What the regulation changes for businesses

The existing Toy Safety Directive 2009/48/EC is being replaced by the new regulation.

The key difference: a directive first had to be transposed into national law by each EU country, while a regulation applies immediately and directly in the same way across all member states. This creates more consistency, but also means less room for interpretation.

In substance, three things change above all for manufacturers and importers:

First, the existing EU Declaration of Conformity is replaced by the digital product passport. Second, requirements on chemical substances in toys become noticeably stricter, including a complete ban on certain PFAS and a significantly longer list of prohibited bisphenols. Third, the supply chain is documented more transparently, with a ten year retention obligation.

Important for planning: the regulation has already been formally in force since 1 January 2026, but the actual obligations for businesses only apply from 1 August 2030. This time should not pass unused, because the detailed technical specifications for the DPP will only be set out gradually through separate legal acts, which themselves require lead time.

What is a digital product passport for toys?

In simple terms, the DPP is a structured, online accessible data record containing all relevant information about a specific toy model.

The DPP replaces the function of today's Declaration of Conformity. When a manufacturer issues the DPP, they are bindingly declaring that the toy meets all safety requirements of the regulation. Unlike a PDF document, which today often ends up in a drawer, the DPP is permanently available online, for at least ten years after the last unit of the model has been sold. This applies even if the company becomes insolvent or leaves the market in the meantime.

A key design principle: consumers should be able to access the DPP without obstacles, without registering or entering a password.

What information must the DPP contain?

The regulation sets out a binding minimum content. At its core, this covers three blocks of information:

Who is behind the product: name and address of the manufacturer and, where applicable, their authorised representative, a unique economic operator identifier, and a communication channel through which consumers can report safety problems.

What the product is: a unique product identifier, a colour image for identification, and the customs commodity code, where relevant.

Why it is safe: references to all EU legislation complied with, the standards applied, where applicable details of the notified body involved, the CE marking, and a list of any allergenic fragrances present.

In addition, safety information, warnings and instructions for use can be included on a voluntary basis. The full set of requirements can be found in Annex VI of the regulation.

How does the DPP get onto the product?

The DPP itself is a data record within a digital infrastructure, not a physical label. So that it can be found by consumers, market surveillance authorities and customs, the regulation requires a physical data carrier, typically this will be a QR code or a comparable identifier. This data carrier must be attached directly to the toy or, where this is not possible for reasons of size or material, to the packaging or accompanying documents.

Before a toy may be sold in the EU, the manufacturer must also upload the unique product identifier to a central EU register. In future, it will be mandatory to attach a DPP to the product before it is placed on the market in the EU. The same applies to imports into the EU.

Want to learn more about the requirements, the timeline and the first practical steps for your business?

Then register now for the webinar: Digital Product Passport for Toys