Supply-Chain Responsibility for the DPP
No single person or link is responsible for the Digital Product Passport (DPP). Obligations spread across the whole supply chain, and every participant has a part to play. Understanding this division avoids the situation where everyone assumes someone else will handle it.
Many participants, different roles
The ESPR (Regulation (EU) 2024/1781) addresses obligations to different economic operators. In a typical chain these are the manufacturer, the importer, the distributor, and also an online platform that intermediates sales.
Each of these roles has a different scope. The point is not for one operator to do everything, but for someone specific to be accountable for their part of compliance at each stage. Well-mapped roles are the best protection against gaps.
The manufacturer: creates the passport
The manufacturer is usually the starting point. It knows the product, its composition and documentation, so it creates the passport and is responsible for the accuracy of the data in it.
This responsibility is substantive. The manufacturer cannot delegate it to a technology provider — more on that shortly — because it is its product reaching the market under its name. Even when using an external platform, it remains responsible for the content.
The importer: takes on obligations at the EU border
When a product comes from outside the Union, the importer takes on a key role. It places the goods on the EU market and becomes responsible for ensuring the passport exists and is correct.
The importer cannot hide behind the fact that the manufacturer operates outside the EU and is not directly subject to EU surveillance. That is precisely why the importer's role is so important in enforcement — it is a real addressee of the obligations, reachable by the authorities. In practice, it answers for the compliance of non-EU goods.
Distributor and platform: a duty of due care
The distributor does not create the passport but is not exempt from responsibility. It should act with due care — for example, checking whether the product it offers has the required carrier and an accessible record.
Likewise, online platforms that intermediate sales are covered by obligations. Online channels are not outside the system; we discuss this in E-commerce and import. Every link that brings the product closer to the customer has its part to play.
The DPP service provider and legal responsibility
An important distinction concerns the DPP platform provider. It does the technical work — creating, hosting and maintaining the passport — but does not take on legal responsibility for the content of the data.
In other words, technology can do the heavy lifting, but the economic operator remains legally responsible. That is why choosing a provider should rest on data portability and freedom from lock-in, not on a promise to assume your responsibility.
How to organise responsibility in practice
To avoid gaps, it is worth clearly mapping the roles in the chain:
- establish who is the manufacturer and who is the importer placing the product on the EU market,
- write into contracts who supplies which data and who updates it,
- treat the platform provider as a technical contractor, not a guarantor of compliance.
We cover what non-compliance risks in Consequences of a missing DPP.
Why gaps in responsibility are dangerous
The hardest situations arise not because someone knowingly ignored an obligation, but because no one treated it as their own. The manufacturer assumes the importer will handle it, the importer counts on the distributor, and the platform treats the topic as someone else's. As a result, a product reaches the market without a complete passport, even though everyone acted in good faith.
Such gaps are dangerous because they surface only during an inspection, when it is already too late to calmly put the data in order. That is why clearly assigning roles is not bureaucracy but a real safeguard.
Data flow between the links
Compliance depends on whether data flows between the links in an orderly way. The manufacturer supplies information about the product, the importer and distributor pass it on, and the platform makes it available to the customer. At each stage someone must know where the data comes from and who is responsible for updating it.
It is worth describing this flow explicitly — who creates the passport, who completes it and who reacts to changes. One jointly maintained record is far safer here than scattered copies circulating across many systems.
Key takeaways
- Responsibility for the DPP spreads across the whole supply chain.
- The manufacturer creates the passport and is responsible for data accuracy.
- The importer takes on obligations when the product comes from outside the EU.
- The distributor and platform have a duty of due care.
- The DPP service provider does the technical work but does not take on legal responsibility.
See how CyfroPass supports every link in the chain in keeping compliant passports. Visit cyfropass.pl and start with your first product.