which supervisory authority checks the product passport in the Netherlands

What you must concretely do

What is expected of you

Whoever creates, sells or trades the steel product passport will at some point be subject to market surveillance. Regulation (EU) 2019/1020 regulates how that surveillance is set up in the EU, and Article 27 of the ESPR (Regulation (EU) 2024/1781) specifies what information manufacturers must keep available for the authorities that request it. The Netherlands must on that basis designate a market surveillance authority or designate which existing supervisory body will take on this task for products with a digital product passport. At the time of writing, it is not yet established which Dutch authority will do so for steel and iron semi-finished products — that follows from the national implementing legislation that comes after the delegated act for this product group.

Keep information available

Regulation (EU) 2019/1020 is based on a system in which a market operator can provide documentation and technical information upon request. For a company with 10 to 100 employees, this concretely means: the data in the product passport and the justification behind it must be retrievable at short notice. Not somewhere loose in an email inbox of an employee who left three years ago, but in a place where someone within the company can find them.

Know who is responsible for what

Market surveillance does not automatically target the party that actually compiled the passport — it targets the market operator who is responsible for it according to the rules. This is not the same party at every link in the supply chain. If you are unsure whether that is the manufacturer, the importer or your own company, you will find the basic distribution in who is responsible for the product passport for steel? and the more precise demarcation in am I importer or manufacturer according to the ESPR?. A trader who only resells steel has a different position again, described under What obligations does a distributor or dealer of steel have?

Cooperate with a supervisory authority request

Regulation (EU) 2019/1020 is based on cooperation: a market operator who is asked for information cooperates within the time limit set by the supervisory authority. For a mid-sized company, this means there must be someone who knows which passport belongs to which batch of steel and who can pass the request on to the right person or the right system — especially if the passport was not drawn up by the company itself but was taken over from a manufacturer outside the EU, a situation that is treated separately in my manufacturer is located outside the European Union — who regulates the product passport then?

Where things go wrong in practice

A few situations come up repeatedly with companies that deal with market surveillance, even if it is not necessarily specifically about steel:

• The QR code points to a passport that is no longer online. The hosting party has ceased operations, the contract has not been renewed, or an internal migration has gone wrong. The passport still exists on paper, but is no longer accessible as the rules require.
• No one in the company knows anymore who compiled the passport. After staff changes, knowledge about the origin of the data has disappeared, while a competent authority is precisely asking for substantiation behind a claim in the passport.
• A product is sold under a private label, but the passport obligations have never been reconsidered. Whoever repackages steel or places it on the market under their own name may end up in a different role than they thought — see I sell steel under my own brand — what obligations do I incur?
• Sales via a marketplace without it being established who supplies which information. When selling via an online platform, it may be unclear which party the competent authority should contact — this is elaborated in what does the product passport mean if I sell steel via an online marketplace?
• The passport exists, but the data in it turns out to be incorrect or outdated. Then the question shifts from "is there a passport" to "who is liable for the error", a matter that is addressed separately under who is liable if there is incorrect data in the product passport

What you can document

Without the Dutch competent authority yet being known, a company can still put its affairs in order so that a request for information does not become a crisis:

• An overview of which product groups of steel the company trades or processes, and which passport applies to them.
• A documented agreement on who within the company is responsible for maintaining and retrieving passport data — even after staff changes.
• Correspondence and documentation from the manufacturer or importer on which the passport is based, kept in a fixed location and not just in an individual mailbox.
• An agreement with the hosting party (or internally) on the retention period and accessibility of the passport, including what happens if there is a change of supplier or platform.
• In case of doubt about the company's own role in the chain: a brief note documenting the reasoning on the basis of which the company considers itself a manufacturer, importer, distributor or brand owner — useful if a competent authority asks about this.

For companies wondering whether this kind of record-keeping should be done internally or can be outsourced, do I need extra staff for the product passport or can I outsource it goes into that choice. And for those wondering what actually happens if this kind of documentation is missing when the obligations take effect, there is what happens if I don't have a product passport for my steel?

As soon as the Dutch implementing legislation names the designated market surveillance authority for this product group, it will be supplemented here.