Digital Product Passport as a Governance Infrastructure

Portaluppi Research & Innovation

Data, Interoperability, Accountability and Supply Chain Transformation

Research Paper · Applied Research · Digital Governance · Supply Chain · Compliance

Author: Maria Luisa Portaluppi Research Unit: Portaluppi Research & Innovation Framework: The Compliance Intersection Research Area: Digital Product Passport · Data Governance · Interoperability · Accountability · Supply Chain

Abstract

This paper analyses the Digital Product Passport (DPP) as a governance infrastructure rather than as a mere digital record associated with a product.

The research focuses on the interaction between data governance, interoperability, accountability, traceability, supply chain processes, auditability and organizational responsibility.

The central argument is that successful DPP implementation depends not only on technological capability, but on the maturity of the governance model supporting the generation, validation, exchange and verification of product data.

The Digital Product Passport therefore represents a practical case of regulatory, technical and organizational convergence and provides a relevant field of application for the framework The Compliance Intersection.

Keywords

Digital Product Passport · DPP · Data Governance · Interoperability · Accountability · Supply Chain · Traceability · Auditability · Digital Governance · Compliance · Standards · Manufacturing

1. Research Context

The progressive digitalization of product information is changing the relationship between products, organizations, supply chains and regulatory systems.

The Digital Product Passport introduces a model in which product-related information may be collected, structured, updated and exchanged across multiple actors and information systems.

This transformation creates opportunities for transparency and traceability, but also introduces new governance requirements.

The fundamental issue is no longer simply whether data exists, but whether it can be considered:

accurate;
attributable;
current;
interoperable;
secure;
verifiable;
traceable;
governed through clear responsibilities.

2. Research Question

Research Question

To what extent should the Digital Product Passport be considered a governance infrastructure rather than a technological compliance tool, and which organizational conditions are necessary to ensure that its data remains reliable, interoperable and auditable across the supply chain?

3. Research Objectives

The research pursues five main objectives:

identify the governance dimensions underlying DPP implementation;
analyse the relationship between product data and organizational responsibility;
examine interoperability as both a technical and governance problem;
assess the role of auditability and evidence in ensuring trust;
evaluate the impact of the DPP on supply chain governance and organizational processes.

4. Methodology

The study adopts an applied interdisciplinary methodology combining:

analysis of institutional and regulatory materials;
analysis of international standardization discussions;
review of research materials related to the Digital Product Passport;
observation of industrial and supply chain implications;
comparison between formal requirements and operational implementation;
evidence-based analysis;
cross-domain interpretation through The Compliance Intersection.

The research does not treat regulation, technology and organization as separate domains.

Instead, it examines the points at which they interact and generate shared governance responsibilities.

5. The DPP as a Governance Infrastructure

A Digital Product Passport may appear to be an information container.

In practice, its operation requires the existence of a broader governance system.

For each information element, organizations must determine:

who generates the data;
who validates it;
who updates it;
who may access it;
who is responsible for errors;
how changes are recorded;
how the origin of information is demonstrated;
how long information is retained;
how data is exchanged between systems.

These requirements demonstrate that the DPP functions as an infrastructure of distributed responsibility.

6. Data Governance

Data governance is one of the central conditions for reliable DPP implementation.

Product data must be governed through defined rules concerning:

ownership;
quality;
validation;
integrity;
availability;
access;
update;
classification;
security;
retention;
correction;
accountability.

The absence of clear data governance may result in a technically functioning DPP containing unreliable or outdated information.

The problem therefore shifts from data availability to data trustworthiness.

7. Accountability

Who is responsible for the data?

Accountability is a fundamental dimension of the Digital Product Passport.

A complex supply chain may involve multiple actors contributing different pieces of information.

The governance model must therefore identify:

the source of each information element;
the responsible actor;
the validation mechanism;
escalation processes;
correction procedures;
evidence demonstrating when and by whom information was provided.

Without these elements, the DPP risks becoming a repository of declarations rather than a reliable governance instrument.

8. Interoperability

Interoperability is often described as a technical capability.

However, technical compatibility alone does not guarantee meaningful information exchange.

Effective interoperability also requires:

common semantics;
shared identifiers;
compatible data models;
agreed validation rules;
common governance principles;
defined responsibilities;
reliable update mechanisms.

Interoperability should therefore be interpreted as both a technical and organizational condition.

9. Traceability

Traceability allows the reconstruction of relevant information across the product lifecycle.

A mature DPP system may need to connect:

origin of materials;
manufacturing stages;
suppliers;
transformations;
maintenance;
repairs;
reuse;
recycling;
end-of-life processes.

Traceability becomes meaningful when the information is not only available, but linked to reliable sources and a demonstrable chain of events.

10. Auditability and Evidence

From declared data to verifiable data

Auditability is essential to distinguish reliable product information from unverified declarations.

