Compliance product data requirements: attributes, evidence and DPP

Which regulations create PIM requirements?

Five EU rules create most regulatory product data requirements for PIM buyers today: PPWR, GPSR, ESPR with the Digital Product Passport, EUDR and the green transition consumer directive. Each one adds attributes, evidence or publication duties. The regulations themselves are explained in the compliance pillar, and this page turns them into requirements within the PIM requirements guide.

The checklist tags 20 published requirements with a regulation. Filter them first in your requirement workshop, because regulatory dates do not move with your project plan.

Which regulatory attributes should a PIM hold?

A PIM should hold regulatory data as structured, reportable attributes, never as free text in a description field. Structured data can be validated, reported, mapped to channels and reused for the passport.

Four attribute groups cover most needs.

• Packaging: components per packaging level with material, weight and recyclability (DM-025, DM-055).
• Composition and substances: material composition and substances of concern with concentration and location (DM-056).
• Operator and safety: manufacturer and responsible operator with postal and electronic address (DM-058), warnings and instructions per language (DM-059).
• Origin: commodity type, country of production and due diligence references (DM-060).

Each group needs the same data model disciplines as marketing data: typed attributes, controlled units, validation rules and completeness per channel. A missing safety warning should block publication to consumer channels (DM-037, DM-041). The full set of data model requirements is on data model and data quality requirements.

Flag passport attributes separately (DM-057). Passport completeness then becomes its own measure, with its own owner and deadline.

Why does evidence matter as much as the attribute?

Evidence matters because a regulatory value without a source is an assertion that nobody can defend. Auditors, market surveillance authorities and retailers ask for the document behind the value.

Three requirements connect values to evidence. PR-033 links each change to a regulatory attribute to the document that justified it and the person who verified it. PR-041 stores supplier certificates, declarations and test reports with expiry dates that start renewal tasks. IN-020 links safety data sheets and declarations of conformity per product, language and version.

Environmental claims need the strictest control. Directive (EU) 2024/825 has applied since 27 September 2026 and targets claims made without recognised substantiation. PR-026 blocks publication of a claim until a compliance role approves it with evidence attached.

Approval adds a second line of defence. PR-025 can require a second approver in a compliance role for regulatory attributes. In PIMvendors selections, buyers test this flow end to end: change a value, attach evidence, approve and show the result in the history.

How should regulatory data be versioned?

Regulatory data should be versioned so you can reproduce what was published, when and on which evidence. Point-in-time answers are the core compliance capability of a PIM.

Four requirements deliver that answer together.

1. Change history (DM-050): previous value, new value, user or system, timestamp and source for every change.
2. Point-in-time state (DM-052): the full product record as it was on a past date.
3. Publication record (PR-032): which version reached which channel and when.
4. Protected audit trail (PR-030): records that business users and administrators cannot alter, with configurable retention.

Test the combination in one scenario. Change a regulatory value, publish it, change it again and then request the state on the first date. The PIM should return the value, the evidence and the channels that received it. Retention periods depend on regulation and product liability, so set them with legal counsel.

How do we test Digital Product Passport readiness?

Test passport readiness on one product group that is likely to be covered early, and check data, identifiers and access separately. The PIM is one part of the passport chain, alongside data carriers, hosting and registry connections.

ESPR entered into force on 18 July 2024, and the Commission is to set up the passport registry by 19 July 2026. Product-specific requirements follow by delegated act. The battery passport is the first sector passport with a fixed date: it becomes mandatory on 18 February 2027 for LMT, EV and industrial batteries above 2 kWh.

Passport scope will change as delegated acts appear. Treat flexibility in the data model as part of readiness. The regulation itself is explained on the Digital Product Passport page.

Who owns compliance data in the PIM?

Compliance data needs a named owner in the compliance or quality function and clear supplier responsibilities. Without ownership, regulatory attributes become the gaps that every team assumes another team fills.

Record the compliance owner per attribute group in the PIM (PR-042). Give that owner approval rights on regulatory attributes (PR-010, PR-025). Exclude regulatory and safety attributes from AI generation (PR-050). AI remains unreliable for regulatory data, and the reasoning is set out in requirements for AI features in a PIM.

Much compliance data originates with suppliers. PR-040 sends data requests per product, such as packaging weights or materials, and tracks them to completion. PR-035 and PR-036 enforce the buyer's rules at submission and hold supplier data in staging until approved.

PPWR deadlines are the most immediate for packaged goods. The requirements specific to packaging data are explained on the PPWR page.