Avoid 2028 ESPR Audits: 5 Chain of Custody Steps for Fashion Brands

Chain of custody is the auditable record proving where and how the fibers in a garment moved, who touched them, and why. It's what lets you legally claim a product is organic cotton, recycled polyester, or Better Cotton without a regulator or auditor calling your bluff. The immediate move for any brand behind on this: start fiber-forward mapping now and pick a chain of custody model before you write another sustainability claim.

TL;DR:

• Packaging chain of custody involves tracking fibers from source to finished product, with documentation at each transfer point to ensure legal claims.
• The preferred models are segregation for the strongest claims, mass balance for efficiency, controlled blending, and controlled mass balance, each with different operational costs.
• Digital product passports depend on comprehensive batch records, supplier certificates, and source data, which must be maintained from design through production for compliance.
• Most failures happen during fiber conversion, especially pooling at spinning stages, making proper documentation at these steps critical for audit success.
• Centralized platforms like DPP Grid help organize evidence for audits but do not certify product legal compliance or guarantee that claims meet regulatory standards.

• What Is Chain of Custody in Fashion, and Which Model Fits?
• How Chain of Custody Feeds Digital Product Passports Under ESPR
• How Do You Build a Usable Chain of Custody Program?
• What Breaks a Chain of Custody, and What Do Auditors Check?
• How a Digital Product Passport Platform Centralizes the Evidence
• Why Traceability Has to Start in Product Design, Not IT
• Get Your Chain of Custody Evidence Audit-Ready
• Where to Verify These Chain of Custody Rules Yourself
• Sources
• FAQ

Chain of custody in fashion means tracking a material claim from farm or recycler through spinning, weaving, cutting, and sewing, with documentation at each handoff. Get this wrong and a "100% organic" label becomes a legal liability rather than a selling point. Four models dominate textile supply chains, and each one determines what you're legally allowed to print on a hangtag.

Segregation keeps certified material physically apart from conventional material at every stage, whether it stays within one country or crosses borders (multi-country segregation).

Mass Balance allows certified and non-certified material to mix during processing, as long as the total volume of certified input matches the volume claimed on outputs. You can say the equivalent volume of certified cotton entered your supply chain.

Controlled Blending permits a defined, limited percentage of certified material to blend with conventional material under controlled conditions, producing an output with a fixed, disclosed certified percentage.

Controlled Mass Balance applies volume accounting rules within a bounded, monitored system rather than across an entire company's book of business.

Better Cotton's chain of custody standard documents Mass Balance, Controlled Blending, and both segregation types with specific recordkeeping rules for each. The trade-off is consistent across all four: segregation gives you the strongest claim but the highest operational cost, since separate storage, separate machinery runs, and separate batch tracking all cost money conventional pooling avoids.

Every batch record, transaction certificate, and origin statement you collect for a certification claim is also raw material for a Digital Product Passport. The EU's Ecodesign for Sustainable Products Regulation treats DPPs as the mandatory disclosure mechanism, and textile-specific requirements are expected to land through a delegated act around 2027, with mandatory DPPs likely arriving roughly eighteen months later, putting real enforcement around 2028 to 2029.

That timeline sounds distant until you map what a DPP actually needs: fiber composition, recycled content percentage, country of origin, the identity of economic operators involved in manufacturing, restricted substance disclosures, and increasingly, a carbon footprint figure. Every one of those data points either comes directly from your chain of custody records or can't be substantiated without them.

The European Commission's technical study on textile DPP content confirms the DPP will be accessible through a data carrier, typically a QR code, and that manufacturers or importers placing goods on the EU market must register each passport and maintain a verifiable link between the digital record and the physical product. That registration requirement means the batch-level data you're gathering for certification today has to survive in a format that maps cleanly to a specific product, not just a general claim about your supply base.

Building chain of custody from scratch feels overwhelming until you break it into sequential steps. Here's the order that actually works:

1. Map fiber-forward from the source. Start at the raw material tier, not the factory gate. Assign a unique batch ID or digital token to each lot of fiber the moment it enters your supply chain, so weight and composition stay auditable through every conversion point rather than reconstructed later from memory.
2. Set minimum evidence requirements for suppliers. Define exactly what you need before you accept a shipment: transaction certificates, invoices tied to specific lots, and signed origin statements. Write data-delivery clauses directly into supplier contracts so this isn't a favor they do you.
3. Choose your model per product line. Decide where segregation is worth the cost and where mass balance is acceptable, then record production-batch accounting consistently so conversion factors and output quantities reconcile with input volumes.
4. Ingest and validate data systematically. Pull supplier documents in through Shopify, CSV, or API feeds, use AI-assisted checks to flag missing fields or mismatched quantities, and route anything questionable to a human reviewer before it becomes a published claim.
5. Archive everything with version history. Keep dated, versioned evidence files rather than overwriting old records, because an audit will ask what you knew and when you knew it.

