Iron and Steel: What the ESPR Product Passport Will Require

Iron and steel is the first product group to get a digital product passport through an ESPR delegated act. Batteries, construction products and toys get theirs from their own laws. The consultation closed on 12 August 2026, indicative adoption is the fourth quarter of 2026, and the passport is built on identifiers steel producers already issue.

A mill test certificate is a PDF. It has been a PDF for as long as most people in the industry can remember, and before that it was a sheet of paper in an envelope. It carries the cast number, the chemical analysis, the mechanical properties, and a validation from the works inspection representative, who under EN 10204 has to be independent of the manufacturing department. It travels with the steel, gets filed by the buyer, and is retrieved years later when somebody needs to prove where a beam came from.

No single law says every tonne of steel must come with one. The industry built the practice itself, and in the places where it matters most, pressure equipment, structural steelwork, offshore, the law has since come to lean on it. Voluntary in the abstract, effectively compulsory where it counts. That is what the Commission is now proposing to build on.

The Commission opened a public consultation on the ecodesign delegated act for iron and steel on 20 May 2026. Two streams closed just over a week ago, on 12 August, a call for evidence for the impact assessment and an open public consultation, drawing 226 responses between them. The Commission’s indicative timing for adoption is the fourth quarter of 2026. Underneath it sits a Joint Research Centre study on what the passport should contain, and that study is the clearest available picture of where this lands.

Status as of 20 August 2026: this delegated act has not been adopted, and no draft text has been published either. What exists is the Commission’s preparatory work and a consultation that has now closed. The next observable step is publication of a draft act for a four-week feedback round, and that has not happened. Everything described below is a proposal, not law. Fields can still move between mandatory and voluntary, access levels can still change, and the study’s own methodologies for carbon footprint and recycled content are still being written. Treat it as the best available read on where this lands, not as a specification to build against.

How many passport rules could hit one product?

Possibly more than one, and they come from different laws with different timetables. This is the question worth answering before any of the steel detail matters.

There is no single European product passport. There are four separate regimes, and which one reaches you depends on what you make and who you sell it to.

ESPR is the horizontal framework underneath all of it. It builds the shared machinery, the central registry, the rules for passport service providers, the requirements for the scannable carrier, but its own product requirements arrive one delegated act at a time. Iron and steel is the first of those, and so far none has been adopted for any product group.

The row that catches people out is construction. The regulation is in force, so it gets described as already requiring a passport. It does not yet, because the passport articles depend on a delegated act nobody has written.

Now the part that actually costs money. These regimes overlap. A reinforcing bar or a structural section is an intermediate steel product under ESPR and a construction product under the CPR, so it can end up inside two passport regimes with two sets of content rules. The study behind the steel act flags this directly and says a high degree of interoperability between the two will be necessary, particularly for product identification, because without it manufacturers face parallel and potentially inconsistent reporting.

So the practical question is not which regulation got there first. It is whether your product sits in one of these boxes, in two, or in none of them yet. If you sell into construction, what DPP means for construction products covers that side. For the wider state of play, see our mid-2026 status assessment.

Why is steel the first product to get a passport under ESPR?

Because it sits upstream of almost everything else, and because most of the data already exists in a standardised form.

The ESPR working plan for 2025 to 2030 named four final products (textiles and apparel, furniture, tyres, mattresses), two intermediate ones (iron and steel, aluminium), and two horizontal measures on repairability and on recycled content in electronics. Its dates are indicative timings for adoption, not compliance deadlines, which is a distinction most coverage loses. Steel sits at 2026, aluminium at 2027.

Intermediate products are an unusual choice for a regulation people associate with consumer goods, and that is the point. A steel coil is not something anyone buys off a shelf, but it ends up inside buildings, cars, machines and wind turbines. Regulating the coil means the carbon and recycled content figures can travel downstream into the products built from it.

