DPP with eIDAS Timestamp and Blockchain: EU Guide 2026

The EU does not require blockchain for a Digital Product Passport. It requires that passport data is authentic, tamper evident and verifiable, and that the record survives for as long as the product does. Those requirements are where eIDAS and blockchain each earn their place, and the two are not interchangeable.

A qualified electronic timestamp under eIDAS gives the record a legal presumption of accuracy and integrity in all 27 member states. Blockchain anchors a cryptographic fingerprint of each passport version in an append-only ledger that any counterparty can verify without trusting your systems. eIDAS is the legal layer. Blockchain is the evidence layer. A digital product passport with eIDAS timestamp and blockchain covers both, and each one holds up on its own.

Two regulatory updates this summer made that concrete. On 16 July 2026 the Commission adopted Implementing Regulation (EU) 2026/1778, which sets the operating rules for the EU Digital Product Passport Registry, in force since 6 August 2026. Two days earlier, Implementing Decision (EU) 2026/1736 published the references of six harmonised standards for digital product passports, EN 18216 to EN 18223:2026. Complying with them confers a presumption of conformity with the ESPR requirements they cover, as set out in Article 41(2) of Regulation (EU) 2024/1781.

This guide explains the three layers of a registry ready passport: the eIDAS identity and timestamp layer, the blockchain audit layer, and the data structure covered by the harmonised standards. It ends with what to do before your category deadline, starting with batteries on 18 February 2027.

A digital product passport with eIDAS timestamp and blockchain: what the EU actually requires

The Digital Product Passport is defined by the Ecodesign for Sustainable Products Regulation, ESPR (EU) 2024/1781. The regulation requires product information to be authentic, secure and verifiable, and it is product-specific delegated acts that set the details per category. Under Article 13(1) of ESPR, the Commission must keep a registry for individual passports, storing in a secure manner at least the unique identifiers.

That registry is the legal hook. It is decentralised by design: the registry stores identifiers and registration data that point to a passport the operator hosts. It does not create the passport. What the operator submits is structured data, mapped to the data model for the product group, hosted at a resolvable location that the registry can check on submission, typically a URL built on GS1 Digital Link.

The eIDAS layer: legal validity that a ledger cannot give

A qualified electronic timestamp is issued by a Qualified Trust Service Provider listed on the EU Trusted Lists, follows RFC 3161 and ETSI EN 319 421, and under Article 41 of Regulation (EU) No 910/2014 (the eIDAS regulation) carries a legal presumption of the accuracy of the time it indicates and the integrity of the data bound to it. The burden flips: whoever challenges the record must prove it is wrong. The presumption applies directly in all 27 member states, with no national transposition needed.

Blockchain timestamps do not carry that presumption. No public blockchain is on the EU Trusted Lists, so a blockchain timestamp cannot be a qualified electronic timestamp as defined by Article 42 of eIDAS. A ledger entry remains admissible supporting evidence under Article 46 of eIDAS, which says electronic documents cannot be denied legal effect solely because of their electronic form. But the party relying on it carries the burden of proving reliability. That asymmetry, the qualified timestamp is presumed correct while a ledger anchor must be explained, is the practical difference (Swiss Trust Layer makes the same point in its eIDAS explainer, citing the exact Article 41 text).

For long-lived products the format matters as much as the timestamp itself. A passport may need to stay verifiable for decades. Long-term validation profiles such as PAdES, XAdES or JAdES keep the signature and timestamp evidence usable after certificates expire, which is why registry providers and eSign.AI both recommend LTV formats for product data.

The blockchain layer: immutable auditability

Blockchain adds what a timestamp alone cannot: an append-only, tamper evident log of every passport version, hash-anchored and verifiable by any inspector without your cooperation. A qualified timestamp fixes a single moment. The ledger makes the sequence of versions auditable. That is why Hoken Pass pairs a qualified eIDAS timestamp with a blockchain anchor on every product record: the timestamp guarantees the moment, the ledger guarantees the chain.

The European institutions are moving the same direction at the infrastructure level. EBSI, the European Blockchain Services Infrastructure operated by the Commission and member states, is used in the EBSI-ELSA pilot with EUIPO to issue and verify verifiable credentials, NFT product twins and blockchain timestamped supply chain events for the Digital Product Passport. And eIDAS 2.0, Regulation (EU) 2024/1183, adds electronic ledgers as a trust service category in its Article 45h. That is the first formal pathway for blockchain based evidence to become a qualified service, once the implementing acts land.

One practical rule: anchor hashes, not personal data. An immutable public chain cannot honour a GDPR erasure request, so compliant designs store a fingerprint on the ledger and keep personal data off chain. A 2026 MDPI review of blockchain for eIDAS trust services formalises exactly that design constraint across the trust service categories.

