The short answer
Technically speaking, you can generate a QR code within a minute using a free online tool. That is not the difficult part. What matters with the digital product passport is what lies behind that code: a dataset that remains current, accessible and properly structured throughout the period applicable to your product group. The code itself is therefore the easy part; maintaining what the code unlocks is where most questions arise.
The regulation sets requirements for what a data carrier must generally be able to do: be uniquely traceable to one product, be durably affixed or linked, and remain readable for the lifetime of the product. For many product groups, the precise technical specifications must still be established through delegated acts. This means that anyone creating their own QR code now must account for a system that may later need to be adapted to a standard that is not yet final.
What you can arrange yourself
Creating an image with a QR pattern is no art. Sticking or engraving that code on a product, packaging or nameplate is something almost every business can do itself. For businesses with a small range and limited changes to product data, that is a manageable task.
Where it becomes more complicated is the underlying part: the page or dataset that the code opens. It must remain online, be updated whenever product information changes, and remain available to those authorised to consult it — even if your business switches software suppliers, changes domain name, or discontinues a particular product. This does not require a one-off action, but a system that remains stable for years.
The choice between building yourself and outsourcing
Building this system yourself involves more than a website with QR codes. You would then need IT capacity to maintain the dataset structurally, knowledge of the technical standards once they have been established for your product group, and a plan for what happens if an employee managing the system leaves or if the software used is no longer maintained. For businesses that see this as a one-off project, that is a different kind of investment than for businesses that see it as an ongoing obligation.
Outsourcing shifts that responsibility to a party for whom hosting, linking and technical updating are core activities. This does not mean you no longer need to look at anything: the data in the passport remains a responsibility of the manufacturer or importer, regardless of who handles the technical side. What shifts is the maintenance of the data carrier itself and the assurance that it remains accessible for the required period. At prodpas.eu, for example, that is hosted for ten years, so you do not need to ensure yourself that the link still works in five or eight years.
When doing it yourself remains practical
For a business with a handful of products that rarely change, an in-house solution can remain viable for a long time. For businesses with many product variants, regular changes, or products in multiple EU countries, maintenance quickly becomes a task in itself, especially since supervision may differ from country to country in how it is carried out. A good first step is not the question "can I do this myself", but "how much maintenance does this structurally require from my organisation". With a few questions to get insight into your situation provides an initial indication of this, without you having to make a decision immediately.
To understand where the data for a passport comes from and how the technical connection with the data carrier works, it is useful to read how that process works in practice. If you want to compare the costs of both routes side by side, you will find an overview at the rates and what is included in them. And for individual terms or doubts about your own role, it is advisable to review the answers to frequently asked questions, before you finalize a choice.
Finally
This text describes the regulation in general terms and is not legal advice about your specific situation. For a determination of what is required in your case, the official text on EUR-Lex is authoritative, and for doubt about its application, a lawyer or the competent supervisory authority is the appropriate point of contact.
Would you first like to get an impression of what applies to your products before you choose between doing it yourself and outsourcing? Take the free quick-scan or browse through the topics in the knowledge base.