EUDR Due Diligence: How to Prepare, Document and Submit a Compliant DDS

Introduction: Why EUDR due diligence matters now

The EU Deforestation Regulation (Regulation (EU) 2023/1115) fundamentally changes how companies can trade forest-risk commodities with the European Union. From December 30, 2025, large operators must have robust due diligence systems in place, with SME traders following by June 30, 2026. This isn’t a distant compliance horizon—it’s an immediate operational priority that demands attention across procurement, legal, and sustainability functions.

If your company trades cattle, cocoa, coffee, oil palm, rubber, soy, wood, or any of their derived products into, within, or out of the EU, you face a stark reality: these goods cannot be placed on the European market unless they are verified as deforestation-free, legally produced, and covered by a due diligence statement (DDS). The regulation creates a legally binding obligation that extends far beyond voluntary sustainability commitments.

The consequences of non-compliance are severe. Penalties can reach at least 4% of EU turnover, alongside temporary exclusion from public procurement and confiscation of goods. This makes EUDR compliance a board-level issue, not just a sustainability talking point. Reputational damage from enforcement actions could further erode customer trust and market position. This article walks you through building an effective EUDR due diligence system and preparing a compliant DDS, with practical focus on traceability, data collection, and TRACES submission.

EUDR due diligence basics: scope, deadlines and roles

Regulation (EU) 2023/1115 represents the European Union’s most ambitious effort to combat deforestation and forest degradation linked to EU consumption. The regulation replaces and significantly expands the EU Timber Regulation (EUTR), extending mandatory due diligence requirements beyond timber to cover seven key commodities and their derived products. The objective is clear: ensure that products contributing to the destruction of the world’s forests cannot access the European market.

The relevant commodities covered under Annex I span a wide range of everyday products identified by their Harmonized System codes. Real-world examples include green coffee beans (HS 0901), cocoa beans and cocoa liquor (HS 1801, 1803), palm oil and palm oil derivatives used in food and cosmetics (HS 1511, 1516), natural rubber and rubber products (HS 4001, 4011), soybean meal for animal feed (HS 2304), cattle leather and beef products (HS 4101, 0201), sawn wood and plywood (HS 4407, 4412), and printed paper and furniture containing wood (HS 4802, 9403).

The EUDR distinguishes between two types of supply chain actors. An “operator” is any natural or legal person who places relevant products on the EU market or exports them from the EU—think of an EU importer bringing green coffee beans from Brazil. A “trader” is someone who makes relevant products available on the EU market in the course of commercial activity—such as a distributor selling roasted coffee within the EU. Both carry due diligence requirements, though operators bear the primary obligation to ensure products meet all regulatory requirements.

Category	Who	Key Commodities	Deadline	Main Duty
Large/Non-SME Operators	EU importers, exporters with >250 employees or >€50M turnover	All Annex I commodities and products	December 30, 2025	Full due diligence system, submit DDS
SME Traders	Smaller distributors, wholesalers	All Annex I commodities and products	June 30, 2026	Simplified obligations, may rely on operator DDS
Non-SME Traders	Larger distributors meeting size thresholds	All Annex I commodities and products	December 30, 2025	Due diligence requirements, obtain/verify DDS

Larger companies must implement comprehensive due diligence systems covering information collection, risk assessment, and risk mitigation. SMEs may benefit from simplified obligations, but all operators placing in-scope products on the EU market must ensure those products are deforestation-free and legally produced in accordance with the country of production’s relevant legislation.

What an EUDR due diligence system must cover

Article 9 of the EUDR defines three interconnected pillars that form the foundation of every due diligence system: information collection, risk assessment, and risk mitigation. These aren’t standalone activities—they form a continuous process that must be documented and defensible. Your system must produce a complete audit trail demonstrating that each product entering the EU market has undergone proper scrutiny.

