How long must a product passport remain available?

The retention period is not yet established in law

The ESPR requires that a digital product passport remains available, but the exact duration is not specified in the regulation itself — it is determined per product group in a delegated act. Article 10 of the ESPR (Regulation (EU) 2024/1781) places on the economic operator who creates the passport the obligation to ensure it remains accessible, and links the duration to what is agreed for that specific product group. For iron and steel, that product-specific act does not yet exist. There is therefore currently no statutory minimum or maximum number of years to specify for which a passport for steel semi-finished products must remain available — this will only be established once the European Commission publishes the act for this product group.

What Article 10 does and does not regulate

Article 10 concerns the accessibility of the passport itself: it must remain consultable, even if the product changes owner or is no longer sold. The article does not regulate the retention periods that flow from other legislation, such as technical files under CE marking rules or documentation that a manufacturer retains for liability reasons. Those obligations exist independently of the product passport and are not changed by the ESPR. Article 10 is also not about the physical product or the storage of the material itself, only about the digital data recorded about it. And the article says nothing about who bears the costs of that availability or by what technical solution it is achieved — that is up to the economic operator and the party hosting the passport.

No established date, but a clear process

There is no date to specify when this retention period for iron and steel will be established, because the relevant delegated act has not yet been published. What is established, however, is the broader process within which this will happen: in the ESPR work plan for the period 2025-2030, the first delegated act is expected in 2026, with obligations taking effect several months later. That work plan indicates the pace at which the Commission addresses product groups, but nothing specific about the duration of the availability obligation for steel semi-finished products — that follows only from the text of the act itself, once it exists. Until that time, there is no statutory obligation for a digital product passport for this product group, and therefore no statutory retention period for it.

What this means for those already working with passports

For those already working with or preparing for a product passport, the first step is to check whether a delegated act has already been published for your own product segment — as long as that is not the case, the precise retention period is simply not yet established and there is nothing specific to say about it. The second step is to keep internal documentation in order regardless of this uncertainty: data on the origin, composition and processing of steel remain relevant, whatever the statutory period ultimately established. The third step is to consider the practical side of hosting: a passport must be stored somewhere, and that choice is separate from the question of how long the law will ultimately require. Ferropas hosts passports for a period of ten years as its own service agreement — that is a commercial commitment by the platform, not an implementation of the statutory period under Article 10. Should the delegated act for steel later prescribe a longer or shorter period, that is an additional statutory obligation separate from what a platform offers as a service.

The foundation: Article 10 and the register in Article 13

This explanation follows from Article 10 of the ESPR (Regulation (EU) 2024/1781), which describes the requirements for the digital product passport, including the obligation to maintain continuous accessibility for a period to be determined per product group. Additionally, Article 13 of the ESPR is relevant, which governs the register of digital product passports: this register stores the registration data and unique identification codes, regardless of whether the passport of an individual product can still be consulted through the usual channels. This register thus forms an additional layer alongside the availability obligation of Article 10, intended to keep data verifiable for supervision and verification.

If you are now preparing a product passport for iron or steel, it is best to structure and record your own source data (origin, composition, processing steps) in advance, regardless of the statutory retention period still to be determined, and to keep an eye on the publication of the product-specific delegated act to see what period ultimately comes to be set there.

What this is based on

The regulation itself can be found on EUR-Lex. We provide references for each statement; you do not have to take our word for it.

What you must concretely do

Anyone who puts steel or a semi-finished product thereof on the market wants to know how long the associated digital data must remain accessible somewhere. This is not only an IT question ("how many years of storage do we rent") but also an organizational one: someone must ensure that those data remain accessible, even if things change internally. Article 10 of the ESPR (Regulation (EU) 2024/1781) sets out the requirement that the product passport must be available as long as it is relevant for the product in question — the precise period will be worked out per product category in a delegated act. For steel and iron semi-finished products, that act does not yet exist, so a concrete number of years cannot be given at this time.

