Requirement or tool?

Tool. No law in Great Britain requires a QR code on a fire door or on any other construction product. Where a data carrier appears in legislation it is in the EU: Regulation (EU) 2024/3110 provides for one alongside the construction digital product passport, and that applies to products placed on the EU market and in Northern Ireland.

The UK reform documents published on 25 February 2026 point towards a unique identifier and a data carrier, but that is a direction rather than a duty. We label it EXPECTED. Some certification schemes and many specifiers already ask for scannable identification, which is a scheme rule or a contract term — worth complying with, and worth describing accurately.

What should sit behind the code

A stable URL to a controlled record: what the product is, which version this is, what it claims, what evidence supports each claim, what the limitations are, and when it was last updated. Not a marketing page. Not a link into a shared drive. Not a PDF that was accurate when it was uploaded.

The record needs to answer the question the scanner actually has, which is usually one of three: is this the right product, is this information current, and what am I allowed to do with it?

Design decisions that matter later

The code must not change when the product does. Encode a permanent identifier for the product family and let the record behind it version. If the code encodes a version, every revision obsoletes every label already in the field.

The URL has to outlive the product. A doorset installed today may be scanned in twenty years, by which time your website will have been rebuilt at least twice. Choose a path you are prepared to keep serving, and keep serving it.

Superseded versions should stay reachable rather than being deleted. Someone holding an old label is asking a legitimate historical question, and the honest answer is "this was the record then, here is the current one", not a 404.

What it does not do

A QR code does not certify anything, does not demonstrate that a product meets any requirement, and does not make a record trustworthy. It makes a record reachable. If the record behind it is not controlled, the code has simply made it easier for anyone to find out.