ESPR and Digital Product Passports: A Cosmetics Compliance Roadmap

Summary

The EU's Ecodesign for Sustainable Products Regulation (ESPR) mandates Digital Product Passports for cosmetics, with packaging compliance required by 2027–2028 and formulations by 2028–2030.
A compliant DPP requires granular, traceable data on ingredients, packaging, and sustainability metrics, demanding a significant data infrastructure overhaul.
Brands must start preparing now by performing a gap analysis, building a data architecture, and engaging the supply chain to secure necessary information.
AI-powered compliance platforms like Reglyr automate ESPR gap analysis and centralize DPP data management, simplifying the entire process.

If you're a cosmetics compliance professional searching for clear answers on the EU's Digital Product Passport mandate, you've likely noticed a frustrating pattern: most articles are vague, hedged, and conspicuously silent on the three questions that actually matter. Which specific regulation governs digital product passports for cosmetics? When exactly does your brand need to comply? And what happens if you don't?

Let's answer those questions directly — because if the candid assessment from practitioners in the Digital Product Passport community is accurate, "Companies are not ready. At all... the majority of brands are WAYYYY behind. The supply chain is also not ready." — then vague overviews aren't going to cut it any more.

The governing regulation: The Ecodesign for Sustainable Products Regulation (ESPR), which entered into force on July 18, 2024, is the primary EU legislation mandating Digital Product Passports across product categories, including cosmetics.

The implementation timeline for cosmetics: Delegated acts (the product-specific rules) for cosmetics packaging are expected to be finalized between 2025–2026, with mandatory implementation starting 2027–2028. A broader extension to cosmetic formulations themselves is projected for 2028–2030.

The penalties for non-compliance: While product-specific penalty frameworks are still being finalized within the delegated acts, the consequences at the market level are unambiguous: non-compliant products will be denied access to the EU market. Given that the EU represents one of the world's largest cosmetics markets, the commercial cost of non-compliance is existential for export-dependent brands.

This roadmap exists to close that preparedness gap — with a clear breakdown of the ESPR framework, the exact data attributes your DPP must contain, and a practical checklist to self-assess your compliance readiness today.

Section 1: Decoding the ESPR Framework for Cosmetics

What ESPR Actually Is (And Why "Framework Law" Matters)

The ESPR is not a traditional regulation with fixed, immediately enforceable product rules. It is a framework law — meaning it establishes the legal architecture and overarching sustainability objectives, while leaving the detailed, product-specific requirements to be filled in through delegated acts published progressively by the European Commission.

This structure has a critical implication for cosmetics brands: the detailed requirements for your category are still being written. But that does not mean you can wait. By the time the delegated acts for cosmetics are finalized and compliance becomes mandatory, you will have had 18–24 months — at most — to implement systems that took early movers years to build.

The Core Objectives Driving ESPR

ESPR sits at the heart of the EU's Circular Economy Action Plan (CEAP) and is designed to fundamentally reshape how products are designed, manufactured, sold, and disposed of across all consumer categories. Its core mandates include:

Improving product durability, reusability, and reparability
Increasing recycled content in products and packaging
Requiring enhanced transparency on sustainability through the Digital Product Passport
Introducing provisions to ban the destruction of unsold consumer goods

For cosmetics, the regulation represents a significant shift from the current compliance paradigm centred on ingredient safety and labelling. ESPR adds a new dimension: lifecycle-wide environmental accountability, built into a digitally accessible, machine-readable passport.

Cosmetics: Packaging First, Formulations Next

The ESPR's application to cosmetics follows a two-phase trajectory that compliance teams need to plan around:

Phase 1 (2027–2028): Packaging. The first wave targets cosmetics packaging — the primary, secondary, and tertiary packaging of your products. DPP requirements will mandate disclosure of material composition, recycled content percentages, and end-of-life instructions. This is your most immediate compliance obligation.

Phase 2 (2028–2030): Formulations. The scope is expected to extend to the cosmetic formulations themselves, requiring ingredient-level traceability, substance-of-concern disclosures, and carbon footprint data tied to the product's manufacturing lifecycle.

Because ESPR is a framework law with evolving delegated acts, staying compliant requires constant vigilance. Platforms like Reglyr provide continuous regulatory monitoring, alerting your team as soon as product-specific requirements for cosmetics are finalized — so you're never caught in a last-minute scramble.

