EN 18246:2026
(Main)Digital product passport - Data authentication, reliability and integrity
General Information
- Abstract
This document defines the requirements and frameworks for secure information processing and communication to safeguard integrity, authenticity and reliability in the digital product passport (DPP) data exchange, minimizing product fraud and counterfeiting through data verification and integrity enforcement mechanisms.
This document provides a framework for establishing trust, interoperability, and interoperation via secure electronically signed data construct (ESDC) for multi-actor applications, applicable across various sectors and in multilingual environments. Existing hardware and software systems for unique product identification and storage of this identification are to be considered.
The following is out of the scope of this document: system architecture for DPP, DPP use cases, secure elements related to data carriers and cryptographic security features for unique product identifiers.
NOTE 1 While not disrupting existing traceability and authentication systems, this document facilitates interoperability by introducing an ESDC scheme to be combined with existing data constructs to cover and preserve existing data models.
NOTE 2 Annex A includes illustrative examples and references to supporting implementations, intended to demonstrate approaches that promote interoperability across diverse environments. These references are provided to assist stakeholders in selecting appropriate solutions that comply with applicable legal obligations and technical standards, while preserving existing systems.
- Status
- Not Published
- Publication Date
- 15-Sep-2026
- Technical Committee
- JTC 24 - Digital Product Passport (DPP)
- Drafting Committee
- WG 3 - Security
- Current Stage
- 5060 - Closure of Vote - Formal Approval
- Start Date
- 16-Jul-2026
- Due Date
- 08-Jul-2026
- Completion Date
- 16-Jul-2026
Overview
EN 18246:2026 is a European standard developed by CEN that defines requirements and frameworks for secure information processing within the digital product passport (DPP) ecosystem. Its primary objective is to safeguard the integrity, authenticity, and reliability of DPP data exchanged between multiple stakeholders, thus minimizing product fraud and counterfeiting. This standard lays the groundwork for trust, interoperability, and secure communication via electronically signed data constructs (ESDCs), facilitating reliable and verifiable digital product information exchange across sectors and languages.
Key Topics
Data Authentication and Integrity
EN 18246:2026 establishes mechanisms that ensure DPP data has not been altered and remains trustworthy throughout its lifecycle. Electronically signed data constructs (ESDCs) and digital signatures underpin data integrity and authenticity, supporting confidence in business transactions.Interoperability and Trust
The standard enables interoperability by defining frameworks that allow DPPs to integrate seamlessly with existing identification systems and data models. ESDCs can be combined with current data constructs to extend the value of legacy product information, all while maintaining compliance with international technical standards.Risk Mitigation and Fraud Prevention
EN 18246:2026 addresses common industry risks such as product counterfeiting, unauthorized data modification, mass data scraping, and malicious digital activities (including phishing or quishing of QR codes). The document specifies logging, audit, and alert mechanisms to detect and respond to potential DPP compromise.Privacy and Accessibility
The standard underscores the importance of protecting user and organizational data when accessing DPPs, ensuring compliance with relevant privacy regulations. It details requirements for equitable access to DPP data, including accessibility features for persons with disabilities and compatibility with everyday devices without requiring proprietary software.Multi-Actor Collaboration
By requiring unique operator identifiers for stakeholders (manufacturers, service providers, regulators, and others), the standard ensures traceability and responsible management of DPP data modifications, including legally binding and audit-proof logging.
Applications
EN 18246:2026 offers practical value across several industries and digital supply chain scenarios:
- Product Lifecycle Management: Securely associate digital product information (e.g., sustainability data, recycling advice, conformity certificates) with physical products for compliance, circular economy initiatives, and consumer transparency.
- Anti-Counterfeiting: Deploy ESDCs and visible digital seals (VDS, per ISO 22376) to ensure only genuine products are traceable through the DPP infrastructure, deterring fake goods and enabling rapid verification by authorities or consumers.
- Regulatory Compliance: Aligns with EU sustainable product and ecodesign regulations (notably Regulation (EU) 2024/1781) by offering demonstrable data reliability and secure audit trails for enforcement and reporting.
- Cross-Border Trade: Provides a foundation for trusted and interoperable product data exchange in international and multilingual environments, benefiting both SMEs and large enterprises.
- Consumer Engagement: Ensures any consumer can access essential product information using familiar devices without installing extra software, improving trust and facilitating informed purchasing decisions.
Related Standards
Organizations implementing EN 18246:2026 should consider the following related standards:
- prEN 18220:2025 - Digital product passport – Data carriers (for hardware and carrier technologies).
