On 20 July 2026, the European Commission published its guidance document for the EU Deforestation Regulation (EUDR), confirming that certification schemes do not replace operator due diligence under Article 10(2)(n) of Regulation (EU) 2023/1115. The certificate is evidence, not a defense. It only counts as evidence while it is valid.

That reframes the problem. Every expired certificate in a supplier file is part of a documentation chain that regulators, auditors and customers can test at the transaction level. A central certificate register with dated expiry triggers tied to procurement approvals closes the gap, so no purchase order goes out and no shipment is accepted against a lapsed document.

Why expired certificates keep showing up as audit findings

Expired certificates reach audits because most companies store them in shared drives, email threads and supplier portals that do not generate expiry alerts. Procurement, quality and sustainability teams each hold partial copies of the same PDFs, and no single owner reconciles what is current against what has lapsed. When auditors sample the supplier file, they look at the central record, not an inbox.

EUDR adds stricter documentation requirements. Under Articles 4, 9, 10 and 11 of Regulation (EU) 2023/1115, operators must collect information, assess risk, mitigate residual risk, and submit a due diligence statement. That statement is filed through the EU information system before the product is placed on the market. Article 10(2)(n) treats certification as complementary information for the risk assessment, not as a replacement for the operator's own checks. If the certificate referenced inside your due diligence file was not valid on the date of the transaction, the file no longer supports the statement filed.

{{product-tour-injectable}}

What auditors check and what triggers a finding

Auditors check three things about any certificate on file: the certified scope, validity on the date of the transaction, and issuance by an accredited body. A certificate whose scope excludes the production site that shipped to you is not valid evidence for that site, even if the paper itself is current. A certificate that expired mid-contract produces an exposure for every purchase order and goods receipt dated after the expiry, not a single exposure.

The stakes extend beyond internal management system audits. Under EUDR, documentation retention is explicit: Articles 4(3), 9(1) and 12(5) require due diligence statements and their supporting documentation to be retained for five years. Any certificate cited in that chain must be verifiable for the full five years, including the exact dates it was valid when the transaction happened. Article 3 of Regulation (EU) 2023/1115 adds a cut-off date. Commodities can only enter the EU market if they are deforestation-free against 31 December 2020, and the certificate must prove this.

Value chain disclosure obligations create the same requirement. Under ESRS S2, companies disclose policies, engagement processes and remediation channels for workers in the value chain, including whether they operate a supplier code of conduct. If that code relies on third-party certification, an expired certificate weakens the policy disclosure under Disclosure Requirement S2-1. It also weakens the effectiveness tracking required under Disclosure Requirement S2-4.

Building a certificate register that flags expiry before procurement acts

A working certificate register holds one row per certificate per supplier site, not one row per supplier. Each row contains the issue date, expiry date, certified scope, certification body, accreditation number and a linked copy of the PDF. Without a site-level record, a buyer purchasing from a secondary plant cannot prove that the plant they used was in scope.

Expiry triggers are what makes the register prevent missed renewals. Alerts should fire at 90, 60 and 30 days before expiry and go to a named owner inside procurement or quality, not to a shared mailbox where no one is accountable. At expiry, the register has to block purchase order release in the ERP for materials that require the certificate, so that the first shipment under a lapsed document does not happen at all.

Scope fields deserve as much discipline as dates. A valid ISO 14001 certificate that lists a head office but excludes the production site actually shipping the material does not support any environmental claim tied to that site. The register must capture the sites within scope, the activities certified and the materials or product groups covered, so that a procurement system can match a purchase order to the right row rather than to the supplier's parent entity.

The register also supports regulatory documentation. For products covered by EUDR, the certificate referenced inside the due diligence statement must be traceable to a specific supplier site and a specific validity window. The practical scope of that requirement is explained further in Coolset's guides to EUDR exemptions and EUDR and TARIC codes.

Verifying certificates at source instead of trusting the supplier PDF

Certificates should be checked against the certification body's public directory at upload and again at renewal. Accredited certification bodies publish active certificates in searchable registers, and those registers show suspensions and withdrawals that a PDF held in a supplier portal will not. The Commission's EUDR guidance is clear that the operator carries the due diligence obligation; relying on a PDF that was altered, withdrawn or never issued does not satisfy Article 10(2)(n).

