CRA Dossier
The Digital Product Passport for Software Products
No EU law requires a Digital Product Passport (DPP) for standalone software, but the registry is live, the standards are cited in the Official Journal, and from 18 February 2027 battery passports will carry data that battery management system firmware produces. This dossier provides a comprehensive breakdown of the Digital Product Passport (DPP) requirements, standards and vocabulary relevant to software products. It details the core horizontal system requirements necessary for full passport conformance and explores how software vendors can gain a strategic advantage by aligning their CRA compliance evidence with standard-conformant passport structures. Software vendors can serve customers whose physical products carry mandatory passports, be ready for the registry at marginal cost if scope later extends to software, and turn compliance documentation into a transparency asset their customers can see.
Written for product, engineering, and compliance leadership.
What Do Digital Product Passports Mean for Software Vendors?
The EU’s Digital Product Passport is up and running. The central registry went live on 20 July 2026, its operating rules entered into force on 6 August 2026, and six European standards cited in the Official Journal now set out how any passport is identified, stored, exchanged and kept interoperable. Software is not yet a mandated product group, but it reaches the Digital Product Passport through embedded products: battery management firmware, its version and its update state are natural passport content once battery passports become mandatory in February 2027. The standards fix the system layer and leave the data to product law. For software, the CRA already defines that data.
What is inside
- The instrument hierarchy behind the EU Digital Products Passport, from the ESPR framework to the registry Implementing Regulation, the presumption-of-conformity Decision and the sector passports for batteries and construction products.
- A glossary of the terms that carry defined legal meaning, including economic operator, verified economic operator, DPP service provider, independent backup provider, data carrier, registration and transfer.
- A map of the eight EN 18xxx Digital Product Passport standards and what each does in the system.
- A direct mapping of CRA evidence (identity and conformity, SBOM, support period and vulnerability handling, update integrity) onto a software passport payload, with model, batch and item identifiers translated into product, release and artefact digest.
- A consolidated checklist of Digital Product Passport requirements for a conformant software passport, a timeline to 2030, and eight recommendations.
Who is it for
Product, engineering, and compliance leadership at software vendors, and at any manufacturer whose software ships inside batteries, construction products or other goods heading for a mandatory Digital Product Passport.
Written by Daniel Thompson-Yvetot for CrabNebula Ltd. Not legal advice, not a conformity determination.
