𝐂𝐀𝐑𝐄 𝐈𝐃’𝐬 𝐑𝐞𝐯𝐢𝐞𝐰 𝐨𝐟 𝐂𝐈𝐑𝐏𝐀𝐒𝐒-2 – 𝐔𝐬𝐞𝐫 𝐒𝐭𝐨𝐫𝐢𝐞𝐬 𝐯3.1

CIRPASS-2 - Digital Product Passport has released User Stories v3.1, outlining how DPPs may be used across regulatory, market, and cross-border contexts under future EU implementation.

While not legally binding, the CIRPASS-2 user stories provide important insight into how DPP data is expected to be used in practice under future ESPR implementation. 𝐃𝐏𝐏𝐬 𝐚𝐫𝐞 𝐟𝐫𝐚𝐦𝐞𝐝 𝐚𝐬 𝐚 𝐫𝐞𝐟𝐞𝐫𝐞𝐧𝐜𝐞 𝐚𝐧𝐝 𝐚𝐜𝐜𝐞𝐬𝐬 𝐥𝐚𝐲𝐞𝐫 𝐰𝐢𝐭𝐡𝐢𝐧 𝐭𝐡𝐞 𝐫𝐞𝐠𝐮𝐥𝐚𝐭𝐨𝐫𝐲 𝐚𝐧𝐝 𝐦𝐚𝐫𝐤𝐞𝐭 𝐞𝐜𝐨𝐬𝐲𝐬𝐭𝐞𝐦, 𝐞𝐧𝐚𝐛𝐥𝐢𝐧𝐠 𝐜𝐨𝐧𝐭𝐫𝐨𝐥𝐥𝐞𝐝 𝐚𝐜𝐜𝐞𝐬𝐬 𝐭𝐨 𝐩𝐫𝐨𝐝𝐮𝐜𝐭 𝐢𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐚𝐜𝐫𝐨𝐬𝐬 𝐦𝐮𝐥𝐭𝐢𝐩𝐥𝐞 𝐚𝐜𝐭𝐨𝐫𝐬.

1) Clear separation between data, claims, and conformity

The user stories reinforce a clear three-layer structure: product data, claims, and conformity evidence relied upon by authorities.

This aligns with emerging UNTP and DPCCE approaches, where claims and conformity credentials are exchanged through interoperable mechanisms, while remaining governed by their respective schemes.

2) Conformity remains scheme-owned — DPP as a lifecycle system

Conformity rules are defined by regulation or scheme owners, with verification performed by recognised bodies, while DPP systems operate alongside existing compliance frameworks.

At the same time, DPPs are positioned as lifecycle-based systems, managing creation, access, updates, responsibility transfer, and deactivation as products move through changing actors and legal responsibilities.

3) Cross-border use through interoperable reference

Several user stories assume cross-border reliance on DPP information for market surveillance, import controls, and due-diligence obligations.

This is enabled through interoperable reference across distributed systems, consistent with the UNTP direction of shared exchange protocols that preserve institutional autonomy.

In this context, DPPs function as technical connectors within a federated information environment.

𝐈𝐦𝐩𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬 𝐟𝐨𝐫 𝐂𝐀𝐑𝐄 𝐈𝐃

The user stories reinforce CARE ID’s positioning around:

• DPP as long-term product-level infrastructure

• clear separation between data, claims, and conformity

• compatibility with UNTP / DPCCE-style credential exchange

• alignment with evolving EU and international governance frameworks

As a participant in CIRPASS-2 EWG1 and as a DPPSP, we found this document highly valuable in clarifying architectural boundaries, governance separation, and long-term interoperability direction.

We recommend this document to anyone designing, implementing, or evaluating DPP systems, and thank the EU CIRPASS-2 team for sharing these insights.