Do I have to disclose commercially sensitive data about my steel publicly?
Not everything in the product passport will be automatically public
No, not all data about a steel product needs to be visible to everyone. The digital product passport is built from different data categories, and the ESPR assumes that not every category is accessible to every user. A distinction is made between information that can be consulted by everyone via the QR code — think of basic data on origin, composition in outline and circularity — and information that is only available to specific parties such as supervisory authorities, market participants further down the chain or certification bodies. Competitively sensitive production or process details typically fall into that second category, but how that division will look exactly per product group becomes concrete only once the product-specific implementing rules for iron and steel have been established.
Who this applies to and what falls outside it
This distinction in access levels applies to everyone who supplies data for a digital product passport under the ESPR: manufacturers, importers and other actors in the supply chain of steel and iron semi-finished products. It concerns data needed to comply with the requirements of the passport — such as origin, composition, environmental impact and end-of-life information. It is explicitly not an obligation to make public everything a company knows about its own production process. Recipes, precise alloy ratios beyond what is legally required, internal process parameters or supplier relationships that are not necessary to meet the requirements, fall outside what the passport asks for. The ESPR regulates which data categories belong in a passport and who has access to them — not that every trade secret is disclosed because there is now a passport.
No fixed date yet, but a clear work plan
There is no fixed date yet when these rules will apply in concrete terms to iron and steel. According to the ESPR work plan 2025-2030, the first delegated act designating product groups is expected in 2026, with obligations following eighteen months later. Only in that delegated act will it be established which data for iron and steel are exactly public, which remain limited access, and for whom. Until that publication, there is no legal obligation to supply or disclose passport data on steel, and any statement about the precise division between public and shielded for this product group cannot yet be substantiated. Once the delegated act for iron and steel has been published, that date and that division will be included here.
How to approach this in practice
Anyone who wants to prepare for this now should start by mapping out which data about a product will be legally required to be provided once the rules come into force, and which data fall outside that. That distinction is the basis: only what is required for the passport needs to be supplied, and not everything that is supplied is automatically public. A second step is to check which data are already treated as confidential in existing contracts or certification processes — that structure is often reusable when categorising passport data by access level. A third step is to ask a platform that compiles the passport, such as ferropas.eu, how the submission of data is separated from its publication, so that it is clear in advance which part of the submitted information will be visible via the QR code and which part remains limited access. Finally, it is wise to wait with definitive internal agreements on which data are and are not shared, until the product-specific implementing rules for iron and steel have been published — only then is it clear what is mandatory.
Where this is set out: Article 10 and Article 38 of the ESPR
The basis for this lies in Article 10 of the ESPR (Regulation (EU) 2024/1781), which describes the requirements for the digital product passport, including the classification of data by accessibility for different users. Article 38 of the same regulation describes the requirements for actors in the supply chain, namely who must provide which data to compile a passport. Both articles govern the provision and classification of data in general terms; the product-specific implementation for iron and steel — and thus the precise boundary between public and restricted access data for this product group — follows from the delegated act to be published.
If you want to know now which data will be relevant for a specific steel product, it is best to organize your own product data in advance by origin, composition and life cycle information, and to follow the publication of the delegated act for iron and steel to see which of that data will then be mandatory and which will be public.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 38 (requirements for actors in the supply chain)
The regulation itself can be found on EUR-Lex. We provide references for each statement; you do not have to take our word for it.
What you must concretely do
What is expected of you
The product passport makes data about a product visible to parties in the supply chain and, in part, to the general public. This raises the same question for many steel traders and metal processors: does everything we know about our alloy, our process recipe or our supplier have to become visible? The answer is more nuanced than "everything public" or "everything secret".
Only share data that the passport actually requires
Article 10 of the ESPR (Regulation (EU) 2024/1781) describes which categories of information a digital product passport must contain. This is a defined set: data needed to identify the product, its composition, sustainability characteristics and the like. It is not an obligation to share every underlying document, every process parameter or every internal calculation. For a company with 10 to 100 employees, this means in practice that a distinction can be made between the result that goes into the passport (for example a value for CO2 emissions or a composition percentage) and the underlying business operations that lead to that result. Which data exactly is required is described on the page about which data will be included in the steel product passport.
Make a distinction between what is public and what is visible only to certain parties
Not every piece of data in the passport is equally visible to everyone. The ESPR provides for layered access: some information is for the general public, other information is reserved for market participants, supervisory authorities or other specifically designated parties. For a company concerned about the origin of raw materials or the precise composition of an alloy, this distinction is relevant: not everything that is recorded is automatically made public. Who exactly may see which layer is explained on the page about who may access which data from the product passport.
Provide data to the party that compiles the passport, even if it is not made public
Article 38 of the ESPR describes obligations for actors in the supply chain: manufacturers, importers and other links must provide the information needed to meet passport requirements. This is a different obligation from disclosure. A company provides data to the party that compiles the passport (in this case the platform), but that does not mean that every figure submitted also literally appears in the public display. For an SME steel trader, this means there is a distinction between "what we share internally and with our contractual partner to enable the passport to be created" and "what is ultimately visible in the QR code for a random reader".
Avoid traceability to a specific recipe or supplier where this is not necessary
Much business sensitivity in the steel sector lies not in the final value, but in the way to get there: which supplier delivers which scrap, in what proportion alloying elements are added, or which melting process is used. The passport requirements ask for results and characteristics of the product, not for a reconstruction of the production process in detail. This means that the proportion of scrap in the melt must indeed be recorded, as described on the page about the proportion of scrap in the meltbut this is separate from the question of whether the identity of every individual supplier of that scrap must also be disclosed.
Where things go wrong in practice
A trader submits the complete internal quality file, including process parameters that were never intended for the passport, when filling in the passport form, for fear of missing something.
A construction company refuses to pass on alloy percentages to the party that compiles the passport, for fear that this will automatically become public, while submission to that party is something different from publication.
An importer assumes that because the origin of a certain batch of steel is sensitive, it does not need to be recorded at all — while recording and public visibility are two different matters.
A metal processor reflexively shares the name and address details of their own ore supplier, while the question of origin is directed at other information; see the explanation about recording the origin of iron ore.
A company assumes that competitors can see exactly via the passport how a specific steel type has been produced, while recording of steel type and standard — explained on the page about recording steel type and standard in the product passport — has a different scope than a full process description.
What you can document
- An overview of which data the company supplies to the party that compiles the passport, separate from what ultimately becomes publicly visible.
- An internal agreement on who within the company decides which process data is or is not shared with chain partners.
- A recording of the source and substantiation of each figure that ends up in the passport, so that it is kept separate from the broader company documentation.
- Agreements with suppliers about which data they supply and in what form, so that no more is shared than necessary.
- A file in which a distinction is made between data that falls under the public layer of the passport and data that is only visible to specific parties.
This is not legal advice. This page provides general information about the legislation that this platform deals with. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-08-22. Is something not right? Let us know — corrections are given priority.