Covering DPP basics, ESPR and CPR obligations, EPD vs DPP differences, GS1 identification, cryptographic verification, CBAM documentation, and multi-language requirements.
A Digital Product Passport (DPP) is a structured, machine-readable electronic record that travels with a physical product throughout its life. For construction materials, it contains environmental performance data (such as EN 15804+A2 indicators), product identity (GTIN, batch, manufacturer), supply chain information, compliance declarations, and a cryptographic signature for tamper-detection. The EU ESPR regulation (2024/1781) defines the legal framework for DPPs.
An Environmental Product Declaration (EPD) is a document — typically a PDF — that reports the environmental performance of a product against a Product Category Rule (PCR). A DPP is a live digital record that embeds EPD data alongside product identity, supply chain information, and compliance declarations. One DPP can reference the same underlying LCA data as the EPD, but the DPP is machine-readable, signed, permanently linkable via QR code, and versioned throughout the product's lifetime. DPPs do not replace EPDs — they complement them.
Under ESPR 2024/1781, DPP obligations are activated product-by-product through delegated acts referencing harmonised standards (hENs). For construction products, the first wave covers products with existing CE marking under CPR 2024/3110: cement (EN 197 series), structural steel (EN 10025 series), and precast concrete (EN 13369 series) are expected Q4 2026 for the delegated act trigger, with mandatory compliance approximately 18 months later (est. Q2 2028). Insulation (EN 13162–13171) follows around Q1 2027.
ESPR and CPR are already in force but impose no immediate DPP obligations. Obligations become active through product-specific delegated acts. Once a delegated act is published for a product group, manufacturers have an 18-month transition period. After that date, CE marking requires a valid DPP. Estimates for the first construction product wave: Q2 2028 for cement, structural steel, and precast concrete.
Yes. Terrave's data model is designed so that a single verified environmental dataset generates both the machine-readable DPP record and a human-readable EPD summary. The underlying LCA data — A1–A3 GWP, the 13 EN 15804+A2 indicators, module declarations — is authored once and published to both formats. This eliminates double-entry and ensures the EPD and DPP are always in sync.
A DPP is created from verified product and environmental data: the manufacturer provides product identity (GTIN, product name, batch), a verifier or LCA practitioner provides the EN 15804+A2 indicator values, and a PCR reference and EPD programme operator reference are attached. Terrave canonicalises this data to JSON-LD, generates a SHA-256 digest, signs it with ECDSA P-256, archives the signed manifest to IPFS, and registers the GS1 Digital Link. The whole process takes under a minute once the source data is in place.
The manufacturer creates a new DPP version. Each version has its own signature, IPFS CID, and timestamp. Prior versions remain retrievable — the version chain is immutable. The GS1 Digital Link QR code on the physical product does not change; the resolver always directs to the current active version. Regulators and verifiers can access the full version history.
ESPR Article 10 requires DPPs to remain accessible for the product's expected service life plus 10 years. For construction products with a 50-year reference service life, this means a minimum of 60 years. Terrave implements a three-layer persistence guarantee: IPFS content-addressed archival, EU data escrow, and GS1 Digital Link resolution. See the authenticity page for full details.
ESPR defines tiered access. Public data (environmental performance indicators, product identity, compliance declarations) is accessible to anyone scanning the QR code or calling the public API — no authentication required. Restricted data (supply chain sourcing details, batch-level traceability, business-sensitive formulations) is accessible only to authorised parties: regulators, notified bodies, and authorised downstream users. Terrave implements this access tier model via scoped API tokens.
Yes. ESPR and CPR require that DPP data presented to end users is accessible in the official languages of the countries where the product is marketed. Terrave stores DPP data in a language-neutral canonical form and renders localised content at the display layer. Product name, compliance statements, and instructions for use must be provided in the relevant EU official languages.
