how do I know if data from my foreign supplier is correct
Trust alone is not enough, verification is
Data from a supplier outside the EU must not simply be taken over without any form of control — whoever imports the steel bears their own responsibility for this. This does not mean that every figure must be tested in a laboratory, but rather that there must be a reasonable basis to assume that the data are correct: consistent documentation, recognisable test methods, and a data set that logically matches the type of product. Whoever imports steel from outside the EU and resells it is treated for the product passport as the party bringing the data to the market — and that position entails more to verify than if that same party had resold the product only within the EU.
For importers this weighs more heavily than for traders within the EU
This question applies particularly to the party fulfilling the role of importer: the one bringing the product to the EU market for the first time from a country outside the Union. For those buying steel from a supplier already established within the EU, the responsibility for the accuracy of the underlying data lies primarily with the manufacturer or its authorised representative — the EU supplier in the chain then takes over that data. For an importer it is different: that party stands at the beginning of the EU chain and has no other EU party before it to rely on. This distinction is relevant, because the question "can I trust this" therefore has a different answer depending on whether someone is a trader within the EU chain, or the one bringing the product into the EU. What this article does not describe: exact test protocols or a concrete checklist for visual inspection of documents — that varies by product type and by delegated act and has not yet been defined EU-wide.
No fixed date yet, but a fixed direction
There is no definitive date yet on which these obligations for steel will take effect; that is laid down per product group in a delegated act, and that has not yet been published for iron and steel. See when the passport becomes mandatory for steel for the status of that process. What is already established is the principle: as soon as the passport is mandatory, importers must be able to demonstrate that the product meets the requirements applicable to it, and must keep relevant documentation available to supervisory authorities. Until that obligation takes effect, there is no legal obligation to verify passport data from a supplier outside the EU — but trading practices and contractual agreements on data delivery can already be prepared now, precisely because making good agreements takes time and cannot be done overnight.
How to approach this in practice
If you are already working with a supplier from outside the EU and want to prepare for this, start by establishing exactly which data are needed — see the list in which data are requested from a steel supplier for an overview that applies to every supplier, inside or outside the EU. Next, it is useful to look at how that data delivery is secured contractually, because an oral promise is difficult to prove later on; recording agreements in the purchase contract describes how that works. Then comes the actual verification question: how is it established whether the data received are plausible and complete, what other signals there are beyond simply "it is on the certificate" — that is elaborated in verifying data for accuracy. For the specific position of the importer, including what a customs authority can control upon import, there is a separate section on importing steel from outside the European Union. If you notice that a supplier consistently fails to provide or provides incomplete data, in what to do if a supplier does not provide data you will find the follow-up steps that apply.
Basis: Articles 15, 29, 39 and 40 of the ESPR
Article 29 of the ESPR (Regulation (EU) 2024/1781) describes the obligations of importers, including ensuring that a product is accompanied by the required documentation and that the product meets the applicable requirements before it is placed on the market. Article 15 governs customs controls that specifically relate to the digital product passport when products are brought into the EU, meaning that an importer should be aware that a customs authority may consult and verify that data. Article 39 addresses the test, measurement and calculation methods used to determine whether a product meets the requirements — relevant to the question of how the "accuracy" of data is actually established. Article 40 finally focuses on preventing circumvention and deterioration of performance, indicating that the regulation deliberately takes into account the possibility that data does not correspond to reality, and is structured accordingly.
What to do now
If you are already doing business with a supplier outside the EU, it is best to start by recording which data will be needed and how they will be provided, so that when the obligation comes into force, you do not have to start from scratch — the pages above on requesting data, laying it down contractually and checking for accuracy form a logical sequence for this purpose.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 15 (customs controls relating to the digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 29 (obligations of importers)
- Regulation (EU) 2024/1781 (ESPR), Article 39 (test, measurement and calculation methods)
- Regulation (EU) 2024/1781 (ESPR), Article 40 (prevention of circumvention and degradation of performance)
The regulation itself can be found on EUR-Lex. We provide references for each statement; you do not have to take our word for it.
