Technical Specification

1. Scope and Purpose

This specification defines the data model, carrier formats, credential protocols, verification mechanisms, and security requirements for Digital Product Passports for Cultural & Quality Goods (DPP-CQ). It applies to products whose value derives from cultural heritage, geographical origin, craftsmanship, or quality attributes.

This is version 2.0.0-draft of the specification, reflecting feedback received during the first public review period (Jul 6 – Aug 20, 2026) and incorporating six major enhancements for broader interoperability and compliance coverage.

2. Normative References

The following standards and specifications are referenced by this document:

• W3C DID Core — Decentralized Identifiers (DIDs) v1.0
• W3C VC Data Model v2.0 — Verifiable Credentials Data Model 2.0 (W3C Recommendation, May 2025)
• IETF RFC 9529 — SD-JWT-based Verifiable Credentials (SD-JWT VC)
• GS1 Digital Link — GS1 Digital Link URI Syntax Specification
• EN 18220:2026 — EU DPP horizontal standard: Data carriers
• ISO 14067:2018 — Greenhouse gases — Carbon footprint of products
• EU AI Act Art.50 — Transparency obligations for AI systems
• GB/T 47507-2026 — AI assessment transparency standards
• GM/T 0009 — SM2 cryptographic algorithm specification
• GM/T 0004 — SM3 cryptographic hash algorithm
• GM/T 0002 — SM4 block cipher algorithm

3. Terms and Definitions

For the purposes of this document, the following terms apply:

• DPP (Digital Product Passport) — A structured dataset associated with a product, accessible via a data carrier, containing information about the product's identity, provenance, quality attributes, and sustainability characteristics.
• DPP-CQ — A DPP specifically designed for Cultural & Quality goods, extending standard DPP frameworks to capture cultural heritage, craft provenance, and quality dimensions.
• Issuer — An entity that creates and signs verifiable credentials for a product passport.
• Verifier — An entity that validates the authenticity and integrity of a product passport.
• Holder — An entity that possesses and presents verifiable credentials.
• Carrier Tier — Classification of physical data carriers (L1: Open QR, L2: SDM Secure NFC, L3: Tamper-evident NFC).

4. Core Data Model

The DPP-CQ data model is expressed as a JSON-LD structure conforming to the W3C Verifiable Credentials Data Model v2.0. It extends the base DPP schema with cultural and quality-specific fields.

4.1 Base Structure

4.2 Cultural Fields

The data model includes dedicated fields for cultural heritage documentation, including intangible cultural heritage listing status, craft technique classification, and geographical indication registration details.

5. Carrier Specification

DPP-CQ defines three carrier tiers aligned with EN 18220:2026 requirements:

5.1 L1: Open QR

Standard QR codes encoding a GS1 Digital Link URI or HTTPS URL pointing to the credential. Zero marginal cost, universally scannable. Suitable for mass-market consumer products and informational access.

5.2 L2: SDM Secure NFC

NTAG 424 DNA class (or equivalent) NFC tags with Secure Digital Message (SDM) capability. Each tap generates a unique encrypted URL with a rolling code, preventing cloning and replay attacks. Suitable for premium products and heritage-grade items.

5.3 L3: Tamper-evident NFC

NFC tags with integrated tamper-evident mechanisms. Physical destruction of the tag is detectable and invalidates the credential. Suitable for forensic-grade verification, judicial evidence chains, and high-value cultural artifacts.

6. Credential Formats

v2.0 supports dual credential formats to accommodate different implementation preferences and regulatory environments:

• BBS+ Signatures — Enable selective disclosure and zero-knowledge proofs at the claim level. Ideal for privacy-sensitive scenarios.
• SD-JWT VC (IETF RFC 9529) — JSON Web Token with selective disclosure. Simpler implementation, broader tooling support, suitable for standard verification flows.

Both formats resolve to the same semantic data model and are interoperable at the verification layer.

7. Interoperability Requirements

DPP-CQ is designed for interoperability with:

• GS1 Digital Link — Native URI structure compatibility for supply chain integration
• W3C DID/VC ecosystem — Standard DID resolution and VC verification flows
• EU DPP (EN 18xxx family) — Semantic alignment with EN 18216, EN 18219, EN 18220, EN 18221, EN 18222, EN 18223
• UN/CEFACT UNTP — Alignment with UN Transparency Protocol for upstream B2B trade

8. Security Model

The security architecture follows defense-in-depth principles:

• Cryptographic credential signing (EdDSA, ES256, or SM2)
• Status list revocation (BitstringStatusList)
• Carrier-level anti-cloning (L2/L3)
• Hash cross-border architecture (data localization, hash-only global resolution)
• Chinese cryptography optional (SM2/SM3/SM4 for regulated deployments)

9. Privacy & Zero-Knowledge Proofs

DPP-CQ implements privacy-preserving verification using zero-knowledge proof mechanisms:

• Selective disclosure — Verifiers see only the claims they need (e.g., "origin: France" without revealing the specific address)
• Predicate proofs — Prove a value falls within a range without revealing the exact value (e.g., "age > 50 years" without revealing exact age)
• Holder binding — Credentials can be bound to a specific holder to prevent unauthorized presentation

10. Sustainability Module

The optional sustainability module enables carbon footprint and environmental impact claims aligned with ISO 14067. This allows cultural products to communicate their environmental performance alongside provenance attributes.

11. AI Assessment Transparency

When AI systems are used for quality assessment, authenticity verification, or grading, DPP-CQ requires transparency disclosures aligned with:

• GB/T 47507-2026 (Chinese national standard for AI transparency)
• EU AI Act Article 50 (transparency obligations)

Credentials must include metadata indicating whether AI was used in assessment, the model type, confidence scores, and human oversight mechanisms.

12. Compliance Mappings

DPP-CQ provides reference mappings to relevant regulatory frameworks:

• EU ESPR (Regulation 2024/1781) — DPP framework compliance
• EU Battery Regulation 2023/1542 — For battery-adjacent cultural products
• EN 18xxx family — Horizontal DPP standard alignment
• UN/CEFACT UNTP — Trade facilitation compatibility

Full Document on GitHub

The complete, machine-readable specification with JSON schemas, example credentials, and normative text is maintained in our GitHub repository: