How do I approach the product passport for steel step by step?
The passport is created in five logical steps
The digital product passport for steel and iron semi-finished products does not come into being all at once, but builds itself up in a fixed sequence. First, it becomes clear which product data are relevant and must be available, then who supplies that data, subsequently how it is recorded and linked to a unique identification, then how the passport is made accessible via a data carrier such as a QR code, and finally how the passport remains available for the required period. This structure follows directly from the way the ESPR arranges the passport: Article 9 of Regulation (EU) 2024/1781 describes what a digital product passport must do in general terms, and Article 10 sets out the technical and organisational requirements it must meet. For steel and iron, there is no delegated act yet published that precisely specifies which data must be included in the passport. The steps below therefore describe the structure as it follows from the ESPR itself, not the exact content that will only be determined with that act.
For semi-finished products of iron and steel, not for every product
This structure applies to products that fall under a delegated act of the ESPR. Iron and steel are listed on the work plan of the European Commission as a product group for which such an act is being prepared, but that act does not yet exist. This means that the steps below are a preparation for something that still needs to be established, not an obligation that already applies to steel traders, metal processors or construction companies. Moreover, it concerns specifically the digital passport as described by the ESPR, not other documentation that is already customary in the steel chain, such as inspection certificates or declarations of conformity under other legislation. These documents may subsequently provide input for the passport, but are not a replacement for it and will not be automatically replaced by it.
No fixed date yet, but a fixed timetable
No date has yet been set for when the digital product passport for steel becomes mandatory. According to the ESPR work plan for the period 2025-2030, the first delegated act is expected in 2026, after which the obligations come into force eighteen months later. This is a schedule, not a firm date: as long as the delegated act for iron and steel has not been published, there is no obligation for this product group under Article 9 or 10. Until then, a company can already examine which data about its own products are available and how they are recorded, without being bound by a legal deadline. Once the delegated act has been published, the date will be stated here.
How to approach the preparation
The way a company approaches this in practice follows the structure of the ESPR itself. First, an inventory is made of which product data already exist: origin and composition of the material, mechanical properties, production processes used, existing certificates and test results. Next, it is determined who in the supply chain is responsible for providing that data; this can be the manufacturer, but in the case of imported products, also the importer. Subsequently, consideration is given to how that data is brought together into a single digital product passport with a unique identification, so that the passport can be linked to one specific product or one specific batch. This is followed by the choice of a data carrier, usually a QR code, which is affixed to or placed with the product and which provides access to the passport. Finally, arrangements are made for how the passport remains accessible during the required period, even if the product changes owner in the meantime or is further processed. Platforms that support this process, such as Ferropas, typically take responsibility for assembling the passport from the supplied data, hosting it and providing the data carrier, so that a company itself remains primarily responsible for providing correct and complete product information.
The legal basis: articles 9 and 10 of the ESPR
Article 9 of Regulation (EU) 2024/1781 stipulates that for products falling under a delegated act, a digital product passport must be available, and describes in general terms what that passport must do: make information about the product accessible to the parties entitled to it, for the duration of the product's life. Article 10 elaborates on this further with concrete requirements: the passport must be linked to a unique product identification, be accessible via a data carrier, meet interoperability requirements with other systems, and remain available to the parties that must have access according to the regulation. Both articles leave the precise content – which data, in which format, for which product category – to the delegated acts established per product group. For iron and steel, that act does not yet exist, which means that the steps in this article follow the structure of the ESPR, and not the details that will only become concrete with the delegated act for steel.
If you want to prepare now, it is best to start by organising the product data that is already available – origin, composition, certificates – so that it can be quickly converted into a passport once the delegated act for steel is published.
What this is based on
- Regulation (EU) 2024/1781 (ESPR), Article 9 (digital product passport)
- Regulation (EU) 2024/1781 (ESPR), Article 10 (requirements for the digital product passport)
The regulation itself can be found on EUR-Lex. We provide references for each statement; you do not have to take our word for it.
