The EU's new packaging regulation applies from 12 August 2026, and one question keeps coming back: if the product gets a digital product passport and the packaging gets its own marking, will there now be two QR codes on the same box? No. Article 12 of the regulation expressly forbids it — and it also says which one stays.
What the PPWR is, in three sentences
The PPWR is the EU's packaging and packaging waste regulation: Regulation (EU) 2025/40, which replaces the thirty-year-old Directive 94/62/EC. It is not about the product but about the box, pouch and film the product travels in — recyclability, mandatory recycled content, packaging minimisation, re-use targets, and the part that concerns us here: labelling obligations.
A regulation rather than a directive, which means no national transposition: it applies directly in all 27 countries, in the same text, from 12 August 2026 (Article 71).
The fear: two codes on one box
From a manufacturer's point of view it looks like this. Under the ESPR the product gets a digital product passport with a data carrier — in practice a QR code. Under the PPWR the packaging also gets marked, in some cases with a QR code too. If those two systems evolve independently, you end up with a sewn-in label bearing one QR on the T-shirt and another on the bag, and the shopper has no idea which one to scan. And you are running two systems for one product.
The legislator saw this coming and wrote the answer into the regulation itself.
The regulation's answer: a single data carrier
The last sentence of Article 12(5) is not a recommendation but a binding provision:
"Where Union law requires information on the packaged product to be provided via a data carrier, a single data carrier shall be used for providing the information required for the packaged product and for the packaging, and both shall be easily distinguishable."
Regulation (EU) 2025/40, Article 12(5) — official English text
There are two things in there and both matter. First: a single carrier. Not two, and not "preferably one" — the text says shall. Second: the two must be easily distinguishable. That is not about the printing but about what a person sees after scanning: it must be clear what describes the product and what describes the packaging.
And which one should it be?
Recital 70 answers that, and it leaves no doubt:
"In particular, where the packaged product is covered by Regulation (EU) 2024/1781 or other Union law requiring a digital product passport, that digital product passport should also be used for providing the relevant information under this Regulation."
Regulation (EU) 2025/40, recital 70 — official English text
Regulation (EU) 2024/1781 is the ESPR. So it is not the packaging marking that swallows the product passport — it is the other way round: the product passport is the data carrier through which packaging information is also made available. If your product needs a passport, the box does not get its own QR code. It shares the existing one.
What the PPWR does not do
This is worth pausing on, because it is widely misunderstood. The PPWR does not create a packaging product passport, and it does not make anyone subject to passport obligations who was not already. Packaging is not among the product groups covered by the product passport registry — that is filled by the ESPR, the battery regulation, and the rules on construction products, toys and detergents.
The most telling evidence is the text itself: the phrase "digital product passport" appears exactly once in the entire regulation — in the recital quoted above. The PPWR does not compete with the product passport. It builds on it.
What happens when
| Date | What happens | Reference |
|---|---|---|
| 12 Aug 2026 | The regulation becomes applicable | Art. 71 |
| 12 Aug 2026 | Deadline for the Commission to adopt the implementing acts specifying the harmonised label and the digital marking | Art. 12(6)–(7) |
| 12 Feb 2027 | Packaging under an extended producer responsibility (EPR) scheme may be identified — but only by QR code or other standardised, open digital marking | Art. 12(9) |
| 12 Aug 2028 | Mandatory harmonised material-composition label (pictogram) — or 24 months after the implementing act, whichever is later | Art. 12(1) |
| 12 Feb 2029 | Reusable packaging must bear a label and a QR code — or +30 months, whichever is later | Art. 12(2) |
| 1 Jan 2030 | Deadline for the methodology on digital marking of substances of concern | Art. 12(7) |
The critical row is the second one. The deadline for the implementing acts is the same day the regulation becomes applicable — and it is precisely those acts that determine what the label looks like and what data goes into the digital marking. Until they exist, the field list is unknown. Anyone claiming today that they know exactly what belongs on a packaging data carrier is guessing.
Four things most people do not expect
1. Transport packaging is exempt — e-commerce packaging is not. Article 12(1) excludes transport packaging and deposit-and-return packaging, but the exemption expressly does not extend to e-commerce packaging. If you run a webshop, your cardboard box will need a label.
2. The QR code is not universally mandatory. The base obligation under Article 12(1) is a pictogram label, not a QR code. A QR code is mandatory for reusable packaging, optional for sorting information, and the exclusive means for EPR identification. Anyone talking about a general QR mandate for 2028 has misread the text.
3. Marking substances of concern is mandatory — but the methodology does not exist yet. If packaging contains such a substance, it must be marked using standardised, open digital marking. What exactly goes into that marking is determined by a methodology the Commission must adopt by 1 January 2030. So the obligation is stated, but its content waits on that methodology.
4. There is a three-year run-off. Non-compliant packaging manufactured or imported before the deadlines may be made available on the market for three years from the entry into force of the labelling requirements (Article 12(12)). You do not have to scrap existing stock.
This article is information, not legal advice. How the PPWR applies depends on the packaging type, the product category and national implementation. The exact form of the marking is settled in the implementing acts referred to above, which had not been published at the time of writing.
What to do now — and what not to
Do not invent packaging data fields. This is the most common mistake around every new piece of regulation: someone adds twenty fields to the best of their knowledge, then the implementing act says something else and they start over — while the wrong data already sits behind printed QR codes.
What is worth doing:
- Check whether your product needs a passport at all. If it does, the packaging information will go there, not into a separate system. If you are unsure, the readiness test tells you in five minutes.
- Ask your packaging supplier what material-composition data they can provide, and in what format. The same data feeds both the harmonised label and the digital marking — and in our experience collecting supplier data takes the longest.
- Design for one QR code, not two. If you are commissioning packaging design now for 2027, the law has already told you the direction. Designing two today means reprinting next year.
- Watch the implementing acts under Article 12(6) and (7). That is the single event after which it is worth touching your data model.
How does Veridyn help?
On two concrete points. One is the "easily distinguishable" requirement: Veridyn passports render in sections, each with its own heading and icon — packaging data in its own place, not mixed into the product data. Nothing needs rebuilding for that; it is the basic structure of the display.
The other is timing. We will not add packaging fields until the implementing acts are published — but we are watching for them, and when they land the schema grows while your existing passports and the QR codes printed on them keep working unchanged. That is what the article on QR codes and GS1 Digital Link is about: the code points at the product, not at a particular data structure, so the schema can grow without a reprint.
See it live, or start for free — the first passport takes minutes.