What happened
On 16 September 2026, CEN and CENELEC published the last two horizontal standards for the EU's Digital Product Passport: EN 18239 on access rights and business confidentiality, and EN 18246 on data authentication, reliability and integrity. The set of eight is now complete, two years after the Commission asked for it.
Neither one is law yet. Six of the eight were cited in the Official Journal on 15 July 2026 under Commission Implementing Decision (EU) 2026/1736, which means a passport built to those six is presumed to conform to Articles 10 and 11 of the Ecodesign Regulation (ESPR). The other two were approved by CEN on 17 August 2026 and made available in September, but they still carry no Official Journal reference. The Commission's indicative timeline, consulted on 30 October, now puts that citation decision in November 2026. It was scheduled for September.
The gap matters more than it looks, because these two are the ones that decide whether a product's passport can be trusted.
What the two standards actually require
EN 18239 is about who can read what. Access rights attach to the individual data element, not to the whole document, so two people scanning the same passport can legitimately see different fields. Every actor in the system must carry a globally unique operator identifier. Access must be authenticated and authorised, access decisions must be traceable, and roles must be grantable, changeable, suspendable, renewable and revocable. The standard also asks for measures against mass scraping and against discrimination based on location.
EN 18246 is about proving nothing was quietly changed. Integrity and authenticity must be verifiable free of charge and without limits for the verifier, and the mechanisms used must be independent of the communication channel carrying the data — so a copy does not become genuine by being replayed through a different route. Every creation, change or deletion must be bound to an authenticated actor, with non-repudiation and an auditable log over time. In plain terms, a passport must be able to show who changed what, when, and under which credential. It also requires at least one data carrier on each product that lets any user reach the public data with no extra software.
A passport a counterfeiter can clone is worse than no passport, because it hands them a tool that looks official.
Why a brand owner should be paying attention
Three things are moving at once, and they are not on the same clock.
- Customs will check imports against your passport. ESPR Article 12 puts the identifiers needed to verify passport authenticity in the EU registry, and Article 13 connects that registry to the customs system. The Commission describes the result as automated import screening and better risk management for non-compliant goods.
- The first hard date has no transitional relief. The battery passport becomes mandatory on 18 February 2027 for electric vehicle batteries, light means of transport batteries and industrial batteries above 2 kWh. That date comes from the Batteries Regulation itself, so the usual 18-month transition that follows an ESPR delegated act does not apply to it.
- Your identifier and your carrier are a print decision. EN 18219 covers unique identifiers and EN 18220 covers data carriers — QR, Data Matrix, RFID. These are the two things that end up physically on the product. They are also the two things that cannot be changed once the product is on a shelf.
Source and caveats
DPPify, 30 October 2026. That is a vendor of DPP software and so an interested party, but the underlying facts are primary: Commission Implementing Decision (EU) 2026/1736, the CEN catalogue entries for EN 18239 and EN 18246, and the Commission's own indicative timeline. The slip from September to November is the Commission's revised date. As of 30 October 2026, no Official Journal citation for either standard had appeared.
Key takeaways
- All eight Digital Product Passport standards are published; the last two landed on 16 September 2026.
- EN 18239 sets access rights at the level of the individual data field. EN 18246 requires integrity mechanisms independent of the transport channel.
- Neither of the last two is cited in the Official Journal, so no presumption of conformity under ESPR Articles 10 and 11.
- The citation decision has slipped to November 2026. Batteries become mandatory on 18 February 2027 with no transitional relief.
- The identifier scheme and the data carrier get printed on the product. Choose them once, deliberately.
What this means for a brand owner
- Design for the audit trail, not for the scan. Field-level access and a non-repudiable change log take weeks to build and are close to impossible to retrofit into a platform bought for its QR codes.
- Do not claim a conformity you cannot defend. Being technically ahead of the citation is worth little if the first market surveillance check contradicts you.
- Authentication is the layer a counterfeiter cannot copy. A static QR can be reprinted. A record whose entire history is signed by each actor cannot.