There is a way of interpreting the European product regulatory ecosystem that makes it appear to be a collection of unrelated regulations. EPREL regulates energy labelling. The ESPR regulates ecodesign. eIDAS regulates digital trust services. Three different areas, three different departments and three different teams managing compliance.
That interpretation is incorrect. The three frameworks do not operate in parallel: they are layers of the same system, designed to work together. EPREL needs eIDAS to guarantee the authenticity of the organisations registering products. The ESPR needs eIDAS to guarantee the authenticity of the data that the DPP will publish. In the future, both EPREL and the DPP will converge within the same digital identity ecosystem that eIDAS 2.0 is building through the EUDI Wallet.
For a company that manufactures or imports physical products into Europe, understanding this connection is not an academic exercise. It is the map that determines which technical infrastructure must be built, why it is worth building it once instead of three times and why EADTrust can operate across all three regulations using the same set of services.
Concepts relating to ESPR, EPREL and eIDAS
European product regulatory ecosystem
A set of regulatory frameworks, including the Energy Labelling Regulation, ESPR, the Batteries Regulation, eIDAS and others, that jointly regulate the placing, traceability, sustainability and digital authenticity of physical products on the European market.
Digital trust infrastructure
A set of qualified eIDAS services, including electronic seals, electronic time stamps and electronic archiving, that provide a legal presumption of authenticity, integrity and availability for digital data and documents throughout the European Union.
EUDI Wallet ready organisation
A company whose digital trust infrastructure is integrated into its operational processes with sufficient robustness to operate within the European digital identity paradigm based on the European Digital Identity Wallet.
Regulatory convergence
The process through which different European regulatory frameworks, including eIDAS, EPREL, ESPR and the Batteries Regulation, require the same type of technical infrastructure for compliance, allowing investment in that infrastructure to deliver regulatory value across multiple contexts simultaneously.
The three frameworks: what each one does in one sentence
Before examining how they are connected, it is useful to understand what each one does independently.
EPREL is the European Commission database in which manufacturers and importers register energy-labelled products before selling them in the EU. A product cannot be marketed without being registered. Since October 2024, nothing can be registered without electronic verification.
The ESPR (Regulation (EU) 2024/1781) is the ecodesign framework that extends sustainability obligations to virtually all physical goods and introduces the Digital Product Passport as an instrument for life cycle traceability. The first mandatory DPP arrives in February 2027 for batteries; the sector-specific DPPs under the ESPR will arrive from 2027-2028 onwards according to the 2025-2030 Working Plan.
eIDAS (Regulation (EU) No 910/2014, updated by Regulation (EU) 2024/1183) is the framework that gives legal value to digital instruments in Europe: signatures, seals, time stamps, electronic archiving and registered electronic delivery. Without eIDAS, a digital signature is just a file. With eIDAS and its qualified services, it benefits from a legal presumption of authenticity throughout the Union.
The first point of connection: EPREL needs eIDAS to verify suppliers
The most visible and immediate connection occurred on 22 October 2024, when Implementing Regulation (EU) 2024/994 made electronic verification in EPREL mandatory.
Before that date, any company could create an organisation in EPREL and register models without proving its identity. The system trusted that the information entered was correct because no other mechanism existed. Since October 2024, trust has been replaced by verification: the supplier must cryptographically prove that it is who it claims to be using a qualified electronic seal issued by a QTSP included in the EU Trusted List.
The required instrument, the QSealC containing the NTR, is an eIDAS instrument. The reason this instrument is required rather than another is the same principle underpinning all qualified eIDAS services: it benefits from a legal presumption, is supported by a supervised and audited third party and is recognised throughout the Union without any additional procedure.
In essence, Implementing Regulation (EU) 2024/994 took the trust infrastructure that eIDAS had built over ten years and connected it to EPREL. The identity verification of suppliers of energy-labelled products now uses the same mechanisms, including QTSPs, the EU Trusted List and qualified certificates, as any other qualified digital transaction in Europe.
