The EU DPP Registry: A Step-by-Step Guide to Sign-Up, Enrolment and Verification

Since 20 July 2026, the European Commission’s Digital Product Passport Registry (DPP Registry) has been live. Every economic operator that places a product with a mandatory Digital Product Passport (DPP) on the EU market will have to register that passport there, starting with certain large batteries on 18 February 2027. Textiles, furniture, steel, tyres, electronics, construction products, toys and detergents follow as their rules come into force.

Before a single passport can be registered, your organisation has to be enrolled and verified. That process involves an EU Login account, a second authentication factor, a declaration sealed by the Commission and a qualified electronic seal or signature from a trust service provider. None of it is difficult, but several steps have lead times you do not want to discover a few weeks before your deadline.

We went through the process ourselves in the Registry’s test environment, took screenshots of every step and drew on the Commission’s official user guide. Below, we walk you through sign-up, enrolment and verification in order, explain the decisions you have to make along the way and cover what happens next.

Contents

What the DPP Registry Is (and What It Is Not)

The Registry is an index, not a storage place for your passports. It records a small set of data per passport: mainly the unique product identifier (a URL that points to where the passport is hosted), the registering operator and, where required, data such as the commodity code. The passport content itself, with all product, sustainability and compliance information, stays with you or with a DPP service provider you choose.

Authorities use this index in two ways:

• Customs: Before releasing imported goods for free circulation, customs can check electronically that a valid, registered DPP exists for the product.
• Market surveillance: Authorities can find the registered passports of a product group and follow the link to the hosted data.

For an overview of how market surveillance, customs, and commercial actors access DPP data, see our DPP Stakeholder Ecosystem Guide.

For you as an operator, this means two separate tasks: hosting a passport that is always reachable and registering its identifier in the Registry. This guide covers the second one.

Before You Start: What You Need

The sign-up itself takes less than an hour. The items below are what actually determines how fast you get through:

• A choice of second authentication factor: The Registry does not accept a password alone. A passkey on your computer or phone can be set up on the fly during sign-up, as shown in Step 3. Other methods need some preparation: the EU Login mobile app installed on your phone, a security key or hardware token at hand, or a national eID that EU Login accepts.
• Your organisation’s official data: Legal name, registered address, country of registration and one official identifier (for companies, preferably the national trade register number). It must match your certificate exactly, see below.
• A legal representative: The person who is legally entitled to sign or seal on behalf of the organisation, with name and email address.
• A qualified electronic seal or signature: Issued by a Qualified Trust Service Provider (QTSP) under the EU eIDAS Regulation; which of the two you need depends on your legal form (see below). This is the item with the longest lead time, because the provider has to check your identity (and your legal entity’s) before issuing the seal or signature. Order it first.

Production or Test Environment?

The Commission runs two separate environments:

Environment	Address and purpose
Production	registry.product-passport.ec.europa.eu: the real Registry. Footer shows “Production”.
Test	registry.acc.product-passport.ec.europa.eu: a sandbox. Before sign-in, EU Login shows an orange “-ACCG-” badge; once signed in, the Registry shows a red “MOCK” badge. Needs its own EU Login account, separate from the one you use in production. Data is not migrated to production and may be deleted.

The test environment is the right place to practise, but it is not a shortcut: according to the user guide, verification there works exactly like in production and requires the same valid data and qualified seal or signature. Everything in this guide applies to both.

Step 1: Open the Registry

The entry point is the Commission’s DPP Registry page on the Single Market website. It links to the production Registry, the test environment and the user guide for economic operators.

Whichever environment you choose, you are redirected straight to EU Login. The test environment uses the acceptance version of EU Login, recognisable by the orange “-ACCG-” badge over the EU Login logo. The red “MOCK” badge only appears once you are signed in to the Registry.

Step 2: Create Your EU Login Account

Click Create an account and fill in first name, last name, email address and the language for EU Login emails. Accept the privacy statement and submit.

A few points worth deciding here:

• Use a personal work address, not a shared inbox. EU Login is an account for a person. The organisation is created later, inside the Registry, and you become its administrator.
• Plan for the person who will actually work in the Registry. If your legal representative will not handle registrations, the account does not have to be theirs. Their name and email are requested separately during verification.

EU Login then sends an email with a link to set your password.

