DPP for Construction Products: What UK Manufacturers Need to Know
Key Takeaways
- The UK Building Safety Act 2022 mandates a "golden thread" of digital information for all higher-risk buildings (18m+ or 7+ storeys), requiring manufacturers to provide serialised, machine-readable product identities.
- The EU's ESPR framework will require Digital Product Passports for construction products from 2028, covering insulation, cladding, structural steel, and concrete — with UK exporters to the EU subject to the same obligations.
- A DPP for construction products must support multiple stakeholders simultaneously: installers, building managers, fire inspectors, insurers, and end-of-life recyclers — each needing role-appropriate data access.
- Manufacturers who build digital product identity infrastructure now will gain commercial differentiation with specifiers, access to the remediation market, and a head start on ESPR compliance.
Seventy-two people died at Grenfell Tower because nobody could answer a simple question: what exactly was in the cladding system on that building, and had it been installed correctly?
Seven years on, the regulatory response to that failure is reshaping the entire construction products industry. The UK Building Safety Act 2022 introduced mandatory "golden thread" information requirements for higher-risk buildings (Department for Levelling Up, Housing and Communities, 2022). The EU's Ecodesign for Sustainable Products Regulation (ESPR) is advancing delegated acts that will require Digital Product Passports for construction products from 2028 onward. And the two regimes, while legally distinct, are converging on the same operational demand: every significant construction product must carry a permanent, machine-readable digital identity containing performance data, installation records, and full traceability back to the manufacturer.
For UK manufacturers of insulation, cladding, fire-stopping systems, structural steel, and concrete products, this is not a distant compliance exercise. The groundwork needs to be laid now.
What the Building Safety Act Actually Requires
The Building Safety Act 2022 introduced a new regulatory framework for "higher-risk buildings" — currently defined as residential buildings over 18 metres or seven storeys. For these structures, the Act creates a statutory duty to maintain a "golden thread of information": a complete, accurate, and accessible digital record of every decision made about the building throughout its lifecycle.
The golden thread is not just a filing system. The Act requires that building safety information be stored in a structured format, accessible to the Building Safety Regulator, accountable persons (typically building owners or managers), and in emergencies, to fire and rescue services. Information must be updated whenever changes are made to the building fabric.
For construction product manufacturers, this translates into a concrete operational requirement: the products you supply to higher-risk buildings need to carry sufficient identity and performance information that they can be unambiguously recorded in the golden thread. That means:
- Unique product identification — batch numbers alone are insufficient; individual serialisation or lot-level traceability is expected
- Verified performance data — fire ratings, structural classifications, thermal performance, and any test certificates must be digitally attached and retrievable
- Installation records — who installed the product, when, and in which part of the structure
- Maintenance and inspection history — particularly for passive fire protection and structural elements
The Building Safety Regulator has made clear that it expects "digital by default" information management. Paper records stored in a site office do not satisfy the golden thread requirement.
ESPR and the DPP Timeline for Construction
On the EU side, the ESPR framework — which replaced the old Ecodesign Directive — enables the European Commission to mandate Digital Product Passports for specific product categories through delegated acts. Construction products are firmly in scope.
The Commission's working plan indicates delegated acts for construction products arriving between 2028 and 2030, with insulation materials and cladding systems likely in the first wave given their direct link to fire safety and energy performance. Structural steel, concrete admixtures, and building systems are expected to follow in subsequent phases.
Each DPP will need to include:
- Product classification and performance declarations
- Material composition and recyclability data
- Carbon footprint (embodied carbon) at product and batch level
- End-of-life instructions and deconstruction information
- Links to third-party test certificates and declarations of performance
The DPP must be accessible via a machine-readable carrier — a QR code compliant with GS1 Digital Link is the most practical solution for physical products — and registered in the EU Product Passport Registry that is being established in parallel.
For UK manufacturers who export to EU markets or supply projects that involve EU-based developers and contractors, ESPR compliance will be a commercial prerequisite regardless of post-Brexit regulatory divergence.
