Aller au contenu principal
← Resources/Choosing a DPP infrastructure
Evaluation guide

How to choose a Digital Product Passport infrastructure

The Digital Product Passport (DPP) is becoming mandatory in Europe, category by category, on a timeline that is already underway. Choosing a provider is not just another software purchase: it commits your product data, your compliance and the persistence of these passports for ten to fifteen years. Better ask the right questions before you sign.

In brief

Choosing a DPP provider commits your product data, your compliance and the persistence of passports for ten to fifteen years — this is not just another software purchase. Five criteria are enough to separate a durable infrastructure from a disposable compliance tool: data openness, multi-sector coverage, production track record, compliance crossed with business value, and data security/sovereignty. An infrastructure that is open, multi-sector and already proven in production protects your investment far beyond any supplier contract.

The timeline that makes the decision urgent

Three texts govern the market and set the tempo.

The ESPR — Regulation (EU) 2024/1781, which entered into force on 18 July 2024 — establishes the Digital Product Passport as the central mechanism for the traceability of products placed on the European market. Two deadlines structure what follows:

  • •19 July 2026 — Article 13 of the ESPR requires the Commission to set up a central digital registry of unique DPP identifiers.
  • •18 February 2027 — Article 77 of Regulation (EU) 2023/1542 makes the battery passport mandatory for LMT batteries, industrial batteries above 2 kWh and electric vehicle batteries.

On the technical side, the CEN-CENELEC JTC 24 committee published, on 27 May 2026, six of the eight European standards (EN) that define the "how" of the DPP — identifiers, data carriers, storage and persistence, APIs, interoperability, exchange protocols. A useful nuance to avoid being sold hot air: a published standard does not confer "presumption of conformity" until it is cited in the Official Journal of the European Union under the ESPR.

Five criteria to evaluate a DPP infrastructure

1. Open or closed?

The questions to ask: is your data portable? Is the protocol auditable and built on open standards (W3C, GS1)? Can you switch operators without losing the product's history? Does the passport's identifier survive the disappearance of the issuer?

Why it matters: a DPP must live far longer than any supplier contract. A proprietary platform creates a ratchet effect — you are locked in to the operator. A closed consortium creates a dependency on membership. By contrast, the JTC 24 standards validate an open-network approach, with decentralised identifiers and data that persists beyond the issuer. It is the most structuring axis.

2. Multi-sector or single-vertical?

A tool designed for fashion alone will not cover your batteries, your home appliances or your WEEE obligations. Yet the ESPR is transversal and obligations stack up. The question: does the infrastructure cover several product categories on the same foundation, or will you have to stack one tool per vertical and per regulation?

3. In production or a promise?

Ask for figures: how many passports actually in production, for which named brands, since when, across how many markets? The difference between a proven track record and a "ready for 2027" promise is measured in years of operation, not in slides.

4. Compliance alone or compliance × business value?

The DPP can be sold as a box to tick, or as an asset. A single passport can answer several frameworks simultaneously — ESPR, battery passport, WEEE, AGEC — instead of one tool per obligation: one euro invested then covers three to five regulations, not just one. And DPP data unlocks revenue: direct customer relationship, digital warranty, authenticated resale, first-party traceability. A provider that only talks about reporting leaves this value on the table.

5. Security, archiving and data sovereignty

The fundamentals people forget to check: SOC 2 certification, legally admissible archiving (NF Z42-013), GDPR compliance, hosting location, and above all data governance — who controls, who can read, who can revoke. A DPP is regulatory data; it should be treated as such.

