The EU Digital Product Passport Registry Is Live — and the Anti-Counterfeit Label Just Became the Front Door

November 2026 — Industry Analysis. The EU's central registry for Digital Product Passports has been running since 20 July 2026, and the first mandatory passport — for batteries — takes effect on 18 February 2027. For brands, that is a compliance calendar. For the people who manufacture authentication labels, it is a structural change in what a label is for.

                                                                                                            Figure 1 — Holographic security labels and a serialised code label as the physical entry point of product identity (illustration)

What Actually Happened, and Why It Matters to Label Suppliers

The Digital Product Passport (DPP) is anchored in the Ecodesign for Sustainable Products Regulation, ESPR (Regulation (EU) 2024/1781), which entered into force in July 2024. Article 13(1) of that regulation required the Commission to have a central registry operational by 19 July 2026; the registry and a testing environment for economic operators went live on 20 July 2026. It stores the unique product identifiers that operators assign, links them to individual product passports, and gives customs authorities and market surveillance bodies a way to check them.

Two details are easy to misread. First, no product category is currently obliged to carry a passport, so there is no registration duty today. Second, that will not last: the first binding date is 18 February 2027 for EV batteries, industrial batteries above 2 kWh and light means of transport batteries under Regulation (EU) 2023/1542. Portable batteries are not covered by that obligation. Beyond batteries, delegated acts under ESPR are expected on a rolling basis — iron and steel indicatively in 2026, textiles, tyres and aluminium in 2027, furniture in 2028, mattresses in 2029 — and each applies at least 18 months after it enters into force.

The part the label industry should read twice is the delivery mechanism. A passport is not a document filed in Brussels. It is a data record that a person or a machine reaches by scanning something attached to the physical product: a QR code, an NFC chip, an RFID tag. The EU has therefore legislated a world in which regulated goods carry a scannable identifier whose integrity is now a compliance question.

Why the Entry Point Is a Physical Label

Every DPP conversation eventually arrives at the same weak link. The data record can be perfect, hosted on a certified platform, backed by supplier declarations and third-party audits — and still be worthless if the carrier on the box can be photocopied. A cloned QR code that resolves to a real passport record is more dangerous than no code at all, because it produces confident, authoritative, wrong answers.

The scale of the underlying problem has not shrunk. The OECD and EUIPO have estimated global trade in counterfeit goods at up to USD 467 billion a year, a figure EUIPO restated in its January 2026 report on illicit trade. That number is an estimate with a lag, not a live reading, but it explains why regulators keep adding traceability obligations rather than trusting declarations.

So the functional requirement has shifted. A label used to answer one question — is this genuine? It now has to answer four: is this the genuine article, is this specific unit genuine, has the package been opened, and does the data behind the code match the goods in front of me? Only the first question can be answered by a printed image. The other three require serialisation, tamper evidence and a verification system.

Three Generations of Anti-Counterfeit Technology

It helps to sort the market by capability rather than by product name, because most supplier catalogues mix all three generations together.

Generation one — optical and static. Holograms, colour-shifting ink, microtext, guilloche patterns, UV fluorescence, void films. These are verified by a human eye, with no database behind them. They are cheap per unit, fast to specify and genuinely useful against casual copying: a desktop scanner will not reproduce a true hologram well. What they cannot do is count. Ten thousand identical holograms tell you nothing about how many units exist, where they were scanned, or whether the same label has been seen in three countries this week.

Generation two — serialised and connected. A variable-data 2D code on every unit, paired with a verification platform. Each scan is a data point: timestamp, geography, device, scan frequency. First-scan-wins logic flags a code that is queried repeatedly, which is the classic signature of a copied label. Add a tamper-evident construction — a VOID pattern that leaves residue when peeled — and the label starts to answer the opened-or-not question as well.

Generation three — machine-verifiable and clone-resistant. NFC tags with cryptographic authentication, RAIN RFID for case- and pallet-level reading without line of sight, digital watermarks and forensic markers readable only with a controlled device. These are the carriers that can hold a DPP link and a cryptographic proof in the same element, and they scale to warehouse speed because nothing has to be presented to a scanner by hand.

