The most common mistake
The most common mistake in a contract with a software supplier for the digital product passport is that it is agreed that a passport will be created, but not who is responsible if the data in it is incorrect or becomes outdated. Companies often assume that the supplier automatically takes on that responsibility, while the regulation places the obligation with the manufacturer or importer, regardless of who provides the technology.
This mistake usually does not arise from carelessness, but from unfamiliarity with the division of roles. A software supplier builds and hosts the passport, but the content, accuracy and timeliness of it remain the responsibility of the company itself. If this is not stated explicitly in the contract, a gap arises: the supplier does not feel responsible for the content, and the company assumes that the supplier will handle it.
Why this gap arises so easily
A software contract is often drawn up by the IT department or by whoever happened to contact the supplier, while knowledge of what exactly must be included in a digital product passport is located in another department, or nowhere at all. As a result, the contract covers uptime, storage and security, and hardly addresses the question of who supplies the source data, who checks it and who takes action as soon as a product changes.
That last point is precisely where things often go wrong. A digital product passport is not a snapshot; it must be accurate throughout the entire period the product is on the market. If something changes in the product, its composition or its origin, that must also be reflected in the passport. If the contract contains nothing about who signals this and who processes it, a passport will unintentionally fall behind the facts.
What the regulation says about this
The regulation for digital product passports mainly addresses what must be included in a passport and who is designated as a provider, not how a contract with a software supplier should be structured. The latter is up to the parties themselves. Supervisory authorities look at the content and timeliness of the passport itself during inspections, not at the internal agreements between a company and its supplier. This means that an incomplete contract may not be a legal problem between you and the supervisory authority, but it can be a practical problem between you and your supplier when something goes wrong.
Which data is precisely mandatory and how it differs per product group can be found in the official text and in the knowledge base with the obligations per product group. This is also the place to check whether a gap in your contract relates to something that is mandatory for your specific products.
What prevents this gap from arising
A contract that prevents this problem explicitly mentions three things: who supplies and checks the source data, within what timeframe a change in the passport must be processed, and what happens to the data and access to the passport when the contract ends. The latter is often forgotten, even though a passport has a retention obligation that runs much longer than an average software contract.
It helps to discuss these points not just when signing the contract, but already in the first conversation with a supplier. Which questions should be addressed at that point is detailed in the frequently asked questions about working with a supplier. This way you avoid discovering only at an inspection or when a product changes that nobody felt responsible.
When this is particularly relevant
This error becomes more significant the more product groups a company operates in, each with different obligations and different deadlines per group. A single generic contract for "the digital product passport" rarely covers all situations. How we handle this at prodpas.eu, from submitting your data to hosting the passport, is explained on the page about how it works.
For your own situation, and for the precise division of responsibility between you and a supplier, it is advisable to consult a lawyer or consult the official text of the regulation. A contract is ultimately a private law agreement, and it does not carry weight in how a competent authority views your passport.
Check your own situation
Do you want to quickly see which obligations apply to your products before you talk to a supplier? Take the free quick-scan in a few questions or read the other topics in the knowledge base. This gives you a concrete starting point for the conversation, without you having to become a lawyer first.