Regulation (EU) 2025/2509 on toy safety (entered into force 1 January 2026) replaces the old Toy Safety Directive 2009/48/EC with a directly applicable EU regulation. All toys placed on the EU market must carry a digital product passport from 1 August 2030, containing safety, conformity, chemical-safety and traceability information accessible to consumers via a data carrier (e.g. a QR code on the product or packaging). The regulation also strengthens substance restrictions (cancer-causing, hormone-disrupting and other harmful chemicals), introduces connected-toy provisions and enables customs screening via DPP data.
Toy DPP is a legal obligation with a fixed date. The question is no longer whether it will apply, but how to organise safety, compliance and substance data before 1 August 2030.
The European Commission published its proposal to replace Directive 2009/48/EC with a directly applicable regulation. The proposal introduced a mandatory Digital Product Passport for toys, strengthened chemical safety requirements, added connected-toy provisions and enhanced market surveillance powers.
The Toy Safety Regulation entered into force on 1 January 2026, replacing the old Directive. The transition period begins: manufacturers and importers should audit conformity documentation, structure substance and supplier data, identify the responsible person for each toy on the EU market, and prepare data-carrier integration.
The European standardisation bodies (CEN/CENELEC) develop harmonised DPP standards covering the data model, data carrier, registry and access rights. Companies should prepare data-carrier implementation (e.g. QR codes), digital Declaration of Conformity workflows and substance-reporting systems. Connected-toy manufacturers should assess alignment with the Cyber Resilience Act (the EU cybersecurity law for products with digital elements).
The ESPR (Ecodesign for Sustainable Products Regulation) mid-term review in 2028 may bring additional alignment between the toy-specific DPP and broader product-category rules. Companies should test DPP publication workflows and validate data completeness across the full product portfolio.
From 1 August 2030, every toy placed on the EU market must carry a digital product passport accessible via a data carrier, containing the EU declaration of conformity, safety and compliance data, chemical safety declarations, traceability information and responsible economic operator identification.
This addendum is based directly on Regulation (EU) 2025/2509 and clarifies what may sit in the digital passport layer and what must still be physically present on, or accompany, the toy.
For toys, the digital product passport replaces the EU declaration of conformity and, where it contains all required information, can also serve declaration-of-conformity functions under other applicable Union product rules.
The Regulation explains that manufacturers should be able to include warnings in digital format through the DPP. However, warnings still have to be marked on the toy, an affixed label or the packaging and, where appropriate, in the instructions that accompany the toy.
Manufacturers must ensure the toy is accompanied by instructions for use and safety information in the language or languages required by the Member State concerned. The DPP can add a digital copy or extra guidance, but it does not remove that accompanying-information duty.
The DPP is accessed through a data carrier physically present on the toy or on an affixed label. If the size or nature of the toy does not allow that, it may be placed on the packaging or documentation accompanying the toy. Additional digital information may be offered through the same carrier, but it must be clearly separated from the mandatory passport layer.
57 attributes · 7 clusters
Toy DPP data is not equally visible to all parties. The general public and consumers see safety, conformity and substance compliance summaries, while market surveillance authorities can access full technical documentation, laboratory data and supplier details to verify compliance.
| Attribute | Public | Authorities |
|---|---|---|
| Chemical safety evidence | Compliant with EN 71-3 migration limits and CMR restrictions | Full Bill of Materials with CAS numbers, concentrations, supplier certificates and laboratory test protocols |
| Conformity assessment | CE marked — conformity per Module A, EN 71-1/2/3 applied | Complete test reports with laboratory data, failure modes, corrective actions and notified body records |
| Supply chain records | Manufactured in [country] | Full factory audit report with production site registration codes, corrective action history and subcontractor mapping |
* "Supply chain" reflects a working view of economic operators with a legitimate interest. Exact toy DPP access rights are to be specified in delegated acts under Article 49; market surveillance authorities are expected to retain the broadest access.
**** Source labels (e.g. ERP = enterprise resource planning system, PIM = product information management, Lab = laboratory, Legal = legal department) indicate which enterprise system typically holds each data cluster. They are guidance for IT integration, not regulatory requirements. This list combines toy passport data explicitly mentioned in Annex VI of Regulation (EU) 2025/2509 with supporting technical-file, conformity and supply-chain data commonly needed to operate the passport in practice. Official legal source for the minimum passport layer: Article 19 and Annex VI of Regulation (EU) 2025/2509; detailed access and system rules still depend on delegated acts under Article 49.
The Toy Safety Regulation applies to all economic operators in the toy supply chain:
Note: The regulation defines a toy as any product designed or intended for use in play by children under 14 years of age, including connected toys, toy cosmetics, and educational products marketed as toys. Excluded: sports equipment, bicycles for children over 14, fashion jewellery for children, and professional products for supervised educational settings.