Record the verification date and source URL inside the register. A defensible audit trail shows active checking against the issuing body. Passive storage of a supplier-sent file is not enough. The same principle applies to any public sustainability claim supported by certification evidence: if the underlying certificate has lapsed, the claim is no longer backed by what the register says it is backed by.

Closing the gap when a certificate has already expired

When a certificate has already expired against live supply, the first step is containment rather than disclosure. Identify the exposure window, list every purchase order and goods receipt dated after the expiry, and quarantine remaining inventory received against the lapsed document. That gives the business a clear picture before the issue becomes an external finding.

Next, request evidence from the supplier and the certification body. A recertification audit report, an extension letter, or confirmation that the certificate is suspended rather than fully withdrawn each carry different consequences for the buyer. If the supplier cannot produce evidence of continued certification, document the risk assessment and the corrective action, including any requalification testing performed on received lots or any substitution of the affected material.

{{custom-cta}}

Log the lapse as a self-identified finding inside your internal audit record so the file shows that the control detected the problem. For EUDR-relevant commodities, update the due diligence file so the certificate reference reflects what was actually in force during the transaction window, consistent with the five-year documentation retention rule in Regulation (EU) 2023/1115.

How the register supports ESRS S2 disclosures

The same register supports ESRS S2 reporting. The ESRS S2 Delegated Act annex sets Disclosure Requirements S2-1 to S2-5 covering policies, engagement, remediation channels, actions and targets for value chain workers, including grievance mechanisms in the workplace of those workers. A register that tracks which certifications underpin each supplier code of conduct lets the reporting team show how the policy is actually maintained, rather than asserting a policy exists on paper.

EFRAG published the draft Simplified ESRS S2 as technical advice on 30 November 2025. Revised Disclosure Requirement S2-3 still requires disclosure of how action effectiveness is tracked for value chain workers. Revised Disclosure Requirement S2-4 requires qualitative or quantitative targets. A current certificate register is the primary data source that makes those disclosures verifiable, and selecting the right ESRS software tools can make that data chain easier to maintain.

Where to start

Name one owner for the supplier certificate register before anything else. The 90, 60 and 30 day expiry alerts, the ERP-level purchase order blocks and the public-directory verification routine all follow from that single point of accountability.

Frequently asked questions

Is an expired supplier certificate automatically a compliance breach?

Not automatically, but it is a documentation gap that auditors and regulators are entitled to test. For regulated files such as EUDR due diligence statements, the certificate referenced must have been valid on the date of the transaction. A certificate that expired before the shipment or purchase order weakens the evidence chain behind the statement filed under Articles 4, 9 and 10 of Regulation (EU) 2023/1115.

Does a valid certificate satisfy EUDR due diligence on its own?

No. Article 10(2)(n) of Regulation (EU) 2023/1115 allows certification schemes to be used as complementary information in the risk assessment, and the Commission's July 2026 guidance confirms that certification does not replace due diligence. Operators still have to collect information, assess risk, mitigate residual risk, and submit a due diligence statement.

How long do supporting certificates need to be retained?

Documentation supporting a due diligence statement under EUDR must be retained for five years, following Articles 4(3), 9(1) and 12(5) of Regulation (EU) 2023/1115. That retention covers the certificate as cited at the time of the transaction, not only the latest version held on file today.

Who should own the certificate register?

A named role inside quality, procurement or compliance owns the register, with ERP integration so that purchase order release is blocked when required evidence has lapsed. A shared inbox is not an owner. Expiry alerts at 90, 60 and 30 days before expiry should go to the same named role every time.

Does ESRS S2 require disclosure of supplier certificate status?

ESRS S2 requires disclosure of policies, engagement processes, remediation channels, actions and targets for workers in the value chain, including whether the undertaking operates a supplier code of conduct. Where that code is backed by third-party certification, the effectiveness tracking under Disclosure Requirements S2-3 and S2-4 depends on knowing which supplier certificates are current.