- prEN 18219 - Unique operator and product identifiers.
- ISO 22376 - Specifications for visible digital seals, supporting secure data linking via 2D barcodes.
- ISO/IEC 20248 - Digital signature data structures for automatic identification and data capture.
- ETSI EN 319 401:2024 - General policy and security requirements for trust services.
- W3C Verifiable Credentials - Widely-adopted framework for expressing and verifying digitally signed claims about entities.
These standards collectively support a robust framework for secure DPP implementation, ensuring regulatory alignment, technical compatibility, and future-proof data handling.
Conclusion
EN 18246:2026 is a vital reference for any organization deploying or managing digital product passports. By emphasizing data reliability, secure authentication, and ease of access, the standard enables trusted and interoperable product data exchange, supporting sustainability, compliance, and anti-fraud objectives across diverse international markets.
Relations
- Referred By
EN ISO 28881:2022 - Machine tools - Safety - Electrical discharge machines (ISO 28881:2022) - Effective Date
- 28-Jan-2026
- Referred By
EN ISO 19085-15:2025 - Woodworking machines - Safety - Part 15: Presses (ISO 19085-15:2025) - Effective Date
- 28-Jan-2026
- Effective Date
- 28-Jan-2026
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
EN 18246:2026 is a draft published by the European Committee for Standardization (CEN). Its full title is "Digital product passport - Data authentication, reliability and integrity". This standard covers: This document defines the requirements and frameworks for secure information processing and communication to safeguard integrity, authenticity and reliability in the digital product passport (DPP) data exchange, minimizing product fraud and counterfeiting through data verification and integrity enforcement mechanisms. This document provides a framework for establishing trust, interoperability, and interoperation via secure electronically signed data construct (ESDC) for multi-actor applications, applicable across various sectors and in multilingual environments. Existing hardware and software systems for unique product identification and storage of this identification are to be considered. The following is out of the scope of this document: system architecture for DPP, DPP use cases, secure elements related to data carriers and cryptographic security features for unique product identifiers. NOTE 1 While not disrupting existing traceability and authentication systems, this document facilitates interoperability by introducing an ESDC scheme to be combined with existing data constructs to cover and preserve existing data models. NOTE 2 Annex A includes illustrative examples and references to supporting implementations, intended to demonstrate approaches that promote interoperability across diverse environments. These references are provided to assist stakeholders in selecting appropriate solutions that comply with applicable legal obligations and technical standards, while preserving existing systems.
This document defines the requirements and frameworks for secure information processing and communication to safeguard integrity, authenticity and reliability in the digital product passport (DPP) data exchange, minimizing product fraud and counterfeiting through data verification and integrity enforcement mechanisms. This document provides a framework for establishing trust, interoperability, and interoperation via secure electronically signed data construct (ESDC) for multi-actor applications, applicable across various sectors and in multilingual environments. Existing hardware and software systems for unique product identification and storage of this identification are to be considered. The following is out of the scope of this document: system architecture for DPP, DPP use cases, secure elements related to data carriers and cryptographic security features for unique product identifiers. NOTE 1 While not disrupting existing traceability and authentication systems, this document facilitates interoperability by introducing an ESDC scheme to be combined with existing data constructs to cover and preserve existing data models. NOTE 2 Annex A includes illustrative examples and references to supporting implementations, intended to demonstrate approaches that promote interoperability across diverse environments. These references are provided to assist stakeholders in selecting appropriate solutions that comply with applicable legal obligations and technical standards, while preserving existing systems.
EN 18246:2026 is classified under the following ICS (International Classification for Standards) categories: 13.020.20 - Environmental economics. Sustainability; 35.240.63 - IT applications in trade. The ICS classification helps identify the subject area and facilitates finding related standards.
EN 18246:2026 has the following relationships with other standards: It is inter standard links to EN ISO 28881:2022, EN ISO 19085-15:2025, EN ISO 3691-4:2023. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
EN 18246:2026 is associated with the following European legislation: EU Directives/Regulations: 2024/1781, (EU) 2024/1781; Standardization Mandates: M/604, M/604 AMD 1. When a standard is cited in the Official Journal of the European Union, products manufactured in conformity with it benefit from a presumption of conformity with the essential requirements of the corresponding EU directive or regulation.
