Digital Product Passport

The passport is anchored by a Unique Registration ID that creates an immutable link between the physical product and its digital twin in the EU AI Act Database. This identifier enables:

• Supply chain traceability from manufacturer to end-user
• Instant compliance verification by market surveillance authorities
• Cross-referencing with incident reports and post-market monitoring data

The identifier must be physically affixed to the product or accessible via a data carrier such as a QR code or RFID tag.

The passport contains structured, machine-readable data fields that enable automated verification by regulatory systems. Key data elements include:

• Conformity assessment outcomes and CE marking status
• Intended purpose declaration defining the legal boundary of registration
• Residual risk disclosures for transparent end-user communication
• Technical documentation file references and version history

This structured format allows for API-based submission to the EU database and automated validation against harmonized standards.

The passport enforces accountability across all economic operators in the AI value chain:

• Providers must ensure the passport is created and accurate before market placement
• Importers must verify foreign manufacturers have completed registration before placing products on the Union market
• Distributors must confirm the passport is present and valid before making products available
• Authorized representatives serve as the EU-based point of contact for non-EU providers

This creates a chain of custody that prevents orphaned or unregistered AI systems from entering the market.

The passport maintains a dynamic record of significant events throughout the AI system's operational life:

• Substantial modifications that trigger re-registration obligations
• Incident reporting linkages connecting the unique ID to mandatory notification portals
• Market withdrawal notifications when a system is recalled or decommissioned
• Registration suspension actions by National Competent Authorities

This lifecycle approach ensures the passport remains a living document rather than a static one-time filing, supporting continuous compliance monitoring.

The passport operates under the principle of mutual recognition, meaning a single registration in one EU member state serves as the basis for market access across all other member states. This enables:

• Single filing for pan-European market access
• Harmonized enforcement through National Competent Authorities
• Centralized database access for all member state regulators

The passport effectively functions as a regulatory passport that eliminates the need for duplicate registrations across jurisdictions.

The passport framework includes transitional provisions for pre-existing AI systems:

• Grace periods allow legacy high-risk systems already on the market to achieve compliance without immediate withdrawal
• Substantial modification triggers ensure that only significantly changed systems require full re-registration
• Version tracking maintains a clear lineage between original and updated system configurations

This prevents market disruption while ensuring a phased migration to full compliance for established AI products.