The most common mistake we see is this: a company enters into a conversation with the software provider about the digital product passport, and leaves that conversation with the idea that the provider has now "sorted it out". This is a misunderstanding with consequences, because the regulation makes a distinction between who supplies the technology and who is responsible for the content of the passport.
The software provider builds or supplies the system: the connection, the storage, sometimes the QR data carrier. But the obligation to ensure that the data in the passport is correct and remains up to date lies with the provider — usually the manufacturer or the importer of the aluminium semi-finished product. A system cannot check data that was never supplied correctly in the first place. Those who confuse this run the risk of ending up with a technically perfect passport whose content no one has reviewed.
Why this misunderstanding arises
A conversation with a software provider quickly turns to technology: which system, which connection with existing administration, what it costs, how fast it works. These are logical questions, and the provider is happy to answer them, because that is his business. But in that conversation, the question that matters most often disappears: who ensures that the data that ends up in the passport is actually correct and remains correct. A provider who talks about a "compliance module" or a "passport solution" sometimes gives the impression that the obligation is thereby covered. This is understandable from a sales perspective, but it is not what the regulation provides for.
It helps to be clear beforehand about what a product passport must contain and where that data comes from. Those who do not yet have this in order will find the knowledge base with explanations per topic an overview per situation, without having to consult a lawyer first.
What the regulation does and does not say about the provider
The regulation describes the role of the provider: the one who puts the product on the market and is therefore responsible for the accuracy of the information that ultimately appears in the passport. A software provider is not a provider in that sense, even if he technically hosts the passport or supplies the QR code. Supervisory authorities look at the source and accuracy of the data during inspections, not at which software package is behind it. This does not mean that the choice of a provider does not matter — it does mean that a well-functioning system is not a substitute for a well-filled and maintained passport.
Whether a specific collaboration with a provider in your situation provides sufficient coverage is something only a lawyer or the competent supervisory authority can determine. This article describes the distinction the regulation makes, not how that is regulated in your own contract.
Which questions prevent the misunderstanding
The mistake can be prevented by explicitly asking the provider in the conversation about who supplies which part of the data, and who remains responsible if something changes about the composition or origin of the aluminium. It is also useful to ask what happens if you switch providers: does the passport remain accessible, and who ensures the update then. A provider who can answer these questions clearly also indicates where his role ends and yours begins. Those who want to see what such a submission looks like in practice can find an explanation of how the data is created there.
How you conduct the conversation differently
It helps to have the conversation with the software supplier only after you have determined for yourself which data you must supply and maintain yourself. Then the conversation becomes a question about technology and integration, rather than a question about responsibility. Companies that don't yet know exactly where they stand can clarify that with a few questions that map out your situation quickly, even before a supplier sits down at the table.
A product passport remains, even after delivery, a living document: it must be updated as soon as anything changes about the product or the data. That responsibility does not shift to the software supplier, even if they handle the technical management. Anyone who wants to read more about this will find, in answers to practical questions about the passport a number of common situations worked out.
If you don't yet have a clear picture of what is needed in your case, the free quick-scan is a good starting point: in a few questions you get an indication of where you stand, without needing an account for it.