No regulation names you. Your customer is already asking for the data.

The request rarely arrives as a letter from a regulator. It arrives as an attachment from your customer’s procurement team: a forty-column spreadsheet, two weeks to return it, and a line at the top saying this is a new requirement under the framework agreement.

You open the regulation to check whether you are actually obliged. You are not in it.

That is not your customer’s mistake and it is not yours. It is how the legislation is built, and it is worth understanding exactly why before you decide how to answer.

The obligation and the work sit in different places

Both the ESPR and the Batteries Regulation attach the passport obligation to the economic operator who places the product on the EU market. If you make a component that goes into somebody else’s product, you place nothing on the market. Your customer does.

So the obligation is theirs. The penalty is theirs. The market surveillance authority will knock on their door.

The data, though, is yours. Composition, the origin of the raw material, the batch, your own supplier’s certificate, the weight, the process. Your customer physically cannot generate any of it, however obliged they are.

The whole asymmetry is in that sentence. The risk is theirs, the work is yours, and your name appears nowhere in the text.

Your customer’s deadline reaches you earlier

The dates quoted in public are your customer’s dates.

Batteries. From 18 February 2027. The exact wording in Article 77(1) of Regulation (EU) 2023/1542 is each LMT battery, each industrial battery with a capacity greater than 2 kWh, and each electric vehicle battery. Note where the threshold sits, because it is repeated wrongly almost everywhere: 2 kWh applies to industrial batteries only. Every EV and every LMT battery is in scope regardless of capacity.

Vehicles. Regulation (EU) 2026/1738 entered into force on 13 August 2026. Article 13 introduces the Digital Circularity Vehicle Passport from 1 September 2032. The date looks remote, but the text is more interesting than the date: the passport must be aligned, interoperable and, where possible, integrated with the battery passport under Article 77 and with passports under the ESPR. And where information is already accessible through one of those, it is not to be duplicated.

In other words the legislator is not building three separate passports. It is building one connected layer of data, into which your data goes once and out of which several regimes read.

Textiles. Among the first product groups under the ESPR. The roadmap to 2030 is already published.

Now do the arithmetic your customer has already done. A brand that must ship a passport on 18 February 2027 does not start collecting data on 17 February. It starts twelve to eighteen months earlier, because it needs time to go round its suppliers, receive answers in a dozen formats, reconcile them into one, and find out which ones are missing.

Which means it starts now. That is why the spreadsheet is in your inbox today and not in 2027.

Who is already in this position

Three groups, and all three are larger than they look from outside.

Automotive component manufacturers. According to the Bulgarian Investment Agency, around 80% of the sensors in European cars and over 90% of airbag sensors are made in Bulgaria; Melexis, Sensata and Schneider Electric all manufacture there. Those components go into cars built by German, French and Italian manufacturers whose batteries need a passport from February 2027 and whose vehicles will need one from 2032. Not one of those regulations mentions a Bulgarian sensor supplier. Every one of them reaches that supplier through a contract.

Textile subcontractors. They sew for other people’s brands. The brand carries the obligation. The workshop holds the composition and origin data, and it is the only party that holds it.

Label, tag and packaging manufacturers. This case is different in one important way, and it deserves its own section.

A cost, or a product

There are two ways to answer the spreadsheet, and the difference between them is large.

The first is to treat it as a compliance cost. You fill it in. Then you fill it in again for the next customer, in their format, with their columns. Then again. It works, nobody can fault you for it, and it costs the same every year while earning nothing.

The second is to turn the same information into something you sell. It is not open to everyone, but for some it is obvious and simply has not been noticed yet.

If you make labels, tags or packaging, the data carrier is literally the item you already sell your customer. A unique code on the label, a page behind the code showing whatever your customer wants shown about the product, and the ability to change that content without reprinting anything. To your customer it is a feature of the label they are buying from you anyway. To you it is a new line on the same order.

That is exactly why we built Traceability: a working platform that a label manufacturer offers under its own brand or alongside ours, priced per item for runs measured in millions rather than dozens. Rollout is measured in weeks. The customer stays yours, and the contract stays between the two of you.

If you do not make labels, the second route usually looks less like a separate product and more like leverage in a negotiation. A supplier who answers the spreadsheet in two days in a structured format is in a different position from one who answers in six weeks in Excel. That difference shows up at contract renewal.

What being ready will not do for you

Three things worth saying up front rather than afterwards.

Being ready does not transfer the obligation. It stays with your customer and there is no mechanism by which it moves to you. If somebody is selling you compliance, check precisely what they mean by it.

The traceability being sold today is not mandatory. That is exactly why it sells easily: the customer wants it now, for commercial reasons of their own, not because anyone is forcing them.

And the reverse is true in the useful direction. For a company that already has structured traceability, the passport later is a configuration rather than a new project. It does not work the other way round. That is the argument for starting there rather than starting from the regulation.

Where to start

Four steps, in this order.

Work out which of your customers are in the first product groups. Not all of them are. The list is short and public, and it tells you which requests arrive next year and which arrive in five.

Check what you already hold. Composition, origin, batch and certificates almost always exist. The problem is rarely that the data is missing. The problem is that it lives in seven places and comes out in a different format for every customer.

Choose the format once. GS1 identifiers, QR or Data Matrix as the carrier, open data that exports. The same foundation the coming regulation is built on. The format you pick now is the rework you avoid later.

Decide whether it is a cost or a product. That is the only decision on this list that is yours rather than your customer’s.

The forty-column spreadsheet is coming either way. The question is whether you fill it in every year, or sell it.

If you make labels, tags or packaging, see what it looks like on a real product. If you are in either of the other two groups, the digital product passport is where to start.