Digital Product Passport: documentary evidence and implementation

CBAM, EUDR and the Digital Product Passport are different legal systems and do not rely on identical data. But they raise many of the same practical questions: who or what the data refers to, where it came from, how it changed, whether sources conflict, and whether the record can still be understood later.

In July 2026 the Commission published six harmonised DPP standards, adopted the implementing arrangements for the DPP Registry and launched the Registry and testing environment on 20 July. These measures make identifiers, interoperability, storage and persistence practical implementation questions.

Product → unique identifier → responsible economic operator → required data field → source system or supplier → source evidence → version → passport data.

A document can be genuine and still fail to prove the point it is being used for. The review therefore tests the links between product and supplier, supplier and producer, producer and installation, reported value and source record, and the current file and earlier versions.

Regulatory files are often revisited long after the original work is finished. Preserving what was received, what changed, what was corrected and what was relied on makes later internal review, professional advice, verification or authority scrutiny much easier.

Regulatory data may come from suppliers, manufacturers, installations, commercial intermediaries, ERP systems, monitoring systems, declarations, certificates and external records. The review asks where the information came from, who produced it, what it relates to, which period and version apply, and whether the different records agree.

The six harmonised standards published in July 2026 address complementary parts of the passport infrastructure: data exchange protocols, unique identifiers, data carriers, data storage/archiving/persistence, APIs for lifecycle management and searchability, and system interoperability. The Registry implementing regulation adds operational rules for registration and access. Together they strengthen the technical chain, but product-specific data requirements still depend on the applicable delegated act or product legislation.

The ESPR does not create one universal passport data set for every product on the same date. Product-specific information requirements arise through the applicable delegated acts or other product legislation, so generic templates should not be presented as final requirements where product rules are not yet adopted.

CBAM is Weetra’s main operational service today. EUDR and DPP are developing areas of regulatory evidence work and are not presented as equivalent commercial services.