Ask a compliance officer what the EU Digital Product Passport requires, and the honest first answer is: we don't have the final text yet. The Ecodesign for Sustainable Products Regulation is in force, textiles are named as a priority category, and the delegated act that fixes the specific data requirements for apparel is expected around 2027. Add the transition period the regulation builds in — roughly eighteen months — and the operative date for most textile producers lands in 2028.
That gap between now and 2028 is being sold two ways. One camp sells panic: the deadline is a cliff, buy something immediately. The other sells complacency: it's years away, revisit it later. Both are wrong in the same way. They treat the passport as a document you will eventually need to produce, and reduce the question to when. The harder question — the one that determines whether the work you do between now and 2028 is worth anything — is what makes a passport actually count.
The self-declaration trap
Here is the version of DPP readiness that is easiest to sell and easiest to buy. A brand assembles what it knows about a product — fiber composition, recycled content, country of assembly, a repairability note — writes it into the passport format, attaches a QR code, and ships it. The data is real in the sense that someone typed it in good faith. The passport exists. The box is checked.
The problem is structural, and it does not go away with better data entry. A passport that a brand issues about its own product, from information the brand itself asserts, is a self-declaration. It is the seller vouching for the seller. In every other domain where a document carries regulatory weight — a financial audit, a safety certificate, a customs declaration under scrutiny — we already know what a self-declaration is worth when it is challenged: it is a starting point for the investigation, not the end of one.
A passport anyone can issue about themselves is not a passport. It is a claim wearing the format of a credential.
The distinction matters most at exactly the moment the passport is supposed to earn its keep: market surveillance. When an authority questions a claim of recycled content, or a competitor challenges an origin statement, or a customs process flags an inconsistency, the self-declared passport has nothing behind it but the brand's own word. The data that was fine for populating a field is now the data that has to survive a challenge — and self-declaration was never built to do that.
What a credential has that a claim does not
The difference between a claim and a credential is not the quality of the information. It is who stands behind each statement, and whether they can be held to it.
A credential has three properties a self-declaration lacks. First, the statement is attributable to a specific party at a specific point in the chain — not "recycled content: 40%" floating free, but a claim traceable to the recycler who processed the material, distinct from the spinner's claim, distinct from the brand's. Second, each statement is verifiable at its origin: the party who made it can be asked to substantiate it, and the substantiation exists independently of the brand's say-so. Third, the statement can be revoked — if the underlying evidence fails, the claim can be withdrawn rather than silently persisting.
None of this requires the final delegated act to be published. These are properties of how you build the data foundation, not of the specific fields the 2028 regime will demand. A brand that spends the runway collecting self-declared attributes is building a pile of claims it will have to re-verify under pressure later. A brand that spends the runway establishing attribution and verification at origin is building the thing that survives the challenge — regardless of which precise fields the delegated act names.
This is why "wait until the text is final" is the expensive answer. The fields will change. The structure — claim versus credential — will not. The work that transfers is the work of making each statement in the passport attributable to the party who can stand behind it. That work takes time to build across a supply chain, and it is the part you cannot buy in the last eighteen months before the deadline.
The honest limits
Two cautions, because the argument is easy to overstate.
Verification at origin is necessary, not sufficient. A verified statement can still be verifying the wrong thing, and a passport full of well-attributed, individually-substantiated claims can still miss the material fact that turns out to matter. Attribution buys you a passport that survives a challenge to the claims it makes. It does not tell you that you made the right claims. That judgment stays with the compliance officer.
And there is such a thing as verification theater — the appearance of independent substantiation layered over what is still, underneath, self-declaration. A logo, a badge, a third-party format wrapped around data the seller still generated and vouches for alone. The test is not whether the passport looks verified. It is whether, when a specific statement is challenged, there is a specific party other than the brand who can be asked to stand behind it. If the answer traces back to the brand every time, it is still a claim.
What to do with the runway
The deadline is 2028. The rulemaking that fixes the fields is around 2027. Neither date is the thing to organize around. The thing to organize around is that the passport you can defend in 2028 is built from statements that were attributable and verifiable when they were made — at origin, by the party responsible for them — not reconstructed under deadline pressure from a brand's own records.
Preparation, not panic. But preparation aimed at the right thing: not populating a format, but building a chain where every claim in the passport has someone standing behind it who has earned the right to make it.
The mechanism behind this — how each claim in a supply chain gets graded by evidence rather than stamped with a badge, and where even a cryptographically perfect chain can still be defeated — is laid out in full here: How verification works.
Suppliers building that attributable chain today issue verifiable Digital Product Passports through Proman.