A robust due diligence system must include:

• Policies and procedures documenting how due diligence is conducted
• Clear responsibilities assigned to specific roles within the organization
• Data collection tools for gathering supplier and geolocation information
• Supplier onboarding processes including standardized questionnaires
• Risk-scoring methodology aligned with EUDR criteria
• Mitigation workflows for addressing identified risks
• Internal controls ensuring consistency and accuracy
• Record-keeping systems maintaining all documentation for at least 5 years

Articles 8–11 and Annex II of the EUDR specify these requirements in detail. The regulation emphasizes that competent authorities will evaluate your system as a whole, not just individual statements. A company with sporadic compliance efforts will face greater scrutiny than one demonstrating systematic, documented processes.

The system must produce an EUDR due diligence statement for every relevant shipment or batch before goods can enter free circulation or be exported. The flow from sourcing decision to market access follows a logical sequence: identify in-scope products, collect supplier data, verify geolocation information, assess risk against EUDR criteria, implement mitigation where risk exceeds negligible levels, and finally submit the DDS through the EU Information System. At each decision point, high-risk situations must either be resolved through mitigation or the trade must be halted entirely.

The EUDR Due Diligence Statement (DDS) explained

A due diligence statement is the digital, legally binding declaration that confirms due diligence has been completed and that products are deforestation-free, produced in accordance with relevant legislation, and carry at most a negligible risk of non-compliance. This isn’t a voluntary disclosure—it’s a mandatory prerequisite for market access that carries legal liability for the operator or trader submitting it.

The DDS must be submitted through the EU’s TRACES system (the European Information System) before placing goods on the EU market or exporting them. Upon successful submission, TRACES generates a unique reference number that becomes the product’s compliance passport. This verification number must accompany customs declarations and be shared with downstream buyers, creating traceability throughout the supply chain. Customs authorities will check for valid reference numbers before releasing shipments for free circulation.

The legal basis for DDS requirements sits in Article 9 and Annex II of Regulation (EU) 2023/1115. Incomplete or false statements can trigger serious consequences: sanctions, seizure of goods, and potential criminal prosecution in cases of deliberate fraud. The European Commission has made clear that enforcement will be substantive, not merely procedural.

Companies can reference previous DDSs for similar products by citing their existing reference number, but only where the supply chain and risk profile are genuinely comparable. This provision streamlines compliance for repeat transactions with established suppliers, but it doesn’t permit blanket reliance on historical statements for materially different sourcing arrangements.

Example DDS Reference Number Format

EUDR-2025-NL-COCOA-0012345-01

This reference number appears on: customs import declarations, commercial invoices to downstream buyers, transport and shipping documents, and internal compliance records.

What information a DDS must contain

Annex II specifies the information categories that every DDS must include. Understanding these requirements is essential for building data collection processes that capture everything needed at the point of submission.

Operator/Trader Details: The DDS must identify the submitting entity with full legal name, address, and Economic Operators Registration and Identification (EORI) number where applicable. For companies subject to EUDR as both operators and traders across different transactions, each role must be clearly distinguished.

Product Identification: Products must be described with sufficient granularity to distinguish between variants. This includes HS/CN codes from the harmonised system, common product names, and scientific names where relevant (particularly for wood species). The description must differentiate, for example, between green coffee beans and roasted coffee, or between solid wood panels and laminated wood products.

Quantity: Net mass and, where relevant, supplementary units must be specified. Quantities should match those on commercial invoices and transport documents to ensure consistency across the documentation chain.

Country and Region of Production: The DDS must identify where the relevant commodities were produced, including sub-national regions where applicable. For products containing multiple commodities from different origins, each source must be documented.

Geolocation Information: This is the central component of EUDR traceability. Geolocation coordinates or polygons must be provided for all plots of land where relevant commodities were produced. This data must correspond to actual farm, plantation, or forest concession boundaries—not approximate locations or administrative regions.

