Who holds the back-up copy of your product passport?

"What happens to our product passports if you are no longer around?" Hardly anyone asks this when talking to DPP providers. Yet the legislator answered it long ago, with an obligation that never shows up in a product demo: the back-up copy.

A product passport belongs to a physical product that may stay in circulation for ten or fifteen years. The company that issued it and the platform that hosts it do not have to last that long. The passport does.

What the Ecodesign Regulation requires

Article 10(4) of the Ecodesign for Sustainable Products Regulation (EU) 2024/1781 is brief: whoever places a product subject to a passport on the market must make a back-up copy of the passport available through a DPP service provider.

Two details are easy to miss.

Timing. The copy has to exist from the moment the product is placed on the market, not once things get critical.

Who holds it. The regulation defines a DPP service provider as an independent third party authorised by the economic operator (Article 2, point 32). A second copy on your own server does not meet the obligation, however well it is maintained.

What EN 18221 makes of it

Since 15 July 2026, EN 18221:2026 has been cited as a harmonised standard in the Official Journal (Implementing Decision (EU) 2026/1736). Conforming to it gives you a presumption of conformity with the regulation's storage and availability requirements, to the extent the standard covers them. The standard turns the regulation's single sentence into three concrete requirements:

Replication. The passport and every change to it are transferred to the back-up provider, promptly enough that as little as possible is lost if something goes wrong.

Archiving. Earlier versions are retained, with the same access restrictions as the current one. A market surveillance authority should be able to see, years later, what the passport said at a given point in time.

Persistence. The passport stays reachable even if the economic operator no longer exists.

A nightly ZIP export does not do this. Transfer runs over a standardised interface, the lifecycle API under EN 18222, so the back-up provider does not depend on one platform's export format.

Where the obligation becomes visible: the EU registry

Until now, the back-up copy was an obligation on paper. The EU DPP Registry makes it checkable. Under Implementing Regulation (EU) 2026/1778, when a passport is registered the Commission verifies, where relevant, the link to the back-up copy (Article 8(7)(e)) and stores a reference to the DPP service provider as part of the registration data (Article 8(9)(c)). The registry is also to keep a list of verified DPP service providers (Article 3(f)).

If you wait until registration to sort out the back-up, you are too late.

And for batteries?

From 18 February 2027, the battery passport is the first mandatory product passport. Formally, it rests on its own legal basis: the Batteries Regulation (EU) 2023/1542 does not repeat the Ecodesign Regulation's wording on the back-up copy. It does, however, require in Article 78(e) that the battery passport remains available even if the responsible economic operator ceases to exist or stops its activity in the Union.

How do you demonstrate that without an independent party holding a current copy? In practice, you cannot. On top of that, Article 78(a) requires the battery passport to be interoperable with product passports under ecodesign law. Anyone placing batteries on the market should therefore treat the back-up exactly as every other manufacturer does.

Can the platform provider hold the copy itself?

This is the most interesting open question. The regulation does not say explicitly whether the provider that creates and serves the passport may also hold the back-up copy. Industry associations have asked the Commission to clarify this. So far there is no answer.

Our view is simple: a copy held by the same provider does not protect against the very failure it is meant to cover. If the platform provider goes insolvent, the original and the copy disappear together. If you want to be on the safe side, keep the two apart.

What is still missing

The Commission has announced a delegated act for 2027 that is to set requirements for DPP service providers and a conformity assessment procedure. Until then there is no certificate and no approval for back-up providers. The criteria for listing providers in the registry are also still pending.

This has a practical consequence: anyone calling themselves a "certified back-up provider" today is relying on something that does not yet exist. Until 2027, the reliable benchmark is EN 18221.

Five questions for your back-up provider

1. Are they independent of your platform provider, legally and technically?
2. Do they keep every version of the passport or only the current state?
3. Does restricted information stay restricted in the copy, or is everything exposed there?
4. How much data loss does the contract allow, and how quickly will they serve the passport if something goes wrong?
5. What happens to the copy if the back-up provider itself stops operating?

Every provider has to face that last question, including us.

Further reading

We hold the back-up copy for passports created with another platform or an in-house solution, and we act as back-up partner for other DPP providers. Details on our DPP Backup page.

How registration and verification as an economic operator work is covered on our page about the EU DPP Registry. Obligations, data points and deadlines for batteries are on the battery passport overview.

As of September 2026. Editorial guidance, not legal advice. Only the relevant legal act in its applicable version is binding.