regulations

Toy Safety Regulation: DPP Mandatory from 1 August 2030

The EU Toy Safety Regulation makes the Digital Product Passport mandatory for all toys from 1 August 2030. What changed, what it requires, and how to prepare.

3/25/2026 · 8 min read · InfoDPP

Toy DPP Is Confirmed Law

Regulation (EU) 2025/2509 on toy safety entered into force on 1 January 2026 and makes the Digital Product Passport mandatory for toys placed on the EU market from 1 August 2030.

Our article Toys & DPP: Safety Files and Product Data Readiness covers the operational side of preparing safety files, product data, and traceability for that obligation.

Toy DPP is no longer a scenario to monitor. The legal basis, application date, and minimum passport logic are already fixed. The remaining work is data, process, and system preparation.

What Regulation (EU) 2025/2509 Actually Confirms

This is not an ESPR delegated-act placeholder. It is a standalone sector law with its own DPP chapter.

Article 19 requires the manufacturer to create a digital product passport before placing a toy on the market. That passport:

under Article 19(2)(a), corresponds by default to a specific toy model, while Article 19(9) leaves room for a different level where another Union-law layer requires it;
contains at least the mandatory data listed in Annex VI Part I;
is linked through a data carrier such as a QR code to a persistent unique product identifier;
must be accurate, complete, up to date, and available in the language or languages required on the relevant market;
must remain available for 10 years after the toy is placed on the market.

Recitals 54 and 58, read together with Article 19(5)-(6), also make the declaration logic stronger than earlier summaries suggested: within the toy regime the DPP takes over the declaration-of-conformity function, and where it includes all required elements it can also be used to satisfy declaration obligations under other applicable Union product laws.

ESPR still matters here on the technical side: the toy passport uses the same logic for identifiers, registry connections, and data carriers, but the legal trigger comes from the toy regulation itself, not from a future ESPR delegated act.

Key Dates

Date	Meaning
1 Jan 2026	Regulation (EU) 2025/2509 enters into force
2026–2029	Article 49 delegated acts and preparation of identifiers, data carriers, registry links, and conformity processes
1 Aug 2030	DPP becomes mandatory for toys placed on the EU market

Annex VI Sets the Minimum Passport Layer

Annex VI Part I defines the minimum mandatory DPP layer. It is narrower and more precise than a full technical file. At minimum, the toy DPP has to identify:

the toy’s unique product identifier;
the manufacturer and, where relevant, the authorised representative, together with unique operator identifiers;
the economic operator responsible under Article 4 of Regulation (EU) 2019/1020;
a statement that the passport is issued under the sole responsibility of the manufacturer;
the object of the passport, including a colour image sufficient to identify the toy;
the commodity code where relevant;
the applicable Union legislation, the relevant harmonised standards or common specifications, and, where relevant, the notified body number and certificate reference;
the CE marking;
any fragrance allergens subject to specific labelling duties;
the communication channel under Article 7(12) and the backup-copy provider reference.

Annex VI Part II may additionally include safety information, warnings, and instructions for use. That distinction matters: the mandatory passport layer is not the same thing as publishing the full safety file.

What Must Stay on the Toy, Label, Packaging, or Instructions

The regulation allows digital support, but it does not turn toy compliance into a digital-only exercise.

Recital 32 and Article 6(3) make clear that warnings must still be marked on the toy, on an affixed label, or on the packaging and be visible before purchase, including in distance sales. Article 7(7)-(8) likewise keeps the duty to accompany the toy with instructions for use and safety information in the language or languages required by the Member State concerned.

In practice, the DPP can carry a digital copy or extra guidance, but it does not replace the physical warning and instruction layer.

Chemical Safety Is Central, but Not All of It Becomes Public

The toy regime is not just about a data carrier. The regulation also tightens the chemical baseline that manufacturers have to evidence in the DPP system and in the underlying technical documentation.

Key points include:

generic prohibitions in Annex II Part III point 4 for CMR substances, endocrine disruptors, specific target organ toxicants, respiratory sensitisers, and selected skin sensitisers;
a ban on the intentional use of PFAS in toys, toy components, and micro-structurally distinct parts;
a prohibition on the bisphenols listed in the Appendix to Annex II, plus a bisphenol A migration limit of 0.005 mg/l;
fragrance-allergen rules under which certain allergens above 10 mg/kg must be named on the toy, label, packaging or leaflet, and in the DPP;
the separate REACH communication duty for SVHCs above 0.1% w/w, where applicable.

This is where earlier summaries often became too flat. Some consumer-facing substance disclosures are explicit in the passport, but most laboratory evidence, composition data, supplier certificates, and safety-assessment records remain part of the technical and authority-facing layer rather than the full public view.

Public Layer, Authority Layer, and Market Surveillance

Article 19(2)(f) ties passport access to delegated acts under Article 49. The regulation already defines the access architecture: consumers and other end users, market-surveillance authorities, customs authorities, notified bodies, the Commission, and other economic operators do not necessarily see the same layer of information.

That has direct operational consequences:

consumers need direct access to the relevant toy information through the data carrier;
market-surveillance authorities and customs use the DPP and the registry for checks, including border risk management;
the economic operator placing the toy on the market must upload the unique product identifier and unique operator identifier to the registry, and for customs-relevant toys the commodity code as well;
distributors and online marketplaces need a digital copy of the data carrier or the unique product identifier so that potential customers can access the passport before purchase;
when the DPP is opened, it must display a link to the relevant Safety Gate section for reporting risky toys.

This is why chemical safety, traceability, online sales, and market surveillance should be treated as one implementation package, not as separate workstreams.

What Toy Companies Should Do Now

Map toy models, relevant lot or batch differentiation, persistent identifiers, and the data-carrier strategy for product, label, and packaging.
Rebuild the declaration workflow around the DPP, because the toy passport is no longer just an information page; it carries legal conformity functions.
Structure chemical evidence now: PFAS, bisphenols, fragrance allergens, REACH/SVHC communication, test reports, supplier declarations, and safety-assessment outputs.
Separate the public passport layer from the authority-facing technical file instead of assuming one flat dataset.
Prepare distance-sales, marketplace, and customs processes so that the identifier or passport link is available before purchase and at border controls.

What This Regulation Does Not Mean

To avoid common misreadings:

it is not an ESPR delegated act waiting for later confirmation;
it does not mean that all chemical, supplier, or laboratory data becomes public;
it does not remove the need for physical warnings, labels, and accompanying instructions;
it does not yet settle that every toy passport will always remain purely model-level in practice; Article 19 starts from a specific toy model, but Article 19(9) leaves room for another level where other Union law requires it.

Official Sources

Need to structure model identifiers, chemical evidence, and conformity records for your toy portfolio? Start free on OriginPass.eu and test a structured product record prepared for toy DPP requirements.

← Back to Blog