EU Digital Product Passport (DPP) for Medical Devices: ESPR, Battery Passport, and UDI/EUDAMED Integration

The EU Digital Product Passport: A New Layer of Product Transparency

The European Union's Digital Product Passport (DPP) is a regulatory framework that requires manufacturers to create and maintain a digital record for every product placed on the EU market — containing verifiable data about what the product is made of, its environmental footprint, how long it will last, and how it should be recycled or disposed of. The DPP is mandated under the Ecodesign for Sustainable Products Regulation (ESPR), which entered into force on July 18, 2024.

For medical device manufacturers, the DPP represents a new compliance obligation that will intersect with — but is distinct from — existing EU MDR and IVDR requirements. While medical devices are not in the first wave of products subject to mandatory DPPs, the regulation will affect medical device companies through several pathways: battery-powered devices, electronics, and the gradual expansion of DPP requirements to additional product categories over time.

This guide explains what the DPP is, how it works, when medical device manufacturers will need to comply, and how it intersects with existing UDI and EUDAMED requirements under the MDR and IVDR.

What Is the Digital Product Passport?

The Regulatory Foundation: ESPR

The Ecodesign for Sustainable Products Regulation (ESPR, Regulation (EU) 2024/1781) establishes the legal framework for the Digital Product Passport. The ESPR is part of the European Green Deal and aims to make products placed on the EU market more sustainable, circular, and transparent throughout their lifecycle.

Unlike a directive (which requires transposition into national law), the ESPR is a regulation that applies directly in all EU Member States. Product-specific requirements are set through delegated acts adopted separately by the European Commission for each product category.

What the DPP Must Contain

Under the ESPR, the DPP must include accurate, verifiable information covering:

• Material composition and component details: What the product contains, including hazardous substances
• Manufacturing data and processes: Where and how the product was made
• Durability, repairability, and safety information: How long the product is expected to last and how it can be maintained
• Environmental performance and end-of-life instructions: Carbon footprint, recycled content, and recycling or disposal guidance
• A unique digital identifier: Linked to the product's verified record, accessible through a scannable code

The DPP must serve three audiences:

1. Consumers: Who can access product sustainability information before and after purchase
2. Businesses: Who need supply chain data for their own compliance and circularity efforts
3. Public authorities: Who can audit environmental claims and enforce compliance

Three Data Layers

The DPP architecture includes three tiers of data access:

DPP Timeline: When Do Medical Device Manufacturers Need to Comply?

The DPP is being implemented on a product-by-product basis through delegated acts. Not all products require a DPP at the same time.

Confirmed Timeline (as of June 2026)

Medical Devices Are Exempt from ESPR — But Not Unaffected

Medical devices are explicitly exempt from the ESPR because they are covered by their own regulatory framework — the EU Medical Device Regulation (MDR) and the In Vitro Diagnostic Regulation (IVDR). The ESPR's Article 1 exemption list states that products covered by specific sectoral legislation (including medical devices) are outside the ESPR's scope.

This means medical device manufacturers will not face a future DPP mandate under the ESPR itself. However, medical device companies are still affected through several indirect pathways:

1. Battery-powered medical devices: Any medical device containing batteries above 2 kWh (e.g., large imaging systems, patient monitors with significant battery backup) will need a Battery Passport from February 2027 under the separate EU Battery Regulation (2023/1542). Light portable batteries follow in August 2027. This is not an ESPR requirement — it comes from the Battery Regulation directly.

2. Electronic components in medical devices: While medical devices themselves are exempt from ESPR, the electronics and ICT delegated act (expected 2027–2028) could affect standalone electronic components that are later incorporated into medical devices. Manufacturers who also produce non-medical electronic products will need DPPs for those products.

3. Supply chain ripple effects: Medical device manufacturers source materials and components from suppliers that also serve non-medical industries. As those suppliers become subject to DPP requirements, the data they generate (carbon footprint, recycled content, material composition) will increasingly flow to medical device manufacturers as well.

4. Convergence with sustainability reporting: Under the CSRD (Corporate Sustainability Reporting Directive), large medtech companies must report on environmental metrics. The data infrastructure built for DPP compliance in non-medical product lines will support CSRD reporting, and the product-level data could eventually inform lifecycle assessments for medical devices.

5. Future regulatory evolution: While medical devices are currently exempt from ESPR, the EU regulatory landscape is dynamic. The European Commission could propose integrating DPP-like requirements into the MDR framework in future revisions, particularly for devices with significant environmental impact (single-use devices, implantable devices with electronic components, large capital equipment).