EN 18246:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
oSIST prEN 18246:2025
01-oktober-2025
Digitalni potni list za proizvode - Preverjanje pristnosti, zanesljivost in celovitost
podatkov
Digital product passport - Data authentication, reliability and integrity
Digitaler Produktpass - Datenauthentifizierung, Zuverlässigkeit und Integrität
Passeport numérique des produits - Authentification, fiabilité et intégrité des données
Ta slovenski standard je istoveten z: prEN 18246
ICS:
13.020.20 Okoljska ekonomija. Environmental economics.
Trajnostnost Sustainability
35.240.63 Uporabniške rešitve IT v IT applications in trade
trgovini
oSIST prEN 18246:2025 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
oSIST prEN 18246:2025
oSIST prEN 18246:2025
EUROPEAN STANDARD DRAFT
prEN 18246
NORME EUROPÉENNE
EUROPÄISCHE NORM
August 2025
ICS 13.020.20; 35.240.63
English version
Digital product passport - Data authentication, reliability
and integrity
Digitaler Produktpass - Datenauthentifizierung,
Zuverlässigkeit und Integrität
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/CLC/JTC 24.
If this draft becomes a European Standard, CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal
Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any
alteration.
This draft European Standard was established by CEN and CENELEC in three official versions (English, French, German). A
version in any other language made by translation under the responsibility of a CEN and CENELEC member into its own language
and notified to the CEN-CENELEC Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.Recipients of this draft are invited to submit, with their comments, notification
of any relevant patent rights of which they are aware and to provide supporting documentation.
Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2025 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. prEN 18246:2025 E
reserved worldwide for CEN national Members and for
CENELEC Members.
oSIST prEN 18246:2025
prEN 18246:2025 (E)
Contents Page
European foreword . 4
Introduction . 5
1 Scope . 6
2 Normative references . 6
3 Terms and definitions . 6
4 General security assumptions for DPP. 7
4.1 General. 7
4.2 Actors of the system . 7
4.3 Access to public DPP data . 7
4.4 Communication . 8
4.5 Product identifier as stored in data carrier . 8
4.6 Data carrier authenticity. 8
4.7 DPP data authentication . 8
4.8 Electronically signed data constructs (ESDCs) . 9
4.8.1 Introduction to ESDCs . 9
4.8.2 General services of ESDCs . 9
4.8.3 General implementation principles of ESDCs . 9
5 Types of risk and requirements for unique product identifiers, data carriers and DPP
Data . 10
5.1 Risk on data security and privacy . 10
5.1.1 General. 10
5.1.2 Protection of personal data . 10
5.1.3 Security of personal data . 10
5.1.4 Security of organizational data . 11
5.1.5 Prevention of profiling . 11
5.1.6 Ensuring safe user behaviour . 11
5.1.7 Protection against phishing, quishing, and malicious code . 11
5.1.8 Safeguarding against mass data scraping . 11
5.2 Risk and requirements on identification . 11
5.2.1 General. 11
5.2.2 Authentication and traceability of responsible actors . 12
5.2.3 Alignment between data providers and product manufacturers . 12
5.3 Risk to products. 12
5.3.1 Protecting against counterfeiting . 12
5.3.2 Risks to DPP-related product fraud . 12
5.4 Risk and requirements related to fair competition . 12
5.4.1 General. 12
5.4.2 Avoiding market restrictions by vendor specific software . 12
5.4.3 Disproportionate resource demand for SMEs . 13
5.5 Risk and requirements to prevent exclusion . 13
5.5.1 General. 13
5.5.2 Accessibility to a DPP with any consumer device . 13
5.5.3 Accessibility for persons with disabilities . 13
Annex A (informative) Examples of electronically signed data constructs (ESDCs) . 14
oSIST prEN 18246:2025
prEN 18246:2025 (E)
A.1 General . 14
A.2 Electronic attestation of attributes . 14
A.3 Visible digital seal (VDS - ISO 22376) . 14
A.4 Digital Signature Data Structure (DigSig - ISO/IEC 20248) . 16
Annex ZA (informative) Relationship between this European Standard and the essential
requirements of Regulation (EU) 2024/1781 establishing a framework for the setting
of ecodesign requirements for sustainable products aimed to be covered . 18
Bibliography . 19
oSIST prEN 18246:2025
prEN 18246:2025 (E)
European foreword
This document (prEN 18246:2025) has been prepared by Technical Committee CEN/CLC/JTC 24 “Digital
product passport – Framework and systems”, the secretariat of which is held by DIN.
This document is currently submitted to the CEN Enquiry.
This document has been prepared under a standardization request addressed to CEN by the European
Commission. The Standing Committee of the EFTA States subsequently approves these requests for its
Member States.
