EUDR Due Diligence: The Three Steps, the Due Diligence System, Annual Review and Record Keeping

It is the core duty of the EU Deforestation Regulation from 30 December 2026.

Operators exercise it, including SME operators and micro or small primary operators; downstream operators and traders do not, since 26 December 2025. A due diligence system keeps the process running, reviewed at least once a year, and non-SME operators publish an annual report.

Due diligence ends in a due diligence statement submitted before placing or export. The four key figures are listed below.

• Components: 3 (information, risk assessment, risk mitigation).
• Review: at least once a year.
• Records: 5 years.
• Application: 30 December 2026.

What Is Due Diligence Under the EUDR?

Due diligence under the EUDR is the duty of operators, "prior to placing relevant products on the market or exporting them", to exercise due diligence "with regard to all relevant products" (Article 8(1) of Regulation (EU) 2023/1115, as replaced by Regulation (EU) 2025/2650). Before 26 December 2025 the text read "all relevant products supplied by each particular supplier". Its purpose is to prove compliance with Article 3 (Article 4(1)): deforestation-free, legal and covered by a statement. Negligible risk is a result of due diligence, not an exemption from it (FAQ 5.10).

Due Diligence vs the Due Diligence Statement

Due diligence is the process of Article 8, and the due diligence statement (DDS) is the declaration, submitted through the information system, that the process was exercised and that no or only a negligible risk was found (Article 4(2)). The abbreviation DDS names the statement, never the system. Without a prior statement, placing or export is not allowed.

Is There an Official EUDR Due Diligence Template?

No: the Commission's Green Forum states that "there is no fixed format or set list of questions", and the Commission considers due diligence "not a tick-the-box exercise" (FAQ Version 5 (April 2026), 5.16). Any checklist is unofficial.

Who Must Exercise EUDR Due Diligence?

Operators exercise due diligence, including micro or small primary operators; downstream operators and traders do not, since 26 December 2025. The roles are compared below in the order of Article 2.

Operators, Including SMEs and Micro or Small Primary Operators

SME operators carry full due diligence and file a statement, because Regulation (EU) 2025/2650 deleted the SME derogation of Article 4(8). All duties of EUDR operators apply whatever their size. A micro or small primary operator must also establish a system, which according to Guidance C/2026/3896, section 4(c), generally consists of the Article 9 information collection; it files a one-time simplified declaration instead of a statement (Article 4a(2), Annex III). The test for who qualifies is under EUDR micro or small primary operators.

Downstream Operators and Traders

Downstream operators and traders exercise no due diligence and file no statement (Article 5, as replaced by Regulation (EU) 2025/2650). Whether you are a downstream operator or trader follows from Article 2, points (15b) and (17). They hold the information of Article 5(3), non-SME ones register and verify on substantiated concerns, and none must ascertain the due diligence of upstream suppliers (Guidance, section 4(d)). A company whose product contains inputs not covered by a statement or declaration becomes an operator for those inputs (Article 2(15b); Guidance, section 9).

Company Groups: Which Legal Entity Carries Due Diligence?

The legal entity named in the due diligence statement carries the obligation, and the EUDR does not govern group policy (FAQ 5.3). The Commission cites the judgment of the Court of Justice of 13 November 2025 in case C-117/24, which concerned the EU Timber Regulation.

What Are the Three Steps of EUDR Due Diligence?

Article 8(2) sets three components: "(a) the collection of information, data and documents" (Article 9), "(b) risk assessment" (Article 10) and "(c) risk mitigation" (Article 11). The steps are compared below.

Step 1: Information Collection, Including Geolocation (Article 9)

Step 1 collects eight items of information with supporting evidence, kept for five years from placing or export (Article 9). The eight items, including the deforestation-free evidence in point (g) and the legality evidence in point (h), are explained under EUDR information requirements. Geolocation uses at least six decimal digits and polygons for plots of more than four hectares, other than cattle (Article 2(28)); see the point and polygon rules under EUDR geolocation.

Step 2: Risk Assessment (Article 10)

Step 2 verifies and analyses the Article 9 information against 14 criteria, Article 10(2)(a) to (n), a list that is not exhaustive (Guidance, section 4(b)). The assessment is documented and reviewed at least annually (Article 10(4)). The 14 criteria are under EUDR risk assessment.

Step 3: Risk Mitigation (Article 11)

Step 3 adopts measures until the risk is no or only negligible, meaning no cause for concern about compliance with Article 3(a) or (b) after a full assessment (Article 2(26)). Measures include additional information, independent surveys or audits and other measures pertaining to Article 9 (Article 11(1)(a) to (c)). Non-SME operators also need model risk management practices with a compliance officer at management level, and an independent audit function (Article 11(2)).

What Happens if Information Is Missing or Risk Stays Non-Negligible?

Products are not placed on the market or exported (Article 4(4)). The ban applies where the products are non-compliant, a non-negligible risk is revealed or the operator cannot fulfil Articles 4(1) and 4(2); the Commission considers that missing information means not placing (FAQ 1.27).

Does Simplified Due Diligence Skip Any Step?

Yes, Steps 2 and 3 only: simplified due diligence under the EUDR drops Articles 10 and 11 where all commodities come from low-risk countries or parts and the operator has assessed supply-chain complexity and the risk of circumvention or mixing (Article 13(1)). Step 1, the system and the statement remain; on new risk information the full Articles 10 and 11 apply again (Article 13(2)). The one-time simplified declaration of Article 4a is a different regime.

What Is the EUDR Due Diligence System?

The due diligence system is the "framework of procedures and measures" that operators establish and keep up to date to ensure that products comply with Article 3 (Article 12(1)). Article 12 has not been amended since 2023.

What Does a Due Diligence System Contain?

A due diligence system contains the documented procedures behind each step, and no format is prescribed. The four elements are listed below.

• Step procedures: how information is collected, risks assessed and mitigated.
• Management practices: for non-SME operators, the risk management, internal control and compliance practices of Article 11(2)(a).
• Update records: every change to the system, kept five years (Article 12(2)).
• Documentation: "all records, measures and procedures pursuant to Article 8".

How Often Must EUDR Due Diligence Be Reviewed?

The due diligence system, the risk assessments and the mitigation decisions are each reviewed at least once a year (Articles 12(2), 10(4) and 11