The DPP Registry Goes Live July 2026

On July 19, 2026, the EU's central infrastructure for Digital Product Passports goes live. This is the registry where all DPPs will be stored and accessible. The registry going live does not mean that all products need a passport immediately — it means the infrastructure is ready for the first mandatory category (batteries in February 2027).

How DPP Intersects with UDI and EUDAMED

UDI Under EU MDR

Under the EU MDR (and IVDR), medical device manufacturers must assign Unique Device Identifiers (UDIs) to their devices and register them in EUDAMED. The UDI system creates a standardized device identification framework that supports traceability, post-market surveillance, and recall management.

The UDI has two parts:

• UDI Device Identifier (UDI-DI): Identifies the specific device version/model
• UDI Production Identifier (UDI-PI): Identifies the production unit (batch/lot number, serial number, expiry date)

As of May 28, 2026, EUDAMED registration is mandatory for all medical devices and IVDs placed on the EU market. New devices must be registered before market placement; legacy devices have until November 27, 2026.

DPP vs. UDI: Complementary but Distinct

The DPP and UDI systems serve different but complementary purposes:

Data Synergies

While UDI and DPP serve different regulatory objectives, there are significant data synergies:

1. Product identification: Both systems require a unique product identifier. The GS1 Digital Link standard — which the DPP is expected to use — can encode the GTIN (which is also the basis for the UDI-DI under GS1). This means a single QR code on a product could potentially link to both EUDAMED and DPP data.

2. Manufacturing data: Both systems require information about where and when a product was manufactured. MDR technical documentation already contains much of this data.

3. Material composition: DPP will require detailed material composition data. For medical devices, biocompatibility documentation (per ISO 10993) already contains material information, though it may need to be reformatted for DPP purposes.

4. Supply chain mapping: MDR requires traceability through the economic operator chain (manufacturer → authorized representative → importer → distributor). DPP will extend this to include environmental data from sub-tier suppliers.

The Integration Question

The European Commission has stated that Annex III of the ESPR explicitly allows delegated acts to incorporate information already required under other EU legislation, including elements of the CE marking technical documentation and the Declaration of Conformity. This means manufacturers who have invested in building complete, well-structured technical files are not starting the DPP journey from scratch.

However, the integration between EUDAMED and the DPP registry has not yet been defined. The European Commission is working on interoperability, and CEN/CENELEC JTC 24 is developing European Standards for the DPP framework and system, including standards for unique identifiers (BS EN 18219:2026), data carriers (BS EN 18220:2026), and system interoperability (BS EN 18223:2026), expected to be published in June 2026.

Technical Standards and Implementation

The CIRPASS Initiative

The European Commission's CIRPASS (Consumer and Product Passport Initiative) project has been developing the technical infrastructure for DPP implementation. Key technical elements include:

Data Carrier: How Consumers Access the DPP

The DPP must be accessible through a scannable data carrier on the product or its packaging. The expected standard is the GS1 Digital Link, which encodes a URL that resolves to the product's digital passport. GS1 Digital Link can embed the GTIN, batch/lot number, and serial number — providing a natural bridge to existing GS1-based UDI systems.

Standards being developed:

• BS EN 18219:2026 — Digital product passport — Unique identifiers (expected June 2026)
• BS EN 18220:2026 — Digital product passport — Data carriers (expected June 2026)

Data Format

DPP data must be machine-readable, structured, and interoperable. The expected format is JSON-LD (Linked Data), which allows structured data to be connected and queried across the DPP ecosystem.

Data Storage and Persistence

Products must maintain their DPP for the entire product lifecycle — including after the product is no longer on the market. Standards for data storage, archiving, and persistence are being developed (BS EN 18221:2026, expected June 2026).

Access Rights Management

Not all DPP data is public. Standards for access rights management, information system security, and business confidentiality are being developed (BS EN 18239:2026, expected September 2026).

What Medical Device Manufacturers Should Do Now

Even though medical devices are not in the first wave of DPP obligations, preparation should begin now — particularly for companies with battery-powered or electronic devices.

Immediate Actions (2026)

1. Audit your product portfolio for battery-powered devices: Any device containing batteries above 2 kWh that will be placed on the EU market after February 18, 2027 needs a Battery Passport. Identify which products are affected.

2. Map your UDI data infrastructure: Review your current UDI/EUDAMED data management systems. Many of the data points required for DPP (product identification, manufacturing data, material composition) already exist in your technical documentation.

