The JTC 24 standards — EN 18216 to EN 18223
The European Digital Product Passport is not one specification. Its technical side is a family of European standards from CEN/CENELEC Joint Technical Committee 24 (JTC 24), written under the Commission's standardisation request M/604 to support the ESPR (Regulation (EU) 2024/1781).
Six were published on 27 May 2026 and cited in the Official Journal by Commission Implementing Decision (EU) 2026/1736 (July 2026). The numbers are not a continuous range: there is no EN 18217 or EN 18218 in the series.
| Standard | Title | What it covers |
|---|---|---|
| EN 18216 | Data exchange protocols | HTTPS, HTTP/2, and the formats a passport is delivered in |
| EN 18219 | Unique identifiers | Product, economic operator and facility identifiers, and the ID schemes behind them |
| EN 18220 | Data carriers | The QR code, Data Matrix or NFC tag on the product, its size, placement and print quality |
| EN 18221 | Data storage, archiving and data persistence | Where the data lives, how its history is kept, and who still has it once the issuer leaves the market |
| EN 18222 | APIs for lifecycle management and searchability | The API for creating, updating and finding passports |
| EN 18223 | System interoperability | The passport header, the data model and how it is serialised |
Each linked page summarises the standard and says plainly where DPP Agent meets it and where it does not. None of them replaces the text, which the national standards bodies sell.
Where DPP Agent stands, in one list
- EN 18216 — passports are served over HTTPS on HTTP/2, as HTML, JSON and JSON-LD from one address. XML is not offered.
- EN 18219 — GS1 Digital Link and Identification Link addresses; the granularity is stored and published per passport.
- EN 18220 — the label designer prints QR codes. Check print size and quality against the standard for your surface.
- EN 18221 — every change is versioned. A back-up provider is selectable per tenant, but replication to it has not run yet; the deep-dive lists which clauses that leaves unmet.
- EN 18222 — the REST API creates, updates and reads passports, but it is not an EN 18222 interface.
- EN 18223 — the passport header is published in the JSON-LD form; the data elements use DPP Agent's own field keys.
Two more, not yet cited
- EN 18239 — access rights, information system security and business confidentiality.
- EN 18246 — data authentication, reliability and integrity.
Neither is cited in the Official Journal, so neither gives a presumption of conformity today. EN 18221 and EN 18223 refer to both.
Around the suite
- GS1 Digital Link — GS1's specification for web addresses built on GS1 keys, and the most common way to meet EN 18219's first ID scheme.
- ISO/IEC 15459 — unique identification through issuing agencies, and the standard the Battery Regulation names in Article 77(3). Its issuing agencies include GS1, ODETTE and EHIBCC, so a conformant identifier need not be a GTIN.
The ESPR and its delegated acts sit above the suite: they decide what a passport has to disclose for a product group. The JTC 24 standards decide how it is identified, delivered, stored and structured.