What you must concretely do
A steel trader who purchases profiles or sheet material from a producer outside the EU receives data that the trader itself has not been involved in: no visibility into the melt, the rolling mill or the laboratory where the tests were carried out. Yet that same trader, at the moment they act as an importer, becomes the one responsible for what is in the passport. This is the core of the question: trusting data on paper is different from being able to demonstrate that it is correct.
What is expected of you
Checking that the passport is present and complete
Article 29 of the ESPR (Regulation (EU) 2024/1781) describes the obligations of importers, and this includes checking whether the product is accompanied by the required digital product passport and whether that passport contains the data required by the applicable rules. For a company with 10 to 100 employees, this means in practice that there is someone — not necessarily a separate function, often the purchasing officer or the quality officer — who checks with each shipment whether the passport is present and whether the fields are filled in that apply to that type of steel product. Which fields exactly apply is described on the page on which data you must request from your steel supplier.
Not placing on the market products known not to comply
The same provision also means that an importer who knows or can reasonably suspect that a product does not meet the requirements must not put it on the market until it is compliant. This requires a certain level of vigilance: if a passport is evidently incomplete, or if figures for composition or mechanical properties do not match what is customary for the type of steel, "we received the passport" is not automatically sufficient.
Testing, measuring and calculating according to prescribed methods
Article 39 of the ESPR addresses the methods by which product properties are tested, measured or calculated. For an importer who does not test themselves, this mainly means that it can be checked whether the supplier has worked according to the method prescribed for that product characteristic, rather than using their own or a different test method. In practice this is difficult to assess without the supplier providing information about it — hence the importance of recording which method was used, not just what the outcome was.
Taking customs controls into account at import
Article 15 of the ESPR stipulates that customs authorities may check upon entry of products from third countries whether the digital product passport is present and accessible. For an importer, this means that border delays are a real consequence of a passport that is incorrect or not retrievable, regardless of what further controls may occur later in the supply chain. What this specifically means for the import of steel is set out on the page on import of steel from outside the European Union.
Guarding against circumvention and degradation of performance
Article 40 of the ESPR is aimed at preventing products from being designed, tested or reported in such a way that their actual performance appears more favourable than it is, or that rules are circumvented. For the practice of a trading enterprise, this translates primarily into vigilance: data that systematically fall just within a standard, or test results that are strikingly favourable compared to similar products, are not proof of fraud, but they are a reason to ask further questions.
Where things go wrong in practice
A supplier delivers a passport with data that have been taken from an older certificate of another party, without it being clear whether those data belong to the current batch. Nobody on this side of the border notices this, because the passport looks complete.
An importer receives test results, but not the indication of which test method was used. Upon inspection, the method used turns out not to be the method prescribed for that characteristic under Article 39 of the ESPR, whereas the result seemed plausible at first sight.
With a shipment from a third country, the passport is present, but not retrievable at the time of customs control as referred to in Article 15 of the ESPR — the QR code refers to a server that does not respond at that time. The delay that results from this is not caused by incorrect data, but by a technical problem that nobody had tested.
A trading enterprise purchases the same steel type from two manufacturers in different countries and combines the batches into one delivery to the customer. The passports of both manufacturers use slightly different units or rounding, which leads to a discrepancy when combining that nobody had noticed. How this combination can be done carefully is set out on the page on combining data from multiple suppliers.
An importer relies on the reputation of the supplier and omits substantive inspection of the passport, because 'that supplier has been delivering good work for years'. Reputation says something about the likelihood of errors, but nothing about what is found in a concrete inspection.
What you can document
- A fixed procedure in which it is checked for each shipment whether the passport is present and complete, using a fixed checklist per product group.
- An overview of which test method was used for which piece of data, separate from the result itself, so that it can be traced later whether Article 39 of the ESPR was followed.
- Correspondence with the supplier in which it has been established who is responsible for the accuracy of which piece of data — a good time to arrange this is when drawing up the purchase contract, as described on the page on agreements on the delivery of passport data in the purchase contract.
- A fixed sample inspection, for example by comparing data from the passport with an independent certificate or test report, as set out on the page on checking data for accuracy.
- A log of customs controls and their outcome, so that a pattern of problems with a specific supplier or route becomes visible before it leads to repeated delays.
This is not legal advice. This page provides general information about the legislation that this platform deals with. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, verified by a human on 2026-09-05. Is anything incorrect? Let us know — corrections are given priority.