Under the EU Deforestation Regulation (EUDR), companies are required to conduct mandatory due diligence before placing regulated commodities on the EU market or exporting them from it. 

The aim is clear: ensure that products are deforestation-free, legally produced, and properly documented. Article 3 of the regulation sets the core requirements, which in practice means businesses must demonstrate three things: The product was not sourced from land deforested after the cut-off date. It was produced in compliance with applicable laws in the country of origin. It is covered by a valid Due Diligence Statement (DDS).

This guide explains what that means in practice, what information must be collected, and how the process works across different company types and supply chain roles.

Who must carry out due diligence?

The obligation to conduct due diligence falls primarily on operators — the companies that first place a regulated product on the EU market, or that export regulated products from the EU. This includes importers and EU-based manufacturers who are first in line in the supply chain.

Following the adoption of Regulation (EU) 2025/2650 in December 2025, a new category of downstream operators was introduced. Downstream operators place products on the market using commodities already covered by an upstream DDS. They are explicitly exempt from submitting their own DDS and from conducting due diligence. Their obligation is limited to passively collecting and retaining reference numbers from their direct upstream supplier.

Traders — companies that buy and resell products already on the EU market — also do not submit a DDS. They retain traceability records and pass on reference numbers if their direct supplier is an upstream operator.

The three-step due diligence process

Step 1: Collect information (Article 9)

Operators must gather the following information for each product before placing it on the market:

• Product description: commodity type, CN/HS code, trade name, quantity
• Country of production and the specific region or district
• Geolocation of all plots of land where the relevant commodity was produced (GPS coordinates in GeoJSON format), or all establishments for cattle
• Date or time period of production
• Name, address, and contact details of the supplier to the operator
• Name, address, and contact details of the operator’s direct customer (where the operator makes the product available on the market)
• Adequate and conclusive information that the commodity or product complies with the applicable legislation of the country of production

The information collected must be sufficient to demonstrate compliance with both the deforestation-free and legality requirements.

Step 2: Risk assessment (Article 10)

Operators must assess the risk that the product is not compliant. The risk assessment must consider, among other things: country and regional risk factors; the complexity of the supply chain; whether the commodities were produced by operators who comply with relevant requirements; whether there are substantiated concerns; and whether the operator or any of its relevant trading partners are subject to ongoing enforcement action.

The output of the risk assessment is a conclusion: either the risk is “negligible” — meaning the operator can proceed to submit a DDS — or the risk is non-negligible, requiring mitigation before submission.

Step 3: Risk mitigation (Article 11)

Where the risk is not negligible, operators must take additional steps to reduce it to negligible. Mitigation measures may include: requesting additional documentation from suppliers; commissioning independent surveys or audits; requiring suppliers to implement corrective action; switching to alternative sources where risk cannot be adequately reduced.

Only once the risk has been mitigated to negligible can the operator submit the DDS and place the product on the market.

Due Diligence Statement (DDS): what it contains

The DDS is the final declaration submitted by an operator to the EUDR Information System. It must include:

• The operator’s name, address, and EORI number
• Product description: HS code, trade name, scientific name (where applicable), quantity
• Country of production and geolocation coordinates of all plots
• Reference to any existing DDS being used
• A legal declaration confirming due diligence was carried out and that no or only negligible risk was identified
• A dated signature including the name and function of the signatory

For a full breakdown of how to submit a DDS, including the technical requirements, see our DDS guide.

How due diligence is checked and enforced

Each EU Member State designates competent authorities to enforce the EUDR through risk-based audits, inspections, and document reviews. For a detailed breakdown, see our guide on EUDR compliance and enforcement. All DDS submissions go into a centralised EU system, where authorities analyse them using risk criteria, flagging shipments or operators for closer scrutiny. Customs also play a role by ensuring a valid DDS is provided for imports and blocking non-compliant shipments. Penalties for non-compliance may include fines (up to at least 4% of turnover), seizure of goods, or suspension from market access. Operators must be ready to show not just the DDS, but the full due diligence system behind it.

{{custom-cta}}

Explore the Coolset EUDR solution or schedule a live demo with us.

June 2026 update: How the simplification package affects due diligence requirements

The Commission’s Guidance Document (3rd edition, 4 May 2026) provides the most detailed operational clarification of EUDR due diligence requirements to date. Several points are directly relevant to the steps described in this article.

Simplified information collection for low-risk sourcing. For supply chains, production areas, and countries of production where an initial examination of available information indicates a negligible risk of non-compliance with Article 3(b) (legality), operators are not required to carry out in-depth data collection. Specifically, the Guidance Document confirms that operators sourcing from low-risk countries should not be required to: systematically collect comprehensive legal documentation for each individual plot of land; obtain specific document types such as individual land titles; or compile an exhaustive list of all potentially relevant national laws. This applies as long as the initial examination does not indicate a higher risk. Under the adopted country risk classification (Commission Implementing Regulation (EU) 2025/1093, 22 May 2025), 51% of importing operators now qualify for this simplified approach.

Downstream operators and traders: no due diligence obligation. The Guidance Document (3rd edition) confirms that downstream operators are not required to ascertain that due diligence was exercised by their upstream supplier, and are not required to submit a DDS. Their obligation under Regulation (EU) 2025/2650 is limited to passively collecting and retaining reference numbers from their direct upstream supplier. Traders further down the chain who do not purchase directly from an upstream operator face only basic business partner information obligations.

Annual compliance costs. The Commission estimates that the combined effect of the simplification measures since 2024 — including the country risk classification, the simplified regime for micro and small primary operators, and reduced downstream obligations — has reduced annual compliance costs by approximately 75%, from EUR 8.1 billion to EUR 2.0 billion per year (COM(2026) 191 final, Chapter 5).

FAQ - EUDR due diligence requirements

1. What is “due diligence” under the EUDR?

Under the EUDR, due diligence is the mandatory process operators must follow to ensure products are deforestation-free, legally produced, and backed by a DDS. This involves collecting detailed supply chain data, assessing the risk of non-compliance, and taking mitigation measures if the risk is above negligible. Only once compliance is confirmed can a DDS be submitted to the EU system.

2. What information must a Due Diligence Statement (DDS) contain?

The DDS is the final declaration submitted by an operator under the EUDR. It must include: The operator’s name, address, and, if applicable, EORI number. A product description including HS code, trade name, scientific name (if applicable), and quantity. The country of production and geolocation coordinates of all plots where the commodities were produced (or all establishments for cattle). A reference number if an existing DDS is being used. A legal declaration confirming due diligence was carried out and that no or only negligible risk was identified. A dated signature including the name and function of the person signing.

3. How is due diligence compliance checked and enforced?

Each EU Member State designates competent authorities to enforce the EUDR through risk-based audits, inspections, and document reviews. For a detailed breakdown, see our guide on EUDR compliance and enforcement. All DDS submissions go into a centralized EU system, where authorities analyze them using risk criteria flagging shipments or operators for closer scrutiny.Customs also play a role by ensuring a valid DDS is provided for imports and blocking non-compliant shipments. Penalties for non-compliance may include fines (up to at least 4% of turnover), seizure of goods, or suspension from market access. Operators must be ready to show not just the DDS, but the full due diligence system behind it.

4. Can existing certifications (e.g. FSC, RSPO) replace the need for due diligence?

No. Certifications cannot replace due diligence under the EUDR, they can only support it. Operators must still collect all required data and perform their own risk assessments.

The European Commission does not recognize any certifications as substitutes for a DDS. Each shipment must be backed by a full due diligence process, regardless of certification status.