The EU Digital Product Passport Is Coming for Cosmetics: What Manufacturers Need to Prepare for Now

Most cosmetics manufacturers I work with have the EU’s Digital Product Passport filed under “watch list — not urgent.” Batteries are first in scope, then textiles and furniture. The Commission’s Ecodesign working plan (2024–2030) doesn’t name your shea butter cream or peptide serum, and no delegated act for cosmetics has been published. That’s a reasonable reading of the current regulatory calendar. But Regulation (EU) 2024/1781 — the Ecodesign for Sustainable Products Regulation, or ESPR — entered into force on 18 July 2024, and the data infrastructure it will eventually demand is the kind of thing that takes two to three years to build correctly. Getting caught in a compliance scramble when the delegated act finally lands is an entirely avoidable risk.

This post explains what the Digital Product Passport actually requires, how it intersects with your existing obligations under Regulation (EC) No 1223/2009, and where to focus your preparation now.

What the ESPR Actually Creates — and Why Cosmetics Aren’t as Far Off as You Think

The Ecodesign for Sustainable Products Regulation replaces the old Ecodesign Directive (2009/125/EC), which was narrowly focused on energy-related products. The ESPR is structurally different: it empowers the Commission to set product-specific eco-design and information requirements via delegated acts for almost any goods category, and the Digital Product Passport sits at the centre of that framework.

The DPP is a standardised electronic record, linked to a physical data carrier — QR code, RFID tag, barcode, or equivalent — attached to the product or its packaging. It contains structured, machine-readable information about the product’s composition, origin, sustainability performance, and end-of-life options. Each record must be registered in a centralised EU product registry currently being developed jointly by ECHA and the Commission’s Joint Research Centre.

Under the ESPR, DPP accessibility requirements will run for a defined minimum period after the last unit is placed on the market. The Battery Regulation (EU) 2023/1542 — the closest existing DPP reference point — sets 10 years as its post-market retention period. The cosmetics delegated act will define its own retention figure, but brands should assume it won’t be shorter than their current PIF archiving obligations under 1223/2009.

The critical point is this: the framework is law. The Commission doesn’t need new primary legislation to bring cosmetics into scope. It only needs a delegated act — a faster, lower-profile process than full co-decision. Given the pace of regulatory activity across EU sustainability legislation in 2024 and 2025, “eventually” may arrive considerably sooner than many manufacturers currently expect.

How the DPP Will Sit Alongside Your Existing Product Information File

Under Regulation (EC) No 1223/2009 — now in its 17th year of application — every cosmetic product placed on the EU market requires a Product Information File maintained by a Responsible Person with an EU address. The PIF contains the cosmetic product description, safety assessment, manufacturing method, GMP evidence, and post-market safety monitoring data. It’s a rigorous internal compliance document.

But it’s designed to be produced, stored, and made available to national competent authorities on request. It’s not publicly queryable. It doesn’t communicate to a waste processor what packaging materials they’re handling. It doesn’t tell a retailer’s sustainability team what percentage of the formula is bio-based, or whether the palm-derived emulsifier came from a certified sustainable source.

The DPP fills precisely that gap — and in doing so, it requires a materially different quality of supply chain data than the PIF demands. Based on Article 9 of the ESPR and the Commission’s technical DPP architecture guidance, cosmetics DPP data will almost certainly need to include:

• INCI ingredient list with geographic origin of primary raw materials
• Packaging material composition — material type, post-consumer recycled (PCR) content percentages, and recyclability classification
• Manufacturing site location — the production facility address, not just the Responsible Person’s EU registered address
• Product carbon footprint — at minimum Scope 1 and 2; eventually full Scope 3 supply chain emissions
• Refillability and format data — product reuse potential and available refill options
• Waste handling codes, machine-readable rather than relying on the on-pack symbols most consumers ignore

Some of this already exists somewhere in your supply chain documentation. The critical word is somewhere. “Exists in a supplier PDF from 2021” and “is structured, current, and linkable to a specific batch identifier” are very different states of readiness.

The Supply Chain Transparency Gap Most Brands Haven’t Actually Measured

The pattern that emerges consistently in DPP readiness assessments: the formula documentation is clean, the safety assessment is compliant, the Responsible Person arrangement is functioning correctly. The gaps appear three or four levels down the supply chain.

Your botanical extract supplier can confirm INCI name, specification, and a batch certificate. Can they confirm the country of cultivation for the raw plant material? Can they provide a Scope 3 carbon footprint for that ingredient that would survive third-party verification? Can they tell you whether their own packaging supplier’s containers contain any recycled content?