The practical reason is the certificate. Steel producers already record chemical composition, mechanical properties and heat identity, and already exchange them through mill test certificates whose content is defined by EN 10168 and whose document types are set by EN 10204. Some of what the passport asks for is genuinely new, particularly the recycled content split and a declared carbon footprint. Much of the rest is a format problem rather than a measurement problem.

What is the passport proposed to carry?

Five areas of mandatory content, plus a set of fields the study recommends keeping voluntary.

Before the detail, one thing worth keeping in proportion. This is an ecodesign act, not a passport act. The Commission’s call for evidence names three measures: information requirements on carbon footprint, recycled content and substances that make steel harder to recycle; performance classes and minimum environmental performance thresholds; and the passport. The passport is the third of the three. A minimum threshold on embodied carbon is the one that can stop you placing a product on the market, and it is getting a fraction of the attention the passport gets.

The study worked through five representative products, all of them intermediates, meaning steel sold on to be made into something else rather than sold to a consumer: hot rolled coil and galvanised cold rolled coil, which are long strips wound into rolls, wire rod, which is coiled bar drawn down into wire, plus electrical steel and stainless steel.

The third column is the interesting one. Most of this is not new information, it is information trapped in an attachment. The study is explicit that digitalising mill test certificate data would not create fundamentally new reporting obligations, because steelmakers already hold those datasets in structured internal systems.

Recycled content is where real work sits. The declaration builds on ISO 14021 and separates pre-consumer from post-consumer material. How you substantiate that depends on your chain of custody, and the study discusses controlled blending alongside mass balance approaches applied either per order or across a site, with or without third-party verification. Which of those you can defend is an accounting question about your scrap and charge records long before it is a software question.

Why the heat number, and not a new EU identifier?

Because the industry already has one, and because what the industry has today is not quite good enough on its own.

A heat is one furnace batch of liquid steel, typically somewhere between 100 and 300 tonnes, and it is the fundamental traceability unit in steelmaking. Everything from a single heat shares a chemical composition and a production route, which makes it the first point where a product can be tied to a defined set of inputs. Each heat carries a number, and the study proposes it as the mandatory batch-level identifier in accordance with EN 10168, with a lot number as an optional addition. One vocabulary warning if you read the study yourself: it treats heat and cast as different things, while the standards treat them as the same unit, and EN 10168 has no heat number field as such.

The study is candid about why a passport needs more than that. There is no globally adopted, value-chain-wide product identification standard in steel today. Identifiers are defined locally, at group, plant or site level, and managed inside company ERP systems. They are often unique only within one organisation or one time window, because serial number ranges roll over and get reused. For a passport that has to stay unambiguous for decades and across company boundaries, that is a real gap, and the study says so directly.

That is why the proposal pairs the heat number with a model-level identifier and lists globally recognised identifiers, including GTIN under ISO/IEC 15459-6, among the other identifiers the passport should carry. How that identity reaches a scanner is a separate question, which we covered in The QR Code Is Not the Passport.

So does every coil need its own passport?

No. The proposal is built around the heat, with item-level identification offered as an option for specific products rather than a general rule.

This is the question that decides the size of the project, so it is worth getting right.

The default is batch level, meaning one passport per heat, so one passport covering everything cast from that furnace batch even though it will be split across several customers. Item level, which for steel means one individual coil, sheet or tube rather than one physical bar, is proposed only for selected product categories where item identifiers are already established and useful, coils being the example the study gives. For long products, individual item marking is not considered practical and identification is applied at bundle level. For powders it is applied at sack level.

The reason is cost, and the study puts numbers on it. Using identifiers that already exist, batch or item, was assessed as low implementation effort. Introducing systematic item-level traceability where production currently runs at batch level was not: industry feedback put that at at least around EUR 100 000 per installation, plus ongoing operational cost. Stakeholders also told the Commission that item-level traceability offers limited additional value for bulk or standardised products.

Contrast that with batteries, where every electric vehicle battery, light means of transport battery and industrial battery above 2 kWh gets a passport per physical unit, because a battery has an individual service history and a second life. There is no single answer to granularity across sectors. The passport attaches to whatever unit an industry already treats as having an identity, and for steel that unit is the heat.

