Digital Product Passports and Chinese suppliers: what the EU requires, and what China now restricts

What actually changed in 2026

The Digital Product Passport has been discussed as a future problem since the Ecodesign for Sustainable Products Regulation — Regulation (EU) 2024/1781, the ESPR — entered into force on 18 July 2024. This year it stopped being future.

Article 13 of the ESPR obliged the Commission to stand up a central DPP registry within 24 months, that is by 19 July 2026. It opened on 20 July 2026, and Commission Implementing Regulation (EU) 2026/1778 — adopted 16 July, in force 6 August 2026 — now governs how it runs.

It is worth being precise about what the registry is, because a good deal of vendor marketing is not. It is a directory, not a database of your product data. You register a unique product identifier, resolved through a data carrier on the product — in practice a GS1 Digital Link URL behind a QR code — and the registry returns the location where the passport itself is hosted, by the manufacturer or its service provider. Market surveillance authorities query it; for imported goods, the Commission’s own guidance says this can be checked at customs.

Who owes what

The ESPR splits the duty, and the split is the part most buyers get wrong. The passport is not something an importer fills in.

What applies, and when

Only one date is legally binding. Everything else is an indicative date from the ESPR Working Plan 2025–2030, adopted 16 April 2025, and depends on a delegated act that has not been adopted. Under the ESPR a delegated act cannot apply earlier than 18 months after it enters into force, which is why the gap between “rule written” and “rule bites” is consistently about two years.

A mid-term review of the working plan is scheduled for 2028 and the Commission may move groups or add them. Treat the rows below the first as planning assumptions, not deadlines — and treat anything you read online that gives a confident 2027 date for textiles as out of date.

The China-side rule nobody priced in

On 31 March 2026, the State Council’s Provisions on the Security of Industrial and Supply Chains — Decree 834 — took effect, immediately, with no transition period and no implementing guidance. Article 13 addresses unlawful investigation and information-gathering on Chinese industrial and supply chains by foreign entities. No approval route or licensing pathway has been published. Article 16 backs the framework with countermeasures that can extend to import and export restrictions, data-related restrictions, and entry and residence restrictions. A companion instrument, Decree 835 on countering unjustified extraterritorial jurisdiction, took effect on 7 April 2026.

This is not a dormant framework. On 15 May 2026 the Ministry of Justice, with MOFCOM, determined that the EU’s Foreign Subsidies Regulation investigation into a Chinese security-technology company amounted to improper extraterritorial jurisdiction, and directed that no organisation or individual assist it. On 20 August 2026 it reached the same conclusion on the EU’s review of JD.com’s bid for Ceconomy.

Set those decisions beside a passport data request and the shape of the problem is visible. An EU rule will require granular production data out of a Chinese factory. A Chinese rule constrains foreign parties gathering supply-chain information in China, and gives Beijing a mechanism to direct refusal. Neither instrument acknowledges the other, and no guidance reconciles them.

How to ask a Chinese supplier for passport data

Nothing here is exotic. It is the difference between a request that reads as a purchase term and one that reads as an investigation.

• Put it in the purchase contract, not in a questionnaire. A supplier disclosing its own data under an agreed clause is doing something legally different from a foreign buyer running an enquiry. Build the passport fields into the specification and the annexes, alongside the ones about tolerances and packaging.
• Ask for the declared values, not the underlying process data. A passport needs figures — recycled content, carbon footprint, material composition. It does not need the factory’s process records. Asking for those invites both a trade-secret refusal and a Decree 834 question you did not need to raise.
• Attach the data to the right legal entity. Passport declarations have to sit with the actual manufacturer. Check the Unified Social Credit Code and the registered business scope on the national registry: if the company you are buying from is registered for wholesale rather than manufacturing, its declarations will not survive scrutiny. See is my supplier a factory or a trading company?
• Get written consent for anything on site. A consented, documented visit is a different act from an unannounced enquiry, and the consent is worth having on file for both jurisdictions. See can I legally audit my Chinese supplier?
• Leave personal data alone. Worker-level information engages PIPL and belongs in no product passport. There is no version of this exercise that requires it.
• Record refusals rather than papering over them. A documented refusal is a finding, and a defensible one. An estimate presented as a measurement is neither.
• Sequence by exposure. Batteries first, because the date is real. Then steel and textiles, because those are where both the EU delegated acts and the Chinese pilots are concentrated.

