Due diligence system
The 3 due diligence steps: information collection (Art. 9), risk assessment (Art. 10), risk mitigation (Art. 11).
Overview of the due diligence system
The due diligence system is the core mechanism of the EUDR. Article 8 requires every operator to establish, implement, and maintain a due diligence system before placing relevant commodities or products on the EU market or exporting them.
The system comprises three mandatory steps, to be performed sequentially:
- Information collection (Article 9)
- Risk assessment (Article 10)
- Risk mitigation (Article 11)
These three steps are not a one-time exercise. Article 12 requires operators to review and update their due diligence system at least annually, or whenever they become aware of new information indicating non-compliance risks.
Who must perform due diligence?
| Actor | Due diligence obligation | Legal basis |
|---|---|---|
| Operator (first placer on EU market) | Full three-step due diligence | Art. 4 |
| Large trader (downstream) | Full three-step due diligence | Art. 5(2) |
| SME trader (downstream) | Simplified: collect and keep references to due diligence statements | Art. 5(1) |
| Authorised representative | Full due diligence on behalf of non-EU operator | Art. 6 |
| Exporter | Full three-step due diligence | Art. 4 |
Step 1: Information collection (Article 9)
The first step requires operators to collect comprehensive data about the relevant commodities and their production conditions. This information forms the factual basis for the subsequent risk assessment.
Mandatory data elements
Article 9(1) lists the following required information:
Product identification:
- Description of the relevant commodity or product
- Quantity (net mass in kilograms and, where applicable, volume or number of units)
- CN code(s) from the TARIC nomenclature
- Country of production (and, where applicable, parts thereof)
Actor identification:
- Name and address of the operator
- Name and address of any traders who have handled the product
- Name and contact details of the supplier(s) and, where applicable, the buyer(s)
Geolocation data:
- GPS coordinates of all plots of land where the relevant commodity was produced
- For plots exceeding 4 hectares: polygon coordinates delineating the perimeter
- For plots of 4 hectares or less: a single point (latitude and longitude)
- Date or time range of production
See chapter 4 for a detailed analysis of geolocation requirements.
Production legality:
- Evidence that the product was produced in accordance with the relevant legislation of the country of production
- This includes environmental, land use, forestry, labour, and human rights legislation
- Tax and anti-corruption legislation applicable to the commodity sector
Deforestation-free status:
- Evidence demonstrating that the commodity was produced on land not deforested after 31 December 2020
- For wood: evidence that the production did not cause forest degradation after 31 December 2020
Sources of information
The regulation does not prescribe specific sources but expects operators to use all reasonably available means:
| Source type | Examples | Reliability |
|---|---|---|
| Supplier documentation | Invoices, contracts, certificates of origin, shipping documents | Primary -- essential but not sufficient alone |
| Certification schemes | FSC, PEFC, RSPO, Rainforest Alliance, UTZ | Supporting -- recognised but not replacing due diligence |
| Satellite imagery | Copernicus, Global Forest Watch, Planet | High -- objective, timestamped, verifiable |
| Government databases | Land registries, forestry concession maps, FLEGT licences | High -- official, but not always current |
| Third-party audits | On-site inspections, independent verification | High -- direct evidence |
| Country risk assessments | Transparency International, FAO data, NGO reports | Contextual -- informs risk level |
Important: certification schemes (FSC, RSPO, etc.) are explicitly recognised as useful tools (Article 10(2)) but do not replace the operator's own due diligence obligation. An operator cannot simply rely on a certificate without verifying the underlying data.
Step 2: Risk assessment (Article 10)
Based on the information collected, operators must conduct a thorough risk assessment to determine the likelihood that the commodity or product is non-compliant.
Risk assessment criteria
Article 10(2) specifies that the risk assessment must take into account:
Country and regional risk:
- Country benchmarking classification (standard, high, or low risk) under Article 29
- Deforestation rates in the specific region of production (not just the national average)
- Prevalence of land use conflicts, indigenous rights violations, or environmental crime
- Effectiveness of enforcement of relevant legislation in the country of production
Supply chain risk:
- Complexity of the supply chain (number of intermediaries, blending points)
- Traceability gaps between production and export
- Presence and credibility of certification schemes in the supply chain
- Past compliance record of suppliers and intermediaries
Product-specific risk:
- Commodity characteristics (e.g., coffee from agroforestry vs. monoculture expansion)
- Known risk of mixing compliant and non-compliant product in the commodity's processing chain
- Whether the production area overlaps with protected areas, indigenous territories, or known deforestation fronts
Risk classification outcome
The risk assessment must conclude with one of the following determinations:
| Outcome | Meaning | Next step |
|---|---|---|
| Negligible risk | No indicators of non-compliance after thorough assessment | Proceed to due diligence statement |
| Non-negligible risk | One or more risk indicators identified | Must proceed to Step 3 (risk mitigation) |
| Unacceptable risk | Mitigation impossible or insufficient | Must not place product on the market |
An operator may only submit a due diligence statement if the risk has been assessed as negligible -- either from the outset or after successful risk mitigation.
