My supplier does not provide the data — what can I do?

What you must do concretely

The product passport for your product consists largely of data that does not come from you. Part of it comes from suppliers: the composition of a component, the origin of a material, a test result that only the manufacturer of that component has. When that supplier does not deliver — does not respond, refuses, or sends data that is incorrect — you as a manufacturer or importer are left with the obligation, but not with the information. This article covers what the ESPR stipulates on this matter, what goes wrong with it in practice, and what you can record to ensure you are not left empty-handed.

What is expected of you

The manufacturer remains responsible for the passport

Article 27 of the ESPR (Regulation (EU) 2024/1781) places the obligations for the product passport with the manufacturer. This does not change when the data must actually come from a supplier. For a company with 10 to 100 employees, this means that missing data from a supplier is no reason to publish the passport without that data, or to wait until the supplier eventually delivers. Responsibility lies with the party that places the product on the market, not with the party that manufactures the component.

Actors in the supply chain have their own obligations

Article 38 of the ESPR (Regulation (EU) 2024/1781) describes what is expected of actors in the supply chain when it comes to making available information that is necessary for the passport. This article is not directed solely at the manufacturer placing the end product on the market, but also at parties that supply to it. For a company that itself purchases from multiple suppliers, this means that the obligation to provide data is not only based on a contract with the supplier, but also follows from the regulation itself. This is relevant at the moment when a supplier relies on the absence of a contractual agreement: the regulation itself already provides for an obligation for suppliers to make available relevant information.

The chain as a whole must be traceable

A passport that is missing data about a component is in practice a passport with a gap. For companies that work with multiple layers of suppliers — a subcontractor that in turn purchases from its own suppliers — this means that traceability must not stop at the first link. What data from a subcontractor should precisely include depends on which component that subcontractor supplies and what role that component plays in the passport of the end product.

Where things go wrong in practice

The supplier simply does not respond. An email requesting composition data goes unanswered, and a reminder does too. There is no refusal, there is silence — and silence is just as problematic for a manufacturer as an explicit refusal, because the product passport does not materialise by itself.

The supplier provides data, but not in a form that can be used. A PDF with free text instead of structured data, or a table that does not align with what the product passport requires. This is often only discovered when the data needs to be processed, not upon receipt.

The supplier does provide data, but the data is incorrect. A composition that does not match what was stated earlier, or a test result that is outdated. Without a way to verify this, such discrepancies often only come to light when someone else — a competent authority, a customer — asks questions about them. How to verify the accuracy of data is therefore a question that should be answered before doubt arises, not when it does.

The supplier invokes business confidentiality. Particularly with composition data and recipes, this is a recurring issue: the supplier does not want to share the data because it is commercially sensitive. This is not only a concern for the manufacturer compiling the product passport, but also for the question of whether and how that data remains protected afterwards.

There is no contract covering product passport data. With existing supplier relationships that have been running for years, there is often never been a reason to record anything about data supply. At the moment the product passport becomes mandatory for the product group in question, the contractual basis to request what is actually needed is then missing.

What you can document

• An overview of which data belongs to which supplier, per component or material, so that when compiling the product passport it is clear who needs to fill which gap. As a starting point for this, you can read which data are requested from a supplier of products.

• An agreement in the procurement contract on the supply of product passport data, including the form in which this takes place and what happens if it does not happen on time. How this can be concretely recorded in a procurement contract is described at agreements on the supply of product passport data in the procurement contract.

• A confidentiality agreement, for the situation in which a supplier only wants to share data if its confidentiality is arranged. This is often the key to persuading a supplier who relies on business confidential information to supply the data anyway; see a confidentiality agreement with the supplier on product passport data.

• A documented procedure for checking received data, so that discrepancies are not only noticed at the moment when the product passport is already published.

• A file per supplier with correspondence about the request, with the date of the request, reminders and any responses. This is not only practical for your own administration, but also the only proof that the request was made, when a supplier provides nothing.

When a product is purchased from a supplier outside the EU, this issue takes a different form: there is what the product passport means when importing from outside the European Union an additional starting point, because the responsibility for the product passport may then lie with the importer while the data is still further along the chain.