9 min readUpdated 2026-10-11

What changed in EU product regulation: July to September 2026

Norruva2026-09-08

The summer of 2026 is when the Digital Product Passport stopped being a plan and started being infrastructure. Four things happened in eight weeks: the EU registry went live, the technical standards became citable law, packaging rules started applying, and CBAM shifted from writing rules to running them.

Every date and instrument below is cited to EUR-Lex or to the European Commission. Where something is still indicative rather than adopted, this briefing says so.

Update, 28 September 2026: We have clarified the status of the two remaining DPP standards, EN 18239 and EN 18246, in section 2. As of this date neither is cited in the Official Journal, so neither yet gives a presumption of conformity under the ESPR. The rest of this briefing is unchanged from 8 September.

Update, 11 October 2026: CEN and CENELEC published EN 18239 and EN 18246 on 16 September 2026. As of 9 October 2026 neither is cited in the Official Journal, so the presumption of conformity still rests on the six standards in section 2. See the note in that section. The PPWR harmonised label will also apply later than 12 August 2028; see the note in section 3.

1. The EU DPP Registry is live

Article 13(1) of the ESPR, Regulation (EU) 2024/1781, required the Commission to set up the digital product passport registry by 19 July 2026. The Commission launched it, together with a testing environment, technical documentation, implementation guidelines, webinars and a helpdesk, on 20 July 2026.

The operating rules arrived three days earlier. Commission Implementing Regulation (EU) 2026/1778 of 16 July 2026, adopted under Article 13(5) ESPR, lays down the implementation arrangements for the registry. It was published in the Official Journal on 17 July 2026.

What the registry is not: a data warehouse. It stores unique identifiers and resolves them. Product data stays with the economic operator. Article 14 ESPR separately provides for a public web portal for searching and comparing passport data, which is a different system.

The first mandatory registrations are 18 February 2027, for batteries.

A citation error worth correcting

A large amount of published commentary attributes the registry to "ESPR Article 12". It does not. Article 12 covers unique identifiers. Article 13 is the registry. Article 14 is the web portal. If a vendor or advisor cites Article 12 for the registry, they are working from a secondary source rather than the regulation.

2. The harmonised standards became citable

On 14 July 2026 the Commission adopted Implementing Decision (EU) 2026/1736, published in the Official Journal on 15 July 2026. It cites six harmonised standards for digital product passports, developed by CEN-CLC/JTC 24 under standardisation request M/604:

Standard	Covers
EN 18216:2026	Data exchange protocols
EN 18219:2026	Unique identifiers
EN 18220:2026	Data carriers
EN 18221:2026	Data storage, archiving and persistence
EN 18222:2026	APIs for passport lifecycle management and searchability
EN 18223:2026	System interoperability

This is the part that changes procurement conversations. A DPP conforming to these standards, or parts of them, is presumed to comply with the corresponding requirements of ESPR Articles 10 and 11. That presumption is a legal safe harbour, and it did not exist in June.

Two standards complete the set of eight: EN 18239 on access rights management, information system security and business confidentiality, and EN 18246 on data authentication, reliability and integrity. As of 28 September 2026 neither is cited in the Official Journal, so neither yet gives a presumption of conformity, and their publication by CEN has not been confirmed at source.

Update, 11 October 2026: CEN and CENELEC published both standards on 16 September 2026 (EN 18239, EN 18246), so the set of eight now exists as published standards, though not yet as harmonised standards. As of 9 October 2026 neither is cited in the Official Journal and neither gives a presumption of conformity. The Commission's indicative DPP timeline had planned the decision citing them for September 2026.

One consequence is worth stating plainly. The EU has been consistently technology-neutral about DPP architecture, and the published standards did not mandate a distributed ledger. Platforms sold on the premise that blockchain is the compliant architecture were making a commercial argument, and the standards did not ratify it.

3. Packaging: PPWR started applying, but not the part most people expected

The Packaging and Packaging Waste Regulation, Regulation (EU) 2025/40, entered into force on 11 February 2025 and applies generally from 12 August 2026.

