DPP certificate for Central Registry verification
The European Commission's Digital Product Passport (DPP) Registry only accepts economic operators verified with a qualified electronic seal, and the ESPR also requires a backup copy of that data to be kept with an independent provider. EADTrust does both: it issues the QSealC and holds the DPP in custody.
Regulation (EU) 2024/1781 (ESPR) sets the general framework, and Implementing Regulation (EU) 2026/1778 sets the Registry rules, including verification with a qualified electronic seal. The specific requirements for each product come with its delegated act: batteries already have a date (18 February 2027) and other sectors will follow. Preparing early costs less than scrambling against the deadline.
What the DPP Registry certificate is
The “DPP certificate” is a qualified certificate for electronic seals (QSealC) issued by a qualified trust service provider, which allows the Digital Product Passport Registry to recognise your company as a verified economic operator. It is not the passport itself, nor a data platform: it is the electronic identity you use to sign and seal before the European Commission.
Legal entities need a qualified electronic seal; sole traders need a qualified electronic signature. In both cases, it must be issued by a provider listed on the EU Trusted List.
Digital Product Passport (DPP) is the digital record of information on composition, sustainability, reparability and life cycle that must accompany products covered by the ESPR. The Commission's central registry does not store the full dataset: it holds identifiers and registration metadata, while the passport data remains hosted by the economic operator or by the service provider it appoints.
That is why there are two separate pieces, and both become mandatory in due course: identity verification to be able to register the DPP, and data custody so that it remains available for the entire required period, even if the company ceases to exist.
What does a DPP service provider actually have to keep in custody?
Custody is not satisfied by a live URL. It means preserving the actual dataset and being able to prove its integrity and availability for the required period.
- Unique identifiersUnique product identifier, economic operator identifier, facility identifier and the registration identifier generated by the Commission.
- Data required by the delegated actComposition, carbon footprint, recycled content, substances of concern and end-of-life instructions, depending on the product group.
- Version historyEvery creation, modification or deletion of registration data is reflected in the registration status in the Registry.
- Long-term availabilityData must remain accessible for the set period, even if the operator becomes insolvent, is liquidated or ceases trading.
- Proof towards third partiesThe proof of registration includes a hash of the DPP version, a Commission timestamp and a qualified electronic seal.
How to verify your company in the DPP Registry, step by step
Verification takes five steps, and a qualified provider is mandatory in only one of them: sealing the declaration document generated by the Commission. That is the step where most organisations get stuck.
Organisation details
The operator's registration details (legal name, tax ID or EUID, establishment) are prepared exactly as they must appear in the Registry.
QSealC issuance
EADTrust issues the qualified certificate for electronic seals on a qualified seal creation device, after verifying identity and powers of representation.
The QTSP steps in hereDeclaration request
The declaration is requested on the platform and the Commission generates a PDF with the organisation's details, sealed with its own institutional seal.
PAdES countersealing
The legal representative counterseals that PDF with the qualified seal and uploads it to the Registry. If the seal does not reach the qualified level, verification is rejected.
Critical stepVerified operator
Once verification is complete, you can register passports, manage access permissions, generate the proof of registration and activate custody.
Three ways to work with EADTrust as your DPP service provider
You can contract just the seal to get verified, just the custody of the backup copy, or hand over the whole process. All three options are compatible with the DPP data platform you already use.
Qualified electronic seal for the DPP Registry
For companies that only need to get verified as an economic operator and sign or seal their registrations with validity across the European Union.
- Qualified certificate for electronic seals for legal entities (QSealC)
- Qualified seal creation device (token)
- Countersealing of the declaration PDF in PAdES format
- Qualified timestamps with certified date
- Certificate validity of 1, 2 or 4 years
- Free support throughout the verification process
Custody of the DPP backup copy
For companies that already create and host their own digital passport, but need the independent third party required by Article 10(4) ESPR.
- Receipt and custody of the DPP backup copy
- Electronic archive with verifiable integrity
- Availability in case of insolvency, liquidation or cessation of activity
- Retention for the period required by your delegated act
- Commitment not to reuse or sell your data
- API integration with your current DPP platform
End-to-end management: onboarding, registration and custody
For companies that prefer to delegate the whole cycle: verification, registration in the Registry, proofs of registration and long-term retention.
