What happens if the QR code is missing
The regulation for the digital product passport will soon require not only that data on a steel or iron semi-finished product exists, but also that this data is findable via a data carrier on or with the product. In practice, this is usually a QR code. If this code is missing, there is admittedly a passport, but no one in the chain can find it when it is needed: during an inspection, during a re-evaluation, or when the next link in the chain wants to assess the material.
The consequence is therefore not that the passport "does not exist", but that it becomes practically unusable. Supervisory authorities assess this type of obligation by asking whether the information is actually accessible to those entitled to it, not only whether a file with data is stored somewhere. A passport without a functioning data carrier therefore does not meet what the regulation intends by the link between product and information.
Why the data carrier is a separate obligation
The passport and the data carrier are two related but separate parts in the regulation. The passport is the collection of data; the data carrier is the way in which someone can consult that data for the physical product. Whoever only collects the data and puts it online somewhere without a clear, functioning link to the product has not fulfilled the practical purpose of the regulation. This distinction also appears in the concepts used by the regulation, and which are clarified per situation in the knowledge base explained.
This also means that a QR code that has been affixed but no longer works, no longer refers to the correct data, or is no longer maintained after the business is sold, leads in practice to the same problem as a QR code that was never there in the first place. The regulation does not ask for a code as a formality, but for functioning access for the entire period it is required.
Consequences in the chain
Whoever processes or resells steel or iron often needs the data from the passport to meet their own obligations, for example when preparing their own product passport for a composite product. If the data carrier is missing from the purchased semi-finished product, that information must be requested in another way, which costs time and does not always succeed within a delivery period. For procurement and contracts, this is a reason to discuss in advance who provides which information and how it reaches the product.
Consequences in supervision
The supervisory authority in the Netherlands and the supervisory authorities in other EU countries have not yet been definitively designated for this regulation. What does follow from the design of the regulation is that supervision focuses on whether the required information is available and findable at the time of inspection. A missing or non-functioning data carrier is then one of the first things that stands out, simply because it is the first step towards the rest of the information. On how that will concretely be enforced and what consequences that may have in each case, this article deliberately makes no prediction; that is for the supervisory authority and, in an individual case, for a legal professional to determine.
What is not yet established
The exact requirements for the data carrier, and the precise date on which the obligation takes effect, are not yet fixed. The European Commission's work plan provides for a first delegated act for iron and steel, with obligations that take effect a number of months later. Once that act is published, the date and the reference to the official text will be added here. Until then, it is useful to know that the obligation is coming, without there being a fixed calendar date to pin down yet.
What you can do now
Even without a definitive date, it is worthwhile to determine now which data you will need later, who in your chain will supply it, and how you couple a QR code to a product in a sustainable way so that it remains usable for ten years. The latter is precisely where hosting and data carrier come together: a code that points to a page that someone set up at some point is less durable than a code that points to a managed, current source. More on how that coupling works in practice is on the page on how the information is prepared.
Do you want to get an initial picture of where your company stands in relation to this obligation, without having to read the entire regulation first? Take the free quick-scan at in a few questions see where you currently stand, or read the shortest answers to frequently asked questions on the page with frequently asked questions.