DPP Data Requirements by Construction Product Type
The data that belongs in a construction product DPP varies significantly by category. The table below maps the key requirements against product type, based on current ESPR draft guidance and Building Safety Act golden thread obligations.
| Product Type | Fire Performance Data | Structural Ratings | Installation Tracking | Maintenance Records | End-of-Life Data |
|---|---|---|---|---|---|
| External cladding systems | Reaction to fire class (EN 13501), fire spread test results | Wind load resistance, impact resistance | Installer certification, fixing method, layer sequence | Annual inspection status, any remediation | Recyclability %, disassembly instructions |
| Insulation (PIR, mineral wool, EPS) | Euroclass rating, smoke production class | Compressive strength (if structural) | Location in building, substrate type, fixing method | Condition checks, moisture monitoring | Recycled content %, take-back scheme |
| Passive fire protection (intumescent, firestopping) | Fire resistance period (EI/EW/E), substrate compatibility | N/A | Gap size, penetration type, installer name and certification number | Re-inspection date, any alterations | Product-specific disposal guidance |
| Structural steel | N/A (unless fireproofed) | Grade (S275/S355), yield strength, section reference | Fabricator, erector, weld inspection records | Periodic structural surveys | Steel recycled content (typically 90%+), scrap route |
| Ready-mix concrete | Fire resistance class of finished element | Compressive strength class (C25/30 etc.), exposure class | Pour date, location, mix design reference, curing records | Inspection/repair history | Carbonation data, recycling suitability |
This data does not live neatly in any single system. Product data sits with the manufacturer. Installation data sits with the contractor. Inspection records sit with the building manager or owner. The DPP is the mechanism that stitches these data layers together across the full product lifetime — which, for a structural element, could be 60 to 100 years.
Why QR-Based Identity Is the Right Answer for Construction
Construction products face environmental challenges that make many digital identity approaches impractical. A QR code label on cardboard packaging will not survive a building site. An RFID chip embedded in concrete may survive structurally but becomes unreadable once buried behind a finished surface. NFC tags on external cladding face UV degradation over decades of exposure.
The most durable approach combines two layers:
Embedded physical identity — a durable, tamper-evident label (anodised aluminium, ceramic, or laser-etched polymer) applied directly to the product or its installation point, carrying a GS1 Digital Link QR code that encodes the manufacturer GTIN and a unique serial or batch identifier.
Cloud-resident data — the QR code resolves to a cloud-based DPP record that holds all the data that cannot be physically engraved: performance certificates, installation photos, inspection logs, maintenance schedules. This record is mutable (new data can be appended) while the physical identity is permanent.
The GS1 Digital Link standard is specifically designed for this use case — a single QR code that resolves differently depending on who scans it and what context they need (GS1 Global, Digital Link Standard ISO/IEC 18975). A building manager scanning the same code as a fire inspector gets a different data view from a recycling contractor scanning at end of life. The underlying identity is the same; the presentation layer is role-aware.
This is exactly the infrastructure that BrandedMark provides out of the box. The platform issues serialised GS1 Digital Link QR codes, hosts the DPP data record, and controls access by stakeholder role — all without requiring manufacturers to build custom integrations. See how we handle industrial equipment identity at scale.
Multi-Stakeholder Access: Who Needs What
One of the distinctive challenges of construction product DPPs — compared to, say, a consumer electronics DPP — is the sheer number of stakeholders who need access to product data across a building's lifetime, each with different data needs and different technical sophistication.
Installers and subcontractors need to confirm product specifications at the point of installation, capture installation photos and measurements, and record their certification credentials against the specific product and location. They are typically working in dusty, wet, and low-light conditions with a smartphone as their primary tool. The interface must be fast, offline-capable, and require minimal data entry. Learn more about how field installers use connected product identity.
Building managers and accountable persons need a consolidated view of all products in the building fabric, upcoming maintenance requirements, and the ability to produce a golden thread report for the Building Safety Regulator without manually assembling records from dozens of contractors. They want a building-level dashboard, not a product-level QR code.
Regulators and fire inspectors need verified, tamper-evident records with full audit trails. They need to be able to confirm that a fire-rated product installed in a corridor is genuinely the product that appears on the approved drawings — not a substituted product with a different fire classification.
Insurers and valuers are increasingly asking for golden thread data as part of building EWS1 assessments and insurance renewals. They need summary-level performance data, not raw installation records.
Recyclers and demolition contractors at end of life need material composition and hazardous substance data to comply with waste regulations and maximise material recovery value.
A construction product DPP platform needs to serve all of these audiences from a single underlying data record, with role-appropriate access controls and presentation layers. This is not a problem that a PDF declaration of performance or a spreadsheet can solve.