Risk Assessment Outcome: The DDS must record the conclusion of the risk assessment, confirming that residual risk has been evaluated as negligible. Supporting evidence should be available for inspection but may not appear on the face of the submitted statement.

Declaration of Compliance: The operator or trader must declare that due diligence has been exercised, that products are deforestation-free and legally produced, and that information provided is accurate and complete.

Voluntary certifications such as FSC, PEFC, RSPO, or Rainforest Alliance can be uploaded as supporting evidence and may strengthen the risk assessment. However, certifications do not automatically replace the operator’s own due diligence responsibilities—they are complementary tools, not substitutes.

The DDS system records the date and time of creation, submission, and any amendments, forming a critical part of the company’s audit trail. Any modifications after submission must be documented and may trigger additional scrutiny from competent authorities.

Example DDS structure and how it appears in TRACES

When logging into the TRACES interface, operators encounter a structured form organized into logical sections. Understanding this layout helps teams prepare data in the correct format before attempting submission.

Section 1 – Operator Information: Legal entity name, registered address, EORI number, contact details, and declaration of role (operator or trader).

Section 2 – Consignment Details: Shipment reference numbers, transport mode, departure and destination countries, expected arrival date, and customs entry point.

Section 3 – Product List: Individual line items for each product type, including HS code (e.g., 1801.00 for cocoa beans), product description, net mass (e.g., 25,000 kg), and packaging details.

Section 4 – Geolocation Block: Coordinates or polygon files for each production plot. For a cocoa shipment, this might include multiple farm polygons across several cooperatives in Côte d’Ivoire.

Section 5 – Risk Assessment Summary: Confirmation of risk assessment completion, overall risk rating (negligible), and reference to supporting documentation held by the operator.

Section 6 – Final Declaration: Legal attestation that all information is accurate, due diligence has been conducted, and products meet EUDR requirements.

Consider a fictional example: Chocolate Imports BV, based in Rotterdam, imports 25 metric tons of cocoa beans from Côte d’Ivoire. Their DDS would show EORI number NL123456789012, HS code 1801.00.00, net mass 25,000 kg, country of production CI (Côte d’Ivoire), and geolocation polygons covering 47 farms supplying the cooperative. The risk assessment references satellite imagery confirming no forest loss since December 31, 2020, plus legality verification through supplier documentation.

Behind the scenes, the system stores detailed risk assessment materials—polygon files, satellite analysis reports, supplier questionnaires, and legality documentation—that aren’t visible on the downloadable DDS PDF but must be available upon competent authority request.

Step-by-step guide to carrying out EUDR due diligence

This section provides a practical checklist that compliance, sourcing, and sustainability teams can use from first risk screening through final DDS submission. The steps follow the legal logic embedded in the EUDR: identify in-scope goods, map supply chains, collect data, assess risk, mitigate where necessary, then document everything in a DDS.

Each step builds on the previous one. Rushing through early stages creates problems that compound during submission, so invest time in getting foundations right.

1. Identify if your products and role fall under EUDR

Start by checking Annex I HS codes against your product portfolio. Common examples include:

• Coffee: HS 0901 (green and roasted coffee beans)
• Cocoa: HS 1801 (cocoa beans), 1803 (cocoa paste), 1804 (cocoa butter)
• Palm oil: HS 1511 (crude and refined palm oil), HS 1516 (hydrogenated palm derivatives)
• Wood: HS 4407 (sawn wood), HS 4412 (plywood), HS 9403 (wooden furniture)
• Rubber: HS 4001 (natural rubber), HS 4011 (rubber tires)
• Soy: HS 1201 (soybeans), HS 2304 (soybean meal)
• Cattle: HS 0201 (beef), HS 4101 (cattle hides)

For each transaction, determine whether your company acts as an operator or trader. An importer of green coffee beans bringing goods into the EU is an operator. A wholesaler purchasing roasted coffee from that importer and selling to retailers is a trader. The same company might be an operator for some products and a trader for others.

