industry

DPP and Small Businesses: 3 SME Concerns from CIRPASS Research

How will SMEs handle the DPP rollout without large IT departments? We analyse 3 key barriers identified in CIRPASS research and practical ways to address them.

4/15/2026 · 8 min read · InfoDPP

When we talk about the Digital Product Passport (DPP), discussion often focuses on large corporations with dedicated engineering teams and integrated data systems. However, the EU Ecodesign for Sustainable Products Regulation (ESPR, Regulation 2024/1781) applies to all economic operators placing covered products on the EU market, including small and medium-sized enterprises (SMEs).

A boutique clothing workshop, a furniture producer employing 15 people, a small lighting importer: for businesses like these, the DPP raises practical questions about cost, capability, and compliance burden.

The EU-funded CIRPASS project (2022–2024) examined implementation barriers and DPP service providers in “A study on DPP costs and benefits for SMEs” (download PDF). Its successor, CIRPASS-2 (2024–2027, cirpass2.eu), pilots DPPs in textiles, electronics, tyres and construction and consults SMEs.

This article discusses three practical challenges, not a statistical ranking. The March 2024 study used eight interviews: four SMEs and four potential service providers. Its findings reflect the authors’ analysis, not a binding EU interpretation.

1. IT Capability Gap: “We Don’t Have an IT Department”

Limited IT skills and funding can make implementation difficult. Some small producers may assume that a DPP requires an in-house development team, cloud servers and custom integrations.

What the regulation actually expects

ESPR does not require manufacturers to build their own infrastructure. Articles 9 to 11 set general DPP requirements; product-specific acts define the detailed content and access rights. A SaaS platform is an implementation choice, but Article 10(4) expressly requires a backup copy through a DPP service provider.

Depending on its features and contract, a hosted service may provide:

No custom code: the manufacturer fills out predefined data fields in a browser-based form.
Subscription pricing: compare recurring fees with setup, integration, migration and data-preparation costs.
Standardised output: the service provider generates the required data carrier, hosts the passport data, and aligns the technical layer with the six DPP EN standards already published by CEN/CENELEC JTC 24, while tracking FprEN 18239, FprEN 18246 and WI JT024009.

CIRPASS discusses potential economies of scale from shared services. It does not establish a universal saving against in-house development: the report says costs need to be calculated for each SME (section 5).

2. Supply Chain Data Gap: How to Collect Environmental Data from Distant Suppliers?

A European furniture workshop sourcing fittings, boards, or motors through external wholesalers faces a practical challenge: how to obtain environmental data (carbon footprint, material composition, recycled content) from upstream suppliers, particularly those outside the EU, who may have no obligation or incentive to share it?

What the regulation provides

Article 5(11)(f) of ESPR requires that ecodesign requirements cause no disproportionate administrative burden, including for SMEs and microenterprises. Article 22 provides for support measures, not a general exemption from DPP obligations.

ESPR does not give a general permission to replace missing supplier data with averages. Secondary datasets are acceptable only where the applicable product rules and calculation methodology permit them.

In practice this means:

Identify the required evidence before commissioning lifecycle assessments or collecting component data.
Use reference datasets only where the applicable methodology permits them, documenting sources and assumptions.
Check product-specific rules on data quality, verification and calculation.

Early supplier engagement remains important. Proportionality does not remove the need to substantiate required information.

3. Trade Secret Exposure: Will Competitors See Our Supply Chain?

Businesses may worry that a QR code will give competitors access to sensitive information such as subcontractor names, specialised material compositions and assembly processes.

What the regulation provides

Articles 9(2)(f), 10(1)(g) and 11(b) provide for access rights set in the applicable delegated act. The following grouping is illustrative, not four legally fixed access levels:

Consumers and end users: information accessible to them under the applicable act.
Economic operators: data accessible within their specified role.
Competent authorities: information required for their statutory tasks.
Repairers, remanufacturers and recyclers: information for their activities, within the applicable access rights.

Confidentiality must be protected, but Article 10(1)(g) does not automatically restrict access to every supplier identity or formulation. Companies must check the product-specific disclosure rules.

The DPP is not necessarily public in its entirety. CEN/CENELEC JTC 24 has already published six DPP EN standards for the core technical layer. Access-rights management, information-system security and business confidentiality remain in FprEN 18239, while data authentication, reliability and integrity remain in FprEN 18246; both still need to be tracked separately from the published EN standards.

A consumer scan should show information made accessible to that user under the applicable law. Whether supplier details are visible depends on those rules, not a blanket confidentiality guarantee.

What SMEs Should Do Now

Rather than waiting until the requirements in each delegated act start to apply, SMEs can take low-cost preparatory steps:

Audit your product data: identify what information you already hold (materials, origin, weight, certifications) and where the gaps are.
Map your supply chain: document your key suppliers and the data they can (or cannot) provide.
Evaluate DPP service providers: compare SaaS platforms on pricing, supported product categories, and data input workflows.
Follow the timeline: battery passports become mandatory in February 2027; textiles and other categories will follow as delegated acts are adopted.

The CIRPASS-2 project maintains an open stakeholder community (sign up) and publishes updates on pilot results and SME recommendations.

Official Sources

Start by organising the information for one product and preparing its digital passport. Try OriginPass.eu.

← Back to Blog