Who Owns Product Data? A Governance Model for Manufacturers
Regulation names who's legally on the hook. It says nothing about who on your team actually owns the field that's wrong.
"Who owns product data" has two completely different answers depending on who's asking. If a regulator is asking, there's a precise legal answer. If your own compliance manager is asking who on the team actually got the fire rating wrong in last quarter's passport submission, there's no answer in any regulation at all, because that question was never regulation's to answer. Both answers matter, and conflating them is where governance actually breaks down.
The legal answer: the economic operator
ESPR gives this a precise legal term. Article 2(46) defines "economic operator" to cover the manufacturer, importer, or authorized representative responsible for placing a product on the EU market. Articles 9(1), 9(2)(g), 10(3), and 27(1)(c) attach data accuracy obligations specifically to that role. If a Digital Product Passport contains wrong data, the economic operator is who's legally exposed, not whichever employee happened to type the number in.
The economic operator is legally responsible for DPP data accuracy. This is settled, citable, and applies regardless of company size or internal structure.
The gap: regulation stops at the company's front door
Here's what's genuinely not addressed, in ESPR, in CPR, or in the advisory commentary on either: which department inside the company owns which specific data field, who approves a change before it's published, and who's accountable when a field turns out to be wrong. The regulation tells you the company is on the hook. It has nothing to say about whether that's R&D, quality, compliance, or whoever happens to still have edit access to last year's spreadsheet.
Internal data ownership, update approval, and accountability for errors are left entirely to each company. This isn't a case of thin documentation, it's a confirmed absence.
What about updates after the sale?
This gets even less settled once a product leaves the factory. ESPR Article 9(2)(g) explicitly defers the detailed rules on keeping DPP data current over a product's lifecycle, after installation, after a component is replaced, to future delegated acts. For construction products under CPR specifically, that detail isn't settled yet either. If your current plan for lifecycle updates is "we'll figure that out when the delegated act lands," you're not behind, that's genuinely where things stand. But it's worth having an internal process ready before the rule arrives rather than after.
A governance model to fill the gap
Since there's no official template here, this is Tylko Academy's own recommended structure, not a regulatory requirement, built from what we've seen work across manufacturers setting this up for the first time.
This exact gap, from a spreadsheet to a governed system of record, is what Module 4 of our course is built around. Real data fields, GWP indicators specifically, and how governance actually works once this isn't informal anymore.
See the DPP course →Frequently asked questions
The economic operator, a legal term under ESPR covering the manufacturer, importer, or authorized representative who places the product on the market. ESPR Article 2(46) defines the term, and Articles 9 and 10 attach data accuracy obligations to that role specifically.
No. Internal data governance, which department or role owns which specific field, how updates get approved, who signs off before publication, is not addressed in ESPR, CPR, or in the advisory commentary we reviewed. This is a genuine gap left entirely to each company to fill.
This is explicitly left open. ESPR Article 9(2)(g) defers detailed lifecycle data-update responsibility to future delegated acts, meaning the specific rules for a given product category, including construction products under CPR, aren't settled yet.
Yes. The roles and process suggested here are Tylko Academy's own recommended approach to filling a real gap in the regulation, not an official EU-prescribed internal governance model, because no such official model exists.
Learn DPP Properly,
Not Just the Headlines
Why it's worth it:
-
The full regulatory picture, not just the deadline. ESPR and CPR explained together, with the real timeline.
-
What's actually inside a DPP. Real data fields and how governance works once it's a system of record.
-
Where this is going next. A bonus module on AI in DPP.
-
A certificate on completion, plus team licenses for whole organizations.