For the relationship with EU Legislation, see informative Annex ZA, which is an integral part of this
document.
oSIST prEN 18246:2025
prEN 18246:2025 (E)
Introduction
Regulation (EU) 2024/1781 establishing a framework for the setting of ecodesign requirements for
sustainable products related to digital product passports (ESPR - DPP) expect end-to-end reliability
throughout the entire ecosystem. Trust is key to any transaction whether physical or digital. Data and
information collected during the whole life cycle of the product is to be protected from both accidental
and malicious compromise and misuse.
Any security assessment is likely to address the following elements of the DPP deployment:
— management and verification of identifiers;
— relationship between the unique identifiers and possible authentication elements related to them;
— questions that deal with the identification of the verifier and any authorized access to privileged
product related information;
— verifier access history (logs);
— authentication solutions;
— artefact metrics, where relevant;
— information processing and communication that protects integrity along the supply chain of physical
and related electronic documents, products, software and services life cycle to mitigate the risk of
product fraud and counterfeit goods, by using object identification techniques, and
— verifiable credentials or equivalent functions.
A wide variety of information security techniques are routinely deployed at scale and at different levels.
For example, the banking, retail, and entertainment industries are global, connected, and always
available. The EU DPP system should leverage industry standards and best practices in all aspects of the
DPP solution, from data generation by the economic operator and data storage in distributed data
centres, through to the management of access rights for data access and data queries. The DPP end users,
product owners, and enforcement agencies will all benefit from a trustworthy DPP infrastructure.
The unique product identifier, as stored in a data carrier can be considered as the DPP access anchor.
Trust in the identifier is therefore a foundational element to the trust of DPP.
oSIST prEN 18246:2025
prEN 18246:2025 (E)
1 Scope
This document defines the requirements and frameworks for secure information processing and
communication to safeguard integrity, authenticity and reliability in the digital product passport (DPP)
data exchange, minimizing product fraud and counterfeiting through data verification and integrity
enforcement mechanisms.
This document provides a framework for establishing trust, interoperability, and interoperation via
secure electronically signed data construct (ESDC) for multi-actor applications, applicable across various
sectors and in multilingual environments. Existing hardware and software systems for unique product
identification and storage of this identification are to be considered.
The following is out of the scope of this document: system architecture for DPP, DPP use cases, secure
elements related to data carriers and cryptographic security features for unique product identifiers.
NOTE 1 While not disrupting existing traceability and authentication systems, this document facilitates
interoperability by introducing an ESDC scheme to be combined with existing data constructs to cover and preserve
existing data models.
NOTE 2 Annex A includes illustrative examples and references to supporting implementations, intended to
demonstrate approaches that promote interoperability across diverse environments. These references are
provided to assist stakeholders in selecting appropriate solutions that comply with applicable legal obligations and
technical standards, while preserving existing systems.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
prEN 18220:2025, Digital product passport - Data carriers
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp/
— IEC Electropedia: available at https://www.electropedia.org/
3.1
electronically signed data construct
ESDC
structured data set containing the header, payload, signature and optional data fields
Note 1 to entry: The payload type and issuer identity are included in the header.
Note 2 to entry: An ESDC is a machine-readable code.
Note 3 to entry: An ESDC can contain non-signed data elements
3.2
digital product passport
DPP
digital record of product characteristics throughout its life cycle
oSIST prEN 18246:2025
prEN 18246:2025 (E)
Note 1 to entry: Example characteristics include environmental sustainability, environmental impact, and
recyclability
3.3
unique product identifier
unique string of characters for the identification of a product that also enables a web link to the digital
product passport
4 General security assumptions for DPP
4.1 General
The DPP provides required information for products. Product information consists of public and
controlled data.
All data flows should be verifiable, both the data and the source of the data to ensure trust in the DPP.
NOTE 1 The data verifiability starts with the unique product identifier.
NOTE 2 ISO 22380 outlines principles for addressing physical product fraud, focusing on authenticity, integrity,
and trust for products and documents. It provides guidelines for organizations to identify and mitigate risks
associated with inter alia product fraud, which can range from counterfeiting to tampering and substitution. The
standard emphasizes the importance of understanding the situational context of fraud, including the motives and
behaviours of fraudsters, to develop effective countermeasures. Types of fraud addressed include recreational,
occasional, occupational professional and activism fraud and misinformation.
4.2 Actors of the system
All actors within a DPP system, except the public, shall be globally identified by a unique operator
identifier.
