Digital product passport: the security standards slip to November 2026
The last two digital product passport standards, EN 18239 on access rights and EN 18246 on authenticity, are published but not yet cited in the Official Journal. The Commission now dates that decision to November 2026, three months before the battery passport becomes mandatory.
Two standards out of eight are missing
The digital product passport rests on eight European standards prepared by technical committee CEN-CENELEC JTC 24. Implementing Decision (EU) 2026/1736, adopted on 14 July 2026 and published in the Official Journal the next day, cites six of them.
| Standard | Subject | Cited in the OJ |
|---|---|---|
| EN 18216:2026 | Data exchange protocols | Yes |
| EN 18219:2026 | Unique identifiers | Yes |
| EN 18220:2026 | Data carriers | Yes |
| EN 18221:2026 | Data storage, archiving and persistence | Yes |
| EN 18222:2026 | APIs for lifecycle management | Yes |
| EN 18223:2026 | System interoperability | Yes |
| EN 18239:2026 | Access rights, information system security, business confidentiality | No |
| EN 18246:2026 | Data authentication, reliability and integrity | No |
The last two are not drafts. They are approved and published; EN 18246 was approved by CEN on 17 August 2026. What they lack is not technical quality, it is the citation in the Official Journal.
Why publishing a standard is not enough
European law separates two moments. CEN publishes the standard, then the Commission publishes its reference in the Official Journal. The second step is the one that triggers the presumption of conformity.
Decision 2026/1736 says so in its first recital: a passport that conforms to harmonised standards whose references have been published in the Official Journal is presumed to conform with the requirements of Articles 10 and 11 of Regulation (EU) 2024/1781, within the limits covered by those standards. The decision entered into force on the day of publication, 15 July 2026, and that date is what counts for the first six.
For the other two, the mechanism is not armed yet. A company can apply EN 18239 and EN 18246 today, and in fact should, but it cannot rely on them to claim conformity. If an inspection looks at access security or data integrity, the burden of demonstration stays with the company, without the safety net of presumption.
What those two standards actually require
They are not administrative documents. They describe mechanisms every passport platform will need.
EN 18239, access rights. The standard separates public data from controlled data, and attaches rights to the data element, not to the whole document. Two people can therefore read the same passport and not see the same fields. It requires every actor in the system to carry a globally unique operator identifier, access to be authenticated and authorised, access decisions to be traceable, and roles to be granted, changed, suspended, renewed or revoked. It also asks for measures against mass scraping and against discrimination based on location.
EN 18246, authenticity. The standard requires data integrity and authenticity to be verifiable free of charge, without limits for the verifier, and the mechanisms used to be independent from the communication channel. Every creation, change or deletion must be bound to the authenticated actor, with non-repudiation and auditable logging over time. In practice, a passport must be able to show who changed what, when, and under which credential.
The official timeline as displayed
The Commission's indicative timeline, consulted on 30 October 2026, lists:
- 1 July 2026: DPP registry framework and the decision on the first six standards.
- 20 July 2026: the DPP registry becomes operational.
- November 2026: implementing decision on the last two standards.
- Fourth quarter 2026: delegated act for iron and steel, and implementing act on battery passport access rights.
- 18 February 2027: passport mandatory for certain batteries, electric vehicles, light means of transport and industrial batteries.
- Second quarter 2027: construction products and DPP service providers.
- Third and fourth quarter 2027: textiles, aluminium and tyres.
- 2028 and 2029: furniture, mattresses, recycled content.
The same page recalls that economic operators get at least eighteen months of transition after the adoption of ESPR delegated acts. That delay does not apply to the battery passport, whose date is set by the Regulation itself.
What to do now
1. Do not wait for the citation to prepare. The requirements of both standards are known and stable. A tamper-proof access log, verifiable signatures and field-level rights take weeks to design, not days.
2. Do not confuse conformity with presumption. You can be technically ahead and still unable to claim the presumption. Say so clearly to your customers; it is stronger than a claim the first inspection will contradict.
3. Keep the two tracks separate in your roadmap. Access security is a product architecture matter, the Official Journal citation is a regulatory calendar matter. Neither depends on the other, and neither blocks the other.
To place your product in the timeline, the DPP scope checker gives the applicable date and legal basis in three questions. For the data required for batteries, the dedicated page details the deadlines.
Sources
- European Commission, Digital Product Passport, official page and indicative timeline, consulted on 30 October 2026
- Commission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports, OJ L, 2026/1736, 15.7.2026, recital 1 and annex
- CEN-CENELEC JTC 24, EN 18239:2026, Digital product passport, Access rights management, information system security, and business confidentiality
- CEN-CENELEC JTC 24, EN 18246:2026, Digital product passport, Data authentication, reliability and integrity, approved by CEN on 17 August 2026
- Regulation (EU) 2024/1781, Articles 10 and 11