Under Regulation (EU) 2023/1115, large and medium EU operators and traders must apply the full due diligence regime from 30 December 2026, with micro and small operators following on 30 June 2027. Every shipment placed on or exported from the EU market from that date must be covered by a Due Diligence Statement (DDS) submitted to the EU Information System before customs release.

For most operators that statement carries plot-level geolocation; micro and small primary operators (MSPOs) submit a one-time simplified declaration, in which a postal address may replace geolocation where it clearly corresponds to the plot or establishment.

An audit that holds up rests on five defensible document sets. Each is tied to a specific Article of Regulation (EU) 2023/1115: geolocation data under Article 9(1)(d), DDS records under Article 4, risk assessments under Article 10, mitigation evidence under Article 11, and supplier legality and chain of custody under Article 9(1)(h). The rest of this guide walks each set in the order a competent authority will read them.

What competent authorities will actually ask to see

Competent authorities will ask for the full Article 9 information file behind each DDS reference number filed in the EU Information System. The EU Deforestation Regulation (EUDR) requires operators to reach a level of no or negligible risk before placing relevant products on the EU market. A DDS in isolation is not enough. Every field on the statement must reconcile with source documents in the operator's records.

The retention period is fixed. Article 9 requires operators to collect, organize and keep the information for five years and make it available on request. A shipment released in January 2027 must still be reconstructable in 2032, with the same coordinates, legality documents, and reviewer signatures.

Gaps usually surface in three places. Geolocation files fail when polygons are missing or the plot outline does not match the declared volume. Legality evidence fails when operators rely on certification alone. DDS reference numbers passed downstream fail when the downstream file stores the number but no evidence that its validity was checked. Each is fixable before December 2026 if the internal audit tests the same five sets a competent authority will examine.

{{product-tour-injectable}}

Geolocation and plot-level evidence under Article 9

Article 9 requires the geolocation of all plots of land where the relevant commodities were produced, together with the date or time range of production. Traceability to the plot of land is a core part of the Regulation: it prohibits placing on the market, or exporting, any covered product whose geolocation has not been collected and submitted in a DDS. The one exception is the simplified declaration of a micro or small primary operator, for whom a postal address may stand in for geolocation, provided the address clearly corresponds to the plot or establishment concerned. A geolocation file that cannot be resolved to a specific plot is a compliance failure, not a data quality issue.

For plots larger than 4 hectares (all commodities except cattle) the geolocation must be a polygon describing the perimeter, using latitude and longitude to six decimal places. Plots of 4 hectares or less may be described with a polygon or a single point. Auditable geolocation files should carry the raw coordinates in the machine-readable format the Information System accepts GeoJSON, in WGS-84 (EPSG:4326). They should also record the source of the data, the timestamp of collection, and any deduplication check performed against other suppliers.

Cattle files have an extra layer. Under Article 2(29), the geolocation requirement refers to all establishments or premises associated with raising the cattle, birthplace, farms where they were kept, any environment where livestock are kept temporarily or permanently, up to the point of slaughter. Establishments where cattle are kept are always described with a single point, regardless of size. Beef, leather and derived-product operators should record each life-stage location and reconcile it with the animal or batch identification carried through slaughter.

Risk assessment and mitigation files under Articles 10 and 11

Article 10 requires a documented risk assessment for every supply chain. The Commission's guidance annex references Article 10 (Risk assessment) as core legal basis, alongside Article 4 (Obligations) and Article 8 (Due diligence). The risk assessment is where the operator shows its reasoning, not just its outputs.

The FAQ sets the operational floor. Operators and non-SME traders must exercise due diligence with regard to all relevant products supplied by each particular supplier, put a due diligence system in place, collect Article 9 information, and apply Article 10 risk assessment and Article 11 risk mitigation measures. That is a per-supplier, per-origin obligation, not a per-country one.

