My supplier does not provide the data — what can I do?
The obligation remains with the manufacturer, even without data from the supplier
If a supplier does not provide the requested data, the obligation to compile a digital product passport does not disappear automatically. That obligation lies with the manufacturer or importer who places the product on the market according to the ESPR (Article 27). At the same time, the regulation also imposes its own obligation on other links in the supply chain to provide the information needed to meet the requirements (Article 38). Two obligations therefore run in parallel: the manufacturer must compile and make available the passport, and the supplier must provide the necessary data for it. If a supplier fails to do so, that is a breach by that supplier under the ESPR — but it does not exempt the manufacturer from his own obligation. The problem does not shift away, it is shared between two parties, each with their own role.
Who this applies to, and who it does not
These two articles address the relationship between parties within a supply chain of a product falling under the ESPR: the manufacturer or importer on one hand, and suppliers of materials, parts or semi-finished products on the other. It is an obligation between businesses themselves, not an obligation from a manufacturer towards an individual end customer asking for data. Moreover, it applies only to product groups for which passport obligations actually exist — this is determined per product group in a delegated act. For iron and steel, that act does not yet exist. As long as it does not, the framework of Article 27 and 38 exists as statutory text, but there are as yet no concrete, enforceable obligations for this product group specifically. It is therefore important to distinguish between the general system of the ESPR (which is already established) and the product-specific implementation for iron and steel (which is still to come).
No fixed date yet: that will follow only after the delegated act
There is no fixed date yet for when these obligations for iron and steel will take effect. The European Commission's work plan for 2025-2030 mentions 2026 as the expected time for the first delegated act, with obligations taking effect a further eighteen months after that. This is a schedule, not an established date — the act must still be published, and only then will it be clear when and for which products within iron and steel the obligations will take effect exactly. Until that time, no enforceable requirements apply to this product group to provide or receive passport data. As soon as the delegated act is published, that date will be stated here.
What to do if the data does not materialise
The first step is to check whether, apart from the ESPR, anything has already been established regarding data submission — for example in purchasing terms, a supply agreement, or previous arrangements concerning certificates and test reports. Once the ESPR obligations for iron and steel apply, the second step is to direct the supplier to their own obligation under Article 38 to provide the necessary information. It is wise to document requests and responses in writing, so that there is a clear overview of what was requested and when. In addition, it is worth checking whether the same data can be obtained via another route, for example via certificates, inspection reports, or other links in the chain that were involved with the same material. What is not wise: filling in or supplementing data yourself without substantiation, merely to complete a passport. A passport with unsubstantiated data carries its own risk, regardless of the question of who was in default. In case of persistent doubt, it is advisable to contact a trade association or the competent supervisory authority for clarification on your own situation.
Where this follows from: Article 27 and Article 38 of the ESPR
Article 27 of Regulation (EU) 2024/1781 (ESPR) sets out the obligations of manufacturers, including the responsibility for compiling and making available the digital product passport. Article 38 of the same regulation sets out the requirements for actors in the supply chain and requires them to provide the information necessary to comply with the requirements of the regulation. Together, these articles determine that the final responsibility for the passport lies with the manufacturer or importer, while the chain must cooperate by supplying the underlying data.
What to do now
At this moment, the main priority is to ensure that your own purchasing and supply agreements are in order and to document which data about material and origin are already available, so that progress can be made quickly upon publication of the delegated act. Keep an eye on the publication of that act for iron and steel, because only then will it become clear from which date which data are precisely required and what role each party in the chain has in that regard.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 38 (requirements for actors in the supply chain)
- Regulation (EU) 2024/1781 (ESPR), Article 27 (obligations of manufacturers)
The regulation itself can be found on EUR-Lex. We provide references for each statement; you do not have to take our word for it.
What you must concretely do
What is expected of you
When steel or a semi-finished product thereof becomes mandatory under the digital product passport, the composition of that passport depends on data supplied somewhere in the chain. Often it is the manufacturer, but other links in the supply chain can also play a role. The ESPR (Regulation (EU) 2024/1781) describes those roles in two articles that are both relevant to this question.
The obligation of the manufacturer
Article 27 of the ESPR describes the obligations of the manufacturer regarding the product passport: to draw up the passport, keep it current and make it available. For a company with 10 to 100 employees that purchases steel, this means primarily that the manufacturer — not the trader or intermediary — is the one from whom the data is in principle expected to originate. If a supplier is itself a manufacturer, the obligation lies there. If the supplier is a trader or distributor, then it depends on what reaches him.
The obligation of actors in the supply chain
Article 38 of the ESPR concerns the requirements for actors in the supply chain: it stipulates that whoever is in that chain must provide information necessary to comply with the product passport obligations. In practice, this means that a supplier who is not itself a manufacturer may nonetheless be required to pass on what he knows — for example origin, composition or previous processing. For a purchasing company, this is the provision that becomes relevant the moment a supplier says "I don't know that" or "you should ask the producer about that": the question then is who in the chain should actually have recorded and passed on that information.
Where things go wrong in practice
The supplier refers back to his own supplier. A trader indicates that he does not have the data and that the customer should approach the rolling mill. For a purchaser without a direct relationship with that mill, that is a dead end.
The data arrives late, or on paper only. A supplier sends a material certificate by email, while the passport requires a structured, digitally accessible set of data. Between "we sent something" and "we supplied what is needed" there is still a gap.
Part of the batch is from a different origin than stated. In mixed shipments or repeat orders, the origin of a partial shipment turns out to differ from what was stated in the original documentation, without this having been reported.
The supplier is outside the EU and does not respond to requests. Communication is slow, data is incomplete, and there is no contractual leverage to enforce delivery. This is more of an issue with imports from outside the European Union, where the importer sometimes takes on tasks that within the EU lie with the manufacturer — see what the product passport means when importing from outside the EU.
It was never established who supplies which data. With multiple suppliers for one combined batch, there is no clear agreement on who supplies which part of the passport data, so that in the event of a shortfall no one feels responsible — this is particularly an issue when data from different suppliers together must form one passport, see how you combine data from multiple suppliers.
What you can document
- A purchase contract in which the supply of passport data is included as a condition, with a description of which data, in which form and at which time are supplied. See how you record this in your purchase contract for the structure of such a provision.
- An overview of what was precisely requested from the supplier, and when. This is the first piece of evidence if a supplier later claims that nothing was ever requested — see what data you request from your steel supplier.
- Correspondence in which the supplier is addressed on the missing data, with a date and a description of what was missing. This is relevant as soon as a supervisor asks what was done when data did not arrive.
- A note of what was actually received, even if it is incomplete — including the form (certificate, digital file, email) and the date of receipt.
- A brief record of your own assessment of the received data, for example whether it matches what is stated on the physical batch. See how to verify whether your supplier's data is correct for an approach to this.
- For suppliers outside the EU: a separate note on the degree of confidence in the supplied data, and what additional steps have been taken to verify this — see how to verify whether data from a foreign supplier is correct.
This record does not undo a problem with a supplier, but shows what was undertaken at the time when data was missing. That distinction — between a supplier that does not deliver and a purchaser that does nothing about it — is often precisely what a supervisory authority's attention is directed towards.
This is not legal advice. This page provides general information about the legislation that this platform deals with. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-08-22. Is something not right? Let us know — corrections are given priority.