Step 3: Add a Second Factor Before Signing In

The next screen looks as if your password were enough, but it is not. Here is what happens, and the way out.

The First Sign-In Fails

Once your password is set, EU Login asks you to sign in to the Registry. The page shows a password field, but the verification method below it is preset to “Trusted Platform, security key or passkey”.

A new account has none of these registered, so entering your password and clicking Sign in fails:

Changing the method does not help either. The dropdown offers the EU Login mobile app, hardware tokens and national eID, but no way to sign in to the Registry with a password only.

Sign In to EU Login Directly, With Your Password

The way out is a detour: sign in to EU Login on its own, not as the gateway to the Registry. The two sign-in pages look almost the same, so check which one you are on:

• Sign-in for the Registry: a line above the heading “Sign in to continue” names the service asking for the sign-in (in the test environment: “login requires you to authenticate”). The address contains /cas/oauth2/authorize. There is no password option here.
• EU Login’s own sign-in: only the heading, with no line above it. The address contains /cas/login. Here the method list includes Password.

To get there, click My account in the error message. EU Login asks you to sign in again, this time on its own page. Choose Password in the method list, enter your password and sign in. You land directly in My Account.

Add a Passkey in My Account

In My Account, choose Manage my Trusted Platforms, security keys and passkeys. Add a Trusted Platform (your computer’s built-in authenticator, such as Touch ID or Windows Hello), a security key or a passkey, and give the device a name.

Your browser or operating system then asks you to create the passkey. Confirm it, and EU Login shows that the passkey has been added.

Sign In to the Registry With the Passkey

Now go back to the Registry and sign in again, with the method still set to passkey. Your browser offers the passkey you just created; confirm it.

If several colleagues will use the Registry, each of them needs their own EU Login account with their own second factor. A passkey stored in a password manager or synced across devices is the most convenient option for day-to-day work; the mobile app works as a fallback.

Step 4: Sign In and Start the Enrolment

Once you are signed in, a first-time user lands on the Welcome page, which sums up the rest of the process: submit your organisation’s details, receive a PDF declaration sealed by the Commission, have it sealed or signed with a qualified seal or signature, and upload it.

Note the sentence about existing organisations: if your company is already enrolled, you do not enrol it again. Ask your organisation’s administrator for an invitation instead.

Click Enrol New Organisation.

Step 5: Enter Your Organisation Information

The first decision is the organisation type. It decides which name fields, identifiers and certificate apply:

The user guide does not explicitly cover partnerships such as a German GbR. If that is your legal form, ask your QTSP which certificate it can issue, and the Commission’s helpdesk which organisation type to choose.

Choose carefully: switching the type after you have started typing gives you a new, empty form.

The address block asks for the registered address (the one on your company registration, not a mailing address). Only street address and country of registration are mandatory.

Choosing the Identifier

Next comes one official identifier, chosen from the types listed above for your organisation type.

“Local definition” adds a second dropdown for the two-letter country code that prefixes your identifier.

The identifier is not a free choice in practice. During verification, the Registry compares your form data with the attributes in the certificate of your seal or signature (see Step 7). Pick the identifier that your QTSP puts into the certificate, and write it in exactly the same format: the full value, not part of it. Check the certificate before you fill in the form, not afterwards. If you are unsure which identifier your certificate contains, ask the QTSP that issued your seal.

Compliance Contact

Finally, an email address and phone number for compliance matters. Market surveillance and other competent authorities may use them to contact you about registrations or product compliance; they are not shown publicly. A team address such as compliance@ is a better choice here than a personal one.

Click Save. If something is missing or in the wrong format, the Registry highlights the fields. Otherwise it confirms the save; click Start Verification in the dialog to continue.

You can pause at any point. When you come back, the Registry resumes at the last step you completed.

Step 6: Request and Download the Sealed PDF Declaration

Verification is a three-stage wizard. First, enter the legal representative: first name, last name and email of the person entitled to sign or seal on behalf of the organisation. Then click Request Declaration.

The Registry generates a PDF declaration that contains all your organisation details and is already sealed by the European Commission. Download it. If generation fails because the Commission’s sealing service is temporarily unavailable, simply request a new declaration.

The declaration is a one-page document in English (other languages are not available at the moment). It repeats your form data and states that the organisation will only perform actions in the Registry that it is legally authorised to perform. The Commission’s seal is embedded as a digital signature.