Practical Tip: Build an internal product–EUDR mapping flagged in your ERP or customs systems. Tag each product code with its EUDR status and applicable due diligence requirements to streamline compliance at scale.

2. Map and understand your EUDR commodity supply chain

EUDR requires traceability to the plot of land where commodities were produced—not just to your first-tier supplier. For coffee, this means knowing which farms supplied the cooperative that sold to the exporter. For palm oil, it means identifying the plantations feeding each mill. Multi-tier supply chains are the norm, not the exception.

Practical mapping actions include:

• Sending structured questionnaires to all suppliers requesting farm identifiers, cooperative memberships, mill locations, and production records
• Requesting geolocation coordinates or polygon files for production areas
• Documenting the flow of goods through each intermediary
• Identifying where aggregation or mixing occurs (e.g., at cooperative collection points or processing mills)

Building long-term relationships with producers, cooperatives, and traders improves data quality over time. Consider adding EUDR data-sharing obligations to supplier contracts, making compliance a condition of continued business.

A typical supply chain map for coffee might show: smallholder farms → local collection point → regional cooperative → exporter → EU importer → roaster → retailer. Each link carries responsibility under EUDR, with the operator (EU importer) bearing primary accountability for demonstrating compliance.

3. Gather and verify required information

Data collection must align with Article 9 and Annex II requirements. Categories include:

• Detailed product attributes and descriptions
• HS codes matching customs classifications
• Quantities by net mass and supplementary units
• Batch or lot numbers enabling traceability
• Supplier identities with legal entity details
• Country and region of production
• Geolocation coordinates or polygons for all production plots

Obtaining accurate geolocation data presents the greatest challenge for many companies. Methods include:

• GPS surveys conducted by suppliers or third parties
• Shape files from farm mapping programs
• Satellite-derived boundary data from traceability service providers
• Government land registry information where available

Geolocation data must be verified against up-to-date forest cover maps or satellite imagery to confirm no deforestation occurred after December 31, 2020. Third-party tools and service providers can assist with geospatial analysis, deforestation risk screening, and legality checks, particularly for high-risk countries where domestic production documentation may be limited.

Data consistency across purchase contracts, invoices, transport documents, and the DDS is essential. Discrepancies between documents trigger customs delays and investigation by competent authorities.

4. Conduct your EUDR risk assessment

A structured due diligence risk assessment considers multiple objective factors to determine whether products carry negligible risk of being linked to deforestation or forest degradation, or of violating legality requirements.

Key risk factors include:

• Country risk rating: The EU Commission benchmarks countries as low, normal, or high risk. Products from low risk countries face simplified due diligence, while high-risk origins require enhanced scrutiny.
• Deforestation rates: Historical and current rates of forest loss in the production region
• Governance indicators: Rule of law, corruption indices, and enforcement capacity
• Indigenous rights: Documented approval from affected communities and respect for human rights
• Sector-specific risks: Known issues such as smallholder cocoa expansion in West Africa or cattle ranching pressure on the Amazon
• Supply chain complexity: More intermediaries create greater circumvention risks
• Supplier history: Previous violations or substantiated concerns

Build a simple scoring model that integrates geolocation results, supplier performance history, and certification status. The model should classify risk as low, medium, or high, with clear thresholds for each category. The goal is determining whether residual risk is negligible—meaning products can proceed—or whether mitigation is required.

All risk assessments must be documented and linked to specific DDSs and consignments. Records must be retained for at least 5 years and be available for inspection.

5. Implement risk mitigation measures where needed

When risk assessment identifies non-negligible risk levels, mitigation measures must reduce that risk before trade can proceed. Options include:

• Requesting additional documentation from suppliers (farm records, legality certificates, land tenure proof)
• Commissioning independent field audits or verification visits
• Adjusting sourcing to lower-risk regions or suppliers
• Excluding problematic farms, mills, or intermediaries from the supply chain
• Revising supplier contracts to include corrective action plans with clear timelines
• Requiring third-party certification as a condition of continued supply

For high-risk cases, mitigation must be robust enough to reduce risk to negligible before products enter the EU market. If risk cannot be adequately mitigated, the consignment should not be placed on the market or exported.

