Regulations •

When the DPP replaces the EU declaration of conformity: what changes for manufacturers

Under the Toy Safety Regulation the digital product passport replaces the EU declaration of conformity outright; the new CPR delivers a merged declaration through the passport, and the Machinery Regulation allows a digital one. What that means for the data behind the declaration.

Author: myDPP Team

When the DPP replaces the EU declaration of conformity: what changes for manufacturers

For thirty years the EU declaration of conformity has been the most important piece of paper in product compliance. It is short — often a single page — and it carries a great deal of weight: with a signature on it, the manufacturer takes sole responsibility for the statement that the product meets every applicable requirement of Union law. Everything else in the compliance file, from test reports to the notified body’s certificate, exists to support that one sentence.

Recent EU product legislation does something with that document which is easy to overlook, because it is not framed as a reform of the declaration at all. In the Toy Safety Regulation the digital product passport does not accompany the declaration of conformity — it replaces it. In the new Construction Products Regulation the declaration of performance and the declaration of conformity are merged into one document, which is then made available through the passport. In the Machinery Regulation the declaration stays as it is, but may be served as a machine-readable code instead of a sheet in the crate. Three different routes, one direction of travel: the declaration is turning from a document into a data set.

Key takeaways

  • The EU declaration of conformity is not disappearing as a legal act. What is disappearing is the assumption that it has to be a document — a file drawn up once, signed and filed away.
  • Toy Safety Regulation (EU) 2025/2509 goes furthest: the DPP is mandatory for every toy and replaces the EU declaration of conformity. Its content mirrors the old declaration, plus the CE marking, the customs commodity code and a contact channel for safety complaints. General application: 1 August 2030.
  • Construction Products Regulation (EU) 2024/3110 merges the declaration of performance with the CE declaration of conformity into a single declaration of performance and conformity, which the manufacturer must supply electronically — unless it is included in the digital product passport or made available on a website.
  • Machinery Regulation (EU) 2023/1230, applicable from 20 January 2027, keeps the declaration but permits it to be provided digitally, via an internet address or a machine-readable code, kept available for the expected lifetime of the machinery and at least 10 years.
  • Under the ESPR and the Battery Regulation the declaration of conformity survives unchanged: manufacturers still draw one up and still affix the CE marking. The passport sits alongside it rather than in its place.
  • What actually changes for a manufacturer is not the legal form of the declaration but where its content lives: in a versioned, machine-readable, multilingual data record that has to stay resolvable for a decade.
  • myDPP is not a notified body, does not perform conformity assessment and does not issue or sign declarations of conformity. It stores, versions and serves verified product data, and provides the data carrier that opens it.

What the declaration of conformity does today

The EU declaration of conformity is the instrument through which the manufacturer — or an authorised representative — declares that a product satisfies the requirements of all Union legislation applicable to it. Its reference structure comes from Decision No 768/2008/EC, and each piece of harmonised legislation restates it in its own annex. The content is consistent across sectors: identification of the product allowing traceability, the name and address of the manufacturer, a statement that the declaration is issued under the manufacturer’s sole responsibility, the Union legislation referred to, the harmonised standards or other technical specifications applied, the notified body and its certificate where a third party was involved, and the place, date and signature.

Two features of that regime matter for what follows. First, the declaration is static: it describes the product as it stood at one moment, and if the product or the applicable standards change, the manufacturer draws up a new one. Second, availability is a duty owed to authorities, not to the public: the manufacturer keeps the declaration and the technical documentation at the disposal of national authorities for ten years after the product is placed on the market, and under Regulation (EU) 2019/1020 the responsible person established in the Union has to be able to produce it on request. Consumers, in general, never see it.

Both features are the ones the passport changes.

Three routes by which the declaration is going digital

Toy Safety Regulation: the passport replaces the declaration

Regulation (EU) 2025/2509 on the safety of toys — adopted on 25 November 2025, published on 12 December 2025, in force since 1 January 2026 — is the first piece of EU product law in which the digital product passport is not an additional obligation but a substitute for an existing one. Every toy placed on the EU market must have a passport, and that passport takes the place of the EU declaration of conformity.

Its content is recognisably the old declaration with additions: the product identifier and a colour image, the manufacturer’s details including a unique operator identifier, the importer’s details, the statement of conformity with references to the applicable Union legislation and to harmonised standards or common specifications, the CE marking, the customs commodity code, the notified body’s details, instructions, warnings and safety information including the list of allergenic fragrances, a contact channel for safety matters, and a reference to the DPP service provider that holds a back-up copy.

