Without a QR code or other data carrier, the digital product passport cannot be consulted by anyone, even if the content exists somewhere in a system. The regulation requires not only that the data is present, but also that it is recognisably and scannably present on the product, the packaging or the accompanying documentation. If that link is missing, the passport is in practice not present, even if the information has been correctly and completely collected.
What that concretely means depends on when it is established and by whom. Market surveillance authorities check whether a product complies with the requirements that apply at that time; a missing data carrier is one of the points they look at once the obligation for aluminium products takes effect. What the concrete consequences are if that is established differs from situation to situation and from one surveillance authority to another, and this article makes no prediction about that.
Why the data carrier is not a side issue
In the design of the regulation, the passport and the data carrier are two sides of the same obligation. The passport is the collection of data on the origin, composition and origin of the aluminium. The data carrier, usually a QR code, is the way in which a buyer, a recycler or a surveillance authority can access that data without requiring a separate document or email. A passport that exists only in an internal database, without a findable carrier on the product, therefore does not meet the objective of the regulation, even if the content is in order as such.
This distinction affects many companies that are already engaged in collecting data, but have not yet arranged the last part, the link to a physically recognisable point on the product. It is precisely that last part that the working method behind the QR data carrier is about: how data, hosting and a scannable code are linked together.
What market surveillance assesses
Market surveillance of products as a rule does not operate solely on the basis of complaints; checks can also take place on a spot-check basis, as already happens with other product rules. This looks at whether the required information is present, current and accessible. A missing or broken QR code, a code that refers to an outdated page, or a passport that exists but is not linked to the product anywhere, are examples of signals that a surveillance authority can pay attention to. Which surveillance authority that is exactly in the Netherlands, and how it acts in practice, is not yet fixed in detail; the official designation follows from the national implementation of the regulation.
The difference between not yet mandatory and soon not in order
For aluminium semi-finished products, the obligation does not yet apply. The delegated act that sets out the precise requirements is expected around 2027 according to the European Commission's work plan, with a presumed entry into force date for the obligation itself around 2029. That date is therefore not yet fixed and may shift. This does not mean there is nothing to do now: companies that only start once the obligation takes effect run the risk that collecting supplier data and setting up a data carrier will take longer than the transition period allows.
It is therefore customary for companies to already check which data they have in-house, which still need to be requested from suppliers, and how a data carrier can technically be linked to a product or batch. Those who wish to get an overview of this process without immediately delving into legal details can get an indication of their own situation in a few questions.
What this is not
The absence of a QR code is not a matter of CE marking, product safety in the strict sense, or a data protection issue. It concerns specifically the accessibility of information required by the regulation. These three subjects can overlap, for example when the same product documentation is used for multiple regulations, but they have their own rules and their own supervisory authorities. For a complete picture of what does and does not fall under the term aluminium and what role each actor in the chain has, the overview per subject in the knowledge base provides a starting point.
What you can practically do now
Because the exact requirements for the data carrier must still be filled in by the delegated act, it is advisable to get two things in order in any case that will be necessary anyway: a complete and current overview of the data that a passport will have to contain, and a way to host that data as soon as a fixed link or code must be linked to it. Both are matters that can be built up independently of the ultimate technical standard. Companies that want to start with this can, via creating a business account already lay the foundation for when the obligation comes into effect.
For your own situation, especially where it concerns liability or the interpretation of a specific provision, the official text of the regulation on EUR-Lex remains the starting point, supplemented by advice from a lawyer or the competent supervisory authority.
Would you like to get an idea of where your company stands now? The free quick-scan provides a first indication in a few questions, and the knowledge base presents the individual subjects clearly side by side.