Technology plays an important role in ongoing monitoring. Data platforms, traceability tools, and remote sensing services can track supplier performance over time and flag recurring issues. Satellite monitoring can detect forest loss in supplier areas between shipments, enabling proactive intervention.

Practical Example: A coffee roaster sourcing from a cooperative in a high-risk district conducted satellite analysis revealing recent forest loss on several member farms. Rather than continuing purchases, the company worked with the cooperative to exclude affected farms, implement monitoring protocols for remaining suppliers, and shift additional volumes to a lower-risk region. Only after these measures were in place—and verified through follow-up satellite checks—did the company submit DDSs for new shipments.

6. Finalize, submit and retain your DDS

The submission process through TRACES follows a structured workflow:

1. Log into the EU Information System using company credentials
2. Create a new DDS and select the appropriate product category
3. Complete all required fields: operator details, product information, quantities, geolocation data
4. Upload or reference supporting documentation
5. Run internal validation checks for data completeness and consistency
6. Obtain management approval where required by internal procedures
7. Submit the declaration

Upon successful submission, TRACES generates a unique EUDR reference number. This number must be:

• Communicated to customs brokers for inclusion in import declarations
• Shared with downstream buyers receiving the goods
• Recorded in internal compliance systems
• Retained with all supporting documentation

All supporting documents—geolocation files, risk analyses, supplier contracts, satellite reports, and correspondence—must be kept for at least 5 years. Competent authorities may request access during inspections, and incomplete records can result in penalties.

Before You Click Submit – Checklist:

• [ ] All product codes match customs declarations
• [ ] Geolocation data covers 100% of production plots
• [ ] Risk assessment conclusion documented and defensible
• [ ] Quantities reconcile with commercial invoices
• [ ] Supplier information verified and complete
• [ ] Management approval obtained (if required)
• [ ] Supporting documents organized and accessible

Common pitfalls and how to avoid them

Early EUDR implementers frequently encounter similar obstacles, often rooted in data quality gaps and unclear internal responsibilities. These issues cause shipment delays, trigger enhanced scrutiny from competent authorities, and create unnecessary compliance costs.

Incomplete Geolocation Coverage: Many companies discover their suppliers cannot provide coordinates or polygons for all production areas. Prevention: Start supplier engagement early, provide technical assistance where needed, and consider excluding suppliers who cannot deliver required data within reasonable timelines.

Over-Reliance on Certification: While certifications like FSC, RSPO, or Rainforest Alliance provide valuable assurance, they don’t automatically satisfy EUDR requirements. Certified suppliers still require geolocation data, and certification schemes may not cover all EUDR criteria. Prevention: Treat certifications as supporting evidence, not substitutes for company-led due diligence.

Inconsistent HS Codes: Discrepancies between the HS code in the DDS and customs declarations create immediate red flags. Prevention: Standardize product coding across procurement, compliance, and logistics systems. Conduct reconciliation checks before submission.

Missing Smallholder Documentation: Complex supply chains involving thousands of smallholders present documentation challenges. Many farmers lack formal records or GPS equipment. Prevention: Work with cooperatives and local partners to build data collection capacity. Consider investing in farmer mapping programs.

Weak Evidence for Negligible Risk: A conclusion that risk is negligible must be defensible with documented evidence, not merely asserted. Prevention: Maintain clear audit trails linking geolocation data, satellite analysis, and supplier documentation to each risk assessment conclusion.

