what happens to the product passport if my company is taken over

What you must do concretely

A takeover changes the owner of a business, not the history of a product. The product passport remains linked to the product or product group for which it was created, with the data that applied at the time of manufacture. What does change in a takeover is the question of who is responsible from that moment on for the accuracy of that data, for maintaining the passport, and for the registration in the register of digital product passports under article 13 of the ESPR (Regulation (EU) 2024/1781). This is not a minor matter that automatically transfers with the share transfer — it requires a deliberate transfer of file and responsibility.

What is expected of you

The obligations of article 27 transfer with the manufacturer role, not automatically with the legal person

Article 27 of the ESPR establishes the obligations of manufacturers: correct data, technical documentation, and the ability to demonstrate conformity. In a takeover where the legal entity remains intact (share transfer) little changes in most cases regarding who the manufacturer is — the legal person continues to exist, only the shareholders change. In an asset acquisition, a merger, or a situation in which a brand or product line is taken over by another entity, it is different: the manufacturer role then actually shifts to another party, and that party assumes the obligations of Article 27. For a company with 10 to 100 employees, this means in practice that in the due diligence of a takeover not only the financial and legal documents are reviewed, but also the digital product passport file: what data has been entered, by whom, and on the basis of which underlying documentation.

The digital product passport itself continues to exist, but the management authority must be transferred

Article 9 and Article 10 of the ESPR describe what a digital product passport must contain and what technical requirements it must meet — including that it remains accessible and up to date. A passport created with a hosting provider such as prodpas.eu is registered in the name of the party that provided the data. In a takeover, nothing changes about the passport itself, but it does change who is authorized to make modifications or add new products. That transfer of authority does not happen automatically with a takeover; it must be arranged separately, just like a transfer of a domain name or a Chamber of Commerce registration must be arranged separately.

The registration in the government register must remain correct

Article 13 requires registration of the passport in a central register. That registration contains data about the manufacturer. When the manufacturer changes — for example because a product line is taken over by another legal entity — that change must also be processed in the register. For a company that carries out a takeover, this means there comes a moment when the register data of the acquired products must be updated to the new manufacturer. That is administrative work that can easily be forgotten among all other integration tasks following a takeover.

Existing contracts with hosting providers and data processors must be reviewed

The passport is determined not only by regulation, but also by the contractual agreements with the party hosting it and keeping the passport available for ten years. In most cases, that contract simply continues in the event of an acquisition, but the party that is the principal sometimes changes. Whoever does not explicitly document this runs the risk that after the acquisition it becomes unclear who is authorized to request changes from the hosting party, or who pays the bill for the remaining retention period.

Where things go wrong in practice

An acquisition where only the shares change hands, but the new owner assumes that "the passport is already in good order" — without checking whether the underlying technical documentation is still present and current at the acquired party.

An asset acquisition where a product line is acquired, but the passport file (test reports, material data, certificates of conformity) remains with the original manufacturer, while the new owner becomes responsible for the data.

A merger between two companies that both already had passports running with different hosting parties, without a plan to merge or consolidate this — resulting in two separate systems that do not align with each other.

An acquisition where nobody checks who previously was the contact person at the hosting party, so that after the acquisition nobody has access to update the passport when necessary.

A situation in which the acquiring party takes over a brand and thereby effectively places itself in the role of manufacturer as described on I sell products under my own brand — what obligations do I incur?, without realizing that this change of role also has consequences for who is responsible for the product passport of the acquired products.

What you can document

• An overview of all product passports that fall under the entity or product line to be acquired, including which hosting party they are housed with and when the retention period expires.
• The underlying technical documentation per passport: test reports, material data, declarations of conformity — so that these do not become separated from the passport itself.
• An explicit provision in the acquisition agreement about who is responsible after the acquisition for maintaining the passport data and for any changes to the register.
• Contact details and login credentials (or a procedure for transferring them) with the hosting party, so that the new owner has immediate access.
• A check on the role allocation after the acquisition: is the acquiring party still a manufacturer, or does the acquisition make it an importer, distributor or a party selling under its own brand — this also determines which obligations apply, as described on Who is responsible for the product passport for products?.
• For acquisitions where production or the brand moves outside the EU or is acquired from a non-EU party, a check on whether an authorized representative is required, as explained on do I need a mandated representative in the EU for the product passport.
• An agreement on liability for data entered before the acquisition, should it later prove to be incorrect — relevant in light of what is described on who is liable if the product passport contains incorrect information.