Digital Product Passport: What the EU 2027 Rules Mean for Dubai Exporters (2026 Guide)

A Digital Product Passport (DPP) is a machine-readable record of a product origin, materials, carbon footprint, compliance documents and end-of-life instructions, reached by scanning a QR code on the item itself. Under Regulation (EU) 2024/1781 it stops being optional: from 18 February 2027 no electric-vehicle, light-means-of-transport or industrial battery above 2 kWh may be placed on the EU market without one, and textiles, aluminium and tyres follow through 2027. If you ship from Dubai to Europe, this is a software project with a legal deadline, not a sustainability brochure.

Most UAE exporters are treating the DPP as a 2028 problem for someone in Brussels. It is not. The EU DPP Registry went live on 20 July 2026 and already issues a Unique Registration Identifier per product, the technical standards were published in the Official Journal in July 2026, and the first binding date is sixteen months away. This guide covers who is in scope, what the passport must contain, what it costs in AED, and how to build it so you are not re-doing it for every product group.

The three numbers that make this urgent for Dubai

• USD 67.6 billion. That was UAE non-oil trade with the European Union in 2024, up 3.6% year on year. The EU is the UAE second-largest trading partner and accounts for about 8.3% of total UAE non-oil trade. This is not a marginal market you can walk away from while you think about it.
• Over USD 1 trillion. UAE non-oil foreign trade passed the one-trillion-dollar mark in 2025, roughly AED 3.8 trillion, after growth of about 27%. A large share of that volume is re-export flowing through Jebel Ali and the Dubai free zones, which means UAE traders sit in the middle of supply chains whose EU end-customers will demand passport data from them.
• 18 February 2027. The hard deadline under the EU Battery Regulation (EU) 2023/1542, the first sector to implement a DPP. European Commission guidance issued in 2026 enumerates 71 data points in the battery passport, of which 51 are mandatory for EV batteries, 54 for LMT batteries and 36 for industrial batteries above 2 kWh at that deadline.

Most Dubai exporters get this wrong: they think the DPP is a label. It is an API. A European importer will not accept a PDF, they will scan a code and expect a resolvable, standards-compliant record to answer in milliseconds.

What a Digital Product Passport actually is, technically

Strip away the sustainability language and a DPP is four engineering components:

• A unique identifier. Every item, batch or model gets a globally unique, persistent ID. EN 18219 sets the bar: the identifier must be unique, persistent, resolvable, and decoupled from whichever endpoint happens to serve the data today. In practice most exporters will use GS1 Digital Link, which encodes the GTIN plus a serial or batch number inside a URI.
• A data carrier. EN 18220:2026 permits QR Code (ISO/IEC 18004), Data Matrix (ISO/IEC 16022) and RFID. For batteries the carrier is in practice a QR code printed or affixed on the battery; NFC and RFID are discussed as supplements but their admissibility is not fully settled.
• A resolver and data service. The scan must resolve to a live endpoint that returns the right view of the record to the right audience. Consumers see safety, care and recycling data. Market surveillance authorities and recyclers see more. That is role-based access control over a product data API, nothing exotic.
• Registry registration. The EU-level DPP Registry, operational since 20 July 2026, stores the unique identifiers plus mandatory registration data and issues a Unique Registration Identifier. Six horizontal DPP standards developed by CEN/CENELEC JTC 24, EN 18216 through EN 18223, were cited in the Official Journal on 15 July 2026, which means the specification you build against finally exists in black and white.

The practical consequence: this is a data problem before it is a compliance problem. If your material composition, supplier declarations and carbon data live in three spreadsheets and a WhatsApp thread, no passport platform will save you. The same discipline that makes MRP and shop-floor software work is the discipline the DPP needs: one authoritative record per item, captured at the point it is made.

The timeline: which product group, which date

The first ESPR Working Plan, adopted on 16 April 2025, set the order. Dates for delegated acts are indicative and the compliance date usually sits 18 to 36 months after adoption, so treat the milestone column as the point at which you must already be live.