Does this mean another carbon number to calculate?

Probably yes, and anyone who tells you the CBAM figure covers it has not looked at the boundaries.

The methodology being developed for ESPR steel does align greenhouse gas accounting with the EU ETS and CBAM frameworks, and aims to be interoperable with EN 15804 and the environmental product declarations built on it. That alignment is real and useful. It is not the same as one number serving every regime, and the study itself is careful to say that CBAM and the passport serve distinct though complementary roles.

Look at what each one actually measures.

The gap in that table is electricity. For an electric arc furnace, which melts scrap rather than smelting ore, and for the submerged arc furnaces that Norwegian ferroalloy and silicon plants run, purchased power is the largest single term in a cradle-to-gate footprint. It appears in neither your ETS return nor, for iron and steel, in CBAM. If you budget the passport work on the assumption that the carbon figure already exists, that is the line item that will surprise you.

There is a second thing worth saying plainly to a Norwegian 🇳🇴 reader, because it is the opposite of what most coverage implies. Goods originating in Norway are outside CBAM. Article 2(4) of the CBAM Regulation disapplies it to countries listed in point 1 of Annex III, and that list is Iceland, Liechtenstein, Norway and Switzerland, precisely because the EU ETS already applies. CBAM is also an obligation on the importer, not the producer. So if you are selling from Norway into the EU, CBAM is not your reporting duty at all. It reaches you, when it reaches you, as a customer’s data request about third-country inputs.

Granularity is the other thing that gets waved through. ETS and CBAM figures are installation totals spread across a reporting period, averages by construction. Getting from there to a figure attached to a single heat is a change of granularity, not a copy and paste. It needs allocation at process-unit level and a defensible rule for co-products such as furnace gas, slag and sold heat. Emissions also keep accruing after the casting stage, through the reheat furnace, the rolling mill and any coating line.

That leaves one open question that matters more than the rest. An environmental product declaration today costs between EUR 10 000 and EUR 30 000, takes up to six months, and stays valid about five years. A passport carrying a figure that moves with production is a completely different operating model, and ESPR requires passport data to be accurate, complete and up to date. Which model the steel act lands on is undecided, and it is the line item most likely to decide what this costs you.

If you want to see what that plumbing looks like against your own product data, book a demo.

Who gets to see what?

Three tiers, borrowed from the Battery Regulation, and the split protects more than most producers expect.

The fear that surfaces in every conversation with a producer is that a passport publishes your cost structure to your competitors. The proposal follows the model in Article 77 and Annex XIII of the Battery Regulation and sets access at the level of individual fields.

Your headline carbon figure is public. The calculation parameters behind it are not, because they can reveal energy consumption and operational efficiency. Detailed chemical composition is restricted because it can expose alloying strategy. The pre-consumer and post-consumer split is restricted too, since a scrap ratio combined with an analysis says more about your process than most producers intend to publish.

One caveat worth knowing if you read the study yourself: it is not fully consistent on substances of concern. The narrative text suggests they are suitable for public access, while the field-level table places them behind legitimate interest or authority access. That is the kind of detail the delegated act will have to settle.

Restricting data is not the same as hiding it, and verified access requires an identity check. That is why the registry and eIDAS layers matter to a steel producer even though they look like plumbing. We covered that gate in eIDAS and the EU DPP Registry.

I make ferroalloys, aluminium or silicon. Does this concern me?

Differently in each case, and one of the three answers will surprise you.

Ferroalloys. You are probably closer to scope than you think. Ferroalloys are CN heading 7202, which sits inside CN chapter 72, and chapter 72 is titled “Iron and steel”. ESPR Article 8(a) requires every delegated act to define its product group by listing the commodity codes it covers. No such list exists yet, because no draft act has been published. Until it does, nobody can tell you with authority that ferroalloys are outside, and the preparatory study’s own framing of the sector runs on chapters 72 and 73. Watch the CN list in the draft act. It is the single field that decides this for you.

