Toy Regulation 2025/2509: Passport Due 2030, Data Due Now

---

slug: eu-toy-safety-regulation-digital-product-passport-tooling title: "Toy Regulation 2025/2509: Passport Due 2030, Data Due Now" description: "Regulation (EU) 2025/2509 applies from 1 August 2030 and repeals the Toy Safety Directive. The fourteen-field digital product passport data set, the customs registry check, and how it maps onto the US 16 CFR 1110 certificate." date: 2026-11-09 status: published tags: - EU Toy Safety Regulation 2025/2509 - digital product passport toys 2030 - toy customs commodity code EU CSW-CERTEX - 16 CFR 1110 certificate of compliance eFile - AI plush toy compliance 2030 image: /assets/img/blog/20261109-dpp01.webp seo_title: "Toy Safety Regulation 2025/2509: Digital Product Passport in 2030" seo_desc: "The new EU toy regulation applies from 1 August 2030. Here is the 14-field passport data set, the customs registry check, and how it lines up with the US 16 CFR 1110 certificate."

---

November 2026 · Toy Safety Regulation 2025/2509, the Digital Product Passport and the Four-Year Gap Between Compliance and Enforcement

Most toy importers already know the headline. The toys on a 2027 booking sheet will be sold under Regulation (EU) 2025/2509, not the old Toy Safety Directive. What most importers have not yet priced is that the new regulation contains a four-and-a-half-year gap: it entered into force on 1 January 2026 and applies from 1 August 2030. During those years the law that governs the product you ship is still the old directive, but the file behind the product has already changed. Every technical documentation pack and every digital product passport you create for a toy placed on the market from 1 August 2030 sits at the end of a paper trail that starts now.

This article covers four things a buyer or brand owner needs to act on: the exact dates, the data a toy passport must contain, how those data map onto the US certificate of conformity requirement, which parts of the toy file change between now and 2030, and a sourcing rule that makes the 2030 deadline a competitive advantage rather than a scramble.

One regulation, one date, and a transition that is shorter than it looks

Regulation (EU) 2025/2509 of 26 November 2025 was published in the Official Journal on 12 December 2025. Article 59 sets out three dates, and they do not apply to the same parts of the regulation.

1. The regulation entered into force on 1 January 2026, twenty days after publication.
2. It applies from 1 August 2030 for the product obligations: essential safety requirements, technical documentation, conformity assessment, the digital product passport, CE marking and customs verification.
3. Articles 28 to 44, which cover notified bodies, and Articles 49 to 55, which cover delegated acts, the committee and penalties, have applied since 1 January 2026. So the machinery that will assess, notify and penalise is already running.

Article 56 repeals Directive 2009/48/EC with effect from 1 August 2030. Article 57 protects continuity in three narrow ways. Toys placed on the market in conformity with the directive before 1 August 2030 may continue to be made available, and EC type-examination certificates issued under Article 20 of the directive remain valid until 1 February 2031 unless they expire sooner.

Note: the transition protects stock already placed on the market. It does not protect a new production run that arrives at Rotterdam or Hamburg after the summer of 2030. The moment a 2031 model is first made available on the Union market, the full regulation applies, and the passport has to exist before that product is put on a shelf or a listing page.

The practical consequence for a sourcing calendar is that a toy designed today with a spring 2027 sampling slot will sell through 2028 and 2029 under the directive, then reach its second or third production run in 2030 and 2031. That is the same product, the same mould and often the same packaging drawings. The only thing that changes is the documentation obligation attached to it, and the change lands on a factory that was never budgeted for it.

What the digital product passport actually is

Article 19 is precise, and reading it line by line removes most of the confusion around the term passport. The passport is not an app, not a certificate and not a database owned by the Commission. It is a data set, tied to a physical data carrier on the product, that must remain available for ten years after the toy is placed on the market.

Article 19(2) lists what the passport must do.

1. It must correspond to a specific toy model.
2. It must state that compliance with the essential safety requirements has been demonstrated.
3. It must contain at least the data set in Part I of Annex VI.
4. It must be accurate, complete and up to date.
5. It must be available in the language or languages required by the Member State where the toy is sold.
6. It must be accessible to consumers, market surveillance authorities, customs, notified bodies, the Commission and other economic operators, according to the access rights set by delegated act.
7. It must remain available for ten years, including if the economic operator becomes insolvent.
8. It must be connected through a data carrier to a persistent unique product identifier.
9. It must meet the specific technical requirements adopted under Article 49(1).