Product group	Instrument	DPP milestone	Dubai exposure
Batteries (EV, LMT, industrial above 2 kWh)	Regulation (EU) 2023/1542	Mandatory 18 Feb 2027	Energy-storage assemblers, e-mobility importers, battery re-exporters
Iron and steel	ESPR delegated act	Act adopted Q4 2026	Fabricators, pipe and structural steel exporters
Construction products	Revised CPR	Requirements from Q2 2027	Cladding, cement, fit-out and glass manufacturers
Textiles and apparel, aluminium, tyres	ESPR delegated acts	Requirements Q3 to Q4 2027	Aluminium smelters and extruders, garment and abaya exporters
Furniture	ESPR delegated act	Act 2028	Joinery and contract-furniture suppliers to EU projects
Mattresses, ICT and electronics	ESPR delegated acts	2029	Electronics assemblers, consumer-goods brands
Toys	Regulation (EU) 2025/2509	All toys from 1 Aug 2030	Toy traders and private-label brands

The toy rule deserves a flag because it is the most underrated one in Dubai. Regulation (EU) 2025/2509 has been in force since 1 January 2026, and from 1 August 2030 the digital product passport replaces the EU declaration of conformity for toys. Manufacturers must issue it by means of a data carrier before placing a toy on the market, and importers and distributors are obliged to verify that it exists. For a Dubai trading company that buys in Asia and sells into Europe, that verification duty lands on you, not on the factory.

Why aluminium exporters should move first

The UAE is one of the largest suppliers of CBAM-covered aluminium to the EU, accounting for around 5% of EU aluminium supply in 2024, and aluminium makes up roughly two-thirds to three-quarters of UAE exports covered by the Carbon Border Adjustment Mechanism. Analysis of early CBAM evidence puts UAE CBAM-covered export value at about 0.53% of GDP, among the most exposed economies in both absolute and relative terms. For scale, Emirates Global Aluminium sold more than 2.83 million tonnes of cast metal in 2025, roughly 4% of global primary aluminium output, to over 400 customers in more than 50 countries.

CBAM is already live. The definitive phase began on 1 January 2026, and published certificate prices moved from EUR 75.36 per tonne of CO2 in Q1 2026 to EUR 75.28 in Q2 and EUR 82.32 in Q3 2026. EU importers below 50 tonnes of CBAM goods a year are exempt, which quietly tells you where the pressure lands: on your large European buyers, who must now be authorised CBAM declarants and need verified emissions figures from you per shipment.

Here is the leverage. CBAM wants embedded-emissions data per consignment. The aluminium DPP will want embedded-emissions data per product. It is the same measurement, collected once and used twice. Building a product carbon footprint pipeline now for CBAM, and designing it to emit DPP fields in 2027, is dramatically cheaper than running two programmes. If you are already standing up ESG and carbon reporting software, that is the system the passport should read from.

What a DPP actually costs

There are three routes, and the right one depends on SKU count and how much of your data already lives in a system. Euro figures are published 2026 vendor pricing, converted at roughly AED 4.3 to the euro.

Route	Typical cost	In AED	Fits
SME self-service SaaS	EUR 29 to EUR 520 per month	AED 125 to AED 2,250 per month	Under a few hundred SKUs, simple bill of materials
Pay-per-passport	EUR 0.50 to EUR 2.00 per product; bundles from EUR 1.00 per SKU at 2,000 SKUs down to EUR 0.25 per SKU at 20,000	AED 1 to AED 8.60 per product	Variable catalogues, seasonal ranges
Enterprise DPP platform	Up to EUR 6,250 per month	Up to AED 26,900 per month	Multi-brand groups, deep supply chains
Carbon footprint calculation	EUR 1 to EUR 10 per SKU automated	AED 4.30 to AED 43 per SKU	Add-on for every route
Total first year, under 100 SKUs	EUR 2,500 to EUR 10,000, then EUR 1,000 to EUR 5,000 a year	AED 10,750 to AED 43,000, then AED 4,300 to AED 21,500	Small brands
Total annual, mid-sized textile or industrial firm	EUR 10,000 to EUR 50,000	AED 43,000 to AED 215,000	Most Dubai exporters
Total annual, large multi-brand group	EUR 100,000 and above	AED 430,000 and above	Groups with complex supply chains

Those are licence and service numbers. The part nobody quotes is integration, and it is where the budget actually goes: pulling item master, batch and bill-of-materials data out of your ERP, getting supplier declarations in a structured format instead of email attachments, and generating and printing carriers on the line. In Dubai, a focused DPP integration layer on top of an existing ERP typically runs AED 45,000 to AED 120,000 for a single product group, and AED 150,000 to AED 400,000 for a multi-product-group build with its own resolver, registry sync and bilingual public passport pages. See our pricing for how we scope that.

