Compliance & standards

This page is the reference for "where does DPP Agent fit each specific regulation / standard". Useful for legal review and for matching ESPR / AGEC obligations to concrete data fields the brand must populate.

ESPR (EU 2024/1781) — Ecodesign for Sustainable Products Regulation

The ESPR is the meta-regulation that introduces the EU DPP concept and delegates specific requirements to category-level delegated acts. Articles 9–10 set the baseline:

• Article 9 — DPP must carry identifier(s), composition, substance information, environmental performance, durability, reparability, take-back instructions, instructions for use, and references to applicable EU Declaration of Conformity.
• Article 10 — DPP must be accessible via a data carrier (typically a QR code), at a stable URL, machine-readable, in the consumer's language for at least the duration the product is on the market.

The DPP Agent runtime delivers Article 10 directly: stable URL pattern, language-aware rendering, JSON-LD machine representation.

Article 9 is satisfied by populating the dpp_data field map. The admin compliance dashboard surfaces per-row coverage so the brand can see which mandatory fields are still missing before going public.

Delegated acts published or in pipeline (June 2026):

Each dpp_runtime.category value loads a category-specific schema under data/dppSchemas.ts that drives admin validation and renderer behaviour.

AGEC (FR Loi 2020-105 + Décret 2022-748)

The French anti-waste law has been already enforced since 2022 for textiles, footwear, furniture, electronics, and cosmetics sold on the French market. Brands selling in France must surface the seven mandatory declarations regardless of where the product was made or where the brand is headquartered.

Mandatory fields per ISO 3758 + Article 13:

tex.journey.steps (structured list) is encouraged. When present it both satisfies the geographic-traceability AGEC requirement and drives the consumer-facing supply chain timeline in the rendered DPP.

The admin coverage dashboard tracks AGEC compliance per row, per locale (since the French market requires French-language content). See Locale → Per-locale compliance coverage.

CEN JTC 24 — EN 18216 through EN 18223

The CEN TC 24 (Joint Technical Committee 24) series of standards operationalises ESPR. DPP Agent maps each to concrete platform behaviour:

• EN 18216 (Identifier persistence) — DPP URLs are stable for the lifetime of the product on the market. dpp_runtime.passport_id is treated as immutable: lifecycle transitions (withdraw, archive, recall) do not change the URL, only the response body.
• EN 18217 (Content) — required content domains: identification, manufacturer, composition, traceability, hazardous substances, environmental footprint, certifications, compliance documentation, end-of-life routing. Each maps to a top-level group in dpp_data.
• EN 18218 (Granularity) — model / batch / item granularity recorded as dpp_runtime.granularity. GS1 secondary keys (/10/ batch, /21/ serial) implement the URL form.
• EN 18219 (Persistence and storage) — DPPs retained for the product's market lifetime. We retain indefinitely; brands drive retention via the lifecycle (active → withdrawn → archived).
• EN 18220 (Interoperability) — JSON-LD with GS1 vocabulary alignment, content negotiation per Accept header.
• EN 18221 (Lifecycle management) — version history with audit log. dpp_revisions table holds every change pending human review.
• EN 18222 (Stakeholder access) — role-based access control per tenant. See Security → Roles.
• EN 18223 (End of life and disposal) — withdrawn / archived responses with regulatory citation. 410 HTTP code per §4.1.2.1.

The full mapping is in docs/site/compliance/en-18216-18223-mapping.md (forthcoming).

GS1 Digital Link Resolver v1.4

The public resolve endpoint implements the GS1 Digital Link Resolver specification v1.4. Specifically:

• §5 URL pattern (/01/{gtin} etc.)
• §6 linkType catalogue and ?linkType=all
• §7 303 redirect handling for individual linkTypes
• §8 content negotiation precedence
• §9 caching directives

Each tenant's https://{slug}.dpp.dppagent.com URL set is a GS1 Digital Link 1.4-conformant Resolver host. Brands hosting their own GTINs at our resolver do not need a separate GS1 registration for the URLs to work — any consumer scanner or B2B client following the GS1 Digital Link spec resolves them directly. Formal listing in the GS1 Conformant Digital Link Resolver registry (voluntary, fee + audit) is on the roadmap and not required for live DPPs today.

ISO 3758:2012 — Care symbols

Care symbols on textile DPPs follow ISO 3758:2012 with the canonical 32-code set covering all five symbol families (wash, bleach, dry-tumble, dry-natural, iron, professional clean). Structured codes (wash:30, bleach:no, natural:line, iron:2, dryclean:P, wetclean:W) render as the recognisable ISO icon grid on every textile template.

Source-of-truth field: tex.care.symbols_iso3758. AI Suggest extracts codes from free-text care instructions on the brand's product page; the operator confirms before publication.

REACH

espr.soc.declaration_table carries the substance / CAS / category / status quadruples REACH disclosure requires for SVHC presence. Brands operating in the EU should run their SVHC screening out-of-band (we don't run chemistry analysis) and publish the results into the DPP via integration or manual edit.

tex.haz.summary is the consumer-facing prose summary required by AGEC ("None declared", "Below SVHC threshold", etc.).

EU Battery Regulation (EU 2023/1542)

Brand category battery carries the dedicated battery DPP schema: chemistry, capacity, nominal voltage, expected cycles, critical raw materials with their recycled-content shares, safety instructions. Mandatory from 2027-02-18 for battery DPPs ≥2kWh; smaller batteries follow on a staggered timeline.

example accessory batteries may fall in this category. The DPP template (renderBatteryHTML, in development) renders the mandatory disclosures with safety-grade prominence.

How to find your obligations

The admin dashboard surfaces per-tenant compliance status:

Example Group
─────────────────────────────────────
ESPR delegated act        coverage
Textiles (2027-Q4)        86%   ⚠  3,142 SKUs · 414 missing tex.haz.summary
Footwear (2027-Q4)        91%   ⚠   824 SKUs · 73 missing tex.mat.natural_fibres_pct

AGEC (FR market only)
fr-FR locale coverage     71%   ⚠ 1,142 SKUs need French translation

Filter by category, by AGEC requirement, by locale; export the gap report to CSV for the compliance team's workflow.

Auditors

For SOC 2 / ISO 27001 / category-specific audits, we keep an audit pack ready: SOC 2 Type II report (annual), ISO 27001 certificate, penetration test summary, GDPR DPIA template. Available under NDA on request.