The measure that actually bit on that date is narrower than much of the commentary suggested. In the Commission's own words, the key measure entering into application was a restriction on per- and polyfluoroalkyl substances (PFAS) in food-contact packaging: such packaging containing PFAS above strict limits can no longer be placed on the EU market.

Harmonised material-composition labelling is not a 2026 obligation. Under Article 12(1) PPWR it applies from 12 August 2028, or 24 months after the relevant implementing acts enter into force, whichever is later. If you have been told your packaging needed a harmonised sorting label this August, check the article.

Update, 11 October 2026: the implementing acts on the label format and on digital marking of material composition were due by 12 August 2026 under Article 12(6) and (7), but none had been published in the Official Journal by 9 October 2026. The label will therefore apply 24 months after those acts enter into force, which is later than 12 August 2028 (Regulation (EU) 2025/40, Article 12).

4. CBAM moved from rulemaking to operations

CBAM entered its definitive period on 1 January 2026. Over three weeks in August and September, the Commission built out the machinery:

14 August 2026: ten guidance documents for the definitive period. Four general guides covering CBAM concepts, a quick guide for non-EU operators, calculation of embedded emissions, and the free allocation adjustment, plus six sector guides for cement, hydrogen, fertilisers, iron and steel, aluminium and electricity.
24 August 2026: guidance on CBAM verification and accreditation for verifiers and National Accreditation Bodies, focused on verifying emissions reports from non-EU installations for goods imported from 1 January 2026.
1 September 2026: accredited CBAM verifiers can obtain access to the CBAM Registry. They must register within two months of receiving accreditation, but not before this date.

The date that matters downstream is January 2027, when verifiers begin issuing verification reports in the CBAM Registry. That is what lets importers use actual verified emissions rather than defaults in their CBAM declaration. The first annual CBAM declaration, covering 2026 imports, is due 30 September 2027.

5. Batteries: the clearest picture yet of what a passport must carry

On 21 August 2026 the Commission published updated guidance on the Digital Batteries Passport, mapping 71 data points across EV, LMT and industrial batteries. For each data point it flags whether the item is mandatory, optional, circumstance-specific or not yet applicable, with legal sources.

This is the most concrete specification available of what the EU's first mandatory product passport has to contain. Under Article 77 of Regulation (EU) 2023/1542, from 18 February 2027 every EV battery, every LMT battery and every industrial battery with a capacity greater than 2 kWh placed on the market or put into service must have a battery passport.

6. The first product-specific ESPR delegated act still has not been adopted

This is the gap between infrastructure and obligation, and it is where a lot of vendor messaging overstates the position.

Iron and steel is the first product group in line for ESPR ecodesign requirements. The Commission's public consultation on that delegated act opened on 20 May 2026 and closed on 12 August 2026. Indicative adoption is Q4 2026. As of this writing no delegated act has been adopted and no draft text has been published.

So: the registry exists, the standards exist, and the presumption of conformity exists. The product-specific obligations that will send most manufacturers into the registry do not exist yet, outside batteries. Anyone selling you a 2026 ESPR compliance deadline for textiles, furniture or steel is selling you an indicative working-plan date, not a legal one.

7. What is next

Date	What applies
27 September 2026	Member States apply the Empowering Consumers Directive (EU) 2024/825. Generic environmental claims without recognised substantiation become unlawful and sustainability labels need a public or certified basis. No transition period.
30 December 2026	EUDR due diligence applies to large and medium operators under Regulation (EU) 2025/2650. Micro and small operators established by 31 December 2024 follow on 30 June 2027, except for timber products covered by the EU Timber Regulation, for which they apply from 30 December 2026 (Article 38(3)).
18 February 2027	Battery passports mandatory. First mandatory registrations in the EU DPP Registry.
Q4 2026, indicative	First product-specific ESPR delegated act, iron and steel.

The nearest of these is the green-claims ban, and it is the one most companies are least prepared for, because it does not require a new system. It requires auditing every environmental claim already on your packaging, your product pages and your advertising.

Sources

DPPESPRCBAMPPWREmpCoBatteriesRegulatory Update