Section 2: The Anatomy of a Compliant Cosmetics Digital Product Passport

A digital product passport for cosmetics is not a marketing document or a reformatted safety data sheet. It is a dynamic, machine-readable digital identity for your product — structured to be accessed by consumers via QR code, audited by regulatory authorities, and interrogated by downstream supply chain partners. Getting the data architecture right from the start is non-negotiable.

Here is the attribute-level breakdown of what a compliant cosmetics DPP must contain:

Product & Formulation Data

Full INCI ingredient listing with source country and supplier identifiers for each ingredient
Declarations for all 26 EU-regulated fragrance allergens, including concentration levels
Disclosure of any substances of concern — including SVHCs (Substances of Very High Concern), POPs (Persistent Organic Pollutants), PFAS, and microplastic content
Preservative identification and, where applicable, antimicrobial efficacy data
Batch and lot traceability identifiers linked to manufacturing records

Packaging & End-of-Life Data

Material composition of every packaging component (primary, secondary, tertiary) broken down by weight and percentage — e.g., "45g HDPE, 12g aluminium, 8g paper board"
Recycled content percentage per component, with supporting certification
Recyclability classification according to EU harmonised standards
Consumer-facing end-of-life instructions formatted per market requirements (e.g., symbol guidance, sorting instructions)

Sustainability & Traceability Data

Carbon footprint data mapped across the product's full lifecycle — from raw material extraction through formulation, packaging, distribution, and end-of-life disposal. (See how DPPs enable carbon tracking)
Manufacturing date and country of origin for each component
Certification statuses (cruelty-free, vegan, Ecocert, COSMOS organic) with issuing body and validity dates

The Supply Chain Data Challenge

The data fields above may look manageable in a spreadsheet until you realise that a single cosmetics SKU can contain 30–80 ingredients sourced from dozens of suppliers across multiple continents, each with its own packaging component supply chain running in parallel. Achieving this level of traceability requires infrastructure — not manual data collection.

A compliant DPP is not just a document; it's a living data asset that must be updatable when formulations change, suppliers switch, or regulations evolve. Reglyr's unified regulatory knowledge graph is built for exactly this complexity — managing ingredient-level screening, restricted substance verification, and packaging material data in one centralised system, and turning what would otherwise be a multi-team data aggregation project into a structured compliance workflow.

Section 3: Your 5-Step ESPR Compliance Readiness Checklist

Use this checklist to honestly assess where your organisation stands today — and what to prioritise in the next 12 months.

✅ Step 1: Run a Portfolio-Wide Gap Analysis

Before you can build a roadmap, you need a baseline. A gap analysis maps your current product data against upcoming ESPR requirements, surfacing exactly which products are missing which data attributes.

Reglyr's ESPR readiness features can run your entire cosmetics portfolio through an automated gap check, instantly generating a prioritised list of compliance gaps across your SKUs. This turns a multi-week manual audit into a same-day diagnostic — and gives you the data-driven starting point your compliance project needs.

✅ Step 2: Establish Your DPP Data Architecture

A DPP is only as good as the infrastructure behind it. You need a system of record capable of storing, updating, and surfacing dynamic, attribute-level product data — one that can connect to your suppliers, integrate with your existing PIM or ERP, and generate compliant DPP outputs on demand.

Reglyr provides this infrastructure out-of-the-box, serving as the single source of truth for all your product compliance data across formulation, packaging, and sustainability attributes.

✅ Step 3: Launch a Pilot on Priority SKUs

Don't attempt enterprise-wide DPP implementation from day one. Select 3–5 products — a new launch, a bestseller, or a product undergoing reformulation — as your pilot cohort. Use the pilot to test your data collection workflows, validate your supplier engagement process, and prototype your consumer-facing QR code experience before scaling.

✅ Step 4: Integrate Your Supply Chain

DPP compliance cannot be achieved in isolation. Your suppliers need to provide verified data — and that requires structured outreach, clear data requirements, and a submission process they can actually follow. According to best practices for supplier programme management, the most common failure point is not regulatory awareness but the absence of a standardised supplier data submission process.

Build your supplier engagement programme now, before the delegated acts are finalised — because supplier onboarding takes longer than most procurement teams expect.