Today, the honest answer from most upstream suppliers is no — or “possibly, with several months’ lead time and significant follow-up.” Once a cosmetics DPP delegated act is in force and transition periods are counting down, “with lead time” becomes “by a fixed date.” The brands that have already qualified suppliers on DPP-relevant data criteria will be in a genuinely different position.

The EU cosmetics sector generated approximately €82 billion in retail value in 2023, according to Cosmetics Europe’s annual industry data — making it the largest cosmetics market globally. That scale means EU compliance requirements here effectively reshape international supply chains. Ingredient and packaging suppliers who cannot provide DPP-ready data will lose EU business to those who can. Sourcing to DPP standards will become a supplier qualification filter, not just a regulatory checkbox.

There’s also a data governance dimension that few brands have worked through: the DPP must remain accessible for the full post-market retention period for every product ever notified. For cosmetics brands that reformulate frequently — and many reformulate dozens of SKUs every year — the archiving and version control implications are substantial.

Three Investments That Pay Off Regardless of When the Delegated Act Arrives

Rather than waiting for regulatory certainty that may never arrive at a convenient time, there are concrete preparatory actions that reduce DPP risk without depending on knowing exact requirements:

Build a structured materials database. The DPP requires machine-readable, standardised data — which means ingredient and supplier information cannot live in a shared drive of PDFs. A raw materials management system that captures INCI identity, supplier location, source country, active certifications (organic, fair trade, Rainforest Alliance, etc.), and sustainability attributes is immediately useful for DPP preparation, the EU Green Claims Directive, and internal ESG reporting. It’s the same underlying dataset serving multiple compliance obligations.

Formalise packaging documentation requests. Start requesting recyclability assessments and PCR content percentages from your packaging suppliers in writing, as a contractual standard. Most major packaging manufacturers already hold this data; the majority of cosmetics brands simply haven’t made it a formal requirement. Getting this into supplier agreements now means it’s available when the DPP data form requires it — rather than triggering an urgent supplier data collection exercise under time pressure.

Review your Responsible Person scope. Under the current 1223/2009 framework, your EU Responsible Person maintains the PIF and carries ultimate compliance responsibility. The DPP will almost certainly extend their data custodianship obligations significantly — including ongoing accuracy obligations across a product’s full commercial life, plus the post-market retention period. If your Responsible Person is a third-party EU agent rather than an internal compliance function, review your current service agreement now. Scope, liability, and data access provisions that made sense in a PIF-only world may need renegotiation. That’s a commercial conversation worth having before a delegated act creates urgency.

One further practical step: engage with Cosmetics Europe’s technical working groups tracking the DPP. The industry association has been active in shaping Commission thinking on how the ESPR should apply to personal care products, and manufacturers participating in that process have early visibility into draft requirements — which translates directly into preparation lead time.

The Broader Picture: DPP as Regulatory Connective Tissue

The Digital Product Passport isn’t a standalone sustainability initiative — it’s deliberately architected as connective tissue between multiple EU regulatory frameworks running in parallel.

REACH substance data flows into DPP ingredient declarations. The EU Green Claims Directive requires the same supply chain traceability that underpins DPP sustainability data fields. The ongoing Commission review of Regulation (EC) No 1223/2009 is widely expected to reference DPP infrastructure as a mechanism for enhanced post-market safety surveillance and ingredient transparency. The proposed EU Cosmetics Regulation revision, if it introduces stricter ingredient origin requirements, will draw on the same supplier data the DPP demands.

A European cosmetics manufacturer investing in DPP-ready data systems in 2026 is simultaneously building the foundation for Green Claims compliance, more defensible REACH declarations, and a more audit-resistant Product Information File. These are not separate compliance workstreams running on separate budgets. They’re the same underlying question: do you actually know, at a granular level, what your product contains, where every component came from, and what happens to it after it leaves the consumer?

The regulatory direction is unambiguous. The exact timetable for cosmetics remains open. That’s not a reason to wait — it’s a reason to use the preparation window while it exists.

At our team, we’ve been running DPP readiness scoping assessments for European personal care and cosmetics clients since the ESPR entered into force. What we find consistently is that the supply chain data gap is fixable. But it requires supplier re-qualification, system investment, and internal process changes that simply cannot be compressed into a six-month compliance sprint. Start the work now, and the delegated act becomes a confirmation exercise rather than a crisis.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• ISO 17025-Accredited Testing to Support EU Cosmetics PIF Documentation — Qalitex Laboratories provides accredited analytical testing for ingredient verification, stability, and safety data that underpins compliant Product Information Files for EU market entry.
• Health Canada Compliance for European Cosmetics and NHP Brands Entering Canada — Androxa supports European manufacturers with NHPD product licensing, cosmetic notification, and GMP compliance requirements for the Canadian market.