Where Arianee stands

On these five criteria, Arianee holds a rare position. Open: a decentralised protocol built on W3C/GS1 standards, data that is portable and sovereign with the brand, governance through a non-profit association — no silo, no possible buyout of the infrastructure. Multi-sector: EEE/retail, luxury, textile, batteries, industry and reuse on the same foundation. In production since 2018, not since the announcement of the ESPR: 3.4M+ passports deployed, 50+ brands, 40+ markets — from retail/EEE (Fnac Darty via the Ecosystem producer responsibility organisation) to watchmaking (Breitling, Panerai) and fashion (Lacoste, Mugler). Compliance × value: a single DPP covers several regulations and powers the customer relationship, the warranty and resale. Fundamentals in place: SOC 2 Type II, GS1 partner, legally admissible archiving via Arkhineo (Docaposte).

External recognition: Arianee is one of only two providers ranked as "Market Leaders" by ABI Research (August 2024) — and the only one of the two built on an open infrastructure.

The rest is just reporting.

Sources

Frequently asked questions

How do you evaluate a DPP provider?
Five criteria are enough to separate a durable infrastructure from a disposable compliance tool. 1) Openness: is your data portable, is the protocol built on open standards (W3C, GS1), can you switch operators without losing the product's history? 2) Multi-sector coverage: does the infrastructure handle several product categories on a single foundation, or do you have to stack one tool per vertical and per regulation? 3) Track record: how many passports actually in production, for which brands, since when, across how many markets? 4) Compliance crossed with business value: does a single passport answer several frameworks (ESPR, battery, WEEE, AGEC) and unlock revenue (customer relationship, warranty, resale)? 5) Security and sovereignty fundamentals: SOC 2 certification, legally admissible archiving, GDPR, hosting location and data governance. The choice commits your product data, your compliance and the persistence of passports for ten to fifteen years.
Should you choose an open or closed DPP infrastructure?
A DPP must live far longer than any supplier contract. A proprietary platform creates a ratchet effect: you become locked in to the operator. A closed consortium creates a dependency on membership. An open infrastructure, built on W3C and GS1 standards with decentralised identifiers and data that persists beyond the issuer, guarantees data portability and the survival of the passport even if the issuer disappears. The standards from the CEN-CENELEC JTC 24 committee validate this open-network approach. It is the most structuring axis of the decision: ask the questions of data portability, protocol auditability and the ability to switch operators without losing history.
Is a single-sector DPP solution enough?
Rarely. A tool designed for fashion alone will not cover your batteries, your home appliances or your WEEE obligations. Yet the ESPR (Regulation (EU) 2024/1781) is transversal and regulatory obligations stack up. The right question to ask: does the infrastructure cover several product categories on the same technical foundation, or will you have to stack one tool per vertical and per regulation? A multi-sector infrastructure avoids the proliferation of providers and integrations as obligations extend to new product categories.
How do you verify that a DPP solution is proven?
Ask for figures, not slides: how many passports actually in production, for which named brands, since when, and across how many markets? The difference between a proven track record and a "ready for 2027" promise is measured in years of operation. A solution deployed at scale for several years — for example several million active passports, dozens of brands and dozens of markets — provides operational proof that a roadmap cannot replace.
What security and sovereignty criteria apply to a DPP?
A DPP is regulatory data and should be treated as such. The fundamentals to check: SOC 2 certification, legally admissible archiving (NF Z42-013 standard), GDPR compliance, hosting location, and above all data governance — who controls, who can read, who can revoke. Data sovereignty — the fact that the brand remains the owner of its product data rather than a third-party operator — is decisive for an asset expected to last ten to fifteen years.
Does a published DPP standard confer presumption of conformity?
No. On 27 May 2026, the CEN-CENELEC JTC 24 committee published six of the eight European standards (EN) that define the "how" of the DPP — identifiers, data carriers, storage and persistence, APIs, interoperability, exchange protocols. But a published standard does not confer "presumption of conformity" until it is cited in the Official Journal of the European Union under the ESPR. This is a useful nuance to avoid being sold a compliance that is not yet legally established.

Assess your DPP infrastructure with our experts

Test your project against the five criteria and see where an open, multi-sector infrastructure that is already in production stands.

Request a demo