The Competitive Landscape
A handful of specialist platforms are already positioning for this market. Cobuilder (Norwegian-origin, now operating across Europe) focuses on structured product data for construction, with strong integration into BIM workflows and the EU Construction Products Regulation. Their strength is in connecting manufacturer data to design-stage product selection. Protokol (UK-based) offers a flexible DPP platform that covers multiple sectors including construction, with good QR-based delivery and data management tools.
What neither of these platforms has built — at least not yet — is a manufacturer-facing Product OS that combines serialised physical identity issuance, post-installation lifecycle management, multi-stakeholder access controls, and built-in GS1 Digital Link compliance in a single no-code platform. That is the gap BrandedMark occupies, and the construction vertical is a natural extension of infrastructure already proven in industrial equipment, PPE, and durable goods manufacturing.
The First-Mover Opportunity
UK manufacturers who establish digital product identity infrastructure now — before ESPR delegated acts are formally adopted — will have a significant advantage on three dimensions.
Commercial differentiation: Specifiers, architects, and main contractors are already asking for golden thread-compatible product data on higher-risk building projects. Manufacturers who can provide a QR-scannable DPP are winning specifications ahead of competitors who cannot.
Remediation market access: The UK external wall remediation programme, driven by the Building Safety Act, involves replacing cladding systems on thousands of residential buildings. Products specified for remediation projects face intense scrutiny on provenance and performance. A robust DPP infrastructure is a commercial prerequisite for this market.
Regulatory readiness: When ESPR delegated acts for construction products are formally adopted, manufacturers with existing DPP infrastructure will face a straightforward data mapping exercise rather than a ground-up system build under deadline pressure.
The window to build this capability ahead of regulatory mandate is closing. Understand the full EU DPP registry requirements that will underpin construction product compliance.
Frequently Asked Questions
Does the Building Safety Act apply to products already installed in existing buildings?
The golden thread requirements under the Building Safety Act primarily apply to new higher-risk buildings and to major refurbishment projects on existing higher-risk buildings. However, the Act also introduced retrospective obligations for existing higher-risk buildings — accountable persons are required to prepare and maintain safety cases, which necessitates gathering information about the existing building fabric. For manufacturers, this creates an ongoing demand for product data even for products already installed, particularly where fire safety systems or cladding are under review.
When exactly will ESPR DPP requirements apply to construction products?
The European Commission's indicative timeline places the first delegated acts for construction products between 2028 and 2030, with energy-related products (including insulation) likely in the 2028 cohort. After a delegated act is adopted, manufacturers typically have 18 to 24 months before the requirement becomes mandatory. UK manufacturers exporting to the EU should plan for mandatory EU DPP compliance on key product lines by 2030 at the latest, and should treat 2027-2028 as the critical infrastructure build window.
How should construction product DPPs handle data that changes after installation — such as inspection results or maintenance records?
This is one of the genuinely novel challenges of construction DPPs compared to consumer product passports. The solution is to architect the DPP as an append-only record: the manufacturer populates the base product data at the point of manufacture, the installer appends installation records at the point of fitting, and the building manager or appointed inspector appends maintenance and inspection records over the product's lifetime. The underlying product identity (the QR code and its resolver) remains constant; the data record grows over time. Platforms like BrandedMark support this model through role-based data write permissions — each stakeholder can add records to a product's history without being able to alter records created by others.
What to Do Now
Construction product manufacturers do not need to wait for ESPR delegated acts to start building DPP infrastructure. The Building Safety Act golden thread requirements are already in force for higher-risk buildings. The commercial demand from specifiers and contractors is already real. And the lead time for implementing serialised product identity across a manufacturing line — label printing integration, QR code issuance, data platform setup — is typically three to six months.
The practical starting point is not a full DPP for every product in your range. It is picking the two or three product lines most exposed to higher-risk building projects — typically fire-rated products, external wall systems, or structural elements — and establishing digital identity infrastructure for those lines first. From that foundation, extending to full DPP compliance as delegated acts arrive is an incremental exercise rather than a crisis response.
BrandedMark handles the full stack: GS1 Digital Link QR code issuance, durable label formats for harsh environments, cloud-resident DPP data management, multi-stakeholder access controls, and built-in compliance with evolving EU ESPR requirements. The platform is already used by manufacturers in adjacent sectors — industrial equipment, PPE, field-serviced equipment — where the same combination of harsh physical environments and long product lifespans applies.
The construction industry has spent a decade arguing about who is responsible for building safety. Digital product identity does not resolve that argument — but it ensures that when the question is asked, the answer is there.