How EUDR Due Diligence Works Step by Step

Overview: the due diligence framework

The EUDR establishes a structured due diligence process that operators must complete before placing any regulated commodity or product on the EU market, or before exporting it from the EU. The process is defined in Articles 8 through 12 of Regulation (EU) 2023/1115 and consists of five interconnected steps:

1. Information collection (Article 9)
2. Risk assessment (Article 10)
3. Risk mitigation (Article 10)
4. Due Diligence Statement submission (Article 4)
5. Record retention (Article 12)

These steps must be completed for every consignment of regulated products. The due diligence process is not a one-time exercise — it must be applied on an ongoing basis, and operators must review and update their due diligence systems at least once a year (Article 8(2)).

Before diving into each step, it is important to understand the fundamental principle: the operator must be able to demonstrate, with documentary evidence, that the products they place on the EU market are deforestation-free (produced on land that was not deforested after 31 December 2020) and legally produced (in compliance with the relevant laws of the country of production).

Step 1: Information collection (Article 9)

The first step is to gather all the information needed to assess whether the product meets the EUDR's requirements. Article 9 sets out a detailed list of information that operators must collect. This is not a checklist of optional items — all of the following are mandatory:

Product and quantity information

• A description of the product, including the trade name and product type
• The Combined Nomenclature (CN) code — the customs classification code that identifies the product
• The quantity of the product (expressed in net mass, volume, or number of items as appropriate)

Country of production

• The country (or countries) where the commodity was produced, including any country where the commodity was harvested, raised, or grown
• If the product contains commodities from multiple countries of origin, all countries must be listed

Geolocation of production plots

This is one of the most operationally demanding requirements of the EUDR. Operators must provide:

• For plots of land under 4 hectares: a single point of latitude and longitude, sufficient to locate the plot
• For plots of land of 4 hectares or more: the full polygon boundary of the plot, defined as a series of latitude/longitude coordinate pairs
• All coordinates must be in WGS84 format with at least six decimal places of precision (approximately 11 cm accuracy at the equator)
• For commodities sourced from multiple plots, geolocation data must be provided for every plot that contributed to the consignment

The geolocation requirement is what enables satellite-based verification of deforestation-free status. Without accurate geolocation data, it is impossible to cross-check production areas against satellite imagery to confirm that no deforestation has occurred since the cut-off date.

Supplier and supply chain information

• The name and contact details of the supplier(s) from whom the product was obtained
• The name and contact details of the buyer(s) to whom the product will be supplied
• Information about the supply chain actors between the production plot and the operator, sufficient to establish a chain of custody

Evidence of legality and deforestation-free status

• Documents, data, or other information demonstrating that the product was produced in compliance with the relevant legislation of the country of production — this includes environmental laws, land use regulations, labour laws, tax obligations, and any other applicable legal requirements
• Information demonstrating that the production land was not subject to deforestation after 31 December 2020 — this may include satellite imagery analysis, land use change assessments, or other verifiable evidence

Step 2: Risk assessment (Article 10)

Once the information has been collected, the operator must conduct a risk assessment to determine whether there is a risk that the product does not comply with the EUDR's requirements. The risk assessment must be thorough, documented, and based on the information collected in Step 1.

Article 10(2) lists specific factors that operators must consider in their risk assessment:

Country and regional risk

• The risk classification of the country or region of production under the EUDR's benchmarking system (low, standard, or high risk)
• The prevalence of deforestation and forest degradation in the country or region
• The rate of expansion of agricultural land into forest areas
• Trends in the production of the relevant commodity in the country

Supply chain complexity

• The complexity of the supply chain, including the number of intermediaries between the production plot and the operator
• The risk of mixing compliant and non-compliant products at any stage of the supply chain — particularly at processing, storage, and transport stages
• The difficulty of tracing the product back to its origin

Governance and enforcement

• The effectiveness of governance and law enforcement in the country of production
• The presence of armed conflict or instability that may affect the reliability of information
• The existence of sanctions or other restrictive measures imposed by the UN Security Council or the EU Council