What you must concretely do
A digital product passport does not come into being all at once. It is a chain of small, successive decisions: what should be in it, who supplies the data, who prepares the passport, and how does the QR code end up on the steel. Anyone who puts these steps in order prevents everything from having to happen at once in the last month before the obligation becomes mandatory. Below is what such a process typically involves, based on Articles 9 and 10 of the ESPR (Regulation (EU) 2024/1781), which lay down what a digital product passport must contain and what technical requirements it must meet.
What is expected of you
Determining whether the product falls under the scheme
Not every steel semi-finished product automatically receives a product passport; this is worked out per product category in delegated acts. For a company with 10 to 100 employees, this practically means that the first step is not "make a passport" but "find out which products in the assortment will later fall under the scheme". That is a matter of laying your own product catalogue alongside the upcoming delegated acts. If you are in doubt about this, you will find more detailed information on Does the digital product passport apply to my steel?.
Collecting data at source
Article 9 of the ESPR mentions product information such as origin, composition and processing characteristics as part of the passport. For a trading company, this means that the data is usually not produced in-house, but must be supplied by the manufacturer or importer. In practice, this is often the most time-consuming step: finding out which supplier already records which data, and which data is missing.
Having the passport put together technically
Article 10 of the ESPR sets requirements for the format and accessibility of the digital passport: it must be readable via a data field structure that machines can process, not just a PDF with text. For a medium-sized company, this means that a technical intermediate step is needed between "the data is there" and "the passport is ready" — that is precisely the part that a platform like this fills in.
Applying and linking the QR code
The passport must be traceable to the physical product via a data carrier, in practice a QR code. That requires a physical step on the shop floor: the code must end up on the product, the packaging or the accompanying documentation, and remain linked to the correct batch of steel. For larger volumes or multiple production locations, this is a logistical matter in itself; anyone who operates multiple locations should arrange this link separately per location.
Keeping the passport available for ten years
Article 10 also addresses the period during which a passport must remain accessible. This is not a one-time action but an ongoing obligation: someone must ensure that hosting, links and accessibility continue to work for years, even if the passport provider changes in the meantime or the company itself switches systems.
Where things go wrong in practice
A number of situations come up repeatedly in practice.
The data arrives late. A manufacturer supplies the composition of a batch of steel only after shipment, while the passport should have been there at the time of delivery. This is primarily a chain problem: the passport cannot be ready before the data on which it is based.
The QR code is kept separate from the product. A sticker with a code is in the administration, but has never been applied to the bar or coil itself. Once the product leaves the premises, the link between passport and physical product is gone.
No one has practised the process before the first real batch. The first passport is put together in a rush, with errors that would have been caught in a quiet trial run. A test run beforehand, as described on Can I already have a test version of my product passport madeprevents the first time from being the most important time at once.
The QR code is damaged during transport or storage, and there is no procedure to replace it without losing the underlying data. See on this point What should I do if the QR code on my steel is damaged.
The shop floor staff do not know what is expected of them. Someone preparing packages of steel for shipment must know when a QR code should be applied and who to contact if the data is incorrect. Without shop floor training, an error does not occur in drawing up the passport, but in its implementation — see How do I train my staff to work with the product passport.
What you can document
A number of matters are good to set down on paper in advance, even though the definitive obligation is not yet established:
- An overview of products and product groups, together with an assessment of whether they may fall under a future delegated act.
- A list of suppliers and the data they (do not yet) provide, so that it is clear where the chain still has a gap.
- An internal agreement on who is responsible for applying the QR code on the shop floor, and who arranges replacement in the event of a damaged code.
- A test report of a pilot passport, including the errors that emerged in the process and how they were resolved.
- A training overview of who on the shop floor has been instructed, and when.
- A cost estimate, so that a future obligation does not come as a financial surprise; an initial indication is on What does a product passport for steel cost?.
- A check as to whether there is already a sector standard which can be aligned with, to be found via Is there already a sector standard for the product passport for steel.
Those who already have these documents ready will not have to start from scratch when the first delegated act is published — only the final steps of the process will then need to be taken.
This is not legal advice. This page provides general information about the legislation that this platform deals with. We do not know your situation. If you are in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-08-22. Is something not right? Let us know — corrections are given priority.