Who is responsible for the Digital Product Passport?

The short answer: whoever places the product on the market

The party that has to create the Digital Product Passport is the manufacturer - and a manufacturer under the Ecodesign for Sustainable Products Regulation (ESPR) is whoever first places a product on the EU single market under their own name or trademark.

Here is the point most companies get wrong: the manufacturer role attaches not to production but to the label. Anyone selling under their own brand is a manufacturer in regulatory terms - even if production sits entirely with a contract manufacturer in Portugal or Vietnam and no one in your own company has ever touched a product.

That only answers half the question, though. The ESPR spreads duties across the whole chain - just very unevenly: one party has to build and maintain the passport, another merely has to check it and make it accessible.

The ESPR roles at a glance

Chapter IX of the ESPR sets out the obligations of economic operators. Six roles matter for the product passport:

The difference between row one and row four is the most important one in the whole regulation: creating is project work, checking is process work. If you are a manufacturer you build a data foundation - if you are a distributor you mainly need a reliable routine at goods-in and on the product page.

The most common case: when you unintentionally become a manufacturer

The ESPR contains a rule that online retail regularly underestimates: an importer or distributor is considered a manufacturer and carries the full set of manufacturer duties in any of these three cases:

1. Own brand. You place the product on the market under your name or trademark - the classic private-label or own-brand case.
2. Rebranding. You buy in goods, remove or cover the original brand and sell under your own label.
3. Substantial modification. You modify a product already placed on the market in a way that affects compliance with the requirements - through repackaging, bundling with other components or replacing parts.

For Shopify brands, case 1 is the norm, not the exception. If you run a D2C brand and have a contract manufacturer produce for you, you are a manufacturer in the full sense - and therefore the party that has to build the product passport, populate it with data and keep it current across the product’s lifetime. What belongs in it is covered by the main DPP guide and by an annotated real-world example.

When the manufacturer is based outside the EU

A manufacturer in a third country is hard for European authorities to hold to account. That is why Article 4 of the Market Surveillance Regulation (EU) 2019/1020 requires that products on the single market always have an economic operator established in the EU who takes on the compliance tasks. The candidates are:

• the importer who brings the goods in,
• an authorised representative appointed in writing by the third-country manufacturer,
• or a fulfilment service provider, where there is neither an importer nor an authorised representative.

In practice: if you source goods directly from a third country, you are that contact point - even if you think of yourself as a pure distributor. Responsibility for the product passport therefore moves entirely to you: you have to ensure a compliant passport exists, not just that it is linked.

This is where import business models regularly turn out more expensive than expected - not because of the software, but because of obtaining data from suppliers. The cost guide works through that item.

Dropshipping, marketplaces and fulfilment

Three set-ups that are often classified incorrectly in practice:

• Dropshipping from third countries. If goods are shipped directly from a third country to end customers in the EU and no one else acts as importer, responsibility lands with whoever made the offer. The “I only sell, someone else ships” model does not hold up in regulatory terms.
• Selling via marketplaces. The marketplace has to make it technically possible for passport information to be displayed, and to cooperate with market surveillance. That does not make it responsible for your product passport - the duty stays with you as the seller.
• Fulfilment by Amazon and similar. A logistics provider takes over storage and shipping, not product responsibility. Only in the special case where there is no importer and no authorised representative can it become the responsible economic operator under Article 4.

Batteries: separate regulation, same logic

The battery passport follows the EU Battery Regulation (EU) 2023/1542 rather than the ESPR - but the allocation is comparable: responsibility lies with the economic operator that places the battery on the market or puts it into service. For e-bike and e-scooter brands that usually means: whoever sells the vehicle or the replaceable battery pack under their own brand answers for the battery passport - from 18 February 2027, the only DPP deadline already firmly fixed. Details on the DPP for batteries & e-bikes page and in the deadline overview.

Who is liable when the data is wrong?

The uncomfortable answer: whoever placed the product on the market - the manufacturer or the importer. The fact that material composition, origin details or certificate numbers came from a supplier is no defence towards market surveillance authorities. Recourse can be agreed contractually, but the regulatory responsibility stays where it is.

Three practical consequences follow:

• Archive evidence, do not just copy it over. For every entry in the passport it should be documented where it came from and when it was confirmed.
• Monitor expiry dates. An expired certificate in a published passport is worse than a missing one - it is an active misstatement.
• Version your changes. Material and supplier changes have to reach the passport traceably, history included.

Who inside the company is responsible?

The regulatory role settles which company is responsible - not who in the building does the work. A lean three-way split has proven itself, and small teams can run it too:

• Subject-matter owner: product management or purchasing - they know materials, suppliers and certificates and are therefore the source of truth.
• Operational owner: whoever maintains master data maintains the passport. In most Shopify teams that is the same person who creates products.
• Accountable: management - market surveillance addresses the company, not a department.

The classic mistake is treating the DPP as an IT project. The software is the easy part; the bottleneck is supplier data, and purchasing obtains that, not engineering. How this plays out in a small team is described in the SME roadmap.

Three questions that settle your role

1. Is your brand on the product? Yes → you are the manufacturer. End of assessment.
2. Do you bring goods in from a non-EU country? Yes → you are the importer and in practice carry almost full responsibility for the passport.
3. Do you sell third-party branded goods that are already in the EU? Yes → you are a distributor: check and make accessible, but do not create. Distance selling adds its own requirements, explained in the guide DPP in e-commerce.

If more than one answer applies - own brand plus bought-in third-party brands in the same shop, say - the stricter role applies per product, not across the company as a whole.

This guide gives an overview of how responsibility is allocated under the ESPR and the Battery Regulation and does not replace legal advice on an individual case. Product-group-specific requirements are set out in delegated acts.

Your role is clear - now the implementation

If this text left you at “manufacturer” or “importer”, the actual work is ahead: capturing data per article and variant, validating it against the mandatory fields of the relevant regulation, and keeping the passport published and current.

That is exactly what SolveDPP’s DPP software is built for: importing products and variants straight from Shopify, AI pre-fill for recurring fields, validation before publication, and hosted DPP pages including a QR code for the label - at predictable prices.