Who is responsible for the Digital Product Passport?
Every EU online store is a 'dealer' under ESPR, and dealers have their own obligations. Here is what falls on you, what falls on your suppliers, and what you are legally entitled to demand from them.
The most common misconception about the Digital Product Passport, among retailers, is that it is somebody else's problem. The reasoning goes: the passport describes how a product was made, I did not make it, therefore it is the manufacturer's job.
That is half right, and the half that is wrong is expensive. ESPR assigns distinct duties to six categories of economic operator, and one of those categories — dealer — is defined in a way that captures every online store selling to EU consumers. Dealers have obligations that are theirs alone and that no manufacturer can discharge for them.
The six roles ESPR recognises
Article 2(46) defines "economic operator" as covering the manufacturer, the authorised representative, the importer, the distributor, the dealer and the fulfilment service provider. The duties sit in Chapter VII, Articles 27 to 38.
| Role | Core duty | Applies to you if… |
|---|---|---|
| Manufacturer Art. 27 |
Create the passport, hold a back-up copy with a service provider, run conformity assessment, keep technical documentation and the EU declaration of conformity, apply CE marking, retain documents 10 years, provide digital instructions for the expected lifetime and at least 10 years. | You make it — or you sell it under your own name or trademark, or you modify it in a way affecting compliance. |
| Importer Art. 29 |
Verify the manufacturer did its job before placing on the market, add your own details, supply your EORI number for the passport. | You bring goods into the EU from outside it. |
| Distributor Art. 30 |
Before making available: check conformity marking, check the product is labelled or linked to a passport, check documents and digital instructions are present in the right language, check manufacturer and importer identification duties were met. Answer authorities within 15 days. | You make products available on the market in the course of business — nearly every retailer. |
| Dealer Art. 31 |
Ensure customers and potential customers can access the accompanying information and the passport, including in distance selling. Display labels visibly, reference label information in advertising, and do not display marks likely to be confused with the regulated label. | You sell to end users. This is every EU e-commerce store. |
| Authorised representative Art. 28 |
Acts for a manufacturer under written mandate. | You have been formally appointed. |
| Fulfilment service provider Art. 33 |
Warehousing, packaging, addressing and dispatch must not jeopardise compliance. | You provide logistics for others. |
Most online retailers are two roles at once. You are a distributor (Article 30) because you make products available on the market, and a dealer (Article 31) because you sell to end users. Both sets of duties apply simultaneously. Neither is the manufacturer's to discharge for you.
Why "dealer" catches every online store
Article 2 defines a dealer as a distributor or any other person who offers products for sale, hire or hire purchase, or displays products, to end users in the course of a commercial activity — including through distance selling. The phrase is in the definition itself. There is no threshold, no exemption by size, and no way to structure around it if you sell to consumers.
Article 31(2) then says the dealer must ensure the passport is easily accessible for customers and potential customers, in accordance with Article 9(2)(e), including in distance selling.
The two words that matter are "potential customers". A potential customer is someone who has not bought yet. The passport therefore has to be reachable before the purchase decision — which, for an online store, means on the product page. A QR code on a box in a warehouse does not satisfy Article 31(2), because the potential customer cannot see it.
This is the obligation that converts the DPP from a supply-chain matter into a storefront project, and it is yours regardless of who authored the data.
What you can legally demand from suppliers
Retailers often assume they are at the mercy of suppliers for passport data. ESPR gives you two specific, enforceable levers, both with a five-working-day clock.
Article 10(3) — the data carrier
The economic operator placing the product on the market must provide dealers and online marketplace providers with a digital copy of the data carrier, or the unique product identifier, so they can make it accessible to customers who cannot physically access the product. Free of charge, and within five working days of the request.
That provision exists precisely for distance selling. It is the answer to "our supplier won't give us the QR asset".
Article 32 — labels
The same structure applies to labels: the operator placing the product on the market must supply dealers with printed labels or digital copies free of charge, within five working days of a request.
Put both in writing, cite the article, and keep the correspondence. A supplier who cannot meet a five-day statutory deadline in 2026 is telling you something useful about February 2027.