Country risk classification is the anchor point. Under the simplification review, Commission Implementing Regulation (EU) 2025/1093 of 22 May 2025 sets rules on the list of countries presenting a low or high risk. The file should record the country risk tier applied to each sourcing origin, the date it was checked against the official list, and any additional risk factors weighed on top.

Where risk is above negligible, Article 11 mitigation closes the file. Certification schemes can support mitigation but do not replace the operator's own assessment. Coolset's guide to certification schemes under the EUDR unpacks how FSC, RSPO, and Rainforest Alliance evidence fits into an Article 11 file. Independent surveys, supplier audits and additional information requests should each carry date, scope and conclusion. An annual review must be dated and signed by a named reviewer.

{{custom-cta}}

Supplier evidence and legality documentation from the country of production

Article 9(1)(h) requires adequately conclusive and verifiable evidence that the relevant commodities were produced in accordance with the relevant legislation of the country of production. Under Article 2(40), that legislation concerns the legal status of the area of production in terms of: land use rights; environmental protection; forest-related rules; third parties' rights; labour rights; human rights protected under international law; the principle of free, prior and informed consent (FPIC); and tax, anti-corruption, trade and customs regulations.

Acceptable evidence is document-based. Concession titles, harvest permits, tax receipts, labor inspection records, and free, prior and informed consent (FPIC) agreements each speak to a specific limb of Article 2(40). Certification schemes are useful supporting evidence but do not, on their own, discharge the Article 9(1)(h) obligation. For how these documents fit into a wider due diligence program, see Coolset's guide to supply chain due diligence.

Chain-of-custody documentation connects the plot to the batch. EUDR requires full traceability from product to plot with no mixing of unknown or unverifiable sources: identity-preserved is the strongest method, segregation is acceptable, and mass balance is permitted only where every input is traceable and EUDR-compliant. For soy crushed with other origins, or cocoa blended at a warehouse, the operator should keep the throughput records and the allocation rule used, and show how volume from a geolocated plot flowed through processing to the batch declared on the DDS.

Supplier contracts should carry the Article 9 information requirements and audit rights in writing. If a supplier is unable or unwilling to provide plot coordinates, legality documents, or verification access, the operator has no route to negligible risk. The Commission's guidance is clear that non-EU producers may be asked to provide information such as locations where products were grown, harvested or raised, and the operator carries the burden of obtaining it.

Due diligence statements and the reference number chain under Article 4

Every quantity of relevant products first placed on the EU market must be covered by a DDS submitted before customs release. Following the 2025 amendments, that only businesses first placing a relevant product on the EU market must submit due diligence statements; subsequent downstream operators and traders are not obliged to do so. That narrows the population of filers, but the reference number still has to work end-to-end.

Downstream operators sit in a lighter category but are not exempt from documentation. Under Regulation (EU) 2025/2650, the definition of operator is updated and obligations are redistributed within the supply chain. The first downstream operator or trader, the one whose direct supplier is an operator, must receive and keep the DDS reference numbers or declaration identifiers received, link them to incoming product flows, and keep them for at least five years. There is no obligation to store them in a specific system, nor to systematically check the content or validity of the reference; it is enough to be able to retrieve and compile the records within a reasonable period on request. For an overview of that role, see Coolset's EUDR downstream operator explainer.

Batch and shipment logic matters. A single DDS can cover multiple physical batches or shipments of multiple different relevant products, and the same reference number can appear in several customs declarations, provided the whole declared quantity is covered and due diligence was carried out for all of it. Once that quantity has been fully placed on the market, a new statement must be filed for additional quantities. Because operators must review their due diligence system annually under Article 12(2), a consolidated statement should not cover shipments over a period longer than one year. Auditors will expect the operator to show the mapping between one DDS and each customs entry, not to assume one-to-one linkage. If the mapping lives only in a customs broker's system, retrieve it and store it in the operator's own file.

The Information System reopened in June 2026 following a closure that began on 16 February 2026 to integrate the December 2025 legislative amendments. The production server and acceptance (training) server are both live. The Commission's Green Forum page is the authoritative source for current specifications, updated user guides, and training dates.

