DPP standards: all eight EN standards are now published, and what changes

What just changed

The joint technical committee CEN/CLC/JTC 24, in charge of the Digital Product Passport, published its last two standards on 16 September 2026. The official CEN catalogue lists both with that publication date, closing a process that started earlier this year.

The references are:

• EN 18239:2026 — Digital product passport – Access rights management, information system security, and business confidentiality
• EN 18246:2026 — Digital product passport – Data authentication, reliability and integrity

They join the six standards published on 27 May 2026. The set of eight horizontal standards is now complete, two years after the Commission's standardisation request.

The eight horizontal DPP standards

Who writes these standards, and under what mandate

These documents do not appear out of nowhere. The Commission addressed a standardisation request to CEN, Cenelec and ETSI through Implementing Decision C(2024) 5423 of 31 July 2024, amended by Decision C(2025) 8024 of 28 November 2025 to adjust the legal basis and the deadlines. CEN/CLC/JTC 24, whose secretariat is held by the German Institute for Standardization (DIN), runs the work.

The legal framework is the ESPR, Regulation (EU) 2024/1781 of 13 June 2024, in force since 18 July 2024. Articles 10 and 11 set out the requirements for the passport: content, access, identification, data security.

What the publication actually changes

Until a standard is published, it does not exist as a reference document. You cannot lean on it, neither with a customer nor before a market surveillance authority. The two standards published on 16 September cover precisely the layer that had no published normative reference until now:

• Who accesses what. EN 18239 structures rights management per type of actor, the separation between public data and commercially confidential data, and the transfer of responsibility between economic operators
• What proves the data has not been altered. EN 18246 covers authentication, reliability and integrity, built around electronically signed data and an audit trail

If you are designing or selecting a passport platform today, these are the two documents to read before locking in an access architecture. Retrofitting them later costs far more than getting the initial design right.

The next step: citation in the Official Journal

The legal effect of these standards depends on a separate act. The Commission adopted Implementing Decision (EU) 2026/1736 on 14 July 2026, published in the Official Journal on 15 July 2026, citing the references of the first six standards. From that publication, a passport conforming to those standards is presumed to conform to the requirements of Articles 10 and 11 of the ESPR, to the extent each standard covers them.

The two standards published on 16 September are not in that decision. The Commission's own timeline places an implementing decision for the remaining standards in September 2026; as of the date of this article, its publication has not been observed. That is the deadline to watch closely, because it conditions any defensible use of those two texts during a market surveillance check.

What it means for your DPP project

Three practical consequences, in order:

1. The technical layer of the passport is now framed. Data exchange, identifiers, carriers, storage, APIs, interoperability, access rights, integrity: every building block has a reference document. You can justify your design choices, which was difficult six months ago
2. The obligation itself has not moved. No sectoral delegated act for textiles, furniture or steel is in force. The Commission's public timeline announces iron and steel plus battery access rights in the fourth quarter of 2026, and textiles, aluminium and tyres across the third and fourth quarters of 2027. After each delegated act, economic operators get at least 18 months of transition
3. The first hard date remains 2027. The battery passport becomes mandatory on 18 February 2027 for electric vehicle batteries, light means of transport batteries and industrial batteries above 2 kWh, under Article 77 of the Batteries Regulation (EU) 2023/1542. See our battery DPP page and our article on the 2027 obligation

Key takeaways

The Digital Product Passport now has a published normative backbone, which was the technical precondition for its rollout. But nothing is mandatory yet for most sectors: the machinery remains that of delegated acts, product group by product group, with transition periods that are short on an industrial scale. The sensible approach is to check your architecture against the two security standards now, and to treat the Official Journal citation as the real signal that things are about to shift.

Want to know where you stand before the deadlines tighten? DPPify supports manufacturers from the data audit through to publishing compliant QR codes.

Sources

• European Commission, Implementing Decision (EU) 2026/1736 of 14 July 2026, OJ L, 2026/1736, 15.7.2026
• CEN-CENELEC, published standards of CEN/CLC/JTC 24, catalogue consulted on 21 September 2026
• Regulation (EU) 2024/1781 (ESPR), in particular Articles 10, 11, 41 and 80
• Regulation (EU) 2023/1542 on batteries, Article 77
• European Commission, official Digital Product Passport page, indicative timeline consulted on 21 September 2026
• CEN-CENELEC, Digital Product Passport, the cornerstone for the implementation of sustainability and circularity, 15 July 2026