How often must I update the data in the product passport?

What you must concretely do

What is expected of you

The ESPR stipulates that the digital product passport remains linked to the specific product and that the information contained in it remains available as long as that product is on the market and for a period thereafter. What the regulation does not do is prescribe a single fixed update frequency that applies to all product groups simultaneously. Articles 9 and 10 of the ESPR (Regulation (EU) 2024/1781) establish the basic structure: which data must be accessible, who has which role in its management, and that changes to the passport must be traceable. The precise update rhythm for steel and other metals is laid down in the delegated act that is established per product group — that text does not yet exist.

Data that belong to manufacturing remain linked to that batch

Part of the information in the passport is fixed at the moment of production: the steel grade, the standard to which it complies, the composition. These are not data that "become outdated" in the ordinary sense — they belong to that specific batch and do not change over time. For a metal processor of medium size, this means that this part of the passport is in fact stable after delivery, as long as no errors come to light. How that documentation looks is described on the page about how you record steel grade and standard in the product passport.

Data that depend on the use phase require a different rhythm

Other fields in a product passport — think of data on repair, reprocessing or final disposal — by definition have a lifespan that is longer than the moment of sale. The ESPR states that the passport must remain usable during the relevant lifespan of the product, which in practical terms means that a company with ten to a hundred employees must take into account that a passport is not only compiled at delivery, but may possibly be supplemented at a later stage if something changes to the product or how it can be processed.

Corrections must be traceable, not silent

What does explicitly emerge from the regulation is that changes to the passport must be traceable: not that an old value is simply overwritten without trace. For a company, this practically means that a correction to, for example, a measured value is not a matter of "adjusting the figure", but of recording when and why a value was changed. This also touches on the question of how a measured value came about — see the explanation about the method by which values for the passport are measured — because an adjustment without a clear measurement method is difficult to justify.

The responsibility for updating lies with whoever compiled the passport

The ESPR identifies the market participant who has had the passport drawn up as the party responsible for the accuracy of its content. This does not change once the passport is online. For a company that has its passports compiled and hosted by a third party, such as through this platform, this means that its own responsibility remains to communicate relevant changes — hosting the data is a different role than being substantively responsible for its accuracy.

Where things go wrong in practice

A common situation that often comes up: a manufacturer makes a slight adjustment to the composition of a steel alloy between two production runs, but the passport of the earlier batch is not corrected because it is assumed that it is about "the same type of steel". For the passport, however, each batch is a separate registration.

A second situation: a trading company purchases steel, passes on the product passport to the next party in the chain, but does not communicate its own processing operations (such as cutting or surface treatment) to whoever manages the passport. If that processing is relevant to data contained in the passport, a discrepancy arises between what the passport shows and what has actually happened to the product.

A third: a company assumes that the passport is 'complete' after delivery and never needs to be reviewed again, while new test results become available internally — for example regarding the scrap content in the melt, see how the scrap content in the melt is recorded — which are not communicated because no one regards that as an 'update', but rather as separate administration.

A fourth: an importer assumes that the inspection certificate 3.1 that belongs to the batch automatically keeps the passport current, without checking whether that certificate and the passport present the same information in the same way. The relationship between those two documents is explained on the page about how an inspection certificate 3.1 relates to the digital product passport.

A fifth: a company changes a value in the passport without recording who communicated the change and on the basis of which document, so that when a customer later inquires, it is no longer possible to trace why a figure differs from an earlier version.

What you can document

• An internal agreement on who within the company is authorised to have changes made to a passport, and on which event that occurs (new measurement, changed composition, corrected origin data).
• A log per batch recording when the passport was compiled, on the basis of which underlying documents, and whether and when adjustments were subsequently made.
• A fixed procedure for when new test results or certificates arrive, so that it is clear whether and how those are communicated to whoever manages the passport.
• Agreements with suppliers and customers on who supplies which data and at which point in the chain — this connects to the question who may access which data from the product passport, because updating and access often go hand in hand.
• An overview of which fields in the passport are static (fixed at production) and which fields may be completed at a later stage, so that it is internally clear where attention remains necessary.