Documenting the risk assessment
While the regulation does not prescribe a specific format, operators should maintain:
- A written risk assessment report for each consignment or product line
- Clear reasoning for the risk classification
- References to all information sources consulted
- Date of the assessment and identity of the person responsible
- Records retained for at least five years (Article 12(3))
Step 3: Risk mitigation (Article 11)
When the risk assessment identifies non-negligible risk, operators must implement adequate risk mitigation measures before placing the product on the market.
Mitigation measures
Article 11 requires operators to adopt policies, procedures, and measures that adequately and effectively mitigate the identified risks. These may include:
Upstream verification:
- Request additional documentation from suppliers (farm-level records, land titles, environmental permits)
- Commission independent field audits or on-site inspections
- Verify geolocation data against satellite imagery (before and after the cut-off date)
- Cross-reference supplier claims with government databases and NGO reports
Supply chain restructuring:
- Switch to verified suppliers with demonstrated compliance capacity
- Reduce supply chain length (direct sourcing vs. multiple intermediaries)
- Implement segregation at critical blending points (mills, warehouses, processing plants)
- Require suppliers to adopt time-bound corrective action plans
Monitoring and controls:
- Establish ongoing satellite monitoring of sourcing areas
- Implement grievance mechanisms for affected communities
- Conduct periodic re-assessments of supplier risk profiles
- Set up internal whistleblowing procedures
Contractual instruments:
- Include EUDR compliance clauses in supplier contracts
- Require suppliers to provide access to information and inspection rights
- Define consequences for non-compliance (termination, financial penalties)
- Share risk mitigation costs equitably along the supply chain
When mitigation is insufficient
If risk mitigation measures cannot reduce the risk to a negligible level, the operator must not place the product on the EU market or export it. This is a hard prohibition -- there is no "residual risk" exception.
Simplified due diligence for low-risk countries (Article 13)
Article 13 provides a simplified procedure for products sourced exclusively from countries classified as low risk under the benchmarking system (Article 29).
Under simplified due diligence, operators must still:
- Collect the information required by Article 9 (including geolocation data)
- Submit a due diligence statement
But they are exempt from the full risk assessment and risk mitigation steps, unless they have substantiated information suggesting a specific risk.
Key limitation: as of April 2026, the Commission has not yet published the final list of low-risk countries. Until the benchmarking is fully operational, all countries are treated as "standard risk" by default, and the simplified procedure is not yet available in practice. See chapter 6 for details on the benchmarking system.
System maintenance (Article 12)
Annual review obligation
Article 12 requires operators to:
- Review the due diligence system at least annually, including the adequacy of information sources, risk assessment methodology, and mitigation measures
- Update the system whenever new relevant information becomes available (e.g., new deforestation data, changes in supplier circumstances, updated country benchmarking)
- Retain all records (information collected, risk assessments, mitigation measures, due diligence statements) for at least five years
- Make records available to competent authorities upon request within a reasonable timeframe
Internal governance
While not explicitly mandated by the regulation, best practice for large operators includes:
- Designating a responsible person or team for EUDR compliance
- Integrating EUDR due diligence into existing compliance management systems (ISO 20400, OECD due diligence guidance)
- Establishing internal escalation procedures for non-negligible risk findings
- Conducting staff training on due diligence procedures
- Performing internal audits of the due diligence system's effectiveness
Due diligence system implementation checklist
Frequently Asked Questions
- Can I rely on a certification scheme (FSC, RSPO) instead of conducting my own due diligence?
- No. Article 10(2) explicitly states that certification schemes may be taken into account as part of the risk assessment, but they do not replace the operator's own due diligence obligation. Even with a certified supply chain, you must still collect geolocation data, assess risks, and verify deforestation-free status independently. Certification is a supporting element, not a substitute.
- How often must I perform due diligence -- per shipment or per supplier?
- Due diligence must be performed for each consignment or batch of relevant products placed on the market. However, where an operator has an ongoing relationship with a supplier and the supply chain characteristics remain stable, the risk assessment may reference previous assessments, provided it is updated with any new information. Article 12 requires a full system review at least annually.
- What happens if I cannot obtain geolocation data from my supplier?
- Without geolocation data, you cannot complete Step 1 (information collection) and therefore cannot submit a valid due diligence statement. The product must not be placed on the EU market. This is a hard requirement under Article 9 with no exception. If your supplier cannot or will not provide GPS coordinates, you must either find an alternative supplier or work with the existing supplier to build the necessary traceability capacity.
- Is simplified due diligence available now?
- Not in practice. Simplified due diligence under Article 13 is only available for products sourced exclusively from countries classified as "low risk" under the Article 29 benchmarking system. As of April 2026, the Commission has not published the definitive country risk classification. Until then, all countries are treated as standard risk, and the full three-step due diligence applies.
- How long must I retain due diligence records?
- Article 12(3) requires operators to retain all information collected, risk assessments performed, risk mitigation measures taken, and due diligence statements submitted for a minimum of five years from the date the due diligence statement was submitted. Records must be made available to competent authorities upon request.