Last month the Registry went live. This month the rulebook behind it took effect: Implementing Regulation (EU) 2026/1778 was adopted on 16 July, published in the Official Journal on 17 July, and entered into force on 6 August. It sets out access management, user verification, data registration, storage and the Registry’s technical architecture.
One provision matters more than the rest, and it is the least discussed.
You cannot register anything until you are a verified economic operator
Under Article 4, only a verified economic operator may register a passport. Verification is not a username and password. It runs on eIDAS (Regulation (EU) No 910/2014), and in practice means:
- a qualified electronic signature if you are a sole trader, or
- a qualified electronic seal if you are a legal entity — which covers essentially every brand reading this
In most cases these come from a qualified trust service provider; the regulation also allows a high-assurance notified eID for EU-established sole traders, and qualified electronic attestations of attributes. Verified status then lasts until the underlying electronic identification expires, and in any case no longer than three years, after which you re-verify.
Obtaining a qualified electronic seal is a procurement exercise with legal-entity identity checks attached. It means choosing a trust service provider, proving who your company is, and getting someone with signing authority to engage. That is a lead-time item measured in weeks, and it sits with finance, legal or company secretarial — not with the person who has been evaluating DPP platforms.
The bit vendors will not volunteer
When a passport is submitted, the Commission runs an automated check on structure and completeness. That check is explicitly not proof of compliance — the regulation says so directly. A passport can be accepted by the Registry and still be wrong, thin in substance, or built on data a supplier estimated.
Expect this distinction to be blurred in sales conversations. “Registered with the EU Registry” will start appearing on vendor slides and, before long, in wholesale onboarding packs. It means the file parsed. It does not mean anyone checked the contents.
Why this is the one DPP task worth doing in 2026
Almost every other DPP decision is hostage to a delegated act that does not exist yet — data model, granularity, which proposed data points survive. All still moving. Verified economic operator status is different: it is defined, it is in force, it applies horizontally across product groups, and it has no product-category deadline of its own.
It is also the rare compliance step where being early costs nothing and being late blocks everything downstream.
Operator takeaway: ask one question this week — does our group already hold a qualified electronic seal? A surprising number of larger businesses do, obtained for e-invoicing or e-signature purposes in a particular member state, sitting quietly in finance or company secretarial. If the answer is yes, your first DPP infrastructure task is an internal phone call. If it is no, start the procurement now, while the deadline pressure is zero.