CIRPASS and CEN/CENELEC: DPP Standards Explained

Behind every Digital Product Passport is a set of technical standards that define how data is structured, shared, and verified. Two names come up repeatedly in DPP discussions: CIRPASS and CEN/CENELEC. Understanding what they are and what they have produced is essential for anyone implementing DPP compliance.

What is CIRPASS?

CIRPASS (Collaborative Initiative for a Standards-based Digital Product Passport for Stakeholder-Specific Sharing of Product Data for a Circular Economy) was an EU-funded project that ran from October 2022 to March 2024. Its mission: develop the technical groundwork for implementing Digital Product Passports at scale across Europe.

CIRPASS brought together around 30 partners and associated partners — industry associations, technology companies, standards bodies, and research institutions — to answer the practical questions that the ESPR regulation left to technical specifications:

  • What data format should DPPs use?
  • How should different systems exchange DPP data?
  • What does interoperability look like across industries and borders?
  • How should access control work for different stakeholder types?

CIRPASS Deliverables

The project produced several key outputs:

DPP Architecture Blueprint — A reference architecture defining how DPP systems should work, including data models, API specifications, and interaction patterns between DPP platforms, the EU Registry, and end users.

Sector Roadmaps — Roadmaps for prototypes in three value chains: batteries, textiles, and electronics. Piloting them is the job of the follow-on project, CIRPASS-2.

Interoperability Framework — Specifications for how DPPs from different platforms and industries can work together. This is critical — a recycling facility should not need a different tool for every brand's passport.

Open Source Tools — CIRPASS-2 (the follow-on project) has published open-source tools including:

  • A DPP Validator for checking passport compliance
  • A Mock EU Registry for testing registration workflows

These are available at github.com/CIRPASS-2 and are valuable for companies building or validating their DPP implementations.

CIRPASS-2

The follow-on project, CIRPASS-2, is currently active and focuses on:

  • Refining standards based on real-world pilot feedback
  • Supporting the European Commission's delegated act development
  • Building the Community of Practice (CoP) for DPP stakeholders
  • Preparing for the EU DPP Registry launch (July 19, 2026; update: live since 20 July 2026)

What is CEN/CENELEC?

CEN (European Committee for Standardization) and CENELEC (European Committee for Electrotechnical Standardization) are the official European standards organizations. When the EU needs technical standards to support a regulation, CEN/CENELEC is where they are developed.

For the ESPR and Digital Product Passports, the European Commission issued a standardization request (July 2024) to CEN, CENELEC and ETSI to develop harmonised standards covering the technical requirements for DPP implementation.

The 8 CEN/CENELEC DPP Standards

Six were published in May 2026 and the last two in September 2026. Together, they form the technical rulebook for DPP implementation. Note that the numbers are not a continuous range — there is no EN 18217 or EN 18218:

1. EN 18216 — Data Exchange Protocols

Specifies how DPP data is requested and transmitted between systems: secure HTTPS transport, JSON as the common baseline format, and content negotiation so the same address can serve a web page or machine-readable data. Without this standard, every DPP platform would speak its own language.

2. EN 18219 — Unique Identifiers

Defines how products, economic operators and facilities are identified. It recognises five product identifier schemes — GS1 Digital Link and other web-enabled structured paths, the Identification Link (EN IEC 61406), decentralized identifiers (DID), ISO/IEC 15459 identifiers as used in RFID, and the Digital Object Identifier (DOI).

3. EN 18220 — Data Carriers

Defines the physical or visual means — QR codes, Data Matrix codes, RFID and NFC tags — by which a product's identifier reaches a phone or reader, including durability and placement.

4. EN 18221 — Data Storage, Archiving and Persistence

Sets requirements for keeping passports and their version history available for the required period, including back-up copies held by a DPP service provider.

5. EN 18222 — APIs for Passport Lifecycle Management and Searchability

Specifies the interface a DPP system exposes for creating, reading, updating and searching passports, so a tool built against one system can query another.

6. EN 18223 — System Interoperability

Defines the common structure of a passport — such as the header that declares granularity, schema version and status — so different DPP systems can exchange and interpret each other's passports.

