Six digital product passport standards reached the Official Journal. The authenticity standard did not.

On 14 July 2026, the European Commission adopted Implementing Decision (EU) 2026/1736, published in the Official Journal of the European Union on 15 July 2026 and in force the same day. It cites six harmonised standards developed for the digital product passport under the EU's ecodesign framework: EN 18216 (data exchange protocols), EN 18219 (unique identifiers), EN 18220 (data carriers), EN 18221 (data storage, archiving, and persistence), EN 18222 (application programming interfaces for managing a passport's life cycle), and EN 18223 (system interoperability). All six were published by CEN-CENELEC on 27 May 2026, developed under the Commission's standardisation request M/604 in support of Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation, known as the ESPR.

Citation in the Official Journal is not a formality. Article 41 of the ESPR states that products complying with a harmonised standard whose reference has been published there are presumed to comply with the corresponding ecodesign requirements set out in the regulation's delegated acts, to the extent those requirements are covered by the standard. In plain terms, build a passport to one of these six standards and the burden shifts: instead of demonstrating compliance case by case, the standard itself does that work, for the requirements it covers.

Eight harmonised standards were commissioned under M/604 in total, not six. The two still outstanding both concern security: EN 18246, "digital product passport, data authentication, reliability and integrity", and its sibling EN 18239. EN 18246 is the standard meant to let a passport's data be checked for authenticity, tamper-evidence, and reliability, built around what the standard calls an electronically signed data construct. Its formal vote at CEN-CENELEC closed on 16 July 2026, one day after the Commission cited the other six, and publication is expected around September 2026.

The standard's own scope is deliberately narrow. It covers the framework for secure information processing and communication that safeguards the integrity, authenticity, and reliability of data exchanged through a passport. It explicitly does not cover the passport's system architecture, its use cases, or the secure elements and cryptographic security features tied to a data carrier for unique product identification; those belong to sibling standards, including the ones already cited. Until EN 18246 is published and then separately cited by the Commission in a future implementing decision, the presumption of conformity that now covers exchange, identification, carriers, storage, APIs, and interoperability does not extend to authenticity.

The absence of a cited standard does not suspend the underlying obligation. Regulation (EU) 2024/1781 already requires, in its own text, that digital product passport data be accurate, complete, up to date, and verifiable; that duty is binding regardless of which harmonised standards exist to help meet it. What is missing is the shortcut. Article 41 also lets the Commission adopt common specifications by implementing act as a fallback where no harmonised standard exists yet, but no such fallback has been adopted for data authenticity either. A company building a passport's authenticity layer today has neither a cited standard nor a common specification to point to, only the regulation's own requirement and its own ability to show how it meets it.

In practice, that means falling back on ordinary means of demonstrating compliance: technical documentation kept on file, a self-declared conformity assessment under the ESPR's general procedure, or a supplier's own attestation, none of which carries the automatic presumption a cited standard provides. That is not a gap in the law; the ESPR's requirement for accurate, complete, and verifiable passport data was never conditional on a standard existing to implement it. It is a gap in the tooling available to prove compliance efficiently, and it will close only once EN 18246 is published and cited.

That gap matters more for authenticity than for most other requirements, because a passport whose data cannot be checked is not much better than a printed label. AnyLAI, for instance, issues its passports signed, with a signature that can be checked against the issuer's published key.

The ESPR's own delegated acts are still arriving on a separate track. The Commission's first ESPR working plan, adopted 16 April 2025 as COM(2025) 187, names six priority product groups: textiles and apparel, furniture, mattresses, tyres, iron and steel, and aluminium. Indicative dates for their delegated acts run from 2026, for iron and steel, to 2029, for mattresses, and a digital product passport obligation typically follows roughly eighteen months after each delegated act is adopted. None of those obligations has arrived yet.

The nearer deadline sits in a different regulation. Under Regulation (EU) 2023/1542, the EU Battery Regulation, a digital battery passport becomes mandatory from 18 February 2027 for electric-vehicle batteries, light means of transport batteries, and industrial batteries above 2 kWh. That is the first real case where the standards gap described above will be tested in practice. The same date recurs in the registry meant to hold every passport's identifier: Commission Implementing Regulation (EU) 2026/1778 of 16 July 2026, which lays down how the EU digital product passport registry operates, requires each member state to appoint a national registry administrator by 18 February 2027 as well.

None of this argues for waiting. The six cited standards already give a real, usable presumption of conformity for how a passport is built, identified, carried, stored, exchanged, and made interoperable, and a company assembling a passport today can rely on them now. The requirement that the underlying data be accurate and verifiable is already in force independent of any standard, so the sensible order is to get that data discipline right first and adopt EN 18246 once it exists, not the other way round. AnyLAI, for instance, labels its AI-assisted output as AI-assisted and human-verified.

Two dates are worth watching from here. September 2026 is when EN 18246 and its sibling security standard are expected to publish at CEN-CENELEC, closing the technical gap even before the Commission formally cites them. What happens after that is less predictable: for the six standards already cited, about seven weeks passed between their CEN-CENELEC publication on 27 May 2026 and the Commission's citation on 15 July 2026, but that gap is a precedent, not a guarantee. A company that has its data discipline in order will not need to change course either way; it will simply gain a shortcut it does not yet have.