✅ Step 5: Consult Experts on Novel Regulatory Questions

ESPR is genuinely new regulatory territory, and there will be interpretation questions that the text of the regulation — and even the delegated acts — do not answer unambiguously. When your team hits those gray areas, you need documented, defensible answers backed by regulatory expertise rather than educated guesses.

Reglyr's regulatory consultancy is purpose-built for exactly these moments. Powered by the same AI platform that drives continuous compliance monitoring, and enriched by real-world client engagements across food, physical goods, and cosmetics, Reglyr's consultants help you resolve novel compliance questions with the rigour and documentation that regulatory authorities expect.

From Mandatory Compliance to Market Advantage

The ESPR's Digital Product Passport mandate for cosmetics is coming in two waves: packaging by 2027–2028, formulations by 2028–2030. The delegated acts are still being drafted, but the direction is set, the timeline is fixed, and the cost of waiting is compounding.

What the most forward-thinking cosmetics brands have already recognised — and what the compliance community is beginning to echo — is that digital product passports are not only a regulatory obligation. They are a strategic asset: a verifiable, consumer-accessible record of your ingredient provenance, sustainability credentials, and packaging responsibility. In an era where greenwashing scrutiny is intensifying and counterfeit products are flooding online marketplaces, a robust DPP is also a trust signal and an anti-counterfeit mechanism rolled into one.

The brands that treat ESPR compliance as a data infrastructure project — rather than a last-minute documentation exercise — will be the ones that turn the mandate into a competitive differentiator.

The 2027 deadline is closer than it appears. Run your cosmetics portfolio through Reglyr's ESPR gap check before the mandate hits.

Frequently Asked Questions

What is a Digital Product Passport (DPP) for cosmetics?

A Digital Product Passport (DPP) for cosmetics is a dynamic, machine-readable digital record that provides detailed information about a product's entire lifecycle, from ingredient sourcing to end-of-life disposal. Mandated by the EU's ESPR, it is accessed by consumers, regulators, and supply chain partners, typically via a QR code. Unlike a static label, it serves as a living data asset, containing comprehensive data on formulation, packaging, and sustainability performance.

Which EU regulation requires a Digital Product Passport for cosmetics?

The primary EU legislation mandating Digital Product Passports for cosmetics is the Ecodesign for Sustainable Products Regulation (ESPR). The ESPR is a "framework law," which means it establishes the main legal structure, but product-specific requirements, including those for cosmetics, are detailed in subsequent "delegated acts" published by the European Commission.

When do cosmetics brands need to comply with the DPP mandate?

Compliance for cosmetics will be implemented in two phases. The mandate for cosmetics packaging is expected to begin between 2027–2028, while the requirements for the cosmetic formulations themselves are projected for 2028–2030. These timelines are based on the finalization of delegated acts, which are anticipated between 2025–2026. Brands should begin preparing now, as the 18-24 month window after finalization is short for implementing the necessary data systems.

What are the penalties for non-compliance with the ESPR's DPP requirements?

The primary penalty for non-compliance is denial of access to the EU market. While specific fines and penalties will be detailed in the delegated acts for each product category, the overarching consequence is that non-compliant products will be barred from being sold in the European Union. For brands that rely on the EU market, this represents a significant commercial and existential risk.

What specific information must a cosmetics DPP contain?

A cosmetics DPP must contain three core categories of data: product and formulation data, packaging and end-of-life data, and sustainability and traceability data. This includes a full INCI list with supplier details, disclosure of allergens and substances of concern, detailed material composition and recycled content for all packaging, and lifecycle carbon footprint data. The passport must also include traceability identifiers like batch and lot numbers.

How can my brand start preparing for the ESPR and DPP mandate today?

The best way to start preparing is by conducting a portfolio-wide gap analysis to understand which data you currently have versus what the ESPR will require. Following the gap analysis, you should establish a robust data architecture to manage DPP information, launch a pilot project on a few key products, begin engaging your supply chain to secure necessary data, and consult with regulatory experts to navigate ambiguities in the regulation.

Will the DPP apply to both the cosmetic product and its packaging?

Yes, the DPP will apply to both the cosmetic product and its packaging, but it will be rolled out in two distinct phases. The first phase (2027-2028) will focus specifically on primary, secondary, and tertiary packaging, requiring data on material composition and recyclability. The second phase (2028-2030) will extend the scope to the cosmetic formulations themselves, mandating ingredient-level traceability and sustainability disclosures.