Do not change the file. Not the content, not the metadata, not by “printing to PDF”. The only permitted change is adding your own qualified seal or signature. Any other modification breaks the Commission’s seal, and the declaration will be rejected.

Step 7: Seal or Sign the Declaration with a Qualified Certificate

This step happens outside the Registry, and it is the one that determines whether verification succeeds. The legal representative applies the qualified seal (company) or the qualified signature (sole trader) to the downloaded PDF. The Registry checks four things:

1. Qualification level: Companies need a qualified electronic seal, sole traders a qualified electronic signature. Advanced or simple seals and signatures are rejected. A qualified certificate alone is not enough: it must be used either from a qualified signature creation device (a smart card or USB token from your QTSP) or through a qualified remote signing service. A qualified certificate installed as a software file (.p12 or .pfx) only produces an advanced signature, and the verification rejects it.
2. Trusted provider: The certificate must come from a QTSP on the EU/EEA trusted lists. A QTSP from any member state is recognised in all of them.
3. Signature format: The seal or signature must be embedded in the PDF as PAdES Baseline (level B, T, LT or LTA). Other containers, such as detached signatures or ASiC files, are not accepted.
4. Matching data: The certificate attributes must match what you entered in the form.

The user guide lists the certificate fields that are compared with your form, and the Commission’s validation tool (see below) shows the qualification level:

You can look these attributes up in any document you have already sealed with the same certificate: in the PDF reader’s signature panel, open the certificate details and look at the Subject. If your form says “Example GmbH” and the certificate says “Example GmbH & Co. KG”, verification fails. Fix the form first, then request a new declaration.

Which Tool to Sign With

The signing tool decides the signature format, so it matters as much as the certificate:

• Your QTSP’s own tool or remote signing portal: Usually the simplest route. Confirm that it produces PAdES Baseline.
• Adobe Acrobat: Works, but check one setting first. Acrobat may embed signatures in a format that is not PAdES, and the declaration is then rejected even with a valid certificate. Under Preferences › Signatures › Creation & Appearance › More…, set the Default Signing Format to CAdES-Equivalent before you sign.
• The Commission’s free DSS signing application: A desktop tool that signs locally. Choose PAdES as the signature format and one of the accepted Baseline levels.

Check the File Before You Upload

The Commission’s free DSS validation tool shows in advance what the Registry will see. Upload your sealed declaration there and check two fields in the result:

• Signature format: must be one of the PAdES-BASELINE levels.
• Qualification: must read QESeal (company) or QESig (sole trader). If it shows AdESeal-QC or AdESig-QC, the certificate was used as a software file rather than from a qualified device or remote service, and the Registry will reject it. Ask your QTSP to switch to one of those two options.

Getting a Qualified Seal or Signature

If you do not have a qualified seal or signature yet, this is the item to start with today. Both are sold by QTSPs, often as a remote (cloud) service that you use through a web portal or API, sometimes on a hardware token. Before you order, ask the provider four questions:

• Is the seal or signature used from a qualified creation device or a qualified remote service, and not delivered as a software certificate file?
• Does the certificate contain your identifier in the format you will enter in the Registry (for companies the organizationIdentifier, for example the trade register or VAT number; for sole traders the serialNumber)?
• Can their signing tool produce PAdES Baseline signatures on an existing, already signed PDF without altering it?
• How long does their identity check take?

Step 8: Upload and Verify

Back in the Registry, continue to the third stage, upload the sealed PDF (drag and drop or “Choose file”) and click Verify your Organization. If you rename the file, keep the name under 100 characters.

The Registry then runs its automated checks. The result appears on the page and in the Activity Dashboard, with one of three statuses: PROCESSING, SUCCESS or FAILURE. On success, your organisation is verified, the menu item “DPP Registration” becomes active and you become the administrator of the organisation in the Registry.