The fact that the duration is not yet fixed does not mean there is nothing to do. The obligation to arrange in advance who is responsible for that availability, and how it is arranged, already exists.

What is expected of you

Arranging availability for the product's lifetime

Article 10 of the ESPR links the retention period to the product, not to the company. In practical terms, this means that a steel trader or metal processor with ten to one hundred employees cannot get by with "we host the passport as long as we are a customer of our software supplier". The data must remain accessible to anyone who later uses, processes or dismantles the product — even if that is years after the first sale. For semi-finished products that disappear into other products, that can be a long period. If you outsource this to a hosting provider, it is wise to arrange that contractually to align with what will later appear in the delegated act, rather than with a fixed contract term that happens to be three or five years.

Maintaining accessibility via the register

Article 13 of the ESPR requires registration of the passport in a central register. That register contains, among other things, a reference to where the passport actually is located. For a company, this means that a registration is not a one-time action: if the passport changes hosting providers, changes format, or the company itself switches infrastructure, that reference must remain correct as long as the passport must exist. What the register of digital product passports precisely records and who maintains it is therefore directly linked to the question of how long everything must remain accessible: a passport that technically still exists but whose register entry points to a location that no longer exists does not actually comply.

Ongoing accessibility, even with business changes

The obligation does not stop at a merger, acquisition, insolvency or cessation of the business that had the passport drawn up. For an SME, this is one of the less obvious consequences: the retention obligation is not linked to the continued existence of the enterprise, but to the product still in circulation. This immediately raises the question what happens to the product passport if a company ceases operations — a question that by the nature of this obligation is not theoretical, especially not in a sector with many smaller, specialized sub-suppliers.

Where things go wrong in practice

A first situation: a hosting contract with an IT supplier expires after a few years, and no one has agreed in advance what happens to the data after the contract ends. The passport effectively disappears, while the product is still in use for years.

A second: in an acquisition, product documentation is transferred, but access to the underlying system in which the product passports were stored is not. The buyer has the steel, but not the key to the associated data.

A third: a company properly registers the passport upon creation, but forgets to update the register entry when it later switches to a different system to link the data to its own ERP or inventory system. The QR code on the product then points to an address that is no longer actively maintained.

A fourth situation arises in batch registration: a batch of steel that has been registered as a batch is later split up and resold in smaller parts. If it has not been established in advance how batch versus individual product registration relates to the retention obligation per sub-delivery, it subsequently becomes unclear who is responsible for the availability of data for which part of the batch.

A fifth: a company assumes that a retention period of five or ten years (as is customary in other regulations) also applies automatically here, and arranges storage accordingly. Because the actual retention period for steel must still be determined by delegated act, that assumption cannot currently be substantiated — and the actual period could be either shorter or longer.

What you can document

A hosting agreement that does not end at the conclusion of a contract period, but explicitly provides for transfer or extension as soon as the retention period from the delegated act is known.
An internal designation of who is responsible for keeping the register entry up to date, including what must happen in the event of a system change.
A procedure for business changes (takeover, merger, cessation) in which it is established how access to passport data is transferred, not only the data itself.
An overview of which identification codes belong to which batch or which product, especially when batches are split — this is consistent with the way each product receives a unique identification code .
A file per product category with the date of registration, the hosting party used and any changes thereto, so that in the event of an inspection it can be easily demonstrated that availability has always been properly arranged.
A fixed check with each change to the data file submitted for the passport, so that it is immediately clear whether a change in the file also entails a change in the storage period.

Once the delegated act for iron and steel establishes a concrete retention period, this will be supplemented here. Until then, it is primarily a matter of properly allocating responsibility for availability itself — that part of the obligation is already established.

This is not legal advice. This page provides general information about the legislation that this platform deals with. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.

Written with AI based on the sources above, checked by a human on 2026-08-22. Is something not right? Let us know — corrections are given priority.