Under Art. 18 of the EUDR (Regulation (EU) 2023/1115), competent authorities may examine commodities on the ground, use technical and scientific analysis, including isotope testing, to determine where a commodity was produced, and use Earth observation data such as Copernicus imagery to test whether products are deforestation-free. Medium and large companies placing cattle, cocoa, coffee, oil palm, rubber, soya and wood products on the EU market face binding application from 30 December 2026. Products newly added to Annex I in 2026 follow from 30 December 2027. Authorities have a defined evidence trail to audit against.

EUDR audit exposure clusters around five preventable weaknesses: imprecise geolocation data, thin legality evidence, superficial risk assessments, broken supplier traceability, and Due Diligence Statements filed without a reproducible file behind them. Each maps to a specific obligation in the Regulation, and each has a documented best practice.

Where EUDR evidence trails break down

Compliance exposure sits inside the three-step due diligence process: information collection, risk assessment and risk mitigation. The Commission's Guidance is explicit that certification and third-party verification schemes support this process but do not replace it. An audit tests the file and evidence, not the certificate.

Plot checks can extend beyond the EU. Art. 18 allows field audits in third countries where those countries agree to cooperate through their local authorities. Upstream data cannot hide behind distance.

Every review tests three conditions. Products may be placed on the EU market, made available or exported only if they are deforestation-free, produced in accordance with the relevant legislation of the country of production, and covered by a due diligence statement. The cut-off date of 31 December 2020 anchors the first condition. Commodities must come from land not deforested after that date, and wood must also be harvested without causing forest degradation after it. Every geolocation and every risk conclusion in the file has to reconcile with that date. Legality evidence is assessed against the law of the country of production.

{{product-tour-injectable}}

Geolocation gaps that undermine the audit file

Geolocation is the most common failure point in an EUDR audit file. The EUDR requires operators to exercise due diligence for cattle, cocoa, coffee, palm oil, rubber, soy and wood and their Annex I derivatives. Partial coordinate coverage is not treated as mostly compliant; if part of the batch is not covered by valid coordinates, the whole batch is considered uncovered.

Geolocation quality has an external reference. Because the EUDR as amended by Regulation (EU) 2025/2650 permits authorities to cross-check coordinates against Copernicus imagery (Art. 18(2)(d)), a polygon that overlaps land cleared after 31 December 2020 is visible in the same datasets the authority uses. Best practice is to validate polygons against the deforestation baseline before the DDS is submitted. Check them at the same time against protected-area and indigenous-territory layers, because an overlap there is a legality red flag even where no deforestation occurred.

Coolset's guide to EUDR supplier tiers works through how to structure that intake across upstream levels.

Legality documentation gaps

Legality evidence fails audits when operators hold generic country-level assurances instead of plot-specific proof of the permits and rights that authorize production. A supplier attestation that all applicable laws are respected does not satisfy the requirement, because it names no permit, registry or issuing authority the auditor can verify.

The Commission's Guidance provides direction on performing due diligence, including legality, and does not allow certification to replace it. Auditors expect a documented chain from the producing plot to the legal instrument that authorizes production in that jurisdiction. 

Best practice is a per-country legality matrix. For each producing jurisdiction, the matrix names the specific permits, land titles, tax records and third-party consents the file must contain, along with the cycle on which each item is refreshed. Coolset's guide to EUDR legality evidence works through the categories in detail.

The Commission plans to publish a repository of relevant country legislation on a dedicated website by December 2026. It is a useful starting point for building the matrix. It does not replace the operator's own verification of plot-level evidence.

Risk assessments that do not survive scrutiny

Risk assessments fail audits when they inherit the Commission's country benchmarking classification without applying it to the specific supply chain. Under Implementing Regulation (EU) 2025/1093, most producing countries are classified as low or standard risk. Where all commodities come from low-risk countries, Art. 13 allows simplified due diligence. The operator must still collect the full Art. 9 information, but need not carry out a risk assessment or mitigation. That relief ends when the operator obtains or is made aware of information pointing to a risk of non-compliance or circumvention. An audit-ready file therefore shows that the operator checked for those signals, not just that the country was listed as low risk.

The Commission's guidance covers how to perform due diligence, including risk assessment, and confirms that third-party verification does not substitute for the operator's own analysis. For standard- and high-risk sourcing, negligible-risk conclusions need reasoned justification that names the evidence and the assessor.

Best practice is a structured risk file per supplier and commodity, versioned so that reassessments over time can be reconstructed. Where risk is not negligible, the same file should also record the mitigation measures triggered before the DDS was submitted.

