Digital Product Passports with LLMs: extracting and assembling ESPR data

A Digital Product Passport is a structured record about a product, reached through a data carrier on the product and registered in an EU registry, that a product group’s delegated act under the Ecodesign for Sustainable Products Regulation will make a condition of market access. Digital product passport data extraction is the part of the work an engineering team actually owns: finding each required value in ERP data and supplier evidence, proving where it came from, and reporting what is missing.

This article covers where the DPP stands in October 2026, what a DPP record is legally and technically, where the data lives, where large language models legitimately help and where they must not, build versus service provider, the business case and a readiness checklist. It is not legal advice.

Where does the Digital Product Passport stand in October 2026?

The infrastructure exists and the first hard deadline is batteries; the product-group obligations under ESPR are still ahead. The EU DPP registry has been operational since 20 July 2026, six harmonised standards were cited on 14 July 2026, battery passports apply from 18 February 2027, and as of mid-October 2026 the Commission’s page still lists the first ESPR product delegated act, iron and steel, as planned for adoption in Q4 2026 (European Commission).

The 18-month floor is in the regulation itself: Article 4(4) of ESPR says a delegated act may not apply earlier than 18 months after it enters into force (ESPR). So for iron and steel the obligation cannot start before mid-2028, and the Commission says economic operators will have a transition period of at least 18 months. What to start now is the data inventory, because evidence chasing with suppliers takes longer than any software build.

What is a DPP record, legally and technically?

Legally, it is a market-access condition with an accuracy duty. Article 9(1) of ESPR says information requirements shall provide that products can only be placed on the market or put into service if a digital product passport is available, and that its data shall be accurate, complete and up to date. Technically, it is a record behind a persistent unique identifier, carried on the product, in open machine-readable formats, at model, batch or item granularity as the delegated act decides.

• Annex III is a menu, not a field list. It names the elements a delegated act selects from: the unique product identifier, the GTIN, commodity codes such as TARIC, compliance documentation, manuals and safety information, manufacturer and importer identifiers including EORI, and the reference of the DPP service provider that hosts the back-up copy. The concrete field list per product group only exists once that group’s act is adopted.
• Back-up and persistence. Article 10(4) requires a back-up copy hosted by an independent DPP service provider, and the passport must stay available even after the operator’s insolvency.
• Registry and customs. Article 13 sets up the registry, which stores at least the unique identifiers and, for customs, the commodity code; Article 15 makes release for free circulation conditional on electronic verification of the registration identifier and commodity code.

The technical layer is standardized. Implementing Decision (EU) 2026/1736 cites six harmonised standards, EN 18216 to EN 18223 covering data exchange, identifiers, data carriers, storage and persistence, APIs and interoperability (EUR-Lex). For the data carrier, GS1 Digital Link turns a GTIN plus batch or serial into a URL that is also a barcode payload, now at URI syntax 1.7.0 and declaring conformance with ISO/IEC 18975:2024 (GS1). The battery passport is the working precedent: Article 77 of the Battery Regulation separates public data from data for authorities and for persons with a legitimate interest (EUR-Lex).

Where does DPP data come from?

From systems you already run and from documents your suppliers send, and the real work is sourcing, not publishing. Identifiers and commodity codes sit in the ERP and the bill of materials; material composition and recycled content sit in PLM and supplier declarations; substances of concern often already exist as SCIP notifications; energy data, environmental product declarations and, for steel and aluminium, CBAM emissions communications cover further fields.

SCIP is a useful example of data that already has a European home: since 5 January 2021, any supplier of an article containing a Candidate List substance above 0.1% by weight must notify ECHA’s SCIP database with defined fields, including the article identifier and a TARIC-based article category (Publications Office). The output of this stage is a gap inventory per SKU: for every candidate field, where the value lives, who owns it and whether evidence exists. Much of it starts in the same plumbing as the Pimcore ERP delta sync, and the supplier side is the same intake problem as supplier data onboarding.

What can an LLM do for DPP data, and what not?

It can extract, normalize and detect gaps; it must never generate a value. The model reads supplier declarations, datasheets and test reports, fills a strict schema per field with the exact character span it read the value from, maps units and categories to the code lists in the registry’s semantic repository, and returns “gap” as a first-class result when the evidence is not there.

[
  {
    "sku": "AL-PROF-40x40",
    "field": "recycledContentShare",
    "status": "extracted",
    "value": { "amount": 35, "unit": "percent" },
    "evidence": {
      "document": "supplier-declaration-2026-07.pdf",
      "sha256": "c41e…",
      "page": 2,
      "span": [1184, 1261],
      "quote": "Recycled content (pre- and post-consumer): 35 %"
    },
    "extractor": "decl-extract-v7"
  },
  {
    "sku": "AL-PROF-40x40",
    "field": "carbonFootprint",
    "status": "gap",
    "value": null,
    "reason": "no EPD or supplier figure found for this alloy",
    "action": "request from supplier S-0217"
  }
]

The reason for the strictness is a number. Vectara’s public hallucination leaderboard, updated 16 October 2026, measures how often models add unsupported content when summarizing a given source: the best model tested sits at 1.8%, mid-pack models at 5 to 10%, and some flagship reasoning models above 10% (Vectara). That is the easiest task in this pipeline, grounded summarization, and the error rate is still not zero. A registry-grade record therefore needs provenance per value, a reviewer for anything the model was not sure about, and a hard rule that missing means missing; the grounding techniques are covered in LLM hallucination, grounding and citations. My jev-decide skill uses the same routing for its own decisions: high confidence goes ahead, low confidence goes to a human.

