The passport standards

A passport is only useful if a customs officer in one country and a repairer in another can both open it and read the same thing. Standards make that possible, and for the Digital Product Passport they now exist. The European standards bodies, CEN and CENELEC, have published eight. The Commission has cited six of them in the Official Journal, through Implementing Decision (EU) 2026/1736 of 14 July 2026. Two more are published, as reported, and waiting for their citation. The count on 15 October 2026: eight published by CEN-CENELEC, six cited in the Official Journal, two awaiting citation.

The six cited standards

EN 18216 covers data exchange, how one system hands passport data to another. EN 18219 covers unique identifiers, the way a product, a batch or an item is named so that the name means the same thing everywhere. EN 18220 covers data carriers, the QR code, RFID tag or NFC chip that links the physical product to its passport. EN 18221 covers storage and persistence, how a passport is kept available over time. EN 18222 covers APIs and lifecycle, the interfaces through which a passport is handled over its life. EN 18223 covers interoperability, the rules that make all of the above work together. Whether a standard is cited in the Official Journal or only published is the status to ask a provider about.

The two awaiting citation

EN 18239 covers access rights, security and confidentiality: who may read which part of a passport, and how that is enforced. EN 18246 covers authentication, reliability and integrity: how a reader knows the passport is genuine and has not been altered. Both are reported as published by CEN-CENELEC on 16 September 2026. The Commission decision that would cite them was listed for September 2026 and had not been published by 12 October 2026. Until it is, they are published standards awaiting citation. They remain useful, and a provider should describe them as published rather than cited.

Six cited, two waiting. A provider that says all eight are cited is ahead of the Official Journal.

Questions for your provider

There is no need to read these standards yourself. They are written for the people who build passports, the way payment standards are written for the people who build card terminals. For a brand, they are a set of questions to put to a provider. Whoever hosts your passport should be able to list the standards they follow, one by one, and to show a passport being opened by a system that is not theirs. If the answer is a certification logo with no detail behind it, ask for the detail. The question to put first is whether you could change provider without reprinting the codes on your products, and the answer should name the standards the provider relies on to make that possible.

The standards in practice

The identifier standard, EN 18219, is the one our own identifiers answer to. We build a passport on the GTIN your brand licenses, with a serial number for an item or a lot number for a batch, and GTIN, SGTIN or batch explains which to use. That is our method; neither the standard nor the law imposes it. The care label and the RFID tag are data carriers, the subject of EN 18220. The storage standard sits behind the Registry's design: the Registry is an index that records where a passport can be reached, and the passport itself is hosted by the company or a DPP service provider. The access-rights standard, EN 18239, covers who may read which part of a passport. The consumer, partner and regulator views in Passport access are how we build access; neither that standard nor the law requires it.