Digital product passport implemented in accordance with the law

Before a company can register digital product passports in the EU DPP Register, the organisation must be verified. This step is essential, as the Register needs to be able to trace which legal entity is behind a product passport. A qualified electronic seal or a qualified electronic signature are the simplest means of verification, authentication and simultaneous confirmation.

Procedure:

1. Log in via EU Login.
2. Registration of the organisation in the DPP Registry.
3. Download a verification statement, which is signed with a qualified electronic seal and then uploaded again.
4. Verification of the declaration by the register.

Requirements:

• Legal entities are required to have a qualified electronic seal.
• Alternatively, a qualified electronic signature may be used.

Relevanz:
This process is usually a one-off for each company, but it is critical: without a successfully verified organisation, product passports cannot be entered into the register. Manufacturers, importers, distributors and corporate groups with multiple legal entities are particularly affected.

The digital product passport typically consists of structured data (e.g. JSON or JSON-LD), which is made accessible via a product URL or a QR code. To ensure that this data set is retrievable and trustworthy, it can be accompanied by a qualified electronic seal.

Technical process:

1. A DPP platform generates the structured product data set.
2. The data set is transferred to the signature and seal infrastructure via the API.
3. A cryptographic hash is generated and secured with the manufacturer’s qualified electronic seal.
4. The sealed data set is returned to the platform and made available.

Benefits:

• Public authorities, business partners or automated systems can verify the authenticity of the DPP.
• The data set is protected against subsequent tampering.
• Sealing takes place automatically in the background and can be seamlessly integrated into existing platforms.

Relevance:
As standardisation around FprEN 18246 progresses, the cryptographic protection of DPP data sets will become increasingly important. API-based sealing is particularly valuable for platform providers who wish to offer their customers a seamless process.

The EU Machinery Regulation 2023/1230 allows for the digital provision of the EU Declaration of Conformity for machinery from 20 January 2027. This declaration is the key document by which a manufacturer confirms that a machine meets the applicable EU requirements. It forms the basis for the CE marking and is of considerable legal significance.

Requirements for digital delivery:

• The statement must be accessible at all times and free of charge.
• It must be recognisable as the original and available in its unaltered form.
• Access must be via a digital link (e.g. QR code, URL).

A matter of trust:
How can it be verified that the digital declaration of conformity is genuine, unaltered and has been approved by the responsible body? This is where qualified electronic signatures, seals and time stamps come into play:

• An authorised person provides a qualified electronic signature.
• The organisation uses a qualified electronic seal.
• A timestamp records the date and time of creation.

Benefits:

• The digital declaration of conformity is robustly secured.
• Paper-based processes can be reduced and documentation processes can be digitised.
• This is particularly relevant for B2B scenarios where automated checks are required.

The cryptographic security of digital product passports (DPP) and declarations of conformity varies depending on the production model:

In mass-production engineering – for example, in the case of standardised industrial plant or mass-produced vehicles – the EU Declaration of Conformity is typically issued for an entire model or a product range. As not every single machine needs to be signed individually, the volume of signatures remains manageable. The focus here is on standardised approval processes and the long-term availability of supporting documentation. Manual or semi-automated signing processes are generally sufficient.

In specialised machinery manufacturing – for example, among plant engineers, robotics integrators or manufacturers of bespoke machines – a separate declaration of conformity and a separate digital product passport are often required for each machine, each project or even each serial number. This leads to a sharp increase in the volume of signatures, and manual processes quickly become time-consuming, error-prone and difficult to scale. At the same time, DPP data records in specialised machine construction are often more customised, as they must reflect specific configurations, technical adaptations or project-specific documentation.

Whilst manual or semi-automated processes are sufficient in standard machine manufacturing, API-based sealing and signing processes are indispensable in specialised machine manufacturing. They enable fully automated, scalable and error-resistant validation of declarations of conformity, product passport data sets and technical documents – directly from existing systems. Such an infrastructure pays particular dividends in scenarios involving a high degree of customisation and large volumes of data, as it reduces manual effort and significantly speeds up compliance processes.