Analysis

Hidden Dependencies

Dependence on external suppliers is unavoidable, but there are certain goods and sectors (such as energy) where dependence has become a vulnerability that undermines sovereignty. While this may also be a natural consequence of a free trading environment, the issue is that identifying these vulnerabilities often comes too late, with critical supply chain weaknesses only becoming apparent in times of crisis. By this point, the damage has already been done, and a reactive policy can at best merely mitigate the fallout.

“By this point, the damage has already been done, and a reactive policy can at best merely mitigate the fallout.”

A finished product can hide a reliance on a narrow set of suppliers for one component. A European firm may assemble final goods, yet depend on vital inputs that come from a small number of non-European producers. Aggregate trade data can show that Europe imports a category of goods, but it is too blunt a tool to reveal the vulnerable point inside the product itself. It is valuable data for sector-level policy, but more precise data is required to identify where targeted interventions (such as supplier diversification or domestic subsidies) would be most effective.

“A finished product can hide a reliance on a narrow set of suppliers for one component.”

DPPs, or Digital Product Passports, narrow down data from broad trade flows into product-level information. The European Commission defines such passports as a product-specific dataset that can be accessed electronically and used to share product information between firms, authorities, and consumers. The EU introduced DPPs mainly as a tool for sustainability, as part of its circular economy policy framework. Yet, the same information infrastructure can also serve a strategic purpose. Properly designed, DPPs have the potential to serve at the forefront of Europe’s de-risking agenda, identifying specific exposed parts of a product’s chain before they become disruptive to the Single Market.

“Aggregate trade data can show that Europe imports a category of goods, but it is too blunt a tool to reveal the vulnerable point inside the product itself.”

What DPPs Are

A Digital Product Passport is best understood as a digital identity card for a product. It hosts a detailed record of what the product is made of and where and when its internal materials were manufactured. This information is usually accessed through a digital carrier, such as a QR code or another identifier.

Originally, the EU’s DPP agenda was developed through the Circular Economy Action Plan and the Ecodesign for Sustainable Products Regulation. The battery passport is the clearest early model. It is expected to include information on the manufacturer, battery composition, critical raw materials, durability, and access rules for different users. Such information is invaluable for policy addressing supply chain vulnerabilities. DPPs already have supply chain use cases linked to traceability and compliance management. 82 use cases suggest that DPPs are already being tested as a way to improve compliance with sustainability regulations, meaning implementing a supply chain resilience function would be fairly straightforward.

The EU Cannot Fix What It Cannot Identify

The EU’s self-reliance agenda depends on the quality of the information behind it. Before policymakers can reduce a dependency, they need precise data on where exactly a vulnerability exists within a supply chain, along with the firms that would be most affected by a potential disruption. This sounds obvious, but current policy tools often operate under incomplete information. DPPs would be most useful as a way of identifying supply chain weaknesses before they become visible through crisis, when it’s already too late.

“The EU cannot fix what it cannot identify.”

For example, consider how DPPs could have identified our gallium and germanium dependence on China. Both are critical inputs in semiconductors and other advanced technologies. Yet China’s 2023 export controls, which imposed licensing requirements for both minerals’ exports, showed how a concentrated input can become a strategic vulnerability overnight. The Commission could have identified the supply as highly concentrated in China and which European products rely on these materials. Policy support could then have been directed toward the exposed component through, for example, subsidising local production or diversifying the range of suppliers. Rather than waiting for a shortage to reveal a vulnerability the hard way, DPP data would help identify said vulnerability, turning industrial policy more proactive while there is still time to act.

AI-assisted Early Warning

DPP data will become valuable only if the EU can implement it at scale. AI and machine learning could become crucial here, provided their role remains limited and accountable. AI would not replace policy judgement but would scan large datasets for patterns and make predictions that humans may miss. The level of detail that DPPs provide means the sheer quantity of data will be overwhelming to a human analyst. This means AI can be used not only to analyse datasets more efficiently, but could also use the vast data available to make complex models and predictors with very precise policy implications.

For example, a tailored AI-assisted tool could flag when multiple strategic goods rely on the same component from one region. It could identify repeated supplier concentration across sectors, predicting the economic impact of a potential supply shock. It could also detect when a disruption in one product chain may affect other industries. The EU should treat this as an early warning function. DPP data could feed a secure dashboard for the Commission and Member States. AI tools would identify possible risk patterns, after which policymakers would assess whether those patterns require a policy response.

Risks and Limitations

Poor data produces poor policy. If suppliers provide incomplete information, the EU may gain the illusion of visibility without any real insight. This is especially likely in global supply chains where non-EU suppliers may resist disclosure. Supply chain transparency is also politically complicated. Firms often disclose some information while withholding other details. For example, a study of Nudie Jeans found that transparency can become selective, especially when disclosure threatens commercial relationships or exposes sensitive supplier information. A digital passport will not automatically solve the transparency problem if firms can decide too freely what counts as relevant data.

“Poor data produces poor policy.”

The EU therefore needs to distinguish between public transparency and institutional visibility. Consumers do not need access to every supplier relationship. Competitors should not gain access to commercially sensitive information. Public authorities, by contrast, need enough standardised information to detect where supply chain risk is concentrated. A DPP system that balances these needs would be more politically realistic than full public disclosure. It would also be more useful for policy design. Interoperability is equally important. DPP systems must be coherent across EU initiatives and compatible with other systems where possible. If every sector builds its own system, DPPs will become fragmented databases rather than a usable policy tool.

Policy Framework

The Commission should begin by adding a supply chain risk layer to DPP rules under the Ecodesign for Sustainable Products Regulation and related sectoral legislation. This layer should be narrow enough to avoid overburdening firms, but with enough detail to inform policy. The minimum dataset should cover component origin, location of major production stages, supplier concentration, and the difficulty of replacing critical inputs. This information should feed directly into EU economic security work. The EU Observatory of Critical Technologies should use DPP data to identify recurring dependency patterns across sectors. DG GROW (the EU Commission’s industry department) should then connect these findings to industrial policy instruments, especially where DPP data reveals a repeated lack of European production capacity. Implementation should start through pilots. For example, a battery sector pilot could test whether DPPs help policymakers identify dependence on specific critical minerals or foreign processing capacity before those weaknesses affect electric vehicle supply chains.

A tiered access model should guide the whole system. Public authorities should receive the data needed to map risk under strict confidentiality rules. Firms should not be forced to publish commercially sensitive information to competitors. The EU should also support capacity-building for firms that lack the technical capacity to implement DPP requirements, especially smaller enterprises, which may need technical guidance. Reporting obligations should be proportionate, with lighter information requirements for firms whose products are not part of strategically important supply chains. Finally, the Commission should test AI-assisted analysis on DPP datasets. These tools should flag possible vulnerabilities and make predictive models, not make policy decisions.

Conclusion

DPPs will not remove Europe’s strategic dependencies by themselves. Their value is in how they can inform policy design by helping the EU see where dependencies are hidden and cementing a proactive industrial policy. If the Commission designs DPPs with supply chain resilience in mind, they can become a practical foundation for sharper industrial policy and earlier crisis detection. Europe cannot make policy responses blindly. It first needs to know precisely where the risk is.

“Europe cannot make policy responses blindly. It first needs to know precisely where the risk is.”