Versioning follows from the same regulation: each new version of a passport links to the original registration identifier and every update is time-stamped. Keep the extraction, the evidence hash and the reviewer’s decision with each version, so the history of a value can be reconstructed years later; registration data without another retention rule is deleted after ten years.

Build on your PIM or use a DPP service provider?

Usually both: the PIM and ERP assemble and version the canonical record, and an independent DPP service provider hosts the back-up copy that Article 10(4) requires. The real decisions are where the record is assembled, who registers it in the registry, and who maintains the API contract defined by the harmonised standards.

Only verified economic operators may register or modify passports, with identity established through a qualified electronic signature or seal or a high-assurance eID valid for up to three years, and the registry keeps a reference list of verified service providers. For reference implementations, the EU-funded CIRPASS-2 project runs 13 pilots across textiles, electronics, tyres and construction and publishes vocabularies and open-source tooling (CIRPASS-2). In more than ten years of PIM work with Spryker and Pimcore, my experience is that this record is mostly a PIM integration exercise: data model, workspaces and who may edit what are the same governance questions as master data, now with a registry API and a legal deadline.

What is DPP data readiness worth?

For a manufacturer or importer, it is worth market access itself. Once a delegated act applies, a product without a passport cannot be placed on the market, and an import cannot be released for free circulation until the registry entry and commodity code verify. No published study quantifies quote lift, win rates or cost per SKU for DPP work, so the numbers below are exposure, not return.

• Market size: the Commission’s working plan puts the EU market for iron and steel at €152 billion (2023), furniture at €140 billion, textiles and apparel at €78 billion, tyres at €45 billion and aluminium at €40 billion, and says the newly regulated products account for over €1 trillion in annual EU sales (COM(2025) 187).
• Public tenders: ESPR Article 65 requires green minimum requirements in public procurement, Article 74 lets Member States impose time-limited exclusion from public procurement as a penalty, and the regulation’s recital puts public procurement at 14% of EU GDP.
• Steel and aluminium: the same products already carry CBAM data duties; the definitive regime applies from 1 January 2026 and the Q3 2026 certificate price was published at €82.32 per tonne (European Commission). Emissions data collected for CBAM overlaps with what a steel passport is expected to need, though no official field mapping exists yet.

For a head of e-commerce, PIM manager or product compliance lead, the useful deliverables are measurable: field coverage per SKU, the number of open gaps, and evidence traceability per value. Structured product data also pays off elsewhere, from search to schema.org markup for B2B shops, much as accessibility work under the European Accessibility Act improved more than compliance.

When should you not use an LLM for DPP data?

Do not use one when there are no source documents, because extraction without evidence is invention. Do not use one when the value is already structured in the ERP or a supplier feed. And do not let a model decide what to do about a gap: chasing a supplier, commissioning a test or marking a product as not yet compliant are business decisions with legal weight. For small catalogs with cooperative suppliers, a structured supplier template may be enough.

A DPP data-readiness checklist

1. Map every SKU to its CN or TARIC code and to the product groups on the Commission’s plan.
2. Inventory evidence per Annex III element: where it lives, who owns it, whether it exists.
3. Decide granularity, model, batch or item, per product line once the act is known.
4. Pick identifiers and the data carrier, for example GTIN with GS1 Digital Link.
5. Build extraction with character-span provenance and gaps as a first-class result.
6. Version every record and keep evidence hash and reviewer decision per version.
7. Plan operator verification and registry enrolment, and choose a DPP service provider for the back-up copy.
8. Define who may update which field, and who signs off on a gap.

A scoped DPP data-readiness engagement, per product group, from SKU mapping and evidence inventory to an extraction pipeline with a gap report wired into the PIM, is a straight extension of B2B commerce and PIM work, not legal advice or certification. If you want to plan one, see my B2B e-commerce work.

Sources

1. Regulation (EU) 2024/1781 (ESPR), EUR-Lex
2. European Commission: Digital Product Passport
3. Commission Implementing Decision (EU) 2026/1736 on harmonised DPP standards
4. Commission Implementing Regulation (EU) 2026/1778 on the DPP registry
5. Regulation (EU) 2023/1542 (Batteries), EUR-Lex
6. Commission working plan COM(2025) 187 under ESPR
7. European Commission: CBAM certificate price
8. GS1: Digital Link standard
9. Publications Office: SCIP database information requirements
10. CIRPASS-2 project
11. Vectara hallucination leaderboard