do I need extra staff for the product passport or can I outsource it

What you must concretely do

What is expected of you

The ESPR does not prescribe who must carry out the work relating to the digital product passport, nor does it specify whether a separate function or department must be created for it. Article 9 and Article 10 of the ESPR (Regulation (EU) 2024/1781) describe what must be included in the passport and how it must be accessible, but not who arranges this internally. This means that the question "do I need to hire someone" is not a question the regulation answers — it is a business management choice. What does follow from the legislation is a number of tasks that need to be assigned somewhere, to a person, a team, or an external party.

Submitting and maintaining data

The product passport consists of data: composition, origin, technical characteristics, and in the case of steel also matters such as the production route. This data is usually already created within the company, during procurement, quality control or production. For a company of 10 to 100 employees, this usually means no new function, but it does mean that someone — often the person who already manages material certificates — becomes a fixed point of contact for that data. Who is precisely responsible for the passport itself depends on the role in the supply chain; Who is responsible for the steel product passport? goes further into this.

Ensuring the QR data carrier stays with the product

Article 10 of the ESPR (Regulation (EU) 2024/1781) sets requirements for the accessibility of the passport via a data carrier, in practice a QR code. This is a logistics task: the code must be placed on the product or packaging and remain there, even if the material is cut, repackaged or resold. For most companies of this size, this fits within existing packaging or dispatch processes, possibly with a minor adjustment to the labelling system. A new employee is rarely needed for this; an adjustment to an existing work instruction usually is.

Assessing whether supplier data is correct

Whoever resells or processes steel often already receives a passport or the underlying data from the manufacturer or importer. The task that arises in this case is not to create the passport, but to verify that what is received matches what is passed on. This is an assessment task, not a production task, and can easily be assigned to someone who already has procurement or quality responsibility. For companies that sell steel themselves under their own brand, this picture does shift, however; I sell steel under my own brand — what obligations do I get? describes when this entails a more substantial role.

Retaining the underlying documentation

The passport itself is hosted — with us for ten years — but the documents underlying it (certificates, declarations, correspondence with the manufacturer) should remain somewhere in the company's own archives. This is not a new function, but rather a new archival discipline: something that is usually added to existing quality procedures rather than becoming a separate set of tasks.

Where things go wrong in practice

A number of situations come up repeatedly at companies that are just starting with this division of responsibilities.

No one is the owner of the matter. The passport is seen as "something of the supplier" or "something of the customer who requests it", and as a result remains stuck between departments without anyone actually checking the data.

The QR code disappears in the process. When cutting a batch of steel into smaller units, the link with the data carrier is lost, because no one has recorded in the work instruction that it must be transferred or regenerated.

An expensive solution is purchased for a small volume. Some companies immediately procure software or external services for a scale that does not match their own volume, whereas outsourcing only the hosting and the data carrier — such as through a platform like this — is often sufficient.

The role in the chain is not clear. A trader who repackages material or assigns a new item number sometimes thinks that the manufacturer's obligations remain, whereas their own role can shift as a result. What obligations does a steel distributor or trader have? describes that distinction.

Manufacturers established outside the EU are not included in the planning. If the base material comes from outside the EU, there is sometimes confusion about who supplies the data and who checks it; this leads to delays when the passport is actually needed. My manufacturer is outside the EU — who arranges the product passport then? goes further into this.

What you can document

• An internal notice of who the point of contact is for passport data — not a new function, but a clear name alongside an existing role.
• A work instruction for handling the QR data carrier when cutting, repackaging or reselling material.
• An overview of which data from which supplier are received, and who checks them before they are passed on.
• A filing agreement for the underlying certificates and declarations, linked to the retention period that already applies to quality documentation.
• A choice between managing in-house or outsourcing the hosting and data carrier, recorded in an agreement with the party that handles it.
• A brief note on your own role in the chain — manufacturer, importer, distributor or seller under your own brand — as a basis for who takes on which task; that role definition is described in more detail under Am I an importer or manufacturer under the ESPR?

These records make it easier to determine at a later time whether the work fits internally with existing functions, or whether outsourcing — of data management, of hosting, or of both — is more practical. This is a choice that differs per company and does not follow from the regulation itself.