Two practical points follow. First, the amendments created new roles that need registering: micro and small primary operators, downstream operators, and traders who have not yet registered should do so before shipments move under the December 2026 regime (non-SME downstream operators and non-SME traders must register once, under Article 5(2)). Second, TRACES provides a test (acceptance) environment. Operators filing for the first time, or under a new role, should run end-to-end test submissions before the production deadline. A submission that fails in testing in the summer is recoverable; one that fails at customs in January 2027 is not. The test environment carries no legal value and cannot be used to demonstrate compliance, but it uses the same fields and validation logic as the live system.

The Information System is also evolving to support the amendments, including the simplified declaration for micro and small primary operators. Operators using any grouping of DDS reference numbers should keep a record of which child references were bundled under which parent.

Running a pre-December 2026 internal audit as method

A shipment-based internal audit reconstructs the full evidence trail behind sampled DDS reference numbers within the time a competent authority would allow. The five document sets provide the checkpoints: geolocation resolvable to a specific plot, DDS linked and live in the Information System, dated risk assessment with a named reviewer, Article 11 mitigation evidence where risk is not negligible, and legality documents covering each limb of Article 2(40).

Article 12 obligations sit on top of the shipment-level check. The Commission's April 2025 guidance annex confirms that Article 12(1) requires operators to establish and keep up to date a framework of procedures and measures, a due diligence system, to exercise due diligence. Evidence of an annual system review, signed off at management level, is part of what auditors will ask to see.

Findings should feed a corrective action log. Owners, dates and closure evidence captured against each finding demonstrate the Article 12 system in operation. For what non-compliance costs when the corrective log has not been kept, see Coolset's overview of EUDR penalties. For the wider effect of the December 2025 amendment on scope and timelines, see the April 30 EUDR simplification 2026 analysis.

Downstream operators run the same discipline over a narrower scope. The lighter obligations still require the operator to keep the DDS references received, evidence that those references were valid at the time of onward placement, and to pass the reference downstream where required.

Where to start

Start by reconstructing one live DDS reference from the Information System against the Article 9 evidence already stored in the operator's repository. The gaps that appear are the ones to close before shipments move under the December 2026 regime. The Information System's acceptance server provides a controlled environment to test that reconstruction. Pull a live DDS reference from the production server, attempt to file an equivalent test submission in the acceptance server using the same Article 9 data, and verify that the geolocation, HS codes, and supplier fields validate without error. Discrepancies between what the system accepts and what the operator's records contain are the gaps to close before December 2026.

Frequently asked questions

When does the EUDR apply?

Regulation (EU) 2023/1115 applies to large and medium operators and traders from 30 December 2026, and to micro and small operators from 30 June 2027, following Regulation (EU) 2025/2650. Competent authorities can request DDS records and underlying evidence once obligations are live.

How long must EUDR documentation be kept?

Operators must collect, organize and keep the Article 9 information for five years from the date of placing the product on the market. That includes geolocation files, the DDS reference, risk assessment records, mitigation evidence and legality documents from the country of production.

Does certification such as FSC or RSPO cover Article 9(1)(h)?

No. Certification can support the risk assessment and mitigation file but does not on its own satisfy Article 9(1)(h). Operators still need document-based evidence covering each limb of the relevant legislation, including land use rights, environmental rules, third parties' rights, labor and human rights, FPIC, and tax and customs law.

Do downstream operators need to submit their own DDS?

Only businesses first placing a relevant product on the EU market must submit a DDS. Subsequent operators and traders in the revised downstream category rely on the upstream reference, but they must still record the reference received, verify its validity, and keep the record on file.

What is the biggest audit failure point to fix first?

Geolocation that does not resolve to a specific plot, or a DDS reference that is not linked to underlying evidence in the operator's own file. Both are treated as compliance failures rather than administrative errors, and both are the fastest to test with a sample shipment reconstruction.