What does a supervisory authority ask for during a steel inspection?

What you must concretely do

A market surveillance authority inspection does not proceed as an unannounced raid in practice, but as a request for documents and data. The powers for this are laid down in Regulation (EU) 2019/1020, which applies to product control throughout the EU and not only for steel. This regulation sets out what a surveillance authority may request, from whom, and what a company must keep available. For the digital product passport, this is supplemented by the implementation in Article 27 of the ESPR (Regulation (EU) 2024/1781), which describes the obligations that lie with the manufacturer. What this means in practice for a trading company or steel processor is primarily a matter of being able to demonstrate what has already been done.

What is expected of you

Demonstrate documentation on request

A surveillance authority first of all requests access: what information belongs to this product, and can it be traced back to a specific batch or delivery. Regulation (EU) 2019/1020 gives the surveillance authority the power to request that information from the party responsible for the product on the market. For a company with 10 to 100 employees, this means above all that the administration must be in order: not only the passport itself, but also the underlying data from which the passport has been compiled. Those who still need to set up this process will find an overview of the steps in how do I approach the steel product passport step by step.

Demonstrate product origin and identity

A second recurring point is the question of whether a product actually falls within the scope of the digital product passport, and if so, which category and which rules apply to it. This is not self-evident for every semi-finished product. The question of whether a specific batch of steel falls within the scope is addressed in does the digital product passport apply to my steel. A surveillance authority posing this question expects a substantiated answer, not an assumption.

Accessibility of the QR data carrier

Article 27 of the ESPR describes that the manufacturer is responsible for keeping the product information available via the carrier linked to the product. In practice, this means that a surveillance authority can ask to scan the QR code and check whether the data is correct and current. A damaged or unreadable code is then a practical problem: what to do about it is described in what should I do if the QR code on my steel is damaged.

Timeliness and accuracy of the data

The passport must not only exist, it must also be correct at the time of inspection. A surveillance authority comparing data with the physical batch of steel looks for discrepancies between what is stated in the passport and what was actually delivered. For a company with multiple locations, this is an additional point of attention, because data compiled at one location must also be consistent at other locations; how to organize this is described in how do I arrange the product passport if I have multiple locations.

Cooperation and timely response

Regulation (EU) 2019/1020 assumes that a company responds reasonably quickly to a request for information. This requires an internal route: who is the point of contact, who can provide the data, and is this known to everyone on the work floor. Staff working with the passport must also know what happens if a question from a surveillance authority comes in; how to train for this is described in how do I train my staff to work with the product passport.

Where things go wrong in practice

A first recurring situation is that the passport exists, but nobody in the company knows exactly where the underlying data comes from. If the surveillance authority asks about the source of a specific value, this creates delay, because it must first be determined which supplier or department provided that data.

A second situation is inventory that was already purchased or produced before the rules came into force, and for which no passport has been drawn up. The question of what to do with it then inevitably comes to the table; a starting point for an answer is in what do I do with steel inventory that is already there when the rules come into force.

A third situation is a QR code that no longer scans, for example due to wear and tear during transport or storage. If that is only discovered during an inspection, it is too late to fix it calmly.

A fourth situation is that different locations of the same company have each developed their own working method, causing the passport of the same product group to look different per location. This stands out to a supervisory authority visiting multiple locations of the same undertaking.

A fifth situation is that a company assumes that the rules do not yet apply because the final date has not been set, and therefore has not prepared anything. What can be done in the meantime is described in what can I do now while the rules are not yet final.

What you can document

• An overview of which product groups and batches of steel fall under the digital product passport, and on the basis of which data that assessment was made.
• The origin of the data contained in each passport: which supplier, which internal department, and when it was provided.
• An internal routing procedure in case a supervisory authority requests access: who receives the request, who provides the documentation, within what time.
• An inspection procedure for the QR data carrier, including what to do in case of damage or illegibility.
• Agreements between locations on a uniform working method, especially if the passport is compiled or managed at multiple locations.
• A training overview of who within the company has been instructed about the passport and how to handle an inspection.
• A test version of the passport, drawn up before the obligation takes effect, to see whether the data and the data carrier match what a supervisory authority would expect; how to organise that is described in can I already have a test version of my product passport made.

What is recorded here is not intended as a legal defence against a specific inspection outcome, but as a way to be able to respond quickly and completely when asked.