Article 19(7) settles the question every packaging engineer asks first: where does the carrier go. The data carrier must be physically present on the toy or on an affixed label. Where size or nature does not allow it, it may go on the packaging or on an accompanying document, and it must be clearly visible to consumers before purchase, including in distance sales. For a soft plush toy with no hard surface, that normally means a woven or printed label, which is a sewing-room decision rather than a marketing decision.

Article 7(3) adds a records point that is easy to miss. Manufacturers must keep the technical documentation and the digital product passport for ten years after the toy is placed on the market. Article 27 fixes the technical documentation deadline at thirty days when a market surveillance authority asks for it, unless a serious and immediate risk justifies a shorter window.

The Annex VI Part I data set: fourteen fields you can assign today

This is where a project manager can do useful work in November 2026, four years before the deadline. Annex VI Part I names fourteen items. Each one has an owner somewhere in your organisation or your supplier's organisation.

1. The unique product identifier of the toy.
2. Name and address of the manufacturer, any authorised representative, plus the unique operator identifier.
3. Name and address of the economic operator responsible under Article 4 of Regulation (EU) 2019/1020, plus the unique operator identifier.
4. A statement that the passport is issued under the sole responsibility of the manufacturer.
5. The object of the passport: traceability identification plus a colour image clear enough to identify the toy.
6. Where applicable, the commodity code under Regulation (EEC) No 2658/87 at the moment the passport is created.
7. References to all Union law the toy complies with.
8. Where applicable, a mention that the passport replaces the EU declaration of conformity under Regulation (EU) 2024/1689 or 2024/2847, Directive 2011/65/EU, 2014/30/EU, 2014/35/EU, 2014/53/EU or Delegated Regulation (EU) 2019/945.
9. References to the harmonised standards used, or to common specifications.
10. Where applicable, the name and number of the notified body that intervened and the certificate reference.
11. The CE marking.
12. A list of allergenic fragrances present in the toy that are subject to specific labelling under Part B, point 1, of the Appendix to Annex II.
13. The communication channel required by Article 7(12).
14. The reference of the digital product passport service provider hosting the back-up copy.

Part II allows two optional additions: safety information and warnings, and instructions for use.

For an AI plush toy, items 7, 8 and 9 are the difficult ones. Item 8 matters because a Wi-Fi connected toy with a lithium battery sits under the Radio Equipment Directive 2014/53/EU and its battery obligations, so the passport can absorb the declaration of conformity that used to be a separate document. Item 6 matters because a toy passport that quotes a commodity code is a customs document as well as a consumer document, and Article 23(3) lets customs release a toy for free circulation only after checking that the unique registration identifier and the commodity code match the registry.

The passport registry and the customs gate

Article 22 creates a registry. Before placing a toy on the market, the economic operator must upload the unique product identifier, the unique operator identifier and any additional data required by delegated act. Article 22(3) extends the obligation to online marketplaces: for toys, the marketplace interface must be designed so that a trader can supply the CE marking, any warning that must be visible before purchase, and the data carrier or weblink that opens the passport.

Article 23 then links the passport to border clearance. A person placing a toy under release for free circulation must provide the unique registration identifier to customs. Customs verify that identifier and the commodity code against the registry through the interconnection between the registry and EU CSW-CERTEX, once that interconnection is operational or from the date the regulation applies, whichever is later.

Note: Article 23(3) is explicit that release for free circulation is not proof of compliance. Passing the border gate does not convert a partially populated passport into a compliant one. It only means the identifiers matched.

Cost and time: what a second data system really adds

The regulation does not set a fee, a format or a vendor. It sets obligations that someone has to perform, and the cheapest way to plan is to count the work in hours rather than in licence costs. The table below compares the four systems a toy buyer will be running in 2030 side by side, with the governing text quoted where the rule is fixed.

Comparison: the four documentation systems a toy buyer runs in 2030

1. Governing text

EU toys: Regulation (EU) 2025/2509, applying from 1 August 2030, repealing Directive 2009/48/EC. US children's products: section 14 of the Consumer Product Safety Act, implemented through 16 CFR Part 1110. EU internet-connected toys: Regulation (EU) 2023/988 (GPSR), Article 19 for distance sales, applicable since 13 December 2024. US privacy for voice-enabled toys: the Children's Online Privacy Protection Rule, 16 CFR Part 312.