- Everything included in options A and B
- Assisted onboarding and organisation verification
- Management of identifiers and interoperable data
- Passport registration and generation of proofs of registration
- Data updates throughout the life cycle
- Ongoing technical and regulatory support
How long must digital passport data be kept in custody?
There is no perpetual retention obligation: the period is set by the delegated act for each product group, with a minimum linked to the product's expected lifetime. Where Union law sets no duration, Registry registration data is automatically deleted after ten years.
| Applicable framework | Availability period | Reference |
|---|---|---|
| General ESPR rule | The period set by the product group's delegated act, at least the product's expected lifetime. | Reg. (EU) 2024/1781, Arts. 9(2)(i) and 11(e) |
| No specific duration in Union law | Ten years from registration for central registry registration data. | Reg. (EU) 2026/1778 |
| Continuity in case of insolvency | Access is maintained for the same period even if the operator ceases trading, through a backup copy held by an independent provider. | Reg. (EU) 2024/1781, Art. 10(4) and Recital 38 |
| Batteries | The battery passport ceases to exist once the battery has been recycled. | Reg. (EU) 2023/1542, Arts. 77 and 78 |
| Construction products | Accessible for the set period after the last unit of that product type is placed on the market. | Reg. (EU) 2024/3110, Arts. 76(2)(h) and 78 |
In practice: custody is a commitment of one or several decades, not one year. That is why the service relies on a cartulary rather than simple hosting, and why it makes sense to contract the mandatory period in one go (€300) instead of renewing it year after year.
Waiting until the last minute is not a strategy
The DPP introduces a new way of organising and communicating information about certain products on the European market. It is being rolled out progressively, but companies need time to understand what applies to them, prepare their data and obtain the qualified certificates the Registry requires.
Registering now does not commit you to anything. It simply keeps you informed and sends you updates when they are genuinely relevant to your product group.
The right information, at the right time
You don't need to follow every European publication or interpret every change on your own.
Get alerts when a delegated act or a change affecting your sector is published.
Follow how the timeline evolves before it becomes urgent.
Registered users are the first to receive upcoming communications and technical materials.
Who needs a DPP service provider
If your company manufactures, imports, distributes or sells ESPR-regulated products in the European Union, you will need a valid digital passport, a backup copy and an independent custody environment.
Manufacturers
Companies that design, produce or place products on the EU market and are responsible for creating the DPP and its backup copy.
Importers and authorised representatives
Organisations that bring products from third countries into Europe and may take on obligations for the passport and its identifiers.
Brands, distributors and retailers
Companies that manage catalogues, product references and sales channels and need the DPP to be accessible and consistent across all of them.
Product and compliance teams
Legal, technical, sustainability, quality, operations and digital transformation teams that need to have compliance ready.
When the digital passport becomes mandatory in each sector
The DPP does not reach every sector at once. First the ESPR framework and the central registry were activated; the specific obligations then follow product group by product group, with batteries as the first confirmed date.
The ESPR enters into force
The legal framework for the Digital Product Passport is now applicable law. Specific obligations come with each sectoral delegated act.
Reg. (EU) 2024/1781
DPP Registry goes live
The Commission launches the central registry and its test environment, with batteries as the first product group enabled.
Art. 13 ESPR
Registry rules in force
Identity verification via eIDAS, the proof of registration with a qualified seal and data retention are specified.
Reg. (EU) 2026/1778
Battery passport becomes mandatory
First DPP with a legal date: electric vehicle batteries, light means of transport batteries and industrial batteries above 2 kWh.
Reg. (EU) 2023/1542, Art. 77
First sectoral wave
Textiles and footwear, steel and aluminium, consumer electronics, tyres and electrical equipment, as their delegated acts are published.
ESPR working plan
DPP expansion
Furniture, construction products, packaging, detergents, mattresses, toys and chemicals, each with its own compliance deadlines.
