Key takeaways
- ●The central registry (deadline 19 July 2026) holds identifiers; passport data stays with operators or providers.
- ●Decentralised does not mean you must run your own servers.
- ●Blockchain is optional, never a legal requirement.
Registry vs passport
ESPR Article 13 required a central registry by 19 July 2026, operated under Implementing Regulation (EU) 2026/1778. It stores at least the unique identifiers so customs and authorities can check products. The substantive passport data is hosted by the responsible operator or a DPP service provider.
Backups and continuity
Article 11 requires passports to remain available, including a backup copy held by an independent DPP service provider, so data survives if a company goes out of business.
Interoperability standards
- CEN/CENELEC JTC 24 — EN 18216, 18219–18223:2026 for identifiers, carriers, access, APIs and exchange
- GS1 EPCIS 2.0 — lifecycle events in JSON/JSON-LD with REST interfaces
- W3C Verifiable Credentials — proving who issued a claim
- UN Transparency Protocol (UNECE Rec. 49) — global traceability framework
Sources
Last reviewed 2 November 2026. Guidance only — not legal advice.