The GS1 Digital Link is a URL format that encodes a product's GTIN (and optionally batch, serial number, and expiry date) in a resolvable web address. A QR code on the physical product encodes this URL. When scanned, the resolver at terrave.ai/01/{gtin} redirects to the live DPP. This means the QR code on a product placed on the market today will still resolve to the correct, updated DPP record decades later — without reprinting labels. The standard is ISO/IEC 18975:2022 and GS1 Digital Link v1.1.1.
Every Terrave DPP is signed with ECDSA P-256. To verify: call GET /api/dpp/{upi}/verify. The endpoint returns verified: true if the current payload matches the original signature, and verified: false with a reason if the data has been tampered with. The IPFS CID provides a secondary check — the CID derived from the retrieved data must match the CID embedded in the public DPP record. No authentication is required to call the verification endpoint.
ECDSA P-256, also known as ES256 in JWA notation. This is the mandatory algorithm specified in prEN 18246, the draft European standard for DPP data elements and exchange formats. The signing key is held in a hardware security module (HSM). The signing public key is published in the Terrave Trust Registry at /api/trust/keys.
IPFS (InterPlanetary File System) is a content-addressed storage network. Unlike a URL that points to a location, an IPFS CID (Content Identifier) is a cryptographic hash of the content itself. The same data always produces the same CID. For DPPs, this means the IPFS CID embedded in the public record is simultaneously the archive address and an integrity check — if the content changes, the CID changes, making tampering detectable.
prEN 18246 is the draft European standard for Digital Product Passport data elements and exchange formats. It defines the JSON-LD schema for DPP records, the canonical serialisation method for signature generation, the mandatory ECDSA P-256 signing algorithm, and the IPFS archival requirement. The 'pr' prefix indicates it is still in draft form (prEN = preliminary European Norm). Terrave implements prEN 18246 conformance. Once finalised, it will be published as EN 18246.
ESPR 2024/1781 establishes the EU-wide DPP framework and applies to all product categories. CPR 2024/3110 is the sector-specific regulation for construction products — it governs CE marking and aligns with ESPR by incorporating DPP requirements into the CE marking process. For construction products, the practical path to DPP obligation is: CPR harmonised standard (hEN) updated to reference DPP data requirements, Commission adopts delegated act, 18-month transition begins.
CBAM (Carbon Border Adjustment Mechanism) requires importers of steel, cement, aluminium, fertilisers, and other covered products to declare the embedded carbon of their imports and purchase CBAM certificates. The embedded carbon data required for CBAM is essentially a product carbon footprint — closely overlapping with the GWP A1–A3 value in an EPD or DPP. A verified DPP with EN 15804+A2 GWP data provides a strong evidentiary basis for CBAM declarations, though CBAM has its own specific calculation methodology that may differ from EN 15804 in boundary treatment.
Not directly — Buy Clean California requires EPDs (under ISO 21930 or NSF 449) for public procurement of covered materials (structural steel, flat glass, mineral wool, carbon steel rebar). DPPs are not yet mandated in the US. However, the EPD data embedded in a Terrave DPP is compatible with Buy Clean requirements, and the machine-readable format makes procurement compliance checking more efficient than reviewing PDF EPDs.
Once a DPP delegated act is in force for a product group, the DPP becomes part of the CE marking documentation. Prior to that, CE marking under CPR uses the Declaration of Performance (DoP). After the delegated act, the DPP supplements or replaces parts of the DoP, incorporating environmental performance data. The exact relationship between DPP and DoP in the new CPR framework is still being defined through implementing acts.
ESPR Article 10 requires that DPPs remain accessible throughout the product's expected service life plus 10 years after the last unit is placed on the market. For construction products with a 50-year reference service life, this typically means 60 years minimum. This requirement drives the need for infrastructure solutions beyond simple hosted databases — Terrave uses IPFS archival and EU data escrow to meet this obligation.
Further reading
Standards reference, regulatory timeline, product family guides, and a live DPP you can inspect right now.