Registry rules: what Regulation 2026/1778 changes

The registry was live for users on 20 July 2026 under Article 13 of ESPR. Regulation 2026/1778, adopted 16 July and in force 6 August 2026, is the implementing act that defines how registration works.

Registration requires a verified economic operator. You prove identity through eIDAS: a qualified electronic signature for a sole trader, a high-assurance eID or an attestation of attributes, and a qualified electronic seal from a qualified trust service provider for a company (Articles 4 and 5). Verified status lasts until the identification means expires and never longer than three years. Operators already verified in EPREL, the EU energy-labelling registry, do not need a second verification per Recital 11.
The Commission runs an automated check on data structure, granularity and completeness. Recital 16 is explicit: this is not a proof of compliance. Substantive verification remains a market surveillance function.
On success the registry generates a unique, persistent registration identifier (Article 8). The registry supports versioning of registered data, and each update to a passport receives a Commission timestamp.
Proof of registration is a secure electronic document sealed with a qualified electronic seal and a Commission electronic time stamp, containing the product identifier, the registrant identity and the registration date. It stays available for 90 days and can be regenerated (Article 9).
Registration data is deleted automatically 10 years after registration, unless the product-specific law sets a different period (Article 10).

The registry covers batteries, construction products, toys and detergents, and future ESPR categories. It does not verify compliance, and no platform can make a passport compliant on your behalf. Every vendor statement that version is worth checking against the exact articles above.

The harmonised standards: EN 18216 to EN 18223

Implementing Decision 2026/1736 of 14 July 2026 published in the Official Journal references for six EN standards drafted by CEN, Cenelec and ETSI in support of ESPR Articles 10 and 11:

EN 18216:2026, data exchange protocols
EN 18219:2026, unique identifiers
EN 18220:2026, data carriers
EN 18221:2026, data storage, archiving and persistence
EN 18222:2026, APIs for passport lifecycle management and searchability
EN 18223:2026, system interoperability

Conformity with a harmonised standard whose reference is published in the Official Journal rebuttably presumes conformity with the corresponding ESPR requirements, per Article 41(2) of ESPR itself. For any software decision, checking alignment with these six standards matters more than any optional feature.

What to do before your category deadline

Battery passports are mandatory from 18 February 2027 under Article 77 of Regulation (EU) 2023/1542, for electric vehicle, light transport and industrial batteries above 2 kWh. Textiles follow later through the ESPR delegated acts. If you build a digital product passport with eIDAS timestamp and blockchain, start with these four steps.

Decide who completes the eIDAS identity verification for your company: the qualified electronic signature for a sole trader, or a qualified electronic seal for a legal entity. That is the gate to the registry, no vendor can do it for you, and the verification takes lead time.
Give every product a standards based unique identifier, resolvable through GS1 Digital Link, with the passport hosted at a URL the registry can check on submission.
Timestamp every passport version with a qualified eIDAS timestamp and anchor each hash on the ledger, so the audit trail is continuous from the first version.
Keep long-term validation evidence in PAdES, XAdES or JAdES profiles, so the record stays verifiable for the product lifetime and beyond.

The slow part is not registration. It is structuring the product data to the required model and collecting what only upstream suppliers know. Start with one product, prove the chain, then scale.

Frequently asked questions

Is blockchain required for a digital product passport? No. ESPR requires authentic, tamper evident and verifiable data. A qualified eIDAS timestamp carries the legal presumption; blockchain is a valuable but optional immutable audit layer.

What is a digital product passport with eIDAS timestamp? A passport in which each data version is bound to a qualified electronic timestamp from a Qualified Trust Service Provider, giving a legal presumption of the time and of the data integrity under Article 41 of eIDAS.

Does a blockchain timestamp replace an eIDAS qualified timestamp? No. Blockchain timestamps are not issued by a Qualified Trust Service Provider and carry no Article 41 presumption. The two coexist: eIDAS for legal validity, blockchain for immutability and auditability.

What is EU Regulation 2026/1778? It is the Commission Implementing Regulation, in force since 6 August 2026, that defines how the EU DPP Registry operates: who can register, the eIDAS proof of identity, the automated structure and completeness checks, and the proof of registration document.

When does the EU DPP Registry become mandatory? The registry went live on 20 July 2026 for users. Registration becomes mandatory per product category under each delegated act: batteries from 18 February 2027, textiles later with the ESPR delegated acts.

What are the harmonised standards EN 18216 to EN 18223? Six EN standards published in the Official Journal by Implementing Decision 2026/1736 covering data exchange, unique identifiers, data carriers, storage and archiving, APIs, and interoperability for digital product passports. Conformity gives presumption of conformity with ESPR Articles 10 and 11.