Supplier data and DDS submission failures

Traceability breaks when operators cannot link a downstream product batch to the specific upstream DDS reference numbers. The Commission's EUDR Information System page describes the EU information system, built on the TRACES platform, that operators, traders, authorities and customs share to submit and exchange those statements.

The EUDR requires due diligence records, including supporting documents such as invoices and DDS reference numbers, to be kept for five years and made available on request. For cattle and beef products, geolocation must cover every establishment where the animals were kept during their lifetime, not just the final farm. A shipment file that cannot be assembled on demand is not compliant, regardless of what sits in individual folders.

The amended version of the EUDR updates the definition of operator and creates two new categories that redistribute obligations across the supply chain. Operators should review where their entities now sit under the revised definitions before assuming existing role assignments still hold.

Best practice is a single system of record. Supplier submissions, geolocation files, legality evidence and DDS references should be versioned per shipment and retrievable in one place. Coolset's guide to EUDR mixing and circumvention risk covers reconciliation for blended and aggregated supply chains. For cattle and beef, where geolocation must cover every establishment in the animal's lifetime, Coolset's cattle traceability guide documents the reference architecture.

{{custom-cta}}

Building an audit-ready EUDR operating model

An audit-ready operating model organizes work around the three due diligence pillars set out in the Commission's Guidance: information collection, risk assessment and risk mitigation. Assigning a named owner to each pillar gives every audit query a clear route to the person who holds the evidence.

Supplier engagement belongs inside that model as a compliance control. Contractual data clauses, onboarding gates and periodic re-verification cycles keep supplier data flowing on the operator's schedule rather than during a live audit.

The Commission's guidance and FAQs are updated regularly and cover geolocation, traceability, product scope, the information system, timelines and penalties. Coolset's overview of what auditors will verify in December 2026 maps those requirements to the most common gaps in operator files.

How EUDR sits alongside CSDDD and the simplification review

Operators subject to broader due diligence law should treat EUDR as the binding standard for products in scope. The Commission's 2026 Guidance confirms that the Corporate Sustainability Due Diligence Directive (CSDDD) sets the general due diligence framework, while the EUDR is the sectoral framework for deforestation. Where the two conflict, EUDR applies as lex specialis. CSDDD obligations do not apply until July 2029, so for the 2026 audit cycle EUDR is the binding standard for in-scope products.

The Commission's simplification review, published on 4 May 2026, closed the question of further legislative change for now. The Commission chose not to reopen the Regulation. It delivered the simplification through implementation measures instead: an updated Guidance Document, a revised FAQ, an amended Annex I and an updated Information System. The application dates are unchanged. For audit readiness, the practical takeaway is that the obligations tested in December 2026 are settled, and operators should not plan around a further delay.

Where to focus before 30 December 2026

Focus on the intake side of the process first. The file quality that determines the audit outcome is set at supplier onboarding and data capture, well before any Due Diligence Statement reaches TRACES. Starting there converts the five weaknesses into fixable data problems rather than late-stage compliance emergencies.

Frequently asked questions

When does EUDR enforcement start?

Medium and large companies, and micro and small undertakings in the timber sector, must comply from 30 December 2026. Other micro and small undertakings must comply from 30 June 2027. Products newly added to Annex I by Delegated Regulation (EU) 2026/2102 come into scope from 30 December 2027.

Which commodities are in scope of EUDR?

The EUDR covers cattle, cocoa, coffee, oil palm, rubber, soy and wood, together with the derived products listed in Annex I. Annex I was updated pursuant to Commission Delegated Regulation (EU) 2026/2102. It removed cattle hides, skins and leather and certain vulcanised rubber articles, and narrowed entries such as tyres and soya beans for sowing. It added products including soluble coffee, certain palm oil derivatives and soaps, which come into scope from 30 December 2027. Check your CN codes against the amended Annex I.

How do EUDR and CSDDD interact?

The Commission's Guidance confirms that CSDDD is the general due diligence framework and EUDR is the sectoral one for deforestation. Where the two conflict, EUDR prevails to the extent it sets more specific obligations pursuing the same objective. CSDDD applies from 26 July 2029.

What is the deforestation cut-off date?

Products must come from land that has not been deforested after 31 December 2020. For wood, the harvest must also not have caused forest degradation after that date. Every geolocation and every risk conclusion in the file has to be reconciled with that date.

Can certification replace due diligence?

No. The Commission's Guidance acknowledges the role of certification and third-party verification schemes but does not allow them to replace the operator's own due diligence process.

‍