How long must a digital product passport remain available?
The passport remains available as long as the product exists
A digital product passport must remain accessible for the entire period that is relevant to the product it belongs to — in practice, therefore, as long as the product is in use, being repaired, changing ownership or ultimately needs to be recycled. The ESPR (Regulation (EU) 2024/1781) sets out this requirement as part of the general requirements for the passport in Article 10, and links to it the obligation that the passport must be findable via a register once it is placed on the market (Article 13). How long that is precisely in years differs per product category and is laid down in the delegated act that applies to that product category — the ESPR itself sets out the principle, not a separate figure for each product.
Which products this applies to, and which do not yet fall under it
This obligation applies to products that fall under a product category for which the European Commission has adopted a delegated act that makes the digital product passport mandatory. As long as the delegated act does not yet exist for a product category, there is no legal obligation for those products to have a passport, and therefore no legal retention period for it. It is therefore not the case that every product now being placed on the market already falls under this rule — the ESPR is a framework regulation that is filled in per product category. For manufacturers and importers who are already voluntarily having a passport made, for example to prepare themselves, the legal retention obligation does not yet automatically apply; however, it is customary to align with what is already known about the system, so that a later transition to a mandatory situation presents no problem.
When this will apply, and what applies until then
The precise duration of the retention obligation is laid down per product category in the delegated act for that category; at present, it is not yet known for all product categories which act will enter into force when and what retention period it will contain. What is certain, however, is the principle set out in Article 10 of the ESPR: the passport must remain available for the period that is relevant to the product, and that period must match how long the product is expected to last, is used or remains relevant for repair, reuse and recycling. Until the moment that a product category has its own delegated act with passport requirements, no legal minimum retention period applies to that category — manufacturers and importers who start anyway determine themselves how long they keep their passport online, and would be well advised to assume a period that at least covers the expected lifetime of the product.
How this works out in practice for those having a passport made
Anyone now drawing up a product passport will first check whether a delegated act has already been established for their own product category and, if so, what retention period for the passport is mentioned in it. If that act does not yet exist, it is worthwhile to still assume a long availability period — the thinking behind Article 10 is that a buyer, repairer or recycler must still be able to access the data years after purchase, and that thinking does not change per product category. Furthermore, it is important that the passport is included in a register pursuant to Article 13: this register contains at least a unique identification with which supervisory authorities and customs can locate the passport, even if the original link or QR code no longer works. Anyone having a passport hosted should therefore do well to choose a solution that keeps both the content and the findability via the register in order, and not just place a loose file somewhere online. In the event of bankruptcy, business transfer or discontinuation of a product line, the question remains relevant as to who takes over the hosting and registration — the ESPR regulates the obligation to keep it available, but does not automatically determine who maintains it if the original manufacturer is no longer there.
Where this is found: Article 10 and Article 13 of the ESPR
The requirement that the digital product passport remains available for the period relevant to the product is laid down in Article 10 of the ESPR (Regulation (EU) 2024/1781), which describes the general requirements for the passport. The link to a register, in which the passport must be findable once the product is placed on the market, is set out in Article 13 of the same regulation. The specific retention period per product category follows from the delegated act established by the Commission for that category, and is therefore not stated as a fixed figure in the ESPR itself.
What to do
Check whether a delegated act imposing a passport requirement has already been established for your own product category, and if so, what retention period it contains; if it has not yet been established, take into account when setting up the passport an availability period that covers at least the expected lifespan of the product, and ensure that hosting and registration remain in place even if the company itself changes or ceases operations.
Where this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 13 (register of digital product passports)
The regulation itself is on EUR-Lex. We provide references for each claim; you do not have to take our word for it.
What you must do concretely
What is expected of you
Availability during the period established in the delegated regulation for the product category
The ESPR itself does not specify a fixed duration applicable to all products. Article 10 of Regulation (EU) 2024/1781 requires that the digital product passport remain available, but the precise period is determined for each product category in the delegated regulation drawn up for that product category. For a company with products in multiple product categories, this means there is no single answer that applies everywhere: a textile manufacturer and an electronics manufacturer may, once product category-specific rules are in place, face different retention periods. In practice, this means that a company of 10 to 100 employees cannot rely on a single central arrangement "we keep everything for ten years" — the actual duration depends on what has been established for the specific product category, and that must be determined for each product line once the delegated regulation for that category is published.