Third-party concerns and indigenous peoples

• Any substantiated concerns raised by third parties — including civil society organisations, media reports, academic research, or whistleblowers — about deforestation or illegality in the relevant supply chain or region
• The presence of indigenous peoples and local communities in or near the production area, and whether their rights (including customary land tenure and free, prior, and informed consent) have been respected

Certification and verification

• Whether the product is covered by a certification scheme or third-party verification system — and the scope, rigour, and independence of that scheme
• Whether the certification covers the specific requirements of the EUDR (deforestation-free status, legality, geolocation) or only some of them

The outcome of the risk assessment must be one of two conclusions: either the risk of non-compliance is negligible, or it is non-negligible. Only if the risk is assessed as negligible can the operator proceed to submit a DDS and place the product on the market. If the risk is non-negligible, the operator must proceed to Step 3.

Step 3: Risk mitigation

When the risk assessment identifies a non-negligible risk that the product does not comply with the EUDR, the operator must take adequate and proportionate risk mitigation measures to reduce the risk to a negligible level. The regulation does not prescribe a specific set of mitigation measures — instead, it requires operators to adopt measures that are appropriate to the nature and level of the risk identified.

Common risk mitigation measures include:

Additional information and verification

• Requesting additional documentation from suppliers — such as land titles, harvest permits, environmental impact assessments, or satellite imagery analysis reports
• Commissioning independent verification of geolocation data and deforestation-free status — for example, by engaging a remote sensing specialist to analyse satellite imagery for the relevant production plots
• Obtaining third-party audit reports covering the supplier's operations and compliance with local legislation

Supply chain audits and field visits

• Conducting or commissioning on-the-ground audits of production sites, processing facilities, and storage locations
• Verifying that the supply chain documentation matches the physical reality — for example, confirming that the volumes claimed from a particular farm are consistent with the farm's productive capacity
• Checking for evidence of mixing or substitution at processing and storage stages

Supplier engagement and capacity building

• Working with suppliers to improve their data collection and documentation practices — particularly around geolocation data and chain of custody
• Providing training or technical assistance to help suppliers meet the EUDR's requirements
• Establishing contractual requirements that obligate suppliers to provide accurate and complete information and to cooperate with verification activities

Sourcing adjustments

• If risk cannot be adequately mitigated through the measures above, the operator may need to change suppliers or source from lower-risk regions
• In extreme cases, the operator may need to exclude certain origins from their supply chain entirely until adequate assurance can be obtained

The operator must document all risk mitigation measures taken and their outcomes. If, after mitigation, the risk is reduced to a negligible level, the operator can proceed to submit a DDS. If the risk remains non-negligible despite mitigation efforts, the operator must not place the product on the EU market.

Step 4: Due Diligence Statement submission (Article 4)

Once the operator has completed the due diligence process and concluded that the risk of non-compliance is negligible, they must submit a Due Diligence Statement (DDS) through the EU Information System before placing the product on the market.

What goes in the DDS

The DDS is a formal declaration that contains:

• The operator's identity and contact details
• A description of the product, including the CN code and quantity
• The country of production
• Geolocation coordinates of all production plots
• A declaration that due diligence has been carried out in accordance with Articles 8–11
• A declaration that the risk of non-compliance has been assessed as negligible
• The date of the statement

The DDS is a legally binding declaration. By submitting it, the operator takes personal responsibility for the accuracy of the information and the adequacy of the due diligence process. False or misleading statements can result in penalties.

How to submit: the EU Information System (TRACES NT)

The DDS must be submitted through the EU Information System, which is built on the existing TRACES NT (Trade Control and Expert System New Technology) platform operated by the European Commission. TRACES NT is already used for sanitary and phytosanitary controls on food and animal products entering the EU, and it has been extended to handle EUDR due diligence statements.

