What are EN 18216 and the CEN-CENELEC DPP standards?

EN 18216 is the first number in a family of eight European standards that describe how a Digital Product Passport works under the hood. They were written by CEN-CENELEC Joint Technical Committee 24 at the request of the European Commission, and they cover the plumbing every passport needs: how products are identified, how the QR code or tag points to the passport, how data is exchanged, stored, protected and checked.

The standards matter because the Ecodesign for Sustainable Products Regulation (ESPR) sets technical requirements for passports in Articles 10 and 11 without spelling out every detail. Since 15 July 2026, six of the standards are cited in the Official Journal. A passport that follows them is presumed to meet those requirements.

The eight DPP standards

The series has no EN 18217 or EN 18218, so a range such as "EN 18216 to EN 18223" leaves out the two newest standards.

What each part does in practice

• Identifiers (EN 18219). Rules for the unique product identifier, so that every passport can be found and every identifier stays unique and persistent.
• Data carriers (EN 18220). How the data carrier, usually a QR code, encodes the link to the passport. Existing schemes such as GS1 Digital Link can be used where they meet the requirements.
• Exchange and APIs (EN 18216, EN 18222). How systems request, create, update and search passports, and how a scanned link resolves to the right passport.
• Storage and persistence (EN 18221). How passports and their back-up copies stay available for the full period a delegated act requires, including when a company stops trading.
• Interoperability (EN 18223). How passports from different providers and existing industry data systems work together, so no one is locked into a single vendor.
• Access and integrity (EN 18239, EN 18246). Who may see which data, how business confidentiality is protected, and how readers can check that passport data is authentic and has not been changed.

Who the standards apply to

The standards are written for anyone who builds or runs a passport system: the economic operator placing a product on the market, a DPP service provider hosting passports on its behalf, and the systems that read passports, such as the EU DPP registry, customs and market surveillance authorities.

They are product-agnostic. What data a passport must hold for textiles, furniture or steel comes from each product group's delegated act, not from these standards.

For batteries, the Battery Regulation currently points to the ISO/IEC 15459 series for the QR code and identifier. A draft delegated act published for feedback on 29 September 2026 proposes to replace that reference with EN 18220 and EN 18219, which would put the battery passport and ESPR passports on the same technical basis.

What it means for your products

• Following cited standards gives legal certainty. It is the simplest way to show your passports meet ESPR Articles 10 and 11.
• Choosing identifiers and QR codes is a long-term decision. Codes are printed on products and packaging for years. Pick a scheme that meets EN 18219 and EN 18220 from the start.
• Ask your provider how it applies the standards. Check identifiers, resolver behavior, back-up copies, access levels and signed versions, not only the look of the public page.

How to prepare

1. Get the standards through your national standards body, which distributes CEN-CENELEC standards.
2. Review your current product identifiers and QR codes against EN 18219 and EN 18220.
3. Check how your passport data is stored, backed up and versioned against EN 18221.
4. Plan access levels for public, legitimate-interest and authority data in line with EN 18239.
5. Watch the Official Journal for the citation of EN 18239 and EN 18246.