What a Failed Verification Looks Like

In our test run we deliberately uploaded the declaration with only the Commission’s seal and no seal of our own. The Registry rejected it and listed every check that failed. It always runs all checks, so a single report can list several errors at once:

The report is useful because it shows what the Registry actually validates. The most important messages and what they mean:

• “Exactly two signatures are expected”: The file must contain the Commission’s seal plus exactly one seal or signature of your organisation.
• “Countersignature or counterseal is missing”: You uploaded the declaration without sealing it.
• “Does not conform to the required PAdES Baseline signature format”: Your signing tool used an unsupported format or settings, or validation data is missing. The message names the format it detected; in our test it was empty because there was no seal of ours at all. In Acrobat, check the Default Signing Format (see Step 7), otherwise ask your QTSP for a PAdES Baseline profile.
• “Does not meet the required Qualified Electronic Seal (QSeal) level”: The seal is not qualified. Possible causes: an advanced rather than qualified certificate, or a qualified certificate used as a software file (.p12 or .pfx) instead of from a qualified device or remote service.
• “Certificate … is not trusted, has been revoked”: The certificate is not from a QTSP on the trusted lists, or it is no longer valid.
• "… provided in the organisation registration form, does not correspond to the value …": One message per field that differs from the certificate (legal name or first and last name, identifier, country of registration). Each message shows both your form value and the certificate value, so you can see exactly what to correct.
• Any message about the Commission seal: The file was modified after download, or it is not the declaration that was generated for you. Restart and request a new one.

From the error page you can upload a corrected file, restart the wizard to change the legal representative, or go back to the organisation information. Changing organisation details restarts the verification and requires a new declaration.

After Verification: Registering DPPs

Registration is the part of the Registry that is still being built out (see the status box at the top), so this section is based mainly on the Commission’s user guide rather than on our own screenshots.

Once verified, you register passports under DPP Registration. For each passport you provide its Unique Product Identifier (UPI): an https:// URL that resolves to the hosted passport data. In return, the Registry issues a Unique Registration Identifier (URI) that links its record to your passport.

• Two submission methods: an online form for single passports, or a file upload (JSON or XML, templates provided) for up to 100 passports per file. If one entry in a file fails, the whole file is rejected. The implementing regulation also provides for registration through an API, but API access is not available yet.
• Granularity: Registration happens at model, batch or item level, depending on what the product legislation requires. Where several laws apply, the most granular level wins. For batteries, only item level is available.
• Asynchronous processing: Each request gets a correlation ID and appears in the Activity Dashboard as PROCESSING until it ends in SUCCESS or FAILURE. Failed requests come with an error report that can be exported as CSV.
• Proof of registration: You can generate a proof of registration for one or more passports, sealed by the Commission with a qualified seal and time-stamped. You can hand it to customers or other third parties as evidence; each generated proof remains available for 90 days.

Current status: In the test environment, submitting a registration with the passport URL already works. However, the user guide states that a complete registration is not possible yet because the semantic catalogue (data model) for batteries, the first product group, is not final yet and still missing. Enrolment and verification, however, work today, and nothing stops you from completing them now.

Keep Your Verification Valid

A verified status lasts until your seal or signature certificate expires, and for at most three years. After that you can no longer register new passports or change existing registrations until you repeat the verification. Put the renewal date in your calendar, together with the expiry date of the certificate.

Pitfalls at a Glance

• Ordering the qualified seal last. It has the longest lead time of the whole process. Start with it.
• Form data that does not match the certificate. Legal name, country and identifier must be identical, including legal form and formatting.
• A software certificate or the wrong signing format. A certificate file (.p12 or .pfx) only produces an advanced seal, and Acrobat’s default format may not be PAdES. Check the file with the Commission’s validation tool before uploading.
• Editing the declaration. Any change besides your seal invalidates the Commission’s seal.
• Using one EU Login for test and production. The test environment needs its own account.
• Enrolling a company twice. If a colleague has already enrolled your organisation, ask for an invitation instead.
• Forgetting the three-year limit. Verification expires; plan the renewal.

Frequently Asked Questions

Conclusion: Enrol Early, Register When Your Product Group Opens

The EU DPP Registry is straightforward to use. The parts that take time are outside the Registry: a qualified seal with exactly the right attributes, and a legal representative who can apply it. Companies that order their seal now, practise in the test environment and complete verification in production well before their first deadline will be able to register passports on day one.

The Registry, however, only stores the pointer. The passport behind the UPI has to be online, correct and reachable for as long as the law requires. itemactive hosts that passport data, generates the identifiers and data carriers and keeps the passports up to date throughout the product’s life, alongside your existing ERP and PIM systems.

Official Sources and Links

Updates to this guide