Choosing a DPP Provider: The Decisions the Demo Never Shows

In August, a Norwegian manufacturer asked us a question we want every buyer to ask: what happens to our product passports if you go bankrupt, and then we do too?

It is the best question we have heard all year. Not because it is dramatic, but because it treats the passport as what it is: a commitment that outlives software contracts. A Digital Product Passport (DPP) is attached to physical products that will sit in buildings, wardrobes and machines for decades. For construction products, EU rules require the passport system to stay available for 25 years after the last product of a type is placed on the market.

Most provider evaluations never get near that question. They compare demos. And a demo is genuinely useful for judging the things that are easy to change later: the interface, the workflow, the reports. The problem is that the decisions that actually cost you are the ones a demo cannot show, because they only surface years after you sign. Here are the five we see buyers miss.

Pitfall 1: Nobody asks who owns what gets printed

The moment a QR code is printed on a product, three things are frozen for the life of that product: the identifier in the code, the domain it points to, and the structure of the link path. Everything else about your DPP setup can be changed later. These three cannot, short of reprinting every label in the field.

So the ownership questions come first. Are the product identifiers yours, or minted in a scheme only the provider controls? Does the printed code carry a domain you own, pointed at the provider with a DNS setting you can repoint, or the provider’s own domain? And is the link path built from your identifiers in standard syntax, or from the provider’s internal database IDs, which no successor can ever serve?

We have covered this layer in depth before, in The QR Code Is Not the Passport and The EU DPP Registry: What It Actually Stores. The short version: a provider can score full marks on standards conformance and still lock you in through the domain and the path. Portability is a separate property, and you have to ask for it separately.

Pitfall 2: “The EU registry takes care of that”

Back to the bankruptcy question, because the reassuring answer you will hear is wrong in an instructive way.

The EU’s central registry, opened in July 2026 and so far running as a test environment, is a directory. It stores identifiers and pointers, never the passport content. When you register a passport, the registry also verifies a link to a backup copy of that passport. That backup is a real legal requirement: the operator placing the product on the market must make a backup copy available through an independent third party, precisely so the passport survives a failed provider or a failed manufacturer.

Here is what the reassuring version skips. The registry verifies that the backup link exists. It does not redirect anyone to it automatically. If your provider disappears and your printed codes point at that provider’s domain, the codes are dead even though the backup exists, findable only by an authority that goes looking in the registry.

And one more thing the market does not like to say out loud: the EU’s certification rules for DPP service providers, including backup providers, are only expected in 2027. Until they land, nobody can call themselves a certified DPP service provider. Today, a credible backup answer is a contractual one: a named independent party, a mirrored copy, the backup link registered from day one, and printed codes on a domain that can be repointed to the backup. A provider who answers “we are certified for that” is describing a certificate that does not exist yet.

Pitfall 3: “We take care of compliance for you”

This is the most common promise in the market, and it overreaches twice.

First, legally: the compliance responsibility sits with the economic operator placing the product on the market. That is you, typically as the manufacturer or the importer. A provider can carry a great deal of the work, and should, but a provider who claims to take the responsibility away is promising something the regulation does not allow them to hold.

Second, in scope. A delegated act under the EU’s Ecodesign Regulation (ESPR) typically carries three kinds of measures for a product group: information requirements, performance requirements such as minimum thresholds, and the passport. A passport platform delivers the third. A minimum threshold on embodied carbon can stop your product being placed on the market at all, and no passport, however polished, addresses it. When a provider says “compliance”, make them say which of the three they mean.

The same precision applies to standards claims. Six European DPP standards were cited in the Official Journal in July 2026, and building on them is exactly what you should demand. But those standards define how a passport is identified, carried, exchanged and kept available. What your passport must contain comes from the rules for your product category. For batteries that content is already fixed, and in the EU Battery Regulation rather than an ESPR delegated act; for most other categories it is still landing. A provider selling a “fully compliant textile passport” today is, as we wrote in our mid-2026 status assessment, describing a destination rather than a specification.

Pitfall 4: The price that scales with your serial numbers

Passport pricing looks simple at model level: a few hundred products, a subscription, done.

Then granularity arrives. Batteries go first: from February 2027, EV batteries, industrial batteries above 2 kWh and light-transport batteries need a passport per individual unit. Other categories will land on batch level or item level depending on the delegated act and on what your customers demand. At item level, one product line becomes thousands or millions of passport records. Per-passport and per-scan pricing that looked cheap at model grain gets multiplied by your production volume.

So ask the question in the demo, with your volumes: what does this cost at batch level, and at item level?

Then ask the reverse question, because the trap has two sides: is item level right for your products, or is it being sold to you? And keep the two bills apart. The platform’s price is one of them. The other is your own production line: collecting item-level data at all means marking and tracking every single unit, and in the consultation on the proposed iron and steel passport, industry put that internal retrofit at around EUR 100,000 or more per production site, for bulk products where batch-level data would carry the same information. A provider that pushes item level is pushing you into both bills. Granularity should follow how your data actually varies, not the provider’s revenue model, and not regulatory ambition either.

Pitfall 5: A passport is a living document, and someone has to live with it

The regulation requires passport data to be accurate, complete and up to date. That sentence hides an operating model.

Environmental declarations expire: an EPD (environmental product declaration) is typically valid for five years. Suppliers change. Certificates lapse. And the rules themselves keep moving: new delegated acts will add fields, and fields will move between public and restricted after you have configured them. A passport platform is not something a provider builds once and hosts; it is something someone maintains against a moving target for as long as your products exist.

So ask who does that work. When a delegated act adds a field for your category, is that configuration you can do yourself, or a change request on the provider’s roadmap? Is regulatory tracking included in the price, or billed as projects? What flags a stale EPD before an auditor does? A provider with a one-time implementation price and no update commitment has answered the question, just not in words.

The exit test

If you only have time for one probe beyond the demo, use the question that started this article. Ask what happens when you leave, and what happens if the provider fails, and listen for structure: export in an open format, identifiers that are yours, a printed domain you can repoint, a named independent backup, a registry entry that moves with you.

Then calibrate your expectations honestly, because this market is young. The core standards were only cited in July, the registry opened the same month and is still in its test phase, sector rules are still arriving, and provider certification does not exist yet. Some checklist questions have no finished answer from anyone today, including us. That is fine.

The red flag is not the provider who says “not yet” and shows you a build status.
The red flag is the one with a confident yes for everything.

The demo shows you year one. The questions above show you year eleven. Both matter, but only one of them is expensive to get wrong.

FAQ

Want to put these questions to a provider in practice? Put them to us first. We will answer them for your products, including the ones where our honest answer is a build status rather than a finished feature. Book a demo.