To submit a DDS, operators must:

1. Register on the TRACES NT platform and obtain access credentials
2. Create a new DDS by entering the required information — product details, geolocation data, supplier information, and the compliance declaration
3. Submit the DDS electronically. Upon submission, the system generates a unique DDS reference number
4. Provide the DDS reference number to downstream actors in the supply chain — buyers, traders, and customs authorities need this number to verify that the product has been through the due diligence process

DDS reference numbers and customs

The DDS reference number is the key link between the due diligence process and the physical movement of goods. When regulated products are presented at EU customs for import, the customs declaration must include the DDS reference number. Customs authorities will check that a valid DDS exists for the consignment before releasing the goods. Products without a valid DDS reference number will not be cleared through customs.

Downstream traders must also retain the DDS reference numbers for the products they handle. If a competent authority requests information about a product's compliance status, the trader must be able to provide the DDS reference number and identify the upstream operator who submitted it.

Step 5: Record retention (Article 12)

The final step in the due diligence process is record retention. Article 12 requires operators to keep all due diligence records for a minimum of five years from the date the DDS was submitted. This includes:

• All information collected during Step 1 (product details, geolocation data, supplier information, evidence of legality and deforestation-free status)
• The risk assessment documentation from Step 2 (methodology, factors considered, conclusions reached)
• Records of any risk mitigation measures taken in Step 3 (actions taken, outcomes, residual risk assessment)
• The DDS itself and its reference number from Step 4
• Any correspondence with suppliers, auditors, or competent authorities related to the due diligence process

Records must be made available to competent authorities on request. The five-year retention period ensures that authorities can conduct retrospective checks and investigations, even for products that were placed on the market several years earlier.

Operators should also be aware that competent authorities may request access to records at any time, not just during scheduled inspections. The regulation gives authorities broad powers to request information, conduct inspections, take samples, and seize products where there are grounds to suspect non-compliance.

Operator vs trader obligations: a comparison

The due diligence obligations described above apply in full to operators — the entities that first place regulated products on the EU market. Traders — entities that make already-placed products available on the market — have different obligations depending on their size:

SME traders

Small and medium-sized traders have simplified obligations. They must:

• Collect and retain the DDS reference numbers from their suppliers
• Keep records of their suppliers and customers for at least five years
• Make this information available to competent authorities on request
• Act on substantiated concerns about non-compliance (suspend sales, notify authorities)

SME traders are not required to conduct their own due diligence, risk assessment, or risk mitigation. They rely on the due diligence performed by the upstream operator.

Large traders (non-SME)

Traders that do not qualify as SMEs are subject to the same full due diligence obligations as operators. This means large distributors, wholesalers, and retailers must conduct their own information collection, risk assessment, risk mitigation, and DDS submission — even for products that have already been through the due diligence process by the upstream operator.

This requirement reflects the EU's view that large traders have the resources and market influence to conduct their own due diligence, and that relying solely on upstream operators' assessments is insufficient for entities of significant scale.

Practical tips for implementation

Based on the regulatory requirements, here are practical considerations for implementing the due diligence process:

1. Start with your supply chain map. Before you can collect information, you need to know who your suppliers are, where they source from, and how many intermediaries are involved. Map your supply chain from production plot to your warehouse.
2. Invest in geolocation data collection early. Obtaining accurate geolocation data from thousands of smallholder farmers takes time. Start engaging with your suppliers now to establish data collection processes.
3. Automate where possible. The volume of data required — geolocation coordinates, satellite imagery analysis, supplier documentation, risk assessments — makes manual processes impractical at scale. Evaluate technology solutions that can automate data collection, satellite verification, and DDS generation.
4. Document everything. The five-year record retention requirement means you need robust document management systems. Ensure that every step of your due diligence process is documented and auditable.
5. Review your due diligence system annually. Article 8(2) requires operators to review and update their due diligence systems at least once a year. Build this review into your compliance calendar.

Sources: This article draws on Regulation (EU) 2023/1115 (EUDR), specifically Articles 4, 8–12, and the European Commission's EUDR implementation guidance.