1. Who signs

EU toys: the manufacturer creates the passport and assumes responsibility by doing so (Article 19(4)). US: the importer is the finished product certifier for products made outside the United States (16 CFR 1110.7(a)). EU online offers: the economic operator making the offer, including a distance seller. US privacy: the operator of the website or service directed to children.

1. What must be public or visible before purchase

EU toys: the data carrier must be clearly visible to consumers before purchase, including in distance sales (Article 19(7)). US: no public display obligation; the certificate must be furnished to each distributor or retailer (16 CFR 1110.13(b)). EU online offers: manufacturer name and contact, EU responsible person, product identification including a picture, and any warning in a language consumers understand (GPSR Article 19). US privacy: no product-facing document; a privacy notice and verifiable parental consent where required.

1. Reference numbers that must match

EU toys: unique product identifier, unique operator identifier and the commodity code, matched against the registry by customs (Article 23(3)). US: at least one of GTIN, model number, registered number, serial number, SKU, UPC or an alternate identifier (16 CFR 1110.11(a)(1)). EU online offers: product identification and type. US privacy: no identifier requirement at product level.

1. Record keeping

EU toys: technical documentation and passport kept ten years after placing on the market (Article 7(3)); technical documentation produced within thirty days on request (Article 27(3)). US: certificate data filed at the time of entry in ACE; certificates available within twenty-four hours on request (16 CFR 1110.13). EU online offers: information kept current for the listing lifetime. US privacy: retention limited to what the purpose requires.

1. Deadline you can act on now

EU toys: delegated acts under Article 49(1) will set carriers, layout, standards and access rights, and their date of application is not earlier than eighteen months from adoption. US: electronic filing of certificate data elements at entry is required for imported finished products (16 CFR 1110.13(a)(1)). EU online offers: in force now. US privacy: in force now.

1. Common failure mode

EU toys: a passport that names the model but not the production batch, so a colour image and a product identifier point to the wrong run. US: certificate data elements filed with an identifier that does not match the shipment. EU online offers: a listing that omits the EU responsible person. US privacy: a voice feature that collects audio before consent is verified.

A useful way to read that table is to notice how much of it is already live. Rows 3 and 4 of the EU online offer column have been enforceable since December 2024, and the US column has been enforceable for imported children's products since the certificate rule took its current form. The toy passport is the only genuinely new column, and it is also the only one where you control the underlying data before the deadline.

Where the EU passport and the US certificate overlap, and where they diverge

Both systems ask for the same eight facts, which is why a single internal data model is attractive. The eight are: who made the product and where, who certifies it, what identifies the unit, which rules it is certified against, which laboratory tested it and when, the manufacturer's address, the manufacturing date and place, and the attestation.

The divergence is in three places.

1. The EU document is publicly reachable through a data carrier; the US certificate is a filing and a file, not a consumer document.
2. The EU passport has a ten-year life after the product is placed on the market and survives the operator's insolvency; the US obligation is to produce the certificate within twenty-four hours and to file the data elements at entry.
3. The EU passport carries the commodity code and is verified by customs against a registry; the US system verifies certificate data elements inside the ACE entry rather than against a public-facing product record.

For a brand owner who sells the same plush toy in Hamburg and in Illinois, that means one internal record with two exports. Build the record to the stricter of the two on retention, which is the EU ten-year rule, and populate the US filing from it. The work of preparing this record is already described in our guide to the toy certification file that buyers never check, which walks through the seven documents and the ten-year horizon in detail.

What the technical file looks like in 2030

Article 27(1) points to Annex V, which lists seven elements. Read them next to the current directive pack and two gaps appear immediately.

1. A detailed description of the design and manufacture, including the list of components and materials and the list of substances and mixtures with safety data sheets from chemical suppliers.
2. The safety assessment carried out under Article 25.
3. A description of the conformity assessment procedure followed.
4. The addresses of the places of manufacture and storage.
5. Copies of documents submitted to any notified body.
6. Test reports and a description of how conformity of production was ensured, where internal production control was used.
7. A copy of any EU type-examination certificate and a description of how conformity to type was ensured.

Article 25 is the element most often missing from a file assembled by a trading company rather than a manufacturer. The safety assessment must cover chemical, physical, mechanical, electrical, flammability, hygiene and radioactivity hazards, and it must address combined exposure to different chemicals. Article 25(2)(c) adds a clause that speaks directly to connected products: for toys within the scope of Regulation (EU) 2024/1689, Regulation (EU) 2024/2847 or Directive 2014/53/EU, the assessment must consider children's particular vulnerabilities.