The connection between EPREL and eIDAS is not technical: it is regulatory. The legislature decided that the authenticity of information in EPREL could only be guaranteed using the instruments that eIDAS had already defined as the most secure and legally recognised in Europe.
The second point of connection: the ESPR DPP needs eIDAS to guarantee data authenticity
The second connection is deeper and more structural than the first. It does not only affect who can register, but also the reliability of everything contained in the passport.
Article 11 of the ESPR establishes that the technical design of the DPP must guarantee the authentication, reliability and integrity of data, provide a high level of security and privacy and prevent fraud. The Regulation does not say “use eIDAS”. However, the question of how to meet these four requirements in a decentralised system, where the data is managed by the manufacturer or a third party rather than the Commission, has a specific answer within the European regulatory ecosystem: qualified eIDAS trust services.
The qualified electronic seal provides authentication: every piece of data entered into the DPP can be sealed using the QSealC of the company entering it, cryptographically linking that data to the entity and creating a legal presumption of integrity and correctness of origin.
The qualified electronic time stamp provides temporal reliability: every event in the product life cycle, including initial placement on the market, repairs and changes in status, can be linked to a verifiable date and time carrying a legal presumption, making it impossible to manipulate the sequence of events without detection.
Qualified electronic archiving provides long-term availability: the ESPR requires the DPP to remain available even after the insolvency or cessation of activity of the responsible operator. The qualified electronic archiving service, regulated by Implementing Regulation (EU) 2025/2532, guarantees the integrity and availability of data throughout the retention period with a legal presumption.
In practice, the technical infrastructure required for the DPP to comply with Article 11 of the ESPR is the same infrastructure that EADTrust’s qualified services already provide in other contexts, including data rooms, court files and corporate contracts. The difference lies in the scale and context, not in the technology or legal framework.
The third point of connection: EPREL and the DPP as nodes in the digital identity infrastructure
The third connection is the most strategic and forward-looking. It does not concern what exists today, but the ecosystem that eIDAS 2.0 is building.
The eIDAS 2.0 Regulation (Regulation (EU) 2024/1183) introduces the European Digital Identity Wallet (EUDI Wallet), which will be available to citizens and companies in every Member State by the end of 2026 and which the regulated private sector will be required to accept by the end of 2027.
The EUDI Wallet is not merely a personal identity wallet. It is the infrastructure that allows any person, including a consumer, repairer or economic operator, to identify themselves digitally, present verifiable attributes, qualifications, powers of representation and authorisations, and sign or seal documents using qualified eIDAS instruments, all from one place and with full legal recognition throughout the Union.
For EPREL and the DPP, this has specific implications:
A repairer updating the state of health of a battery in the DPP will be able to authenticate using their EUDI Wallet and sign the update with a qualified electronic signature, without requiring a separate individual certificate specifically for that system.
A supplier needing to complete verification in EPREL will be able to present its company attributes, including its name, business registration number and EUID, directly from its digital identity wallet, with the same effect as the current QSealC.
A consumer seeking to verify the authenticity of the data they consult in a product’s DPP will be able to do so using the same infrastructure used for any other verified digital transaction. The QR code on the energy label and the DPP QR code provide access to an information system that eIDAS makes legally trustworthy.
The image EAD Factory uses to describe its purpose is accurate: preparing organisations to become EUDI Wallet ready organisations, meaning companies whose digital trust infrastructure is integrated into their processes with sufficient robustness to interact with customers, suppliers, public administrations and European regulatory systems under the new digital relationship paradigm.
How the three frameworks are related chronologically
The consolidated roadmap for the European product regulatory ecosystem clearly shows that the three frameworks did not arrive at the same time or by coincidence. There is a sequence with its own internal logic:
2014-2017: The legal architecture is built. eIDAS (2014) creates the digital trust framework. Energy Labelling Regulation 2017/1369 establishes EPREL as an obligation. These are the foundations.
2019-2021: EPREL begins operating, with registration becoming mandatory in January 2019. The major rescaling introduces the new A-G scale. Product databases begin accumulating registered models. eIDAS is already operational but is not yet connected to EPREL.
