Digital Product Passports are a data capability test

The EU Digital Product Passport, DPP, is easy to underestimate because it sounds like a label. The European Commission DPP page describes a system for making product information digitally available across the value chain. The underlying regulation is the Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781.

The practical point is that DPP obligations arrive through product groups, delegated acts and sector rules. That makes the operational challenge harder than a single deadline. A business needs product data that is complete, current, governed and retrievable before the label format becomes the visible task.

For a UK exporter, the value of readiness is commercial. A buyer, distributor or EU market-surveillance authority may ask for information on composition, repairability, durability, recycled content, substances of concern, environmental performance or instructions. The company that can produce the data quickly will look easier to buy from.

The margin implication is less obvious but important. If product data is slow, the business pays twice: first in manual search time across engineering, procurement and compliance, then in slower customer responses when EU buyers compare suppliers. DPP readiness therefore protects sales velocity as well as regulatory standing.

Why we used a capability maturity model.

Capability maturity models are widely used in technology, process improvement and data governance. They assess how repeatable and reliable a capability is, from ad hoc activity to controlled, measured and continuously improved practice.

That fits DPP because the problem is maturity. The question is whether the information is complete, trusted and current enough to be used in a regulated digital product record.

What the maturity model shows.

Maturity level 1: scattered product evidence.

At this level, data exists in drawings, supplier PDFs, certificates, purchase files and individual inboxes. The company can answer questions, but only with manual effort. This is common and fragile.

Maturity level 2: a product master with missing evidence.

The business has a product master or ERP record, but sustainability, material and supplier evidence sit elsewhere. That can support internal planning, but it is weak for DPP because the passport needs connected evidence beyond part numbers.

Maturity level 3: controlled supplier and material data.

The business can identify which suppliers provide which evidence, how often it is refreshed and who approves it. This is where DPP becomes manageable. Procurement, product, quality and compliance are working from the same record.

The key test is whether a supplier change automatically creates a product-data review. If supplier evidence changes without triggering product, compliance and customer-data updates, the passport record will drift away from the real product.

Maturity level 4: customer-ready passport data.

The business can assemble the fields a customer or distributor needs, with source evidence and version control. The output may not yet be the final regulatory passport for every product group, but the data is ready to move into the required format.

Maturity level 5: governed and auditable product-data capability.

The business can show ownership, update cycles, evidence trails and exception handling. This level matters where product claims may be checked, challenged or reused across markets.

The management application.

The board should treat DPP as a product-data programme. The useful ownership map includes product management, procurement, quality, compliance, IT and sales. Each function owns part of the evidence chain.

The commercial question is which products would become harder to sell into the EU if a customer asked for passport-style data today.

That turns the roadmap into a prioritisation exercise. Start with the product families that combine EU revenue, material complexity, sustainability claims and distributor dependence. Those are the products where poor evidence will show up first in tenders, technical questions and customer-risk reviews.

What to do before the delegated act lands.

1. Identify EU-facing product groups and expected priority categories.
2. Build a DPP data inventory for each product: materials, suppliers, technical documents, sustainability claims and compliance certificates.
3. Mark each field as verified, available but unverified, missing, or owned by a supplier.
4. Assign a data owner and refresh cycle.
5. Test one product by assembling a customer-ready evidence file within five working days.
6. Create a gap plan for supplier data, substance declarations and product lifecycle information.

Red flags.

• Product data lives in engineering files that sales and compliance cannot access.
• Supplier certificates are stored without expiry dates or version control.
• Sustainability claims appear in sales material without a matching evidence file.
• IT owns the system but nobody owns the data quality.
• The business is waiting for the final rule before mapping data fields.

Torsik read.

DPP readiness is data maturity with a market-access consequence. The right question is simple: can the business assemble trusted product data before a customer, distributor or authority asks for it?

If the answer is slow, manual or dependent on one person, the passport work has already started.

Boundary. This is a commercial framework. Company-specific trade, tax, customs, regulatory, legal or financial treatment needs current official guidance, product codes, supplier evidence, customer terms and specialist review.