3. Assess your supply chain data maturity: DPP will require environmental data from your supply chain — carbon footprint data, recycled content percentages, hazardous substance declarations. Begin supplier engagement now.

4. Monitor ESPR delegated acts: Track the adoption of delegated acts for electronics, which could affect electronic medical devices. The ESPR 2025–2030 working plan identifies electronics as a priority category.

5. Evaluate GS1 Digital Link readiness: If your company uses GS1 for UDI purposes, begin exploring how GS1 Digital Link can serve both UDI and future DPP requirements.

Medium-Term Preparation (2027–2029)

1. Build a unified product data platform: Consolidate product data across regulatory compliance (MDR/IVDR technical documentation), quality management (ISO 13485), environmental compliance (RoHS, REACH, WEEE), and sustainability reporting (CSRD) into a single platform that can feed multiple compliance outputs — including future DPP.

2. Pilot DPP for affected products: For battery-powered devices that need Battery Passports by February 2027, implement DPP as a pilot project. The lessons learned will inform your broader DPP strategy.

3. Engage with industry associations: MedTech Europe and national industry associations are actively engaging with the European Commission on DPP implementation. Participate in these consultations to ensure the medical device perspective is represented.

Long-Term Strategy (2029+)

1. Plan for medical device DPP coverage: Assume that medical devices will eventually be covered by DPP requirements — likely in the post-2030 timeframe. Build data infrastructure that can accommodate environmental sustainability data alongside safety and performance data.

2. Integrate DPP into your regulatory strategy: As DPP requirements emerge for your product categories, incorporate them into your regulatory roadmap alongside MDR/IVDR, AI Act, Cyber Resilience Act, and other EU regulatory obligations.

3. Leverage DPP for competitive advantage: Companies that can demonstrate robust environmental data and sustainability credentials through their DPP will have a competitive edge in EU public procurement and with sustainability-conscious customers.

Other Regulations with DPP Requirements

The DPP is not limited to the ESPR. Several other EU regulations include DPP or DPP-like requirements:

• EU Battery Regulation (2023/1542): The Battery Passport is the first mandatory DPP, taking effect February 18, 2027 for EV, industrial, and light-means-of-transport batteries above 2 kWh
• Toy Safety Regulation (2025/2509): Includes explicit DPP obligations for toys
• Critical Raw Materials Act: Requires a DPP for products containing permanent magnets above 0.2 kg
• Construction Products Regulation: Has its own phased DPP approach
• EU Deforestation Regulation (EUDR): Requires traceability data for wood-based products, which will be integrated into DPP for applicable product categories

The pattern is consistent: the DPP is becoming the standard transparency mechanism across EU product legislation.

The Global Context: DPP Beyond the EU

The EU is leading the global DPP regulatory push, but other jurisdictions are moving in similar directions:

• China is developing a parallel product traceability system
• United States is taking sectoral approaches, with no comprehensive DPP framework currently
• The Brussels Effect: Because ESPR applies to products placed on the EU market regardless of where they are manufactured, non-EU manufacturers selling into the EU must comply. This creates a de facto global standard.

For medical device manufacturers with global distribution, the practical implication is that DPP compliance will eventually be part of doing business in the EU — just as CE marking, UDI, and EUDAMED registration are today.

Conclusion

The EU Digital Product Passport is not yet a direct compliance obligation for most medical device manufacturers — but it is coming. The Battery Passport takes effect in February 2027, electronics DPP requirements will follow, and medical devices will likely be covered in future ESPR working plans.

The smart approach for medical device companies is to treat DPP preparation as an extension of existing regulatory compliance infrastructure. The data you already collect for MDR technical documentation, UDI/EUDAMED registration, ISO 13485 quality management, and RoHS/REACH environmental compliance forms a strong foundation for DPP. The incremental work is in adding environmental sustainability data — carbon footprint, recycled content, repairability scores — and formatting it for the DPP ecosystem.

Companies that build unified product data platforms now, linking regulatory, quality, and environmental data, will be well-positioned when DPP requirements reach medical devices. Those that wait for the delegated act will face a compressed timeline and competitive disadvantage.

Related reading: For EUDAMED mandatory registration requirements, see our EUDAMED Mandatory Registration Guide. For environmental compliance requirements affecting medical devices, see our RoHS/REACH/WEEE Guide. For CSRD sustainability reporting for medtech companies, see our CSRD Guide.