EU Deforestation Regulation Compliance

The first compliance file should identify the exact relevant commodity or Annex I product, the EU activity, and the actor role. Operators place relevant products on the market or export them. Traders make relevant products available on the market and are not operators or downstream operators. Downstream operators and traders have their own information, registration, notification, and recordkeeping duties where Article 5 applies.

Do not file a due diligence statement from a generic supplier questionnaire alone. The record should connect the product to the covered commodity, country of production, supplier chain, plot or establishment information, and the internal owner who can stop placement, availability, or export if the EUDR evidence is incomplete.

Operators need a due diligence system that runs before placing a relevant product on the market or exporting it. Unless Article 13 simplified due diligence applies, the system should combine Article 9 information collection, Article 10 risk assessment, and Article 11 risk mitigation where the risk is not negligible. If the due diligence conclusion is no or only negligible risk, the operator makes the due diligence statement available through the Article 33 information system and assumes responsibility for Article 3 compliance.

The practical compliance owner is usually split across sourcing, sustainability, trade compliance, and legal. Sourcing obtains supplier and plot-level inputs; sustainability checks deforestation-free and legality evidence; trade compliance controls release and statement references; legal handles substantiated concerns, non-negligible-risk decisions, and competent-authority correspondence.

Downstream operators and traders should treat supplier references as controlled compliance data. Article 5 source support requires them to possess specified supply-chain information, including supplier details and due diligence statement reference numbers or declaration identifiers where the supplier is an operator, and to keep the information for at least five years.

Non-SME downstream operators and non-SME traders have additional Article 5 controls. They register in the Article 33 information system before the relevant activity, and if they obtain information indicating non-compliance or a substantiated concern before placement, availability, or export, they verify due diligence and do not proceed unless verification demonstrates no or negligible risk.

Article 9 information is the foundation for the rest of the EUDR compliance file. A useful record is structured enough for a reviewer to connect product, supplier, country of production, plot or establishment, legality evidence, and deforestation-free evidence without hunting through email attachments.

Where simplified treatment is available for micro or small primary operators, do not erase the compliance trail. The record should still show why the simplified declaration route applies, what declaration identifier was assigned, and what production-location substitute information is being used where the source support allows it.

A compliant EUDR risk assessment should explain why the product is no or negligible risk, not simply state that a supplier is approved. The record should evaluate production location, commodity and product characteristics, supplier reliability, supply-chain complexity, mixing or circumvention risks, and any substantiated concerns.

If risk is not negligible, Article 11 mitigation happens before the product is placed on the market or exported. The release decision should show which mitigation actions were required, who approved the result, and why the remaining risk is no or negligible. If the conclusion cannot be supported, the operator must not place the product on the market or export it.

The due diligence statement is the controlled output of the EUDR file. Operators must not submit statements until the Article 9 file, the applicable Article 10 assessment and Article 11 mitigation or Article 13 simplified-due-diligence checks, and release approval are complete.

Enforcement-readiness means the evidence can be produced quickly, not that it sits somewhere in procurement. Keep a single file index for each DDS reference or declaration identifier, with the product, supplier, origin, Article 9 evidence, risk conclusion, mitigation record, authority communications, downstream reference communications, and retention owner.

Article 12 requires operators to review their due diligence system at least annually and whenever new developments could affect it. Keep a record of system updates for five years, and reopen affected product files when a changed supplier, origin, benchmark tier, substantiated concern, or evidence failure undermines the earlier conclusion.