The mistake that comes up most often
Companies that want to arrange the digital product passport for aluminium usually think first about the technical side: which connection, which QR code, which system. The agreements with the software supplier then mainly concern connection and delivery. What is systematically forgotten in this process is who is responsible once the passport is online: who updates it if an alloy, a supplier or a production process changes, who can be held accountable if the QR code no longer works, and what happens to the data if you switch suppliers or if the supplier stops.
This mistake often only becomes apparent after a couple of years, when the passport must remain online for ten years and the original agreements only covered the delivery phase. A contract that ends at "go live" leaves out precisely the part that lasts the longest.
Why this specifically applies to the product passport
With ordinary business software, a contract that mainly concerns maintenance after delivery is usually sufficient, because the consequences of a failure remain internal. With the product passport it is different: the passport is designed to show information externally, via the QR code, to customers, supervisory authorities and processors further down the chain. If the data is outdated or the link no longer works, that is visible outside your own organisation.
Then there is the term. A passport is not made for a season, but for the entire service life of the aluminium component, with a retention period that in practice is referred to as ten years. A software supplier who after two years chooses a different platform, undergoes a takeover or stops a product line, leaves you with a passport that can no longer be updated, while the obligation to keep it up to date does not simply disappear. For more information on how such a connection works in practice and which data is involved, you can read the explanation of where the data comes from.
What is often missing in practice
Three components are noticeably often missing from contracts we encounter. Firstly: who may and must adjust the data if something changes about the product, and within what timeframe that happens. Secondly: what happens to the already published passports if cooperation with the supplier ends, for example whether the QR codes continue to work and where the data is then located. Thirdly: who is liable if a supervisory authority asks questions about incorrect or outdated information in the passport, and whether that affects the manufacturer, the supplier or both.
These are not technical details but agreements about responsibility, and they belong in the contract itself, not in an appendix that no one reads anymore once the system is running.
The overlap with existing rules
This mistake does not stand alone. Data in a product passport can involve personal data, for example contact details of a responsible person at the manufacturer, and then the usual GDPR rules on retention period and security apply in full alongside the requirements for the passport. Existing rules on product safety and liability for incorrect product information also remain fully in force; the product passport comes on top of these, not in place of them. How we handle the security of data is explained on the page on privacy and data security.
How you prevent this
The essence is simple to state, even though implementation differs from company to company: establish who keeps the data current, how long the supplier keeps the passport accessible, and what happens when you switch to another party. Explicitly ask for an exit clause: can you take the data and QR codes with you if you decide to switch, or are you then dependent on the goodwill of the departing supplier.
Because each company has a different position in the chain, the agreements needed also differ. An overview of the questions relevant to each situation can be found in the knowledge base with topics by situation. For the legal side of a contract, such as liability and warranties, it is advisable to have a lawyer review it; we cannot make that assessment for you.
Know where you stand
Would you like an indication before you enter into discussions with your software supplier? With the free quick-scan of a few questions you can quickly see which components are relevant for your company and which questions you can best prepare for.