2023-2024: The three frameworks converge. In July 2023, the Batteries Regulation introduces the first DPP with a fixed deadline. In July 2024, the ESPR enters into force. In April 2024, Implementing Regulation 2024/994 connects eIDAS with EPREL: supplier verification requires a QSealC. In April 2024, eIDAS 2.0 is published and the digital trust infrastructure begins its major update.
2025-2026: Consolidation. Only the NTR has been valid since April 2025. The Central DPP Registry opens in July 2026. The EUDI Wallet will be available by the end of 2026. The first ESPR delegated acts can be adopted from July 2025. Implementing Regulation 2025/2532 on qualified electronic archiving has already been published.
2027-2030: Deployment. The battery passport becomes mandatory in February 2027. The regulated private sector must accept the EUDI Wallet by the end of 2027. Sector-specific ESPR DPPs are introduced gradually. By 2030, 80% of EU citizens will use the EUDI Wallet.
The convergence is not accidental: it is by design. Every new regulation introducing digital authenticity obligations into the European ecosystem builds on the infrastructure already provided by eIDAS. Every new obligation under eIDAS 2.0 expands the ability of systems such as EPREL and the DPP to operate with greater trust, interoperability and efficiency.
The four layers of trust infrastructure for EPREL and the DPP
From the perspective of a manufacturer or importer required to comply with both EPREL and the future DPP, the necessary technical infrastructure can be organised into four layers. Each layer uses a different eIDAS instrument. All of them can be provided by a QTSP such as EADTrust.
Layer 1: Verified identity
The QSealC containing the NTR proves to EPREL, and will prove to the Central DPP Registry, that the company entering the data is who it claims to be. This is the most basic layer and has already been mandatory in EPREL since October 2024.
Layer 2: Data integrity
The qualified electronic seal applied to DPP data guarantees that the data originated from the company that entered it and has not been modified since. This is the layer that meets the authentication and integrity requirements under Article 11 of the ESPR.
Layer 3: Temporal traceability
The qualified electronic time stamp applied to every event in the product life cycle provides a verifiable sequence of who did what and when. This layer allows a market surveillance authority to reconstruct a product’s history with legal certainty.
Layer 4: Permanent availability
Qualified electronic archiving guarantees that DPP data, including the mandatory backup required under Article 10 of the ESPR, remains available and verifiable even after the manufacturer ceases trading. This layer meets the ESPR longevity requirement with a legal presumption of integrity throughout the retention period.
These four layers are not four independent projects. They are four services within the same eIDAS infrastructure, provided by the same type of provider, a QTSP, and with the same legal effect throughout the European Union.
Why building the infrastructure once is the right strategic decision
The strongest argument for understanding the strategic connection between ESPR + EPREL + eIDAS is not technical: it is economic.
A company that builds its EPREL compliance infrastructure, including the QSealC containing the NTR, verification process and certificate management, in isolation from the rest of its digital ecosystem is already completing three quarters of the work required by the DPP. The verified identity layer is already in place. The remaining elements, including the data seal, time stamp and qualified archiving, are built on the same foundation and with the same provider.
A company that waits until the ESPR delegated act for its sector is published before considering the DPP trust infrastructure is wasting the time that EPREL could have provided to build that foundation. It will probably discover that eighteen months is not enough to build from scratch what it could have developed in parallel over two or three years.
The strategic connection also has a regulatory cost dimension. Every new European regulation introducing digital authenticity obligations adds another layer to the ecosystem. DORA has applied to the financial sector since January 2025, introducing digital resilience obligations. NIS2 requires essential and important entities to secure the digital supply chain. The future Cyber Resilience Act introduces security requirements for products with digital elements. All of them build on the same trust infrastructure.
Companies with that infrastructure, including a trusted QTSP and qualified services integrated into their processes, can adapt to each new regulation by adding a layer. Those without it must start from scratch every time.