How we build it, and what to insist on

Build once, extend per product group. A DPP stack that will not need re-doing in 2028 has six parts:

• Identifier service. GS1 Digital Link URIs minted per item, batch or model, stored against your ERP item master. Decide early whether you passport at model, batch or serial level, because it changes your printing and data volumes by orders of magnitude.
• Resolver. A hosted endpoint on your own domain that takes a scanned URI and routes to the correct passport view. Keeping the resolver on your domain, not a vendor domain, is what makes the identifier persistent if you ever change platforms.
• Data model keyed to the legal annex. Battery Annex XIII fields today, textile and aluminium fields in 2027. Model them as versioned schemas so a new delegated act is a migration, not a rewrite.
• Supplier data intake. A portal or structured upload for tier-one and tier-two suppliers, with validation at the door. This is the single biggest source of delay on every DPP project, and it is a traceability problem of exactly the kind certification traceability systems already solve.
• Carrier generation. QR or Data Matrix generated at pack-out and verified by scan before the pallet leaves. Tie it to your shipping documents so your customs clearance workflow carries the same identifiers the EU importer will scan.
• Role-based public and authority views. One record, several audiences, with an audit log of who read what and when.

On consequences: ESPR does not set fine amounts itself. Article 74 obliges each Member State to adopt penalties that are effective, proportionate and dissuasive, and they must at minimum include fines and time-limited exclusion from public procurement procedures, with Article 74(2) listing the severity factors a regulator must weigh, including any economic benefit you derived from non-compliance. Translated for an exporter, the real risk is not a fine letter. It is a container held at a European port, a buyer who de-lists you because their own compliance team cannot sign off, and a bar on EU public tenders. The cost of inaction is denied access to the destination of roughly 8.3% of UAE non-oil trade.

Frequently asked questions

Does the DPP apply to a UAE company, or only to EU companies?

The obligation attaches to whoever places the product on the EU market, which is often your European importer or authorised representative. In practice the data obligation flows straight back to you, because only the manufacturer can produce material composition, batch and footprint data. Contracts signed in 2026 and 2027 are already adding passport-data warranties. Treat it as a customer requirement with a legal deadline behind it.

Is there a UAE equivalent I should prepare for at the same time?

Not a mandate yet. The UAE Circular Economy Policy 2021-2031 names traceability, quality control and certification programmes among its instruments, and the Ministry of Industry and Advanced Technology is pushing Industry 4.0 adoption in manufacturing. The direction of travel across the GCC in 2026 is from voluntary disclosure toward digital mandates for key industrial sectors, so a system built for the EU rules is very likely the system you will need locally.

Can I just use a QR code that links to a PDF on my website?

No. The standards require a persistent, resolvable unique identifier, a conformant data carrier, structured machine-readable data, and registration of the identifier in the EU DPP Registry, with different data visible to different actor types. A PDF fails on machine-readability, on access control and on registry registration.

How long does an implementation take?

For one product group with clean ERP data, plan three to four months: four to six weeks on data modelling and supplier intake design, six to eight weeks on the identifier service, resolver and passport pages, then line trials. If supplier data has to be collected from scratch, the supplier phase alone can run two quarters. Working back from 18 February 2027, a battery exporter should be starting now.

What should I do first if I only have one week?

Three things. Confirm which ESPR or sectoral act covers your product and its date. Export your item master and check whether you can produce material composition and a product carbon footprint per SKU without manual work. Ask your three largest EU customers what passport data their compliance teams will require and when. That tells you whether you are facing a two-month integration or a two-quarter data programme.

Next step

The exporters who will win share in 2027 are the ones whose data was ready a year early, because their European buyers will consolidate suppliers around whoever can answer a scan. Aquarius builds the identifier service, resolver, supplier intake and ERP integration that turns your existing product data into a standards-compliant passport, for one product group or a whole catalogue. Tell us what you export and where, and we will map your product group to its deadline and the data you are missing.

This guide is commercial and technical guidance based on published EU regulations, standards and vendor pricing as at October 2026. Indicative delegated-act dates may shift. Have EU regulatory counsel confirm your specific product scope.