Article 9 of the ESPR. For many product categories, the exact date is not yet fixed, because those implementing regulations are still being drawn up. What is established is the principle from Article 27: as soon as a passport is mandatory for a product category, responsibility for the accuracy of its content lies with the manufacturer, and this responsibility does not disappear because the technical implementation has been outsourced. Until the obligation for a specific product category comes into force, there is no legal liability for passport data, simply because there is no mandatory passport yet.

What this means in practice

Anyone wondering what to do when there is an error in the passport should start by determining where the error is: in the supplied data or in the display. If the error is in the supplied data — an incorrect material composition, an inaccurate repair score, an outdated test result — then it is a matter for the manufacturer, who must correct the data and have it updated. If the error is in the display, while the supplied data was correct, then it is a matter for the party that technically hosts or creates the passport.

It is then useful to document who within your own organization or supply chain supplied which data and when, especially for products sold under your own brand but produced by a third party. With private label products, responsibility does not automatically follow with whoever is most visible to the consumer; the page on liability for private label describes how this allocation works in practice. In addition, in the case of a takeover or merger, it is important to know that responsibility for existing passports transfers with the legal entity, as described on the page on takeover or merger and the passport.

Finally, it is relevant to examine the source of test results and calculations contained in the passport. Article 39 of the ESPR sets requirements for the test, measurement and calculation methods underlying product data, and Article 40 addresses the prevention of circumvention and of methods that conceal actual performance. A passport built from data not established according to these methods is a different problem than a simple input error, and may carry greater weight in an assessment by the competent authority.

Where this is based on: Article 27, 9, 39 and 40 ESPR

The manufacturer's responsibility for the content of the digital product passport follows from Article 27 of the ESPR. Article 9 describes what a digital product passport is and when it becomes mandatory per product category. Articles 39 and 40 set requirements for the manner in which underlying data have been tested, measured or calculated, and for the prevention of circumvention of those requirements — all relevant to the question of when data in a passport are to be considered incorrect.

Anyone wishing to know whether this obligation applies to their own products starts with the pages on who is responsible for the product passport and on whether the product passport applies to their own products, and proceeds from there to their own situation — manufacturer, importer, or seller under own brand.