Three ways a retailer becomes the manufacturer
Article 34 is short and consequential. An importer or distributor is treated as the manufacturer, with all of Article 27's obligations, in two situations — and a third arises through importing.
1. You sell under your own brand
Placing a product on the market under your own name or trademark makes you the manufacturer for ESPR purposes. Private label, own brand, white label — the commercial vocabulary varies, the legal effect does not. You now owe conformity assessment, technical documentation, the EU declaration of conformity, CE marking where applicable, passport creation, the back-up copy with a service provider, and ten years of document retention.
This is a step change, not an incremental burden. Merchants who have built a private-label line as a margin play often have not priced this in.
2. You modify the product
Modifying a product already on the market, in a way that affects compliance with the applicable requirements, makes you the manufacturer of the modified product. Bundling is usually fine; reworking, rebuilding or altering specification is not.
3. You import it yourself
Importing does not technically make you the manufacturer, but Article 29 gives importers manufacturer-adjacent duties: verify compliance before placing on the market, add your details, supply your EORI number. In practice, if your supplier is outside the EU and no one else is bringing the goods in, the obligations land on you.
What your product listings must show
Article 36 covers distance selling specifically. Offers must clearly and visibly show:
- The manufacturer's name, trade name or trade mark, plus postal and electronic address.
- If the manufacturer is not established in the EU: the name, postal and electronic address and telephone number of the EU-established responsible operator under Article 4(2) of Regulation (EU) 2019/1020.
- Product identification information including a picture, the type, and any other identifier.
The second bullet is the one that catches dropshippers and direct importers. If you sell goods manufactured outside the EU and there is no EU-established responsible person for them, the product cannot lawfully be placed on the EU market. Someone has to be that person — and if your supply chain does not contain anyone else, it is you.
Article 36 also requires you, on reasoned request, to identify your suppliers and business customers with quantities and models, retained for ten years in each direction, and answered within 15 days.
If you also sell on marketplaces
Article 35 brings online marketplaces and search engines into the regime through the Digital Services Act. Marketplaces must cooperate with market surveillance authorities and maintain a single contact point for them. Authorities can order the removal of listings, and non-compliant listings count as illegal content under DSA Article 3(h).
For a merchant, the practical consequence is that a marketplace can and will delist you on an authority's instruction, without the process you might expect from a regulator acting against you directly. Marketplace enforcement will almost certainly arrive before national enforcement does.
The short version
| If you… | Then you… |
|---|---|
| Resell goods sourced within the EU | Must verify a passport exists and surface it on the product page before purchase. You do not have to create it. |
| Import from outside the EU | Carry importer duties: verify compliance, add your details and EORI, and ensure an EU responsible person exists. |
| Sell under your own brand | Are the manufacturer. Full Article 27 obligations, including creating the passport. |
| Substantially modify products | Are the manufacturer of the modified product. |
| Sell to EU consumers at all | Are a dealer. Article 31 applies no matter what else is true. |
Timing caveat. None of the passport obligations bite until a delegated act covers your specific product group. For most merchants the first real exposure is batteries on 18 February 2027. What is enforceable today is the unsold-goods regime, and for battery sellers the operator duties already in force since August 2024. Knowing your role now is preparation, not compliance — but it is the preparation that determines how large the eventual project is.
Questions
We only dropship. Who is responsible?
Does selling under our own brand really make us the manufacturer?
Our supplier says they'll handle everything. Is that enough?
What if we sell to both consumers and businesses?
How is any of this actually enforced against a small online shop?
Sources
Keep reading
What is a DPP
The concept, in plain language — what it contains, how it is reached, and the four things people wrongly assume it is.
DPP readiness checklist
Work through your catalogue in order: what is in scope, what data you are missing, and who has to give it to you.
DPP on product pages
The distance-selling rule makes the passport a storefront problem. Where to put it, and how to render it well.
Turn this into a plan for your catalogue
The readiness checklist walks your product groups one at a time and tells you what data to start collecting from suppliers now.