The strategic question is not “Do I need a QTSP for EPREL?” The strategic question is “What digital trust infrastructure will my company need over the next five years?” The answer includes EPREL, the DPP, the EUDI Wallet and all the frameworks that will follow.
EADTrust’s position within the ecosystem
EADTrust is a qualified trust service provider included in the EU Trusted List, supervised and authorised by the Spanish Ministry of Economic Affairs and Digital Transformation, and operating across every country in the European Union and European Economic Area.
Its services cover the four layers required by the EPREL + DPP + eIDAS ecosystem:
Qualified electronic seal certificates containing the NTR for EPREL verification and identification in the Central DPP Registry. Already in production: more than 200 EPREL certificates issued.
Qualified electronic time stamps (Q-Timestamps) for event traceability throughout the product life cycle and the DPP evidence chain. Integrated into EAD Factory and Evidence Manager services.
Qualified eArchiving for the custody of DPP data with a legal presumption of integrity throughout the retention period, including the mandatory backup required under Article 10 of the ESPR. Deployed on Oracle EU Sovereign Cloud under 100% European jurisdiction.
EAD Factory as a platform integrating all these services into the company’s own QTSP infrastructure, or as rPaaS, a regulated platform as a service, enabling eIDAS trust services to be connected directly to business processes with legal effect.
Preparation for the EUDI Wallet: EAD Factory is explicitly designed to turn organisations into EUDI Wallet ready organisations, meaning they are prepared to interact with customers, suppliers and regulatory systems under the new European digital identity paradigm.
Connection map: at a glance
| Framework | Requirement | eIDAS instrument that meets it | When |
|---|---|---|---|
| EPREL – Supplier verification | QSealC containing the NTR to verify the organisation | Qualified electronic seal | Mandatory since Oct 2024. NTR only since Apr 2025 |
| DPP – Data authentication | Guarantee of who enters each piece of data | Qualified electronic seal | When the sector’s delegated act is published |
| DPP – Data integrity | Guarantee that the data has not been modified | Qualified electronic seal + hash | When the delegated act is published |
| DPP – Temporal traceability | Who did what and when, with a verifiable date | Qualified electronic time stamp | When the delegated act is published |
| DPP – Permanent availability | Data accessible even after cessation of activity | Qualified electronic archiving | From the first placement on the market of a product with a DPP |
| EUDI Wallet – Regulated private sector | Acceptance of the digital identity wallet | EUDI Wallet ready infrastructure | Mandatory by the end of 2027 |
Frequently asked questions about ESPR, EPREL and eIDAS
Not necessarily. The QSealC containing the NTR currently used for EPREL verification is the same type of instrument that the DPP will require to authenticate the data entered into the passport by the manufacturer. If the QTSP issuing the EPREL certificate also provides qualified time-stamping and archiving services, the entire infrastructure can be managed through a single provider and a single contract.
In the long term, the EUDI Wallet will probably allow suppliers to present their company attributes directly from the wallet, replacing or complementing the current verification process. However, the EUDI Wallet for companies, the so-called “organisational attribute wallets”, is still under development and there is no specific date when its use for EPREL verification will become mandatory. In the meantime, the QSealC containing the NTR remains the required instrument.
No. If the company already has a QSealC containing the NTR, the central instrument in the DPP trust infrastructure, it can use it directly to complete verification in EPREL. The DPP infrastructure is a superset of what EPREL requires, not an alternative.
Sectors with products registered in EPREL currently need Layer 1, the QSealC containing the NTR. When the DPP arrives for their sector, they will need all four layers. Sectors that are not covered by EPREL but will be subject to the DPP, including textiles, aluminium and furniture, will need all four layers directly when the delegated act for their product group arrives.
DORA and NIS2 are sector-specific frameworks for the financial sector and essential or important sectors that impose digital operational resilience and supply chain security requirements. Their obligations relating to ICT risk management, incident reporting and critical supplier audits are easier to meet when a company already has a robust digital trust infrastructure. Qualified eIDAS services, particularly electronic archiving for log evidence and electronic time stamps for incident traceability, are also relevant in this context.