Delegated acts
If your product group does not yet have a published delegated act, the obligation is not yet enforceable. Delegated acts usually grant a compliance period of 18 to 36 months from publication, so early preparation is a real advantage over those who wait until the last quarter.
A DPP data platform and a qualified trust layer are not the same thing
A DPP platform generates and manages passport data. A qualified trust service provider provides evidential value and long-term retention. They are complementary pieces, and the ESPR requires both.
| Function | DPP data platform | EADTrust (QTSP) |
|---|---|---|
| Generate and structure passport data | Yes | Depending on option |
| Unique identifier and data carrier (QR, NFC, RFID) | Yes | Depending on option |
| Qualified electronic seal for Registry verification | No | Yes |
| Qualified timestamp with certified date | No | Yes |
| Backup copy as an independent third party (Art. 10(4) ESPR) | No: it hosts the data on its own infrastructure | Yes |
| Electronic archive for periods of decades | No | Yes |
| Listing on the EU Trusted List | No | Yes |
A non-qualified seal, an advanced signature, a server certificate or a blockchain record may be technically useful, but they are not equivalent to a qualified electronic seal: the Registry validates against the EU Trusted List and, if the instrument does not reach the qualified level, verification is rejected.
How much the qualified seal and DPP custody cost
Two pieces, two ways of pricing them: the seal has a fixed price and custody is tailored to your catalogue.
Qualified electronic seal for legal entities
To sign the declaration and get verified as an economic operator in the DPP Central Registry.
Custody of the DPP backup copy
Retention with verifiable integrity for the entire period required by your product group.
- Number of products to keep in custody
- Onboarding fee and 10-year custody
- Annual custody period
Reference prices excl. VAT. The final proposal is tailored to the number of products, the product group and the custody period required by its delegated act.
We're preparing more DPP-related updates
Technical materials, registration guides and additional services for economic operators and data platforms. Registered users are the first to hear when the time comes.
I want to be among the first →What will you receive when you sign up?
Selected communications to help you follow the DPP's evolution without information overload.
Regulatory updates
Updates on the ESPR, the DPP Registry and delegated acts as they are published.
Timeline alerts
Information on the progressive rollout of obligations by product group.
Useful content
Guides and materials to understand the DPP and data custody without unnecessary jargon.
Priority access
You'll receive EADTrust's upcoming news before it is announced publicly.
The trust environment your digital passport needs
With the Digital Product Passport, storing information is not enough: you must be able to prove who entered it, when, and that it has not been altered, throughout the required period. Only eIDAS qualified services provide that.
QTSP on the EU Trusted List
EADTrust is a qualified trust service provider listed on the Spanish Trusted List and, therefore, on the EU Trusted List. Its seals are automatically recognised in all Member States.
Electronic archive
The cartulary service solves exactly the problem the ESPR raises: long-term retention with verifiable integrity, even if the economic operator ceases to exist.
Entity seals and timestamps
Article 11(g) ESPR requires authentication, reliability and integrity of data. Qualified electronic seals and timestamps link each operation to an identified entity and to a date with a legal presumption of accuracy.
Years as a digital trust service provider
Certificates and qualified services issued for European companies
Member States where our qualified services are valid
Verifiable credentials, not claims
Any provider can say it offers digital trust. EADTrust proves it with official registrations, audited certifications and qualified services applicable to the Digital Product Passport.
EU Trusted List and national register
Registered as a qualified trust service provider under the eIDAS Regulation, recognised across the Union.
ISO 27001 · ISO 9001 · ISO 20000 · ISO 22301
Certifications in information security, quality, business continuity and IT service management.
Spanish National Security Framework (ENS)
Security framework required for digital services working with public administrations and critical information environments.
eIDAS services applicable to the DPP
Qualified electronic seals, timestamps, electronic archiving and verifiable evidence on passport data.
Questions about the certificate, custody and the DPP Registry
A qualified certificate for electronic seals (QSealC) if you are a legal entity, or a qualified electronic signature (QES) if you are a sole trader, issued by a qualified provider listed on the EU Trusted List. A notified electronic identification means with assurance level high is also accepted. That instrument is used to counterseal the declaration document generated by the Registry.
