Supplier Compliance
The Compliance Loop That Ran Over Email Now Runs Inside the Platform.
Digital Product Passport (DPP)

A Digital Product Passport is a scannable record on a garment. It shows the material, who made it, what it's made of, how it was repaired. The EU is making these mandatory for all textiles. But when I started building this, the EU hadn't finished writing the rules yet.
The real problem wasn't a missing feature. It was this: how do you design a system for a regulation that doesn't exist? The rules could change. The data fields might shift. The filing format is unknown. But brands need to start now.
I built this for 10 fashion brands across their processing facilities, headquarters, and stores. TrusTrace has since shipped 15,000 live passports. The lesson wasn't about design execution. It was about operating under radical uncertainty.
Fashion brands are collecting worn garments, repairing them, and reselling them. Good for the environment. But now they need to prove it. They need a digital record showing the garment's whole story — from factory to repair to retail.
The EU says this is mandatory. The due diligence statements brands file with customs, the chain of custody proof, the material composition. All of it needs to be structured, verified, and traceable.
The problem isn't the data. Brands have it. They have facility records, repair notes, shipping logs. The problem is that this data lives in spreadsheets, facility logs, emails. None of it is validated. None of it is linked to a specific garment. And none of it is structured for a regulator to trust.
Publishing unvalidated repair data is not a UX problem. It's a legal liability. A brand publishes a garment's passport. A regulator checks it. The data doesn't match what actually happened in the facility. Now the brand is defending falsified documents to customs. That's the constraint that drove every design decision.

The EU's Ecodesign for Sustainable Products Regulation entered into force in July 2024. It establishes the framework for digital product passports. But the product-specific delegated acts — the actual data field requirements — are still being written. I had to design for something that didn't exist yet.
This is the core decision. I could wait — build after the rules are final, play it safe. But that means every vendor waits too. The moment the regulation is published, hundreds of SaaS companies start building simultaneously. Brands that waited are building from zero at the exact moment competition is highest.
Or I build now. Run pilots. Learn how brands actually process garments. Let the architecture adapt when the rules arrive. That's the bet I made. I was designing in 2021. The regulation lands in 2028. The mandatory deadline is 2029. That's an 8-year gap — and either I build early and iterate, or I wait and rush at the last moment.

1
The Rules Don't Exist
Every decision was made against incomplete information. The data fields might change. The filing format is unknown. The compliance requirements could shift. I was designing for a ghost.2
Three Environments, Three Teams
The garment moves through a facility (wash, repair, ship), then through a brand's HQ (QA, approval, publishing), then to a retail store (sale). Each location has different users, different devices, different pressures. One system had to work everywhere.3
Speed Versus Trust
Processing facilities run on throughput. Fast matters. But a published passport is a legal document. Speed and trust usually fight each other. I had to make them work together.01Core Decision
Build now and I sacrifice certainty. The regulation could change. I might build features that become irrelevant. I might choose a data structure that the final rules reject. That's real risk.
Wait for the rules and I get clarity. But I'm building 6 months before the deadline. Everyone else is too. I'm in the deepest competition at the most time-pressured moment. I lose the learning advantage.
I chose to build now. The strategy was simple: run the system with 10 brands in production. Learn how they process garments, where the friction is, what data actually flows. When the regulation lands in 2028, the system is 75% ready. The remaining 25% I adapt based on whatever the final rules say. That 75/25 split was intentional.
Vendors who wait are building from zero when the regulation drops. I'm iterating from a live system with real data and real brands. The learning gap is years, not months. By 2029 when mandatory compliance hits, I've had 4 years of operational feedback. They have 18 months from regulatory clarity to market readiness.
Tradeoff:
Gain → 4 years of operational learning before the mandatory deadline — iterating from a live system, not building from zero under pressure
Cost → Built against incomplete rules — structural rework was a real risk if the regulation landed differently
02Lifecycle Design Decision
Parallel processing seems faster. A repair team waits for washing confirmation — parallel entry would eliminate that wait. Throughput improves. Everyone's happy.
But here's the catch. A garment in parallel processing can exist in states that don't match physical reality. Marked shipped before repair is even documented. Marked repaired, never washed. Those data states don't exist in the real world. But they exist in the system. When that garment is published to a regulator, the data lies.
I enforced sequential progression. One state at a time. Wash completes. Then repair. Then ship. Then cost. Teams work in parallel across different garments, but each individual garment has one physical path. The system models what actually happened, not what the org chart allows.
Tradeoff:
Gain → Every passport reflects physical reality — legally defensible because data matches what actually happened
Cost → No parallel logging — teams wait for each stage to close before the next opens

03Governance Decision
Automation seems obvious. A garment clears quality check — automatically publish the passport. Eliminate delays. Reduce admin burden. Everyone processes faster.
But publishing a passport means a brand is making a legal assertion. This garment is made of these materials. It was repaired in this way. Here's the proof. A regulator might challenge that assertion. An audit might question it. When that happens, someone has to explain the decision.
If the system auto-published based on data alone, there's no decision to defend. No human looked at it. No one approved it. That's indefensible in a regulatory context.
I kept the human gate. An admin reviews and approves in batch before publication. That introduces friction and delays. But it's intentional friction. It preserves the accountability that makes the document legally sound.
Tradeoff:
Gain → Every passport has an accountable human approval behind it — defensible when a regulator challenges the record
Cost → Batch approval adds delay — publication waits on admin review, slowing throughput at scale




The system proved itself at scale with real brands. Then the 75/25 bet paid off. The regulation is still not finalized. And I'm years ahead of competition.
10 fashion brands ran this system in production. Processing facilities in 3 countries. Repair centers, headquarters, retail stores. The data flowed. The governance structure held. Brands could publish passports that a regulator would accept.
TrusTrace shipped 15,000 live passports with these brands — Kappahl, Marimekko, Gina Tricot, ETON. They're doing this now, before the rules even exist. In 2028 when the regulation lands, they don't start from zero. They adapt.
Gartner named TrusTrace a representative provider for DPP in 2025. Not because we built the only one. But because we had operational depth that others didn't.
What Worked
What I'd Approach Differently