ESPR Compliance in 2026: What Applies Now and Where PIM Fits

Key Takeaways

• No product-specific ESPR delegated act has been adopted yet. Iron and steel is first in line, with adoption indicated for Q4 2026, and apparel is expected in late 2027.
• Some obligations already apply. Since 19 July 2026, large companies may destroy unsold apparel, clothing accessories and footwear only under narrow derogations, and they already have to disclose the unsold consumer products they discard.
• The EU DPP registry has been live since 20 July 2026. The first mandatory passports are for certain large batteries, starting on 18 February 2027.
• No single tool makes a company compliant. ESPR compliance runs on a stack that connects product data, supplier evidence, footprint calculation, and a passport layer.
• PIM is a strong foundation for model-level product attributes. It doesn't natively cover persistent identifiers, external access rights, registry integration, or the independent backup copy.
• Supplier data is the bottleneck for most companies. Software alone won't close that gap.

What ESPR Regulates

ESPR is Regulation (EU) 2024/1781. It was adopted on 13 June 2024, entered into force on 18 July 2024, and repealed the Ecodesign Directive 2009/125/EC. The old directive covered energy-related products. ESPR covers almost every physical product placed on the EU market, including intermediate products such as steel and aluminium. Food, feed, medicinal products and veterinary medicinal products are among the exclusions.

The regulation is a framework. It sets the rules, and delegated acts switch them on one product group at a time. A delegated act's requirements apply no earlier than 18 months after it enters into force, except in duly justified cases. So there's no single ESPR start date for your products. Your date is your product group's act plus that transition.

The Commission's first working plan, adopted on 16 April 2025, sets the order. Steel, aluminium, apparel textiles, furniture, tyres and mattresses come first, along with horizontal rules such as repairability for consumer electronics and small household appliances.

A delegated act can set two kinds of requirements. Performance requirements set minimum or maximum levels for things like durability, repairability, recycled content, energy efficiency, carbon footprint and substances of concern. Information requirements oblige companies to disclose product data, mostly through the DPP and on labels.

Iron and steel will be the first real test. The Commission's call for evidence closed on 12 August 2026. The options include mandatory information on carbon footprint and recycled content, plus performance classes based on carbon footprint. Passport requirements would apply to every actor in the supply chain. As of October 2026, no draft act had been published.

No product-specific ESPR delegated act exists yet. Passport content is defined per product group, so any generic "DPP field list" is an educated guess until your act is published.

What Already Applies In 2026

The unsold goods rules are live. Large companies must disclose the number and weight of unsold consumer products they discard, and have had to since their 2025 financial year. Medium-sized companies follow from 2030. Micro and small companies are excluded. From 2 March 2027, Implementing Regulation (EU) 2026/2 fixes the reporting format: product categories based on Combined Nomenclature codes, reasons for discarding, disclosure within 12 months of financial year-end, five years of record-keeping, and authority checks with a 10% tolerance for discrepancies.

The destruction ban covers unsold apparel, clothing accessories and footwear. It has applied to large companies since 19 July 2026 and reaches medium-sized companies on 19 July 2030. Delegated Regulation (EU) 2026/296 lists the exceptions: dangerous products, IP infringement, licensing restrictions, damage (hygiene issues count), defects, and failed donation as a last resort. The donation route means offering the goods to at least three social economy organisations located in the EU first. Records stay for five years. One record can cover many items when a single event, like a shipment damaged in transit, affects them all.

For an apparel brand, this is mainly an ERP and warehouse task. Return reasons and donation attempts need to land in a system that can produce an audit trail five years later. A PIM doesn't hold that data, and it shouldn't.

The registry is the other live piece. The EU Digital Product Passport registry went live on 20 July 2026 with a testing environment, technical documentation, implementation guidelines and a helpdesk. It's an index. Passport content stays decentralised with the company or its service provider, and the registry records unique identifiers and registration metadata. Companies register through a web interface or an API. They can also request a proof of registration to show B2B customers. A free semantic repository publishes machine-readable data models by product group.

A few registry details shape system design. Operators verify themselves with an eIDAS qualified electronic seal or attestation. Each unique product identifier must be an https URL, which GS1 Digital Link satisfies. The Commission's user guide caps manual uploads at 100 passports per file, so API integration is the realistic route for any volume. And a registration identifier isn't proof of compliance. A third party can register on your behalf, but your company stays fully responsible.

Eight harmonised standards define how passports work technically. Six are published, covering unique identifiers, data carriers, data exchange protocols, APIs, storage and interoperability. The two on access rights and on data integrity are still pending. The standards cover mechanics. Data content comes from each delegated act.

Batteries go first. The battery passport under the separate Batteries Regulation becomes mandatory on 18 February 2027 for electric vehicle and light means of transport batteries, plus industrial batteries above 2 kWh. It runs on the same registry.

ESPR Timeline At A Glance

Add at least 18 months to any indicative adoption date to estimate when obligations start.

What The Digital Product Passport Requires

ESPR's passport rules sit in Articles 9 to 15. The ones that shape system design:

• A covered product can be placed on the market only if its passport is available and its data is accurate, complete, and up to date.
• A data carrier on the product, packaging, or documentation links to a persistent unique product identifier. The data must rest on open standards and stay transferable without vendor lock-in.
• Access rights differ by stakeholder group. In a JRC study for apparel, public visitors would see basics like fibre composition and care instructions, while recyclers and authorities get progressively deeper data, up to full conformity documentation for customs.
• Passports must stay available for the period set in the delegated act, including after the company's insolvency or liquidation.
• A backup copy must sit with a DPP service provider, which ESPR defines as an independent third party.
• Dealers and online marketplaces must get access to the data carrier or identifier.
• At import, customs check the registration identifier and commodity code against the registry before releasing the goods.

Granularity is set per delegated act and ranges from model level to single items. Batteries need item-level passports with data that changes over the battery's life. Apparel granularity is still open.

ESPR doesn't prescribe a technology. The Commission has said no specific technology is favoured or excluded, blockchain included. There's also no ESPR platform certification yet. A delegated act on DPP service providers is planned for 2027, so an "ESPR-certified" badge today is marketing.

Where Readiness Stands

KPMG surveyed more than 70 organisations in 13 European countries between September and December 2025. The sample skews large: 46% have over 1,000 employees and 44% work in textiles and footwear. KPMG states that the survey isn't statistically representative. Even with that tilt toward engaged companies, the numbers are modest. In the KPMG European DPP Readiness Survey, 19% called themselves well prepared, 53% were just getting started, 16% planned to start soon, and 12% were unprepared.

Ownership is often missing. 23% had not assigned DPP responsibility to anyone. Where someone owns it, it's mostly Sustainability (46%), followed by IT (26%), Procurement and Supply Chain (24%) and R&D (20%). KPMG recommends moving day-to-day execution to the teams that create the data, meaning product development and procurement. That's also where PIM, PLM and ERP owners sit.

Supplier data was the most cited challenge at 31%, ahead of understanding technical requirements at 25%. Consumer-facing sectors pointed to tier 2 suppliers and beyond.

61% of companies in the KPMG sample hadn't decided whether to build or buy a DPP solution. Only 5% planned to build in-house.

Waiting for delegated acts is a reasonable stance. It also compresses the implementation window once an act lands, and supplier onboarding doesn't speed up because a deadline is close.

Risks Worth Planning For

Penalties are set nationally. ESPR requires them to be effective, proportionate and dissuasive, and Member States must be able to impose fines and temporary exclusion from public procurement. The regulation sets no EU-wide fine level, so guide sites quoting a fixed percentage of global turnover are making it up. For importers, the sharper risk is market access. Customs won't release a covered product whose registration identifier and commodity code don't match the registry.

The requirements are a moving target. Data content, granularity, and access rights are only fixed per delegated act, and none is adopted. A data model you build today needs to be configurable, because some fields will change.

Passports have a long tail. They must outlive your vendor contract, your current IT stack, and possibly your company. If the identifier URL sits on a vendor's domain, your passports are tied to that vendor. Export rights and a genuinely independent backup provider are the exit plan.

Passports can also expose supplier relationships and sourcing details. Field-level access rights matter, and the standards for access control and data integrity are still pending.

One risk gets less attention. Once environmental attributes sit in a machine-readable passport, anyone can compare them with your marketing copy. Feeding both from one governed source is cheaper than explaining the difference to a regulator.

The Software Stack Behind ESPR Compliance

There's no single ESPR compliance product. Mapping the legal text and the standards to systems gives about a dozen capability areas, and they spread across several tools.

Product master data holds category-specific attributes, completeness rules, and translations. It usually lives in PIM, PLM and ERP.

Upstream evidence covers multi-tier supplier data, chain of custody for recycled or organic content claims, substances of concern, declarations of conformity and test reports. Traceability platforms and product compliance tools handle most of it.

Footprint calculation needs LCA or PCF tools aligned with the EU's Product Environmental Footprint methods, fed with production data from ERP or MES. A PIM can store the result. It can't calculate it.

The passport layer is where the legal obligations concentrate. It issues identifiers and data carriers, hosts and renders passports, and enforces access rights per stakeholder group. It also versions and archives passports, registers them through the registry API, replicates them to the backup provider, and accepts updates from repairers and recyclers. DPP platforms do this work, and some PIM vendors offer it as a module or through partners.

Unsold goods records belong in ERP and warehouse systems.

The DPP vendor market is young. Judge platforms by what they show in a scripted demo with your own products and in a pilot against the registry's test environment.

Where PIM Fits In ESPR Compliance

PIM is an enabler. It's often the best place to author and govern the model-level attributes a passport exposes, and it can feed a passport layer through APIs. Mainstream PIM systems don't natively cover the identifier, hosting, access control, persistence, registry, and backup obligations that make a passport legally compliant. They don't calculate footprints or verify multi-tier supplier evidence either.

What PIM does well maps closely to Article 9's demand for accurate, complete, and up-to-date data. A PIM gives you flexible attribute models per product category, validation rules, completeness scores and approval workflows. It handles translations into EU languages. It's built around models and SKUs, which match model-level passports. And it already syndicates product content to shops and marketplaces, so passport data and marketing copy can come from the same record.

Our customers often turn to us with passport-relevant data scattered across systems. Material declarations arrive as supplier spreadsheets, each in its own format and with no shared taxonomy. Care instructions sit in an ERP text field, and nobody can say which version is current. Before any passport work makes sense, that data needs one governed attribute model.

In projects we implemented, mapping DPP field requirements to category-specific attribute sets with completeness rules made the gaps visible per product category. Commercial attributes were mostly there. Recycled content evidence and substances of concern usually weren't, because those come from suppliers. Fixing that meant supplier onboarding workflows with mandatory fields and attached evidence, plus an API that pushes approved attributes to the passport layer whenever the schema changes.

Here's how typical PIM capabilities line up with ESPR and the DPP standards:

The vendor ecosystems follow the same split. Akeneo delivers passports through Ocode's app on the Akeneo App Store. Inriver lists DPP partners such as OrigoVero for unit-level passports. Pimcore publishes to passports through a Narravero extension. In each case, the PIM supplies governed attributes, and a separate layer handles the passport itself.

How much passport data a PIM already holds depends on the product group. For apparel and textiles, composition, care instructions, and identification data often exist in PIM or PLM already, so the PIM is a natural anchor. It still needs traceability, footprint, and a passport layer around it. Furniture and mattresses look similar, with more data coming from PLM bills of materials. Consumer electronics passports will lean on spare parts and repair information from PLM and service systems. Steel and aluminium passports hinge on production-route carbon footprint, which lives in production systems, so PIM plays a small part. Batteries need item-level dynamic data from battery management and manufacturing systems, and PIM plays a smaller part still.

Some PIM vendors bundle a passport layer. AtroPIM, for example, pairs a DPP module with a separate public web app that publishes versioned passports via QR code or GS1 Digital Link while internal systems stay closed. The back-up copy still has to sit with an independent provider, as it does for every vendor.

Treat the PIM as the system of record for model-level attributes and the passport layer as the system that carries the legal obligations. The independence rule for the backup copy means the two can never fully merge.

How To Choose The Passport Layer

Whether the passport layer comes from a PIM vendor or a specialist, test it the same way:

• Ask for a written conformance statement per published EN standard and a plan for the two pending ones.
• Register test passports in the Commission's testing environment during the pilot.
• Check whose domain sits in the identifier URL. Use one you control.
• Name the independent back-up provider in the contract.
• Secure full export rights in standard formats.
• Model total cost over the passport's required availability period, which can approach the product's lifetime.

What To Do In The Next 12 Months

Map each product line to its delegated act, or to the Batteries Regulation, and note the indicative dates. Large apparel and footwear companies need a working unsold goods process with derogation evidence now. That obligation is live.

Run your data gap analysis against the most concrete specification available. For apparel, that's the JRC's proposed DPP content. For steel, it's the options in the call for evidence. Vendor field lists are a weaker baseline.

Assign data ownership by system. PIM owns commercial and model-level attributes. PLM owns bills of materials and repair data. ERP and MES own batches and footprint inputs. Traceability tools own supplier evidence, and compliance tools own substances and declarations. Write this down, because the 23% of companies in KPMG's sample without a DPP owner show where projects stall.

If you already run a PIM, extend it. Add ESPR attribute groups, validation rules, and supplier onboarding workflows, and expose them via API to the passport layer. Only let the PIM host public passports if the vendor can show the EN standards, registry registration, and external access control in a live demo.

Put data delivery clauses in supplier contracts now, including substances of concern and update cycles. Supplier onboarding takes longer than software setup.

Then pilot. Two real products, real supplier data, a printed data carrier and a test registration will tell you more than any vendor deck.

Over the next year, watch for the iron and steel delegated act, the citation of the two pending standards, the battery passport go-live on 18 February 2027, the first standardised unsold goods reports and the draft apparel act. Dates in this article reflect the status on 10 November 2026.