Red Flags That Trigger Scrutiny

• Geolocation data missing for any production plots
• Risk assessment with no supporting documentation
• Supplier with history of substantiated concerns
• HS codes that don’t match product descriptions
• Products from high-risk countries with minimal mitigation evidence

Working with partners, systems and audits for EUDR due diligence

Robust EUDR due diligence typically requires cross-functional collaboration across procurement, sustainability, legal, IT, and logistics teams. No single department owns all the information needed for effective compliance. In many cases, external support for satellite analysis, geospatial verification, or IT system implementation proves essential.

Dedicated traceability and compliance systems centralize supplier data, geolocation information, risk assessments, and DDS records in a single platform. These systems ensure consistency across submissions, enable real-time monitoring of compliance status, and maintain audit readiness. Manual processes using spreadsheets and email become unmanageable at scale and create unacceptable error rates.

Internal and external audits play a critical role in testing whether the due diligence system functions as designed. Companies should consider:

• Initial gap assessments comparing current capabilities against EUDR requirements
• Annual internal reviews of policies, procedures, and sample transactions
• Periodic independent verification by qualified third parties to demonstrate ongoing compliance

Competent authority inspections typically involve document requests, potential on-site visits, sampling of consignments, and cross-checks against reference numbers in the EU Information System. Authorities may verify supplier locations abroad in cooperation with producing country governments. The European Commission reserves the right to conduct checks in certain cases, creating EU-level oversight alongside national enforcement.

Build a continuous improvement loop using findings from audits, incidents, and regulatory feedback. Update procedures, training materials, supplier criteria, and technical specifications based on lessons learned. EUDR compliance is an ongoing process, not a one-time implementation project.

FAQ: Practical questions on EUDR due diligence and DDS

Do I need a separate DDS for every shipment? Generally, yes. Each consignment requiring customs clearance needs its own DDS with a unique reference number. However, operators can reference previous DDSs for subsequent transactions involving the same product from the same supply chain, provided the risk profile remains comparable and no material changes have occurred.

How detailed must geolocation polygons be? Polygons must represent actual production plot boundaries with sufficient precision to enable verification against forest cover maps. For large plantations, this means the plantation boundary. For smallholder farms, it means individual farm plots. Administrative region coordinates are not acceptable—the regulation requires plot-level specificity.

Can I rely on my supplier’s DDS? Traders may rely on DDSs submitted by upstream operators, but they must verify that a valid DDS exists and retain the reference number. However, traders making products available on the EU market must ensure compliance—they cannot simply assume upstream due diligence was adequate. Medium sized companies and large companies must conduct their own verification.

What happens if my data changes after submission? If material information changes after DDS submission (e.g., updated geolocation data or corrected quantities), you must submit an amended DDS. The system records amendment history, and unexplained changes may trigger scrutiny. Maintain documentation explaining any modifications.

How does EUDR interact with other ESG reporting rules? EUDR due diligence may inform corporate sustainability reporting under the CSRD and other frameworks. However, EUDR has specific technical specifications and legal consequences distinct from general ESG disclosure. Treat it as a separate compliance stream that may share underlying data with broader sustainability efforts.

Are there simplified rules for small and micro-enterprises? SME traders have extended deadlines (June 30, 2026) and may benefit from simplified obligations, particularly regarding system documentation requirements. However, all operators placing in-scope products on the EU market must ensure compliance with core requirements regardless of company size. Check the latest guidance from the European Parliament and European Commission for current SME provisions.

Where can I find further information on EUDR requirements? The European Commission publishes official guidance documents, FAQs, and updates on the EUDR implementation page. National competent authorities in each EU member state also provide country-specific information on enforcement and submission procedures.

Starting EUDR due diligence preparation early isn’t optional—it’s essential for maintaining access to the European market. Companies that invest now in traceability infrastructure, supplier relationships, and robust data systems will navigate the transition smoothly. Those that delay face potential shipment holds, penalties, and reputational damage. Treat the DDS not as a one-off form to complete, but as the visible output of an ongoing compliance process that protects your business and contributes to protecting the world’s forests from further degradation and climate change impacts.