Silicon metal. Cleaner answer. Silicon is CN 2804 69, chapter 28, outside both chapter 72 and the aluminium group. You are not in this act.

Aluminium. A separate product group with indicative adoption in 2027, roughly a year behind steel. Worth knowing where that actually stands: as of August 2026 there is no aluminium product group on the JRC Product Bureau and no call for evidence has opened, so the preparatory work has not publicly started. Read 2027 as a target rather than a plan, and treat the steel act as a preview of your own.

There is a Norwegian wrinkle underneath all three. ESPR carries EEA relevance in its title, but as of August 2026 it has not been incorporated into the EEA Agreement, and the incorporation decision carries an Article 103 reservation, meaning it needs the Storting’s consent. Product-specific delegated acts will then be implemented as forskrifter under the sustainable products act. So the domestic legal hook arrives later than the EU date. That changes nothing about your exports. If you place product on the EU market, the EU rules apply at that border whatever the state of the EEA process, which is why treating the EEA lag as breathing room is a mistake.

Whichever of the three you are, the data question arrives before the legal one. A steel mill that has to declare a carbon footprint and a recycled content split sources those figures from its own inputs, and those inputs are yours. The obligation sits with the mill. The request lands on your desk.

The same applies to anyone melting, casting or re-rolling. The study is explicit that passport obligations transfer to whichever economic operator places the transformed product on the market, so a service centre or a fabricator inherits the duty rather than escaping it.

One more thing worth flagging if you run a primary process. The recycled content requirement, with its pre-consumer and post-consumer split, is written for a scrap-fed world. If you charge ore and quartz rather than scrap, the honest declaration is close to zero, and the work for you is substantiating that number rather than improving it.

What is still undecided?

Three things that will change what this costs you, and none of them are settled.

The methodologies. The carbon footprint and recycled content calculation rules are being written in parallel workstreams, and the study calls its own granularity proposal preliminary. Fields can still move between mandatory and voluntary.

The plumbing. The data carrier, whether QR, Data Matrix, RFID or NFC, comes from horizontal rules and the CEN/CENELEC standards rather than this act. So do the EU registry and the public portal, which we covered in The EU DPP Registry.

Who owns the passport as material changes hands. Responsibility transfers each time a product is placed on the market in a new form, and information continuity breaks at company boundaries rather than inside plants. Related: environmental data is modelled rather than measured, so it needs a different kind of verification from a mechanical property, and evidence has to move from PDFs to machine-readable signed attestations an authority can check automatically. A mill test certificate is trusted because of who validated it. A passport has to reproduce that trust without the paper.

What should you do in the next twelve months?

Four things, none of which require the final text.

Find out whether your heat number is usable as an identifier. It exists on the certificate. Whether it exists as a queryable field linked to the analysis and the carbon figure is a different question, and in many plants the answer is that it lives in three systems that do not agree.

Work out which chain-of-custody model you can defend. Controlled blending and mass balance, per order or per site, make different demands on your scrap records. Pick the one your records already support, or start building the records for the one you want.

Connect the carbon figure to the product, not just to the reporting period. The number exists for CBAM. The passport needs it attached to a heat.

Decide who owns this internally. Steel passports touch quality, environment, IT and sales, and projects like this stall when they belong to all four and none of them.

None of that depends on choosing a vendor, and none of it is wasted if the final act moves a field or two. It is the same groundwork the practical implementation guide sets out for every sector.

FAQ

The steel act is the first of many, and its choices are worth understanding before your own sector’s act arrives. DPPA builds Digital Product Passport infrastructure that handles model, batch and item level identity, so a passport can attach to a heat, a production run or a serialised unit without rebuilding the system each time a delegated act sets a different granularity. We build against the EN 18xxx standards and sit on Standard Norge’s DPP committee, SN/K 624, the Norwegian mirror of CEN/CLC/JTC 24. If you want a straight answer on what your product data would need, book a demo.

For how the scannable code and the identifier behind it work, see The QR Code Is Not the Passport.