Six horizontal DPP standards are now cited in the Official Journal

Commission Implementing Decision (EU) 2026/1736 of 14 July 2026 cites six EN 18xxx Digital Product Passport standards, giving them a presumption of conformity under the ESPR. The two security standards, prEN 18239 and prEN 18246, are not yet included.

Standards only carry legal weight for the ESPR once the Commission cites them in the Official Journal. That has now happened for the core of the Digital Product Passport framework.

Commission Implementing Decision (EU) 2026/1736 of 14 July 2026, published in the Official Journal on 15 July 2026, cites six harmonised DPP standards drafted in support of Regulation (EU) 2024/1781. This is the sequel to our explainer on the CEN-CENELEC EN 18xxx family.

The six cited standards

EN 18216:2026 — data exchange protocols
EN 18219:2026 — unique identifiers
EN 18220:2026 — data carriers
EN 18221:2026 — data storage, archiving and persistence
EN 18222:2026 — APIs
EN 18223:2026 — system interoperability

Why citation matters

Citation is the trigger for presumption of conformity. Under Article 41(2) of the ESPR, a passport that conforms to these harmonised standards, or parts of them, is presumed to satisfy the requirements in Articles 10 and 11. For a company, that means building to the EN 18xxx data model and interfaces lets you document conformity without commissioning a bespoke assessment: cheaper, faster and more defensible.

The two security standards are not in yet

The citation lists the six horizontal standards only. The two security standards, prEN 18239 (security and confidentiality) and prEN 18246 (data authentication and integrity), are not part of Decision (EU) 2026/1736. Their formal vote closed on 16 July 2026; we are not aware of an official result yet, and they are expected to be cited once published as full EN standards. We will update this when CEN-CENELEC and the Commission confirm.

What to do now

If you are specifying a DPP build, treat the six cited standards as the baseline to design against; see the standards and tech overview.
Remember the horizontal standards define how a passport is identified, stored, secured and made interoperable. What data each product must carry still comes from the product-group delegated acts.

Primary source: Commission Implementing Decision (EU) 2026/1736.

Frequently asked questions

Which Digital Product Passport standards are cited in the Official Journal?

Commission Implementing Decision (EU) 2026/1736 of 14 July 2026 cites six horizontal DPP standards: EN 18216:2026 (data exchange protocols), EN 18219:2026 (unique identifiers), EN 18220:2026 (data carriers), EN 18221:2026 (data storage, archiving and persistence), EN 18222:2026 (APIs) and EN 18223:2026 (system interoperability).

What does presumption of conformity mean for a Digital Product Passport?

Under Article 41(2) of the ESPR, a DPP that conforms to these cited harmonised standards, or parts of them, is presumed to meet the corresponding requirements in Articles 10 and 11 of the regulation. In practice, applying the standards lets a company document conformity without a bespoke assessment, which is cheaper and lower-risk.

Are the DPP security standards published yet?

Not in this citation. The two security standards, prEN 18239 (security and confidentiality) and prEN 18246 (data authentication and integrity), are not listed in Decision (EU) 2026/1736. Their formal vote closed on 16 July 2026 and they are expected to be cited once published as EN standards.