7. EN 18239 — Access Rights Management, Information System Security and Business Confidentiality

Defines how different stakeholders get access to DPP data. Consumers see one set of information, business partners see another, and authorities see what they are entitled to. Given that DPPs may contain commercially sensitive information, security is not optional.

8. EN 18246 — Data Authentication, Reliability and Integrity

Sets requirements for showing that passport data is genuine and unaltered, and for protecting the people who read public passport data.

How Standards Become Mandatory

A common source of confusion: CEN/CENELEC standards are voluntary by default. They become effectively mandatory through the ESPR's "presumption of conformity" mechanism:

  1. The ESPR sets requirements (e.g., "DPPs must be interoperable")
  2. CEN/CENELEC develops harmonised standards that define how to meet these requirements
  3. If you follow a harmonised standard whose reference is cited in the Official Journal, you are presumed to comply with the requirements it covers (ESPR Article 41)
  4. If you do not follow the standard, you must demonstrate compliance through other means — which is significantly harder and more expensive

In practice, this means the CEN/CENELEC standards are de facto mandatory. Building a DPP system that ignores them is technically legal but practically unwise.

What the Standards Mean for Your Implementation

If You Are Choosing a DPP Platform

Ask your platform provider:

  • Do you comply with the CEN/CENELEC DPP standards?
  • How do you handle the data model and schema standard?
  • Is your EU Registry interface ready for the July 2026 launch?
  • How do you implement access control per the authentication standard?

A platform that was built before the standards were finalized may need significant updates. Platforms like DPP Agent, built alongside the standardization process, are designed for compliance from the ground up.

If You Are Building Custom

The standards are your blueprint. Do not design your data model or API structure independently — align with the CEN/CENELEC specifications. This saves development time and ensures your system can interoperate with the broader DPP ecosystem.

If You Are a Supplier

Your customers will ask you to provide data in formats defined by these standards. Understanding the data model standard helps you prepare structured data that flows cleanly into your customers' DPP systems.

The JRC DPP Methodology

Alongside the CEN/CENELEC standards, the European Commission's Joint Research Centre (JRC) published its DPP methodology in March 2026. This methodology complements the standards by defining:

  • Three priority levels for data — essential, strongly recommended, and voluntary
  • A step-by-step method — how to choose, for a product group, which data a passport should carry and why

The JRC methodology is a technical report, not a standard or a legal text, but it shows how the data requirements in future delegated acts are likely to be chosen.

GS1's Role

GS1, the global standards organization behind barcodes and GTINs, plays a specific but crucial role in the DPP ecosystem:

  • GS1 Digital Link is one of the identifier schemes EN 18219 recognises, and the most widely used for consumer products
  • GTIN is the product identifier embedded in a GS1 Digital Link
  • GS1 resolver infrastructure supports the technical resolution of DPP URLs

If you take the GS1 route and do not already have GTINs for your products, obtaining them from your national GS1 member organization is the first step. Read more in our GS1 Digital Link guide.

Standards Still in Development

With all eight standards published, work continues on:

  • Sector-specific extensions — Additional data fields for batteries, textiles, electronics
  • International alignment — Coordination with ISO and other international standards bodies
  • Registry operational specifications — Detailed procedures for the EU DPP Registry
  • Testing and certification — How DPP platforms can be certified for standard compliance

Practical Implications

Interoperability is Real

The standards ensure that a DPP created on Platform A can be read by Platform B, verified by the EU Registry, and accessed by any authorized stakeholder. This is not theoretical — the CIRPASS pilots demonstrated cross-platform interoperability in practice.

No Proprietary Lock-In

Because data formats and APIs are standardized, companies are not locked into a single DPP platform. You can switch providers without losing your passport data or breaking your QR codes. This is by design.

Compliance is Demonstrable

Following the standards gives you a clear compliance argument. When a market surveillance authority asks "how do you know your DPPs comply?", the answer is straightforward: "We follow the harmonised CEN/CENELEC standards."

Next Steps

Understanding the standards is important. Implementing them is what matters.

Start with a readiness assessment at dppagent.com to understand which standards apply to your products and how prepared your current systems are. Then use DPP Agent to implement compliant DPPs on infrastructure built to the CEN/CENELEC specifications. Powered by Blippa — helping European businesses navigate DPP standards since day one.