Article 14 · Commission Implementing Regulation (EU) 2026/1778

Contents

Article 14Log system#

1.The Commission shall establish, maintain and run a log system. The Commission shall ensure the creation of a complete, accurate and reliable audit trail in the log system.

2.In the log system the Commission shall log events relating to all of the following categories of actions:

(a)data related to access and authentication entries;

(b)data modifications by all registry users, including the uploading or updating of data referred to in Article 13(4) of Regulation (EU) 2024/1781 or of data required to be uploaded in the registry pursuant to other Union legislation that mandates the use of the digital product passport for a product;

(c)administrative actions by all registry users, including the creation, change or deletion of user accounts, changes to access rights and permissions, and any changes to the registry’s configuration and other administrative actions of registry users;

(d)data exchange logs.

3.To ensure that the data stored in the registry is processed securely and in compliance with Union law, the Commission shall keep the logs for a period of:

(a)six months for the categories of actions referred to in paragraph 2, point (a);

(b)five years for the categories of actions referred to in paragraph 2, points (c) and (d);

(c)for the duration of the registration for the events relating to the categories of actions referred to in paragraph 2, point (b).

4.In the case of suspected incidents and for the purposes of audits and random checks of security performed by competent national authorities and customs authorities, the Commission shall make the relevant logs referred to in paragraph 2 available to the relevant national authorities.

5.The Commission shall implement appropriate technical and organisational measures to guarantee the security of all logs and protect their integrity, in particular against unauthorised or unlawful processing, accidental loss, destruction or damage. Such measures shall, at least, ensure the immutability and confidentiality of the logs.

Defined terms · 18

Show every defined term

authentication token
means a token that securely transmits information about successful authentication and is used to prove authenticated sessions or delegated access between applications and the digital product passport information system;
controlled vocabulary
means a structured and authoritative set of standardised terms with defined meanings with a view to ensuring consistent representation of data attributes across digital product passports;
data exchange model
means a structured framework through which data can be exchanged between different systems and platforms;
data model
means a structured framework that organises elements of data, standardises the structure, determines how they relate to one another, and identifies the entities, their attributes and the relationship between those entities;
digital product passport
includes the battery passport established by Article 77 of Regulation (EU) 2023/1542.
hash of the version of the digital product passport
means the output generated from the relevant electronic data using a cryptographic algorithm from the relevant version of the digital product passport;
identity verification process
means the process by which a natural person or legal person provides evidence of identity and, where applicable, of establishment;
log system
means an automated system that records and stores information on all operations and interactions carried out in the registry;
login credentials
means a set of unique identifiers, such as a username and password, that enables a user to verify its identity in order to authenticate themselves in the registry;
massive data download
means the retrieval of an exceptionally large or complex dataset - typically ranging from terabytes to petabytes in scale - which exceeds the processing or storage capabilities of conventional tools or a single local machine or interferes with monitoring safeguards.
registry
means the information system established and maintained by the Commission in accordance with Article 13 of Regulation (EU) 2024/1781;
semantic conformity
means the extent to which the data contained in a digital product passport comply with the applicable semantic specification, in that:
semantic interoperability
means the ability of information systems and the organisations that support them to exchange data in such a way that the meaning of exchanged information is mutually understood and unambiguously interpretable by all parties, regardless of the underlying technology or jurisdiction;
semantic repository
means a collection of data models and semantic definitions that are composed of a structured and logically interrelated set of terms and their meanings specifying the core elements of the digital product passport, the definitions of names or vocabularies, the data elements and the ontology associated with specific data in order to ensure common understanding across all users, and cross-lingual interpretation used for digital product passport validation and for linking the registry data with the digital product passports;
semantic specification
means any artefact published in the semantic repository, including ontologies, data models, controlled vocabularies, and code lists, together with their versioning metadata and provenance information;
value chain actor
means a natural or legal person, other than the economic operator, that performs activities in the value chain of a product requiring a digital product passport and its registration in the registry, such as a repairer, refurbisher, remanufacturer or recycler;
verified economic operator
means an economic operator that has successfully completed the identity verification process in the registry in accordance with Article 4;
verified value chain actor
means a value chain actor that has successfully completed the identity verification process in the registry in accordance with Article 5;