All such actors shall be authenticated via a trustworthy process.
NOTE 1 Actors within the DPP system are defined in prEN 18239.
NOTE 2 The unique operator identifier is defined in prEN 18219.
NOTE 3 Actors accessing not restricted data (public part the DPP) are not subject to identification or
authentication requirements.
4.3 Access to public DPP data
Consumer access to DPP data, limited to reading purposes, differ from other use cases due to the following
considerations:
— No Authentication Required: Accessing public data shall not require authentication.
— Privacy Considerations: Privacy measures are needed to prevent profiling of user interests.
— Ease of Use and Scalability: The access control of DPP data shall be capable of handling a large
number of requests without compromising usability.
— User Safety: The platform shall be safe for all users.
— Compatibility: Smart devices, without the need for additional software, should be able to retrieve
DPP data from DPP services.
oSIST prEN 18246:2025
prEN 18246:2025 (E)
— Optional Additional Security: Enhanced security features could be provided through an official app
by the European Commission or an authority, or integration with wallets or digital services of legal
authorities. However, this should remain optional, as not all devices used by consumers may support
such applications. Consumer access to DPP data shall remain available regardless of the device.
— Access to public DPP data for consumers shall be possible without the need for download of
additional software
4.4 Communication
Communication within the DPP context refers to the transmission of product related information
between stakeholders, ensuring that all involved parties, such as manufacturers, regulators, and
consumers, have access to accurate relevant and up-to-date data.
The communication of this data shall be secure, using encryption and authentication methods in
accordance with relevant standards (such as ETSI EN 319 401:2024) to prevent tampering, unauthorized
access, or data breaches, maintaining the integrity and confidentiality of the DPP.
NOTE EU legal acts for trust services can also apply.
Seamless and interoperable communication channels shall be established to allow different systems and
actors to exchange DPP data, ensuring compatibility across various platforms and regulatory frameworks
at national and international levels.
4.5 Product identifier as stored in data carrier
The authenticity and integrity of the data in the data carrier should be ensured with a high level of
security protecting the data from unauthorised modifications and supporting non-repudiation.
Any solution for ensuring the authenticity and integrity of the product identifier should be fully
interoperable with the unique identifiers as defined in prEN 18219.
Such solutions may require additional data carrier(s).
While specific software may be used to enable users to verify the authenticity and integrity of the product
identifier, at least one data carrier on each product should allow users to access the DPP data without the
need for additional software.
4.6 Data carrier authenticity
The economic operator should secure the physical authenticity of the data carrier, when justified by a
value/cost relationship or mandated by law.
Any solution for ensuring the physical authenticity of the physical data carrier shall be fully interoperable
with the data carriers as they are defined in prEN 18220:2025.
Such solutions may require additional data carrier(s).
While specific software may be used to enable users to verify the physical authenticity of the data
carrier(s), the protected data carrier shall allow users to access the DPP data without the need for
additional software.
4.7 DPP data authentication
A DPP should be verifiable in term of authenticity and integrity of the data and the identity of the
economic operator through interoperable mechanisms in the regulated cross-border scenarios.
Checking the validity and the integrity of the data managed by the DPP shall be for free of charge and
limitations for the verifier.
The following scenarios are possible:
oSIST prEN 18246:2025
prEN 18246:2025 (E)
— no verification (user is not obliged to verify the DPP);
— verification by the receiving application;
— verification via a third party;
— other solutions as mandated by law.
Any creation, modification, or deletion of data within the DPP system shall be logged in a non-repudiable
and legally binding manner.
This should be ensured through the use of digital signatures or digital seals, without the need for
additional supporting documents or offline procedures.
The responsible editor of any change shall be identifiable through a globally unique operator identifier,
as well as the system or individual user executing the change.
Any event that modifies a DPP during its operational phase shall be logged in an audit-proof manner, such
that they can be accessed by the relevant parties.
A mechanism shall flag or alert compromised DPP data and DPPs.
4.8 Electronically signed data constructs (ESDCs)
4.8.1 Introduction to ESDCs
ESDCs are electronically signed documents or data sets. They are used to create a portable and verifiable
digital representation of product-related information, attestations, or credentials. ESDCs are
cryptographically signed by their issuing party, making them tamper-evident and digitally verifiable.
4.8.2 General services of ESDCs
Electronically signed data constructs (ESDCs) allow to:
— verify the DPP data integrity: by ensuring the data within the ESDC has not been altered
...