No. The Registry validates the instrument against the EU Trusted List and rejects verification if the seal does not reach the qualified level. A conventional digital seal, an advanced signature or an SSL/TLS server certificate are not equivalent. The difference is not just technical: only a qualified seal enjoys the legal presumption of data integrity and correctness of origin.
The ESPR is in force and the central registry is already live, but the specific requirements are being developed progressively for different product groups. The first confirmed date is 18 February 2027 for electric vehicle, light means of transport and industrial batteries. The applicable timeline depends on the category and its delegated act.
Because the ESPR requires that copy to be made available through a digital product passport service provider that is an independent third party. The aim is for consumers, recyclers and authorities to keep accessing the data even if the company becomes insolvent, is liquidated or ceases activity in the Union. If the custodian is the operator itself, that guarantee disappears exactly when it is needed.
It is not a perpetual obligation. The duration is set by the delegated act for each product group, with a minimum corresponding to the product's expected lifetime. Where Union law sets no specific duration, Registry registration data is automatically deleted after ten years. For construction products the period runs from the last unit placed on the market, and a battery's passport ceases to exist when the battery is recycled.
From the first day on the market. The ESPR establishes that regulated products may only be placed on the market or put into service if a digital passport is available, and that the backup copy with the independent provider must be made available when the product is placed on the market. Custody is not a closing formality; it is an entry requirement.
With the proof of registration you can generate in the Registry at any time. It is a downloadable electronic document that includes the unique product identifier, the identity of the responsible verified economic operator, the date and time of the latest registered version validated by a Commission timestamp and a hash of that passport version, and it is secured with a qualified electronic seal. That combination of hash, timestamp and qualified seal is what gives it evidential weight towards third parties.
Not as a substitute. A blockchain can provide technical traceability, but the Registry requires a qualified instrument under the eIDAS Regulation, and Article 11(g) ESPR calls for authentication, reliability and integrity of data with legal value. The two are compatible: you can keep your traceability solution and add the qualified seal and archiving layer the regulation requires.
No. The ESPR is explicit: the digital product passport service provider may not sell, reuse or process that data beyond what is necessary to provide the contracted service, unless expressly agreed with the economic operator. It is both a regulatory obligation and a contractual obligation of the service.
Then the DPP obligation is not yet enforceable for you. Even so, delegated acts grant compliance periods of 18 to 36 months from publication, and identity verification and data preparation are the most time-consuming tasks. We can help you find out when it will apply to you and have the infrastructure ready before the deadline is upon you.
Manufacturers, importers, authorised representatives, brands, distributors and professionals in legal, technical, sustainability, quality, product or operations roles who want to follow the DPP's evolution or start preparing their verification and custody now. Registration is free, involves no commitment and works both for receiving updates and for requesting a proposal.
Communications on regulatory updates, the timeline by sector, informative content and EADTrust news related to the Digital Product Passport. If you also request a quote, a specialist will contact you to learn about your catalogue and deadlines.
Guides and analysis of the DPP ecosystem
Technical and regulatory content published by EADTrust for economic operators and compliance teams.
The full flow of onboarding, declaration request and PDF countersealing, including the points where verification fails.
Registry live The Digital Product Passport Registry, up and runningWhat changes from July 2026, which product groups are enabled and why the seal has to be qualified.
Regulatory analysis Regulation (EU) 2026/1778: the DPP Registry rulesIdentity verification via eIDAS, proof of registration, delegation to third parties and operator responsibility.
Related service EPREL certificate with NTR and EUIDThe same type of qualified seal required by the European energy labelling database, already in production.
Related service Entity seal certificate (QSealC)What a qualified electronic seal for legal entities is, who can apply for one and how powers of representation are proven.
About us EADTrust, qualified trust service providerFull catalogue of eIDAS services: certificates, timestamps, certified notifications and electronic archiving.
Will your product need a DPP? Get ready before it's required
Tell us what you sell and in which markets. We'll tell you whether it applies to you, when, which certificate you need and how much it would cost to keep your data in custody. No regulatory jargon, just straight talk.