How long must a product passport remain available?

What you must do concretely

What is expected of you

Article 10 of the ESPR (Regulation (EU) 2024/1781) governs the availability of the digital product passport. It states that the information in the passport must remain available even if the company that created the passport no longer exists, goes bankrupt, or ceases the activity to which the passport relates. The precise period is established per product group in the delegated act for that group — for clothing and textiles, this period has not yet been published at this time.

Availability during the product's lifetime

A product passport is not a one-time publication that can disappear after sale. The passport must remain accessible as long as the product is in use — including during second-hand resale, repair, or years after the original purchase. For a company with 10 to 100 employees, this means that hosting of passport data cannot be tied to the lifetime of a webshop, a seasonal collection, or an IT contract that expires after a few years. Those building their own hosting solutions must account for a long horizon; that is precisely why platforms offering this hosting as a service are often more practical than an in-house solution that grows with the rest of the web infrastructure.

Availability after the business ceases operations

Article 10 explicitly states that access to the passport must not disappear when the market operator that created it ceases to exist. This touches on a practical problem: a small or medium-sized clothing company typically hosts its own data on its own servers or with an IT provider chosen for the duration of business operations, not for a period that exceeds the lifetime of the business itself. What happens to passport data upon business closure, takeover, or insolvency is therefore a question that deserves an answer in advance, not afterwards. That subject is elaborated on the page about what happens to the product passport when a company stops operating.

Link with the product passport register

Article 13 of the ESPR requires registration of certain passport data in a central European register. That registration is separate from the question of where the passport itself is hosted, but in practice the two are connected: the register contains identifying data and references, while the passport itself — with the complete product information — remains available elsewhere. What exactly must be in the register and what falls outside it is described on the page about the product passport register. For long-term availability it is relevant that a register entry without a functioning passport has little value for a consumer who wants to verify a product.

Availability as part of technical design

The obligation to keep data available long-term is not only a legal matter but also a technical one. A passport that is unlocked via a QR code on the garment must point to an address that still exists after years and leads to the correct information. How that link works exactly is described on the page about the QR code on the product. Companies that link their passport data to their own ERP or inventory system face an additional risk: if that system is replaced, migrated, or phased out, the link to the passport must remain intact. That subject is addressed on the page about linking to your own system.

Where things go wrong in practice

A first situation arises when a brand hardcodes its passport data in its own webshop database, and that webshop is replaced by a new platform after a few years. The QR codes on products already in consumers' homes then point to an address that no longer exists.

A second situation arises in business acquisitions: the acquiring company takes over the brand name and inventory, but not automatically the server infrastructure on which the passport data runs. Without an agreement on this, the passport data can fall between the cracks.

A third situation occurs in bankruptcy. The administrator focuses on settling debts and assets, not on maintaining a database with product information. Without a documented agreement on who takes over the hosting, access often disappears silently.

A fourth situation is more technical: a company hosts the passport itself, but the domain to which the QR code points is not renewed in time. A passport that is still correct in substance becomes unreachable due to an administrative detail.

A fifth situation arises with seasonal collections: older collections are removed from the active assortment and the associated passports no longer receive maintenance, while the garments themselves are still worn for years. How this relates to variants per size and colour is explained on the page on product passports for seasonal collections and variants.

What you can record

• An agreement with the hosting party that specifies what happens upon termination of the contract, a takeover, or cessation of business activities.
• An internal list of which products, collections and QR codes are linked to which passport data, so that nothing is overlooked in case of a system change.
• An agreement on domain management: who is responsible for renewal and management of the domain to which the QR codes point, and what happens to it upon cessation of business.
• Documentation of registration in the European register, so that upon inspection it is clear which data has been recorded where.
• A transfer protocol for takeover or merger, specifying what happens to existing product passports.

For companies that do not wish to draw up these agreements themselves, texpas.eu offers templates and a hosting service in which the availability of the passport does not depend on the lifespan of the brand's own IT contract.