Yes, you can place the files behind a digital product passport on your own servers or your own webpage. There is no obligation to do this through an external party. What makes the answer more complicated is that the regulation does not only ask for a page that is accessible: it also sets requirements for how long that page must remain accessible, how the data is structured and how the link with the QR code or another data carrier works.
This means that self-hosting in practice is something different from "we put it on our own website". It is a technical and organisational obligation that extends longer than most companies are used to with ordinary web hosting, and it remains in place even if something changes internally: a different hosting provider, a takeover, or an employee who leaves and was the only one who knew how the system worked.
What hosting a product passport actually entails
A digital product passport does not consist of a single file, but of a combination of components that must fit together. There is a unique identification of the product, there is a dataset with the data that is mandatory for that product group, and there is a data carrier (usually a QR code) that refers to that dataset. Hosting means that you ensure that this reference continues to work, that the dataset is in a recognisable and readable format, and that the content can be updated as soon as something about the product changes.
This is more work than it appears. A product change, a new supplier of a component, or modified composition can mean that the data in the passport is no longer correct. Anyone who self-hosts is also responsible for keeping track of these changes and for maintaining a record of what was in it before.
What self-hosting requires in practice
The regulation requires that a passport remains accessible for a longer period than most standard hosting contracts provide. This means that a company that self-hosts must consider what happens if the current system is replaced, if the company changes name or ownership, or if the IT employee who manages it is no longer employed. A QR code that after a few years points to a dead link is a different kind of problem for a supervisor than a passport that is simply not optimally compiled.
Interoperability also plays a role: the data must be in a form that machines can read, not just people. For companies with their own development department, this is a matter of applying the right standards. For companies without that capacity, it is often the reason to outsource this task to a party that has already arranged the technical side. how storage and linking with the QR code works in practice provides a picture of this, regardless of who ultimately carries it out.
Where the line lies between doing it yourself and outsourcing
The line is not at "may I do this myself" but at "can my organisation continue to do this, also over years". Compiling the content, providing product data and assessing whether data is up to date is in any case your responsibility: you cannot fully outsource this work, because only you know what is in your product or what changes. The technical infrastructure around it — the storage, the standard formats, the continuity of the link — is something that other parties can arrange for you, without you losing your own responsibility for the accuracy of the content.
Some companies with their own IT department and multiple product groups choose to manage this internally. Other companies, especially when products are marketed in different countries or when the product groups have varying requirements, deliberately choose an external party to handle the technical side and keep only the content with the company itself.
What remains your responsibility, even when outsourcing
Whether you host yourself or engage a third party, your responsibility for the accuracy of the data in the passport does not change as a result. An external hosting party ensures availability and the technical aspects, but not whether a product's composition is correct or whether a certificate is still valid. When choosing a party, it is therefore useful to clarify who does which part, and to record this in a contract rather than assume it is arranged.
For those who doubt whether self-hosting is feasible for their own product groups, a short scan that shows where your products currently stand provides an initial direction, and the knowledge base with explanations per product group shows which requirements are relevant for your situation. For your specific situation, and for questions about liability when outsourcing, a legal advisor or the competent supervisory authority remains the appropriate party.
Would you like to get an overview of what applies to your products before you decide whether to self-host or outsource? Take the free quick-scan or browse through the topics in the knowledge base.