A DPP governance model should therefore consider:

source identification;
timestamps;
revision history;
audit trails;
evidence of validation;
control of modifications;
responsibility records;
system logs;
consistency between interconnected systems.

This dimension connects directly with the Case & Evidence Library and with the principle of evidence-based compliance developed within The Compliance Intersection.

11. Supply Chain Transformation

The Digital Product Passport extends governance beyond the boundaries of the single organization.

Its implementation creates dependencies between:

manufacturers;
suppliers;
subcontractors;
distributors;
logistics operators;
digital platforms;
certification bodies;
public authorities;
other relevant stakeholders.

The quality of the DPP therefore depends partly on actors that may operate outside the direct control of the manufacturer.

This makes supplier governance, contractual responsibility and supply chain assurance increasingly relevant.

12. Manufacturing and Industrial Systems

The impact of the Digital Product Passport is particularly significant in manufacturing environments.

Organizations may need to integrate DPP requirements with:

ERP systems;
product lifecycle management systems;
supplier platforms;
quality management systems;
traceability systems;
sustainability reporting;
cybersecurity controls;
existing compliance processes.

Implementation therefore requires integration with existing organizational infrastructure rather than the creation of an isolated digital tool.

13. SMEs and Implementation Maturity

The impact of the DPP may differ significantly according to organizational maturity.

Small and medium-sized enterprises may face challenges related to:

fragmented data;
legacy systems;
lack of interoperability;
limited internal resources;
supplier dependency;
unclear data ownership;
insufficient digital governance;
limited audit capabilities.

For these organizations, DPP readiness may require organizational transformation before technological implementation.

14. Cybersecurity Considerations

The expansion of connected product information increases the attack surface of supply chain ecosystems.

Relevant risks may include:

unauthorized access;
manipulation of product data;
compromise of identifiers;
API vulnerabilities;
platform attacks;
availability failures;
supply chain attacks;
fraudulent modification of traceability information.

Cybersecurity therefore becomes a condition for maintaining confidence in the DPP ecosystem.

15. Data Protection Considerations

Although the Digital Product Passport primarily concerns product information, personal data protection may become relevant whenever information is linked to identifiable individuals.

Possible areas of intersection include:

operators;
individual suppliers;
employees;
customers;
users;
access credentials;
usage information;
activity logs.

Privacy by design should therefore be considered where personal data enters the DPP architecture.

16. Standardization and Global Trade

The international dimension of product supply chains makes standardization essential.

Different national, sectoral or technological implementations could undermine the effectiveness of the DPP if information cannot be interpreted across markets.

International standardization may therefore play a central role in enabling:

interoperability;
common data models;
identification mechanisms;
verification;
trust;
cross-border exchange.

The relationship between DPP and global trade is explored in the research material dedicated to the ISO Annual Meeting 2026 - Digital Product Passports and the Future of Global Trade.

17. Findings

Key Findings

The analysis supports the following findings:

The Digital Product Passport should be treated as a governance infrastructure, not merely as a digital compliance artefact.
Data quality is inseparable from organizational accountability.
Interoperability requires governance alignment as well as technical compatibility.
Auditability is necessary to establish trust in product information.
DPP implementation extends compliance responsibilities across the supply chain.
Organizational maturity may be more decisive than technological availability.
Cybersecurity and Data Protection form part of the broader governance architecture.
International standardization will be critical for large-scale interoperability.

18. The Compliance Intersection Perspective

A real-world compliance intersection

The Digital Product Passport provides a clear example of the principle underlying The Compliance Intersection.

No single discipline is sufficient to govern it.

DPP implementation sits at the intersection of:

regulation;
standards;
technology;
Data Protection;
cybersecurity;
accountability;
audit;
data governance;
supply chain management;
sustainability;
organizational processes.

The DPP therefore demonstrates the need for integrated compliance models capable of analysing systems rather than isolated obligations.

19. Research Implications

Further research should focus on:

governance models for distributed product data;
verification mechanisms;
supplier accountability;
DPP audit methodologies;
interoperability governance;
integration with management systems;
impact on SMEs;
sector-specific implementations;
relationship between DPP and cybersecurity;
development of common standards;
evidence models for product information.

20. Conclusion

The Digital Product Passport represents a major transformation in the way organizations manage product information, supply chain relationships and regulatory responsibility.

Its effectiveness will depend on the capacity to establish trustworthy data, clear accountability, interoperable systems and auditable processes.

Technology alone cannot achieve these objectives.

The Digital Product Passport should therefore be understood as a governance infrastructure for complex industrial and supply chain ecosystems.

This perspective shifts the focus from implementation as a technical obligation to implementation as an organizational governance challenge.

Research Materials

Portaluppi Research & Innovation Research Paper · Digital Product Passport · Governance · Interoperability · Accountability · Supply Chain