Note: a plush toy with a microphone, a Wi-Fi module and a companion app falls inside that clause. The safety assessment is no longer only about stitching and small parts. It has to say something defensible about how a child interacts with a voice product.

Annex V also requires the list of substances and mixtures with safety data sheets obtained from chemical suppliers. For a factory that buys nine fabric and component lots across four subcontractors, that list is a supply chain exercise, not a paperwork exercise. Our breakdown of the one toy four factories problem explains why forty percent of a typical bill of materials can arrive without a certificate, and why that gap becomes expensive once a passport has to cite the standards behind every part.

Customs, commodity codes and the border check

Item 6 of Annex VI Part I, read alongside Article 23, turns a classification decision into a compliance decision. If your passport quotes a commodity code, customs will compare that code with the registry entry. A plush toy with a Bluetooth speaker is classified differently from a plush toy without electronics, and a toy that ships as a set can attract a classification that a trading company never recorded.

This is the same problem our analysis of landed cost and tariffs covers from the duties side. The difference is that from 2030 the classification appears in a document that must also carry the CE marking, the harmonised standards and the notified body certificate. An error that used to be corrected with a post-entry adjustment becomes a mismatch between a passport and a border system.

A four-step plan that fits inside a 2027 product calendar

The deadline is 1 August 2030. The work that makes it cheap is work you can start in the sampling season that begins in February 2027 at Nuremberg.

1. Add four fields to the sample request. Ask for the unique product identifier convention, the commodity code at component level, the colour image at passport resolution, and the name of the economic operator responsible under Article 4 of Regulation (EU) 2019/1020. A factory that cannot answer in a sample quotation will not answer in 2030.

1. Move the label decision into sewing. Article 19(7) requires a carrier visible before purchase. Decide now whether the carrier is a woven label, a printed care label or a hangtag, and put that decision in the technical pack, not in a marketing brief. The 7 mm gap problem in our small parts guide shows what happens when a label change is treated as cosmetic.

1. Freeze the standard list with the standards version attached. Item 9 of Annex VI cites harmonised standards. Record the edition number and publication reference, because a passport that cites a withdrawn edition is inaccurate on its face, and Article 19(2)(d) requires accuracy, completeness and currency.

1. Run one passport dry run on a single SKU in 2027. Populate all fourteen fields, including the allergenic fragrance list and the notified body reference, in the language of the first market you will sell into. The dry run costs less than one lab test and it exposes which supplier cannot produce the underlying source documents.

What changes for the buyer who starts now

The four-year gap invites the comfortable conclusion that nothing needs to be done before 2030. The regulation is written so that the opposite is true. The delegated acts that will fix carriers and access rights apply no earlier than eighteen months after their entry into force, which means the technical detail will arrive late and compressed. Any operator who has already organised the fourteen data points and decided the carrier will spend that window checking formats, while everyone else spends it chasing documents from subcontractors who have moved on to other customers.

Start with one SKU, one market and one label. The deadline is long, but the component data behind it is not something you can collect retroactively.

Sources

1. Regulation (EU) 2025/2509 of the European Parliament and of the Council of 26 November 2025 on the safety of toys and repealing Directive 2009/48/EC, Official Journal L series 2025/2509, 12.12.2025. Articles 7, 9, 18, 19, 22, 23, 25, 27, 49, 56, 57, 59 and Annexes V and VI. https://eur-lex.europa.eu/eli/reg/2025/2509/oj
2. Regulation (EU) 2023/988 of the European Parliament and of the Council of 10 May 2023 on general product safety. Article 4, Article 9, Article 11, Article 12, Article 16, Article 19 and Article 21. https://eur-lex.europa.eu/eli/reg/2023/988/oj
3. 16 CFR Part 1110, Certificates of Compliance, including 16 CFR 1110.7, 1110.9, 1110.11, 1110.13 and 1110.15, current as of 1 November 2026. https://www.ecfr.gov/current/title-16/chapter-II/subchapter-B/part-1110
4. 15 U.S.C. 2063, Certification, section 14 of the Consumer Product Safety Act. https://www.govinfo.gov/link/uscode/15/2063
5. European Commission, Internal Market, Industry, Entrepreneurship and SMEs, Toy safety and the new Toy Safety Regulation (EU) 2025/2509. https://single-market-economy.ec.europa.eu/sectors/toys/toy-safety_en
6. 16 CFR Part 312, Children's Online Privacy Protection Rule. https://www.ecfr.gov/current/title-16/chapter-II/subchapter-A/part-312