The obligations that come with it are where the difference from a PDF becomes concrete. The passport must be linked to a persistent unique product identifier through a data carrier placed on the toy itself or on an attached label — packaging or accompanying documents only where size or nature makes that impossible. It must be accessible before purchase, which for online sales means the listing has to carry the link. It must be available in the official languages of every member state where the toy is sold. It must remain available for at least ten years after the toy is placed on the market. It must contain no personal data about customers. And the product identifier together with the operator identifier must be registered in the central EU registry established under the ESPR — the Toy Safety Regulation plugs into the horizontal passport infrastructure rather than building a parallel one.

General application starts on 1 August 2030, when Directive 2009/48/EC is repealed. Technical specifications for the passport — formats, protocols, the shape of the data model — are to arrive by delegated act before that date and are not yet known. The full picture is in our article on the EU Toy Safety Regulation.

Construction Products Regulation: one merged declaration, served through the passport

Regulation (EU) 2024/3110 takes a different route to a similar place. Construction products had two parallel documents: the declaration of performance, in which the manufacturer declared the performance of the product’s essential characteristics, and the CE declaration of conformity. The new CPR merges them into a single declaration of performance and conformity.

The delivery mechanism then changes as well. The manufacturer has to supply a copy of the declaration by electronic means for every product made available on the market — unless the declaration is included in the digital product passport or made available on a website. The construction passport itself runs on a registry operated by the Commission and interoperable with the ESPR infrastructure, and the declaration is one of its core fields.

The sequencing is slower than the headline date suggests. The regulation applies from 8 January 2026, but the passport obligation lands product family by product family, together with the new harmonised technical specifications — realistically from around 2028, with the old regime phasing out into the 2030s. See our article on the Construction Products Regulation for the detail.

Machinery Regulation: the declaration stays, the paper goes

Regulation (EU) 2023/1230 on machinery, applicable from 20 January 2027, is the least radical of the three and for many manufacturers the most immediately useful. The declaration of conformity remains exactly what it was, but it may be provided in digital format: either with the machinery, or as an internet address or machine-readable code where it can be retrieved. If it is served digitally it has to stay available online for the expected lifetime of the machinery and in any case at least ten years. The instructions for use may go digital on the same terms, with one consumer-protection backstop — a purchaser who asks for a paper version at the time of purchase must get one free of charge within a month.

This is not a passport regime. But it is the same underlying move: a QR code on the machine, resolving to a compliance record that has to remain reachable for a decade.

Where the declaration is untouched: ESPR and batteries

It is worth being precise about the two regulations most closely associated with the passport, because neither of them abolishes the declaration.

Under the ESPR, a product covered by a delegated act goes through the conformity assessment procedure in the regulation’s annexes, the manufacturer draws up an EU declaration of conformity and affixes the CE marking, and the digital product passport is a separate obligation alongside both. Under the Battery Regulation (EU) 2023/1542, the declaration of conformity and the CE marking have applied since 18 August 2024, while the battery passport becomes mandatory on 18 February 2027 for EV, LMT and industrial batteries above 2 kWh. Two instruments, running in parallel.

So the substitution is not yet the general rule — it is a pattern that has appeared in sector legislation and is spreading. The Toy Safety Regulation is the precedent worth watching, because it shows what the drafters do once a passport is available: they stop requiring a second, paper artefact that says the same thing.

Paper declaration versus passport-borne declaration

Classic declaration of conformityDeclaration carried by the passport
FormDocument (PDF, paper)Structured, machine-readable data
Who issues itManufacturer or authorised representativeUnchanged — manufacturer remains responsible
AccessOn request by authorities; kept in the fileOpen via a data carrier on the product, before purchase
LanguagesLanguage(s) required by the applicable actOfficial languages of every market where the product is sold
UpdatesNew declaration drawn up, old one filedNew version of the record, with history retained
Retention10 years at the disposal of authorities10 years resolvable, including after the company changes systems
VerificationManual, document by documentMachine-readable — market surveillance and customs can query it
Failure modeDocument cannot be foundLink does not resolve — a visible, public failure

The last row is the one manufacturers underestimate. A declaration nobody can locate is an internal problem discovered during an inspection. A passport whose QR code returns an error is a compliance failure any customer, competitor or authority can see by pointing a phone at the product.

What actually changes for a manufacturer

The declaration stops being a document and becomes a view of your data

Today the content of a declaration is typically assembled by hand: someone opens last year’s file, updates the standard references, checks the notified body certificate is still valid, and signs. When the same content has to be exposed as structured data behind a QR code, that process does not scale — not because of the volume of products, but because every field now has to have an owner, a source system and a defined state. The declaration becomes a view rendered from product data rather than a file stored next to it. This is the same shift described in our article on DPP data requirements.

