How does the QR code for the product passport get on my steel?

The manufacturer or importer applies the code, Ferropas supplies the code itself

The QR code that refers to the digital product passport is not affixed to the steel by a public authority — that is done by the party placing the product on the market, using the data and code made available for that purpose. The process works as follows in essence: first the product data is collected and recorded in a passport, then a unique code is linked to it, and only then is that code — usually a QR code, but the ESPR also permits other techniques — physically affixed to the product, packaging or accompanying documentation. Ferropas handles the first part: compiling the passport from the data of the manufacturer or importer, hosting it, and supplying the QR data carrier itself. Affixing it to the physical steel — as a sticker, engraving, label or otherwise — is the responsibility of the party supplying the product.

Which steel this applies to, and what other matters it does not

Article 11 of the ESPR addresses the technical design and operation of the digital product passport in general; it is not specific to iron and steel. Whether and when a QR code is mandatory on a particular type of steel product depends on the delegated act established for that product group — which does not yet exist for iron and steel. Until that time, there is therefore no obligation to affix a code, only the prospect that one will be required.

It is also important to distinguish between the data carrier (the QR code that refers to the passport) and the label as referred to in Article 16. A label is a separate instrument that may exist alongside or in combination with the passport; the two do not automatically merge. Article 17 addresses something different again: preventing counterfeit labels that could be confused with a genuine label or a genuine data carrier. That article therefore says nothing about how the code comes to be on the product, but rather about protecting the system against counterfeiting.

What does not fall within this either: the QR code itself is not proof of conformity or quality. It is a reference to data — the content of that data and its accuracy is a different matter from the question of how the code physically comes to be on the steel.

The obligation is not yet fixed, only the timetable towards it

There is no established date on which QR codes must be mandatory on iron and steel products. What is established is the work programme of the European Commission for 2025-2030: the first delegated acts under the ESPR are expected in 2026, and obligations arising from them generally do not take effect until eighteen months after publication of such an act. For iron and steel, it is not yet known when the delegated act will appear or what it will contain exactly. Until that act is in place, there is no obligation to affix a QR code — although, as now, advance preparation can take place by having passport data and a data carrier ready as soon as it is required.

How this takes place in practice, step by step

The order in which this is typically addressed: first the product data is collected from the manufacturer or importer — origin, composition, and other data needed for the passport. The passport is then compiled from this and linked to a unique identification; in the case of Ferropas, that identification remains accessible for ten years. After that, the QR code is generated that refers to that passport, and that code is supplied as a file or as a physical label, depending on what is practical for the type of product.

The application itself is customized per product form: for a steel plate or profile, a sticker or engraved code may suffice, for smaller components a label on the packaging may be more practical, and for products where physical application is difficult, the code can be placed on the accompanying documentation instead of on the product itself. Where exactly the balance lies between these options will become clearer once the delegated act for iron and steel is in place — this is expected to address the technical requirements for the data carrier specific to this product group. Until then, it is advisable to know which data are available and how they are recorded, so that applying the code later is a matter of implementation and not of gathering data again.

What this is based on: Articles 11, 16 and 17 of the ESPR

That the digital product passport has a technically established data carrier follows from Article 11 of the ESPR (Regulation (EU) 2024/1781), which governs the technical design and operation of the passport. The distinction from a label follows from Article 16, which describes labels as a separate instrument. The protection against counterfeiting of those labels or data carriers follows from Article 17, on counterfeit labels. For the precise technical requirements for the QR code for iron and steel specifically, the associated delegated act is the source that has yet to be published.

What to do

Anyone who already trades or processes steel can best start by getting the product data in order that will soon need to be included in a passport — origin, composition and the like — so that applying the QR code later is a matter of implementation. Once the delegated act for iron and steel is published, the date and precise technical requirement will be stated here.

What this is based on

The regulation itself can be found on EUR-Lex. We provide references for each statement; you do not have to take our word for it.