For a mid-size brand with a few hundred SKUs, expect three to six months to get fiber-forward mapping and supplier contracts in place, plus ongoing time each season to onboard new suppliers into the same format.

Pro Tip: Don't wait for your first audit to discover your spinning mill breaks the chain. Ask every supplier now for their own chain of custody documentation upstream of you, not just their finished-goods invoice.

Most chain of custody failures happen at conversion points, not at the farm or the factory floor. Spinning-stage breakage is the most common and most underestimated risk: raw fiber arrives with a clean certification trail, gets pooled with conventional fiber at the spinner, and the traceability link simply disappears. Recycled-content claims are especially vulnerable here, since maintaining documentation through yarn and fabric conversion points is exactly where brands lose the thread.

Other frequent failings include missing batch-level records at the manufacturing tier, and footprint claims built on industry averages instead of measured site data, which creates exposure once ESPR audits start checking actual energy and water metering rather than estimates.

Auditors generally want to see:

• Transaction certificates connecting specific sellers, buyers, and quantities of certified material.
• Production-batch logs showing input volumes, output volumes, and the conversion factor applied between them.
• Signed supplier declarations and a documented retention policy for how long records stay accessible.
• A clear map of which sites in your supply chain actually hold certification, since claims can't extend beyond certified scope.

A brand can hold a valid certificate at the farm level and still fail an audit at the cutting table, because certification scope rarely covers every site a garment passes through.

Contract language that requires suppliers to flag any subcontracted processing step closes off one of the most common gaps before it becomes an audit finding.

Once you're collecting transaction certificates, batch logs, and supplier declarations across dozens of suppliers, spreadsheets stop working. This is the operational gap a platform like DPP Grid is built to close: importing product data from Shopify, CSV, or API, collecting supplier documents in one place, and using AI to extract fields like fiber content or origin while a human reviewer approves each piece before it publishes.

The output is a permanent product-passport page with a QR code, holding evidence at the model, batch, or individual-item level, with full version history so you can show an auditor exactly what changed and when. What it won't do is certify you're legally compliant. It organizes and preserves the evidence; the certification and legal judgment still belong to you and your certifying bodies.

Most brands treat chain of custody as a data problem to solve after the fact. It's actually a product-design and labeling decision that has to happen before a garment goes into production, because the ESPR requires a data carrier physically linked to the item itself. If you're not planning batch IDs and supplier data formats at the design stage, you're building a passport for a product that was never built to carry one.

The brands getting this right treat supplier onboarding as collaboration, not enforcement. Punitive, audit-only relationships produce worse data than shared formats and clear expectations set upfront. That's worth internalizing before your next supplier contract renewal.

— Vytautas

Chasing supplier documents across email threads and shared drives is the single biggest reason chain of custody claims fall apart under scrutiny. DPP Grid gives you one place to pull it all together: import your catalog from Shopify, CSV, or API, collect certificates and origin statements directly from suppliers, and let AI extract the details while your team reviews and approves before anything goes live.

Independent fashion brands, Shopify merchants, and importers selling into the UK and EU tend to see the fastest payoff, since they're usually juggling the most suppliers with the least standardized paperwork. Once your evidence is organized, publishing a QR-linked passport page for each product becomes a formality rather than a scramble. Read the practical guide to preparing DPP data for fashion brands, or start a trial to see how your own supplier documents look once they're centralized.

Check the European Commission's textile apparel page for ESPR timelines, the JRC technical study for DPP data requirements, Better Cotton's standard for model definitions, and ISEAL's guidance for cross-standard baselines.

• Textile apparel - European Commission
• Study on DPP content for textile apparel products under ESPR - JRC (European Commission)
• Physical Chain of Custody Models - Better Cotton Initiative
• Chain of custody models and definitions guidance - ISEAL

It's the documented, auditable trail showing how a material claim (organic, recycled, certified) moved from its source through every processing stage to the finished garment, without breaking the link between the certificate and the physical product.

Mass Balance, Segregation (which can be single-country or multi-country), Controlled Blending, and Controlled Mass Balance, each defined in detail by Better Cotton's chain of custody standard.

It supplies most of the raw data a Digital Product Passport needs, including fiber composition and origin, but a DPP also requires a registered data carrier like a QR code and a verified link to the specific product.

No. DPP Grid centralizes supplier evidence and publishes passport pages with QR codes, but certification and legal compliance decisions remain with your certifying bodies and legal counsel.

• Clothing Digital Product Passport: A 2026 Guide
• Fashion Digital Product Passport: 2026 Guide
• What Is Chain of Custody and Why It Matters in 2026