Linkage between passport and the specific product, also after sale
Article 10 assumes that the passport remains linked to the product for which it was created, even if that product changes ownership, is resold, or remains unused by a user for years. For a company, this means that the passport is not bound to the lifespan of the company itself or to an ongoing customer relationship, but to the physical product itself. A machine that is resold on the secondhand market after eight years must still have a functioning passport. This requires an infrastructure that is not dependent on incidental IT choices made today, and it is one of the reasons why many companies outsource that linkage rather than host it themselves.
Recording and updating of data in the European register
Article 13 of the ESPR describes the register of digital product passports, in which part of the passport data is recorded once a product is placed on the market. For a company, this means an additional obligation beyond hosting the passport itself: data must also be supplied to this register, and that registration must remain current as long as the passport exists. What exactly must be included in this register and how that process works is described in what the register of digital product passports contains and what must be included in it. For a company that operates multiple product categories, this means multiple registration streams, each of which may have its own rhythm.
Accessibility for the parties entitled to it, throughout the entire retention period
The passport must not only exist, it must also actually be accessible to those who are authorised to access it — consumers, market players, supervisory authorities — throughout the entire period for which it is required to be available. This is a different requirement than merely "storing": a passport that exists but is no longer retrievable because a server has been shut down or a link no longer works does not meet the purpose of Article 10. For a company of 10 to 100 employees, this is often the point at which it becomes clear that hosting a passport is something different from creating a passport: creation is a one-time effort, availability is an obligation that continues for years, even if the product is no longer being sold or the contract with a passport service provider expires.
Where things go wrong in practice
A first situation that often occurs: a company has the passport hosted by an IT supplier without a contractual provision for what happens if that supplier ceases operations or is taken over. The passport then effectively disappears as soon as the supplier contract ends, while the product continues to be in use for years to come.
A second situation arises when a company itself ceases operations or is taken over, and no one has thought in advance about who assumes responsibility for the ongoing passports. This directly raises the question what happens to the product passport when a company ceases operations — a question that is often only asked after the situation has already occurred, whereas it can be regulated in advance.
A third situation: a company assumes that the storage period for all its products is the same, because that was how it was explained for the first product category. As soon as a second product category with a different delegated regulation is added, the assumption proves to be incorrect and the storage strategy must be reviewed per product line.
A fourth situation arises with product modifications: a manufacturer replaces a component or updates a software version, and it is unclear whether the existing passport remains alongside a new version, or is replaced. This is particularly relevant for products that are composed of multiple linked components, as described in whether each component receives its own passport or the product as a whole.
A fifth situation: the QR code on the product becomes damaged or unreadable after years of use, preventing anyone from effectively accessing the passport, even though the passport itself still exists online. That risk and the way it is addressed is described in what happens if the QR code becomes damaged or unreadable.
What you can document
- For each product category in which the company is active: the storage period resulting from the applicable delegated regulation, once it has been established, with a reference to the source.
- An overview of which products are linked to which delegated regulation, so that during an inspection it is quickly clear which period applies to which product.
- A contractual agreement with the hosting provider regarding continuity: what happens to the passports upon termination of the contract, insolvency, or takeover.
- An internal agreement on who is responsible for keeping the registration in the European register up to date, including the moment when data is checked or updated.
- A procedure for what happens in the event of business closure or takeover, in anticipation of the question that arises as soon as that scenario occurs.
- A log of changes to the passport or the underlying product, so that it can be reconstructed which version of the passport applied at which point in time.
- A documented procedure for cases where data in the passport is automatically updated from another system, including a check on whether that process continues to function correctly after years — something that relates to how data in the product passport can be automatically updated.
This is not legal advice. This page provides general information about the regulations that this platform concerns. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI on the basis of the sources above, checked by a human on 2026-08-22. Is something incorrect? Let us know — corrections are given priority.