A harmonised standard is superseded; a component supplier changes; a variant is added. In the paper world the manufacturer issues a new declaration and the old one goes into the archive. In the passport world the record has to change and the history has to remain reconstructable, because a product placed on the market in 2028 was accompanied by the state of the data as it stood in 2028. An audit trail — who changed which field, when, on what basis — stops being an internal nicety.

Languages turn into a data problem

The Toy Safety Regulation requires the passport in the official languages of every member state where the toy is sold. For a manufacturer selling across the EU, that is not a translation project that finishes; it is a permanent obligation attached to fields that change. Warnings, safety information and instructions have to be versioned per language, and a change to the source text has to propagate.

Ten years of availability is a service obligation

“Available for ten years” reads differently when availability means a URL that resolves. The identifier has to be persistent through system migrations, rebrands and domain changes. Both the Toy Safety Regulation and the Machinery Regulation address the business-continuity risk in their own way — the former by requiring a reference to a DPP service provider holding a back-up copy, the latter by tying availability to the expected lifetime of the machinery. Where you host the record, and what happens to it if you change vendors, becomes a compliance question rather than an IT preference.

Liability does not move

This is the point most easily lost in vendor marketing. Using a DPP service provider does not transfer responsibility: the manufacturer remains fully responsible for the accuracy of the passport, exactly as it was for the signature on the declaration. A provider that stores and serves the data is doing the work of a filing cabinet with an API, not the work of a signatory.

What does not change

  • Conformity assessment. The applicable procedure — self-assessment or notified body involvement — is unaffected. The passport is the output, not the assessment.
  • The role of notified bodies. Where third-party involvement is required, it is still required, and their certificates are referenced in the record.
  • CE marking. The passport does not replace the CE marking; the two coexist, and under the Toy Safety Regulation the CE marking is itself one of the passport’s fields. Our article on CE marking and the DPP covers the relationship.
  • Technical documentation. Test reports, risk assessments and the technical file remain what they were, retained for the same periods. The passport references them; it does not publish them.
  • Who signs. The manufacturer, or its authorised representative, still takes sole responsibility.

What to do now — five steps

  1. Establish which regime applies to you, and when. Toys: passport replaces the declaration from 1 August 2030. Construction products: family by family, from roughly 2028. Machinery: digital option from 20 January 2027. ESPR and batteries: declaration and passport in parallel.
  2. Take your existing declaration apart into fields. Go through the last declaration you signed and, for each element, name the system it comes from and the person who owns it. The fields with no clear owner are the ones that will hold up implementation.
  3. Decide where the identifier lives. A persistent unique product identifier and a resolvable data carrier are prerequisites for every one of these regimes. If your product identifiers are currently ERP-internal and change between systems, that is the first thing to fix.
  4. Set up versioning before you need it. Retaining the state of the record at the moment of placing on the market is far cheaper to design in than to reconstruct later.
  5. Treat language coverage as a data model question. Decide now which fields are language-dependent, and how a change to a source text reaches every market.

Our DPP implementation checklist walks through the wider programme.

Frequently asked questions (FAQ)

Does the digital product passport replace the EU declaration of conformity everywhere?

No. Today the substitution is explicit only in the Toy Safety Regulation (EU) 2025/2509, and there only from 1 August 2030. The new CPR merges the declaration of performance and the declaration of conformity and allows the merged document to be delivered through the passport. Under the ESPR and the Battery Regulation, the declaration and the CE marking remain separate obligations.

Can I put my declaration of conformity behind a QR code today?

For machinery, that becomes an explicit legal option from 20 January 2027 under Regulation (EU) 2023/1230, subject to availability requirements. Outside such express provisions, digital delivery is a matter for the applicable act — where a document has to accompany the product, publishing it online does not on its own discharge that duty. Check the requirement for your specific legislation before withdrawing paper.

Who is liable if the data in the passport is wrong?

The manufacturer, or its authorised representative — the same party that signed the declaration. Delegating storage and delivery to a DPP service provider does not shift responsibility for the accuracy of the content.

What happens if the passport is unreachable ten years after sale?

That is a breach of the availability obligation, and it is publicly visible in a way a lost document never was. This is precisely why the Toy Safety Regulation requires a reference to a service provider holding a back-up copy, and why identifier persistence and hosting arrangements belong in a compliance discussion rather than an infrastructure one.

Sources

Back to Knowledge Base