What getting it wrong costs

The ESPR and the Batteries Regulation both leave penalties to member states, on the familiar test that they be effective, proportionate and dissuasive. Neither sets an EU-level ceiling, so the number depends on where the goods land. Italy has already legislated: Legislative Decree No. 29 of 2026, in force 10 February 2026, implements the Batteries Regulation with fines reaching €150,000. Other member states are still drafting, and figures circulating for particular countries should be checked against the national text rather than a summary.

The fine is rarely the real exposure. Without a compliant passport for a covered product, the goods may not lawfully be placed on the EU market at all, and for imports that can be checked at the border. A held container costs a season; a fine costs money.

There is no enforcement precedent to reason from, because no DPP obligation is yet in application anywhere in the EU. That is a statement about the calendar, not about how strictly this will be policed from February 2027 onwards.

China is building its own passport system

China has no law requiring a digital product passport for imports, and none is drafted. What exists is a standards trajectory, and it is moving quickly:

• April 2025 — the China Academy of Information and Communications Technology (CAICT) published a national DPP roadmap proposing a three-tier structure: a national registry, industry registries, and enterprise-level systems. Its stated purpose is to lower green trade barriers for Chinese exporters while keeping cross-border data secure.
• 27 March 2026 — the first National Standardization Working Group for Digital Product Passports (SAC/SWG 41) held its inaugural session in Beijing. The secretariat is hosted by GS1 China, which is also the Chinese mirror committee for the ISO/IEC JTC 5 work on passports.
• Pilots are concentrated in batteries and steel, with textiles expected to follow — the same three sectors the EU is starting with.

The practical read: identifiers are likely to interoperate, because GS1 sits on both sides. The data behind them may not. China’s design assumes sensitive supply-chain data stays in China, which points toward an interface that answers questions rather than a pipe that exports records. For a buyer, that is not necessarily worse — a verified answer is what a passport needs. It does mean the “just get the spreadsheet” approach has a shelf life.

Quick FAQ

Do I need a Digital Product Passport right now?

Almost certainly not. As of August 2026, no product group’s DPP obligation is in application. Batteries are first, on 18 February 2027. Everything else waits on a delegated act that has not been adopted, and cannot apply earlier than 18 months after that act enters into force.

Who creates the passport — me or my Chinese supplier?

The manufacturer creates it and keeps it accurate. Where a Chinese factory makes the goods, that is their duty. Yours, as importer, is to verify a compliant passport exists before placing the goods on the market and to keep the documentation for ten years. You cannot contract that verification away, and an authorised representative cannot assume the creation duty on the manufacturer’s behalf.

What if I sell under my own brand?

Then you are likely the manufacturer for ESPR purposes, and the passport is your obligation rather than the factory’s. This catches private-label importers and marketplace sellers routinely, because commercially the factory feels like the manufacturer.

Does China require a passport for goods imported into China?

No. There is a CAICT roadmap from April 2025, a national standardisation working group since 27 March 2026, and pilots in batteries and steel. None of it is mandatory. Chinese customers may nonetheless start asking for provenance and emissions data under domestic green-supply-chain policy, which is a commercial requirement rather than a legal one.

Is it now illegal to ask a Chinese supplier for supply-chain data?

No. A supplier disclosing its own information under a commercial contract is ordinary trade. Article 13 of Decree 834 is directed at unlawful investigation and information-gathering by foreign entities in China. Because the boundary is undefined in published guidance, contractual disclosure and consented, documented visits are the lower-risk route. Take Chinese counsel before running a data-collection programme at scale.

Do the UK or the United States require a DPP?

Neither has a mandatory national regime. The obligation attaches to goods placed on the EU market, so a UK or US business selling into the EU is caught by the EU rule regardless of where it is established — and a business that never sells into the EU may still be asked for passport-grade data by a customer who does.

What is the single thing worth doing this quarter?

Find out which of your products would be covered first, and which legal entity in China actually manufactures them. Almost every passport problem downstream is a version of not knowing the second answer.