What you must concretely do

What is expected of you

A data carrier that is readable and available

Article 11 of the ESPR (Regulation (EU) 2024/1781) requires that the digital product passport is accessed via a data carrier on the product: in practice usually a QR code. The data carrier must be physically present on the product, packaging or accompanying documentation, and must point to the data for that specific product or specific batch. For a steel trader or metal processor with 10 to 100 employees, this means the QR code becomes part of the production process itself: it must be applied somewhere between rolling, cutting or packaging the steel, and that moment must fit into the existing workflow without slowing down production.

The link between data carrier and unique identification

The QR code itself is nothing more than a reference. What lies behind it is the actual content: the data that belongs to that product or batch. This means the QR code only works if the correct, unique identification is linked behind it. How that identification is structured and what is needed for it is described at how do I give each product a unique identification code?. Without a properly functioning identification system, the QR code is an empty reference, or worse: a reference to the wrong data.

Technology that aligns with a common standard

Article 11 leaves room for the precise technical implementation, but in the sector that has been dealing with product identification for some time, a link to GS1 standards is obvious. For a company that already works with GS1 barcodes in logistics, that is a matter of expanding existing systems. For a company that does not yet do that, it is a new step. What GS1 Digital Link precisely entails and whether it is necessary is explained at what is GS1 Digital Link and do I need it for the product passport?.

Distinction from the label

Article 16 of the ESPR regulates the labelling of products, separate from the digital passport, and article 17 prohibits labels that imitate a passport label without an actual passport behind it. In practice, this is a distinction that may seem small at first sight, but is not legally: a QR code that leads to nothing, or to incorrect data, is not only a technical defect but falls under the prohibition of counterfeit labels. A company that for convenience places a "placeholder" QR code on products while waiting for the actual passport runs that risk.

Durability of the data carrier on the material itself

Steel is rolled, cut, welded, galvanised and sometimes stored for years before it is processed. The QR code must survive that entire lifespan, at least until the next user in the chain needs the data. This places demands on the method of application: a sticker that comes loose during galvanising is not a working solution, an engraved or burned-in code is — but that in turn requires sufficient readability despite surface rust or coating.

Where things go wrong in practice

The QR code is applied separately from the batch. When steel delivered in coils or bundles is cut later, the original QR code sometimes disappears along with the cut-off waste material. The remaining part then has no data carrier, even though it continues as a separate product through the chain.

One QR code for an entire batch, while the data differs per piece. When a batch of steel from the same melt but with different processing is sold, one QR code for the entire batch no longer matches the pieces that have undergone separate processing. Whether this needs to be resolved per batch or per piece depends on how the product is traded in practice; this issue is addressed at do I register steel per batch or per piece?.

The code is not readable after processing. A QR code applied before galvanizing or coating steel may become unreadable after that processing. This is often only discovered by the end user, not by the company that applied the code.

Small components offer no space for a readable code. With narrow profiles, small bolts or thin sheet metal parts, there is physically insufficient surface for a QR code that can be scanned with an ordinary mobile phone. Practical solutions for this can be found at how do I get a QR code on a very small piece of steel?.

The QR code points to a page that has since been moved or removed. When the hosting platform changes or a company switches to a different provider, the old QR code on already sold steel remains unchanged. If the underlying link no longer works, a problem arises that does not lie with the current owner of the steel, but does land with him.

What you can document

A work instruction for applying the data carrier, including the point in the production process at which the QR code is applied, the method (sticker, engraving, laser etching) and the check on readability after any post-processing.
The link between the QR code and the unique identification code of the product or batch, including how this link is checked before the product leaves the door.
Agreements with suppliers and customers about who applies the data carrier when steel changes hands before final processing, so that not two parties think the other will handle it — or neither of them does.
An overview of which data file is required behind the QR code, and in what format it is supplied to the platform hosting the passport; see in what format must I submit the data for the product passport.
A procedure for repair of damaged or unreadable codes, including who within the company is responsible for reapplying a data carrier when an inspection reveals a problem.
Evidence of the choices made, such as internal notes on why a particular technical implementation (sticker versus engraving, GS1 format versus proprietary format) was chosen — useful if it later appears that a different approach is needed and it must be demonstrated that careful consideration was given to the matter.

This is not legal advice. This page provides general information about the legislation that this platform deals with. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.

Written with AI based on the sources above, checked by a human on 2026-08-22. Is something not right? Let us know — corrections are given priority.