Can I arrange the digital product passport for steel myself?
Yes, technically you can compile the digital product passport for steel yourself: gather the data, create a QR code and link it to a product. Whether that makes practical sense depends on three things: do you already have your data in order, do you have someone who can build and maintain the technical side, and can you guarantee that the passport will still be there in ten years?
The difference does not lie in whether you are allowed to do it — the regulation does not prescribe a mandatory provider — but in what still needs to happen after the first version. A passport that is created once and then never updated, hosted or checked again is not a passport but a snapshot.
What goes into the passport in terms of content
The passport for iron and steel consists of data that is largely already with you or your supplier: composition, origin, certificates, and data on recycling content or CO2 footprint to the extent these are already being kept. You can read which documents are needed for this in the knowledge base with explanations per topic; here the question is who compiles it and where it remains afterwards.
You can usually organise the collection of that data yourself, or together with your supplier. It is mainly administrative work: checking which certificate belongs to which batch, and what data is still missing.
Doing it yourself: where that is practical
For companies with a limited number of product lines that already have their own system for certificates and batch data, compiling the content of a passport can often be done with your own staff. Looking up and organising data is not specialised work; it mainly requires time and overview.
Creating a QR code is also not a technical hurdle in itself: that can be done with simple software. The question is not whether you can create a QR code, but whether the page that code points to will still exist years later, with the same content retrievable, and can be updated if something changes.
What often falls outside your own scope
Three components are more difficult to organise yourself. First, long-term hosting: the regulation requires that the passport remains available, even if your company switches software providers or moves a website. A link that produces an error message after a few years no longer meets the idea behind the passport.
Second, the format. Digital passports must be machine-readable and align with a shared data model, so that other parties in the chain can read the data without needing someone to intervene manually each time. Coming up with a format that happens to work is different from a format that aligns with what the rest of the sector uses.
Third, continuity while the rules are still being finalised. The first delegated act for iron and steel is expected in 2026, with obligations taking effect eighteen months later; the exact date is therefore not yet fixed. As long as details are still changing, building it yourself means you have to keep track of what changes and reprocess it.
The responsibility of the supplier does not shift
Whether you compile the passport yourself or have it compiled, the role of supplier — usually the manufacturer or importer — remains with the same party. Outsourcing the technical work does not mean the responsibility for the accuracy of the data moves with it. Whoever provides the data remains responsible for its accuracy; a platform handles storage and the data carrier, not the content.
What a platform takes over, and what it does not
A platform like Ferropas compiles the product passport based on the data you provide, hosts it for the agreed period and supplies the QR data carrier. What it does not do is assess the accuracy of your source data or determine on your behalf which data the regulation precisely requires for your specific product. With a few questions you can see where you stand now and whether your situation is already covered.
When outsourcing makes sense
Outsourcing becomes more attractive as you have more product lines, switch suppliers more frequently, or lack an internal system that already keeps track of certificates and origin data. The guarantee that a link remains functional for ten years is also something that few companies can easily ensure themselves alongside daily business operations. You can read more about where that data comes from exactly and how storage works at the explanation of our working method.
So managing it yourself is not a question of being able to or not, but of what you want to continue maintaining in the long term. If you are unsure where your company stands, run through the free quick-scan or view the overview with frequently asked questions.