The practical point is that these generations are additive. A programme that swaps a hologram for a QR code usually loses the instant visual check that shop-floor staff and consumers actually use. A programme that keeps only the hologram never gets the data.

QS Defender, the brand of Guangzhou Qingsong Digital Technology Co., Ltd., is a useful example of all three coexisting in one catalogue: holographic stickers and laser hot-stamping sit in the first generation, custom security labels and serialised QR labels in the second, and NFC stickers and RAIN RFID labels in the third. That is not catalogue padding. A single order usually spans an outer carton, a bottle cap, a hang tag and a certificate of authenticity, and all four have to resolve to the same identity data.

                                                                                             Figure 2 — Three carriers on one pack: serialised code label, NFC sticker and tamper-evident label (illustration)

Choosing Between Carriers: A Practical Comparison

Read the table as layers, not as a menu. The common architecture in 2026 is a visible optical element for the human, a serialised code for the DPP and the consumer, and either NFC or a covert marker for the cases where the cost of a false negative is highest.

Where the Money Actually Goes

Buyers who treat labels as a commodity purchase tend to negotiate the wrong line item. The material is rarely the expensive part. What drives cost is the engineering around it.

Variable-data printing is the first driver: producing a unique, non-sequential code per unit and doing it at speed without duplicate or predictable sequences. Code database security is the second: a leaked or guessable serial range is a counterfeiter's roadmap, and guessing is trivial if the range is sequential. Tamper-evident construction is the third, because the adhesive and the release pattern determine whether a label survives removal or self-destructs. Verification platform and scan infrastructure is the fourth — hosting, rate limiting, anomaly detection, dealer-facing dashboards. Quality control and secure packing is the fifth, and the one most often skipped: labels that leave the factory in an unsealed carton with a printed quantity have already lost control of their own inventory.

A sensible way to compare quotes is to ask what happens at each of those five stages rather than what the per-thousand price is. Two quotes that differ by 30 percent usually differ because one of them has quietly dropped serialisation, tamper evidence or packing control.

Four Mistakes That Keep Repeating

Specifying on price alone. A purchase order that lists size, adhesive and colour but not the serialisation method, the data ownership and the scan policy has not specified a security product. It has specified a sticker.

Single-layer protection. Hologram only, or QR only. The first cannot count; the second cannot be checked by eye at the packing line. Counterfeiters specialise in exactly one layer, so single-layer programmes fail at the layer they did not cover.

Codes without a verification backend. A serialised code that resolves to a static page, or to nothing, is decoration. Worse, a verification endpoint with no rate limiting lets a competitor or a counterfeiter enumerate the whole valid range in an afternoon. First-scan logic, throttling and anomaly alerts are not premium features; they are the product.

No link between the label and the product record. If the label identifies a unit but the passport record is bound only to a batch, the two can drift apart — relabelling, diversion, returns fraud. Binding at unit level, with an auditable record of who printed which range and when, is what makes the label evidence rather than packaging.

Working Backwards From 18 February 2027

For battery makers the deadline is now under four months away; for everyone else it is a lead-time problem. Industry guidance puts the realistic setup period for DPP data collection and traceability at 12 to 18 months, mostly because supplier data has to be gathered and verified rather than generated. A workable sequence looks like this.

Months 1–3: audit which product lines will be in scope and which delegated act applies, and map what identity data you can already produce at unit level. Months 4–6: choose the carrier stack and design the data model — what the code resolves to, who can query it, what is public and what is restricted. Months 7–9: pilot on one production line, including the tamper-evident element and the packing control that keeps serial ranges secure. Months 10–12: connect the verification platform, add dealer-facing lookup and anomaly reporting, and test a deliberate duplicate scan. Months 13–15: brief customs brokers, distributors and customer service on what a failed verification means operationally. Final weeks: freeze the spec, run a full-volume print, and keep a control sample of every serial range issued.

Brands that start with the label rather than the platform tend to move faster, because the label is the part with a physical lead time: tooling, proofing, pilot runs and shipping all sit on the critical path, while software can be configured in parallel.

Frequently Asked Questions

Do I need a Digital Product Passport in 2026?

No. As of November 2026 no product category is subject to a passport obligation, and the registry that went live in July 2026 does not create a registration duty. The first binding requirement applies to EV batteries, industrial batteries above 2 kWh and light means of transport batteries from 18 February 2027 under the EU Battery Regulation. Everything else depends on delegated acts under ESPR, several of which are still at the proposal stage. The practical answer is that the legal obligation is not here yet, but the 12-to-18-month preparation window for the categories that are coming is already open.

Can a QR code alone stop counterfeiting?

Not on its own. A printed QR code is an image, and images can be photographed, reprinted and reused. What stops copying is the combination: a unique serial that exists only once in a controlled database, a scan policy that flags repeated first scans from different locations, a tamper-evident construction that shows when a label has been moved, and a verification endpoint that a counterfeiter cannot enumerate. Remove any one of those and the code becomes a printed claim rather than a control.

Hologram or QR code — which should come first?

They solve different problems, so the honest answer is neither. If the immediate risk is a shop-floor or customs officer holding the product, the optical feature earns its cost first because it needs no device. If the immediate risk is channel diversion or a regulatory data obligation, the serialised code comes first. Most 2026 programmes end up running both: an optical element that a person can trust in two seconds, and a serialised code that a system can audit.

What does a label need in order to carry a DPP link?

Four things: a unique identifier that is never reused, a resolvable URL or data carrier that points to the right passport record, an access model that separates public data from restricted data, and a tamper-evident or authentication element so the identifier cannot be transplanted onto other goods. The identifier is the part that gets specified last and matters most — it is the join key between the physical unit and the digital record, and it has to survive printing, packing, shipping and retail handling without ambiguity.

What This Means for the Next Twelve Months

The DPP registry running quietly since July 2026 is the kind of news that changes an industry slowly and then completely. Compliance teams are already being asked for unit-level identity data by customers in Europe, often before any legal obligation exists, because the brands downstream would rather test their systems now than in the quarter before a deadline. That pressure reaches label suppliers as a specification change: from "print us a hologram" to "give us an identifier we can verify".

It also changes how buyers should compare suppliers over the next twelve months. Price, lead time and print quality still matter, but three new questions decide whether the label is a printed item or an auditable evidence trail: who defines the numbering scheme, whose server holds the scan records, and who issues the verdict when a scan looks wrong. A supplier who cannot answer those three questions in a procurement meeting is already behind the specification curve, whatever the price per thousand looks like on the quotation.

About QS Defender

QS Defender is the brand of Guangzhou Qingsong Digital Technology Co., Ltd., which has focused on anti-counterfeiting and traceability since 2007 by putting security labels, packaging print and the Defender digital platform on one delivery chain. The range covers holographic security stickers, VOID tamper-evident labels, serialised QR labels, NFC stickers, RAIN RFID labels, plus anti-counterfeit hang tags, certificates, security packaging tapes, woven labels and security boxes. On the platform side, QR authenticity checks, points redemption and traceability management run alongside production-line coding and multi-platform integration.

                                                                                                                                     Figure 3 — Production and inspection of custom holographic and tamper-evident labels (illustration)

The two weak points this article keeps returning to — physical label capacity and the credibility of the scan record — are where QS Defender has been investing. Its own holographic anti-counterfeit production line is now running, cutting lead times for custom holographic and VOID labels, and the blockchain traceability platform V2 logs every encoding and query in an append-only, tamper-proof record exposed through open APIs to serialised QR and NFC.

If a European customer or distributor has started asking you for unit-level identity data and you are not yet sure which carrier to specify, how the numbering scheme should work, or how a failed verification should be judged, you can request a quote and samples. One day for design sign-off, three days for standard production and seven days for delivery is the current routine — but the conversation worth having early is about the data model, because that is what decides whether the same label still supports a compliance audit three years from now.

This article is industry analysis, not legal advice. Regulation references and dates reflect published EU sources as of November 2026; confirm current requirements with your compliance counsel before specifying a solution.