For years, EU product compliance data sat in folders on a shared drive. Test reports, a signed declaration of conformity, label artwork, and a risk assessment that nobody outside quality ever opened.
That changed in two steps. Since 13 December 2024, the General Product Safety Regulation (GPSR) has required every online offer to show manufacturer details, product identifiers, a product picture and safety warnings. Then, on 20 July 2026, the European Commission opened the registry for Digital Product Passports (DPP). The first mandatory passports, for large batteries, are due on 18 February 2027.
So a large part of product compliance now lives in product data. This article maps the EU rules that end up in that data and shows how to set up a product information management tool to carry them.
Key Takeaways
- GPSR Article 19 makes each online listing a regulated record. A missing manufacturer address or warning is a gap on every channel that shows the product.
- The DPP registry stores identifiers and metadata only. The passport content comes from your own systems, typically the PIM plus production systems.
- Passport duties arrive by product group. Batteries come first in February 2027, and toys follow in August 2030, while construction products and ESPR groups such as textiles wait for their delegated acts.
- Since 27 September 2026, generic environmental claims such as "eco-friendly" are banned in EU consumer marketing unless the trader can prove recognised excellent environmental performance. Old stock gets no grace period.
- A PIM handles model-level data and channel output well. Serial-level traceability and legal interpretation stay outside it.
What The 2025 Safety Gate Numbers Show
The EU rapid alert system for dangerous non-food products logged 4,671 Safety Gate alerts in 2025, 13% more than in 2024 and the highest number on record. Cosmetics and toys made up more than half of the cases. Follow-up actions by national authorities rose 35%. Those actions include withdrawals, recalls, border stops and the removal of listings from online marketplaces.
Marketplaces now carry formal duties. The GPSR requires every online marketplace active in the EU to register in the Safety Gate portal and name a single point of contact. More than 1,200 had registered by the end of 2025.
Removing a listing is one of the standard measures. That makes the listing a product compliance object in its own right.
GPSR Turned Every Online Listing Into A Compliance Record
Article 19 of the General Product Safety Regulation (EU) 2023/988 sets the minimum content of any distance-sales offer. The offer has to show the manufacturer's name, registered trade name or trademark, with a postal and an electronic address. If the manufacturer is established outside the EU, the offer also names the responsible person in the EU, again with both addresses. It needs information that identifies the product, including a picture, its type, and any other product identifier. And it has to show the warnings and safety information that go on the product or in its accompanying documents, in a language consumers easily understand, as decided by the Member State where the product is sold.
The duty attaches to the offer. So it applies to the brand's own shop and to every marketplace or distributor webshop separately. Article 22 requires marketplaces to design their interfaces so traders can enter this information, and each platform built that with its own field structure.
Article 9 covers the product itself. The manufacturer marks the product with an identifier such as a batch or serial number, plus its name and postal and electronic address. Before placing the product on the market, it carries out an internal risk analysis and draws up technical documentation, which it keeps for 10 years.
In product data, these articles become a few design decisions.
Manufacturer And Responsible Person As Linked Records
Keep the manufacturer and the EU responsible person as separate records with their own addresses, and link products to them. Addresses typed into descriptions or free-text fields go out of sync across thousands of SKUs. With linked records, an importer that moves office changes one record, and every linked product carries the new address in the next export.
Identification That Matches The Physical Product
The type or model number online has to match the marking on the product. Store it as a dedicated attribute with a format rule. Then flag one image as the identification picture. A marketing team swapping the hero image should not be able to remove the only photo that shows the product clearly.
Warnings As Governed Text Blocks
Warnings take the most work. They depend on product class, age group, chemical content, and the language of each market. Store them as reusable text blocks linked to classifications, with one approved translation per language, and pull them into listings automatically. Warnings typed per SKU drift apart over time. A warning that appears on the box and is missing online fails Article 19 by itself.
If the law requires a field for a channel, publishing to that channel without it should be technically impossible.
Our customers turn to us with a familiar setup: importer addresses typed into long descriptions, and warnings copied by hand from packaging PDFs, in a slightly different version on each marketplace. In projects we implemented for manufacturers, the fix was plain. One manufacturer record, one responsible-person record, warning blocks per product class, and a channel export that stops when any of those links is empty. After that, a marketplace query about GPSR data gets answered with a filter.
Digital Product Passports: The Registry Is Live, Deadlines Follow Product Groups
The Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781, entered into force on 18 July 2024. It is a framework. The data each product group must carry comes from delegated acts, and those generally apply no earlier than 18 months after they enter into force. The Commission's working plan for 2025 to 2030 starts with iron and steel, then textiles, tyres, aluminium and furniture.
The infrastructure came first. On 20 July 2026, the Commission launched the DPP Registry together with a testing environment. Passport data stays decentralised, with the economic operator or a service provider acting for it. The registry receives the unique product identifier and associated metadata through a web interface or an API. Operators can request an electronic proof of registration to show B2B customers. The Commission also offers a free semantic repository with machine-readable data models and vocabulary. Six of the eight harmonised DPP standards are published, covering unique identifiers, interoperability, data carriers, APIs, data exchange protocols and data storage.
The same registry serves laws outside ESPR. The Battery Regulation (EU) 2023/1542 requires a passport from 18 February 2027 for industrial batteries above 2 kWh and for batteries used in electric vehicles and light means of transport. Each of those batteries gets its own passport. The Toy Safety Regulation (EU) 2025/2509, published on 12 December 2025, replaces the EU declaration of conformity for toys with a passport from 1 August 2030 and requires a back-up copy held by a DPP service provider. Construction products and detergents will register there as well.
The registry holds identifiers and metadata. Everything a customs officer or a recycler reads in the passport comes from your own data.
A PIM system covers the model-level part of a passport well. Material composition, substances of concern, recycled content, repair instructions, and safety documents are attributes or assets of a product model, and they need translations and approval like any other content. Item-level data works differently. A battery passport exists per battery, and values that vary by batch or unit come from production systems.
So most workable setups split the work. The PIM supplies model data, and ERP or MES supplies batch and serial data. A DPP platform, run in-house or by a service provider, combines both, hosts the passport and registers it through the registry API.
Timing is a real trade-off. Until the delegated act for a product group is adopted, its exact attribute list does not exist, so attributes modelled today may need restructuring later. But data such as recycled content or substances of concern often has to come from suppliers, and they need lead time to provide it. A practical middle path is to build the stable parts now: identifiers, data carriers, document links and a configurable attribute set per product group that can change without a software release. Use the semantic repository's vocabulary wherever it already covers your attributes.
Other EU Product Compliance Rules That Land In Product Data
- The Packaging and Packaging Waste Regulation (EU) 2025/40 has applied since 12 August 2026. Packaging now needs an EU declaration of conformity and technical documentation, and harmonised sorting labels follow from 12 August 2028 at the earliest. Model packaging as its own record, with material per component, linked to the products it holds.
- The Empowering Consumers Directive (EU) 2024/825 has applied since 27 September 2026. Generic claims such as "green" or "eco-friendly" are banned unless the trader can prove recognised excellent environmental performance. Search every marketing text in every language for such terms, and store each remaining claim with its evidence document and an approver.
- The Construction Products Regulation (EU) 2024/3110 has applied since 8 January 2026. It merges the declaration of performance and the declaration of conformity into one document, the DoPC, and leaves the passport date to a delegated act.
- The Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and allows instructions for use in digital form, with paper available on request. Instructions become versioned documents tied to models, and the access path given on the machine or its packaging has to keep working.
How PIM Software Supports Product Compliance
The setup below keeps product compliance data consistent across channels. It works for GPSR listings today and extends to passports later.
Classification Decides Which Rules Apply
A toy, a power bank, a lipstick, and a garden shredder carry different obligations. The product classification in the PIM should decide which compliance attributes are mandatory and which warning blocks and documents apply. Standard schemes help. ETIM covers electrical and building products, and GS1 GPC covers retail goods. Add the regulatory layer on top: a toy class pulls the toy warning set, and a battery class pulls the battery data set.
Keep legal reasoning out of the PIM. Store the outcome, such as "attribute required for class X in market Y", and keep the analysis behind it with the compliance team.
Completeness Rules Per Channel And Language
Measure completeness per channel and per language. A marketplace channel for Germany and Poland needs the GPSR set complete in German and Polish. A DPP channel needs the passport set. Validation rules catch format errors: an electronic address that is a valid email or URL, a postal address with a country code, an identification picture that exists, a warning translation with the status "approved". When a rule fails, the export to that channel stops.
Evidence Documents With Dates
Declarations of conformity, test reports, safety data sheets and claim certificates belong in the PIM's asset storage, linked to the products and attributes they support. Give each document its dates and the standard version it references. Two reports then carry most of the value: certificates that expire in the next 90 days, and products that reference a standard version that was just revised.
Field Ownership And Approval History
Field-level permissions keep warnings and claims with the compliance team, and marketing keeps the descriptions. Approval workflows route each new environmental claim to the person who signs it off for a market. Revision history answers the question authorities and marketplaces ask after an incident: what the listing showed on a given date.
In projects we implemented, ownership took longer to settle than the data model. Someone has to approve each warning translation and each claim per market, and that person needs edit rights on exactly those fields. In AtroPIM, for example, the data model is configurable, so a team can add a responsible-person entity and link it to products without custom development. Data quality rules can block a channel export, and the workflow and revision modules cover approval and history.
Output To Channels And Passports
One product record feeds several outputs: marketplace feeds with mapped GPSR fields, the brand's webshop, PDF data sheets and instructions, and an API for the DPP platform. Each marketplace gets its own mapping, because field names differ. When a recall comes, the same record shows which channels list the product and which variants are affected.
Where A PIM Stops
A PIM does not test products or interpret law. It does not replace production systems for serial-level data either. Accident reports under the GPSR go to the authorities through the Safety Business Gateway, and passport hosting with the required availability and backup copy usually sits with a DPP platform. Treat the PIM as the governed source of model data and the point that distributes it.
Product Compliance Preparation Steps For Data Teams
- List the rules that apply per product class and target market, with dates. That usually means the GPSR, the sector regulation, the PPWR for packaging, the Empowering Consumers Directive for marketing texts, and any passport duty.
- Turn each obligation into concrete attributes and documents, each with one owner, and have the compliance team sign off the mapping.
- Clean the shared records first: manufacturers, responsible persons, warning blocks, and packaging components.
- Define required attributes per channel and language, and block exports that fail them.
- Attach evidence with dates, and run the expiry report every month.
- Test one passport end to end in the Commission's registry testing environment, including registration through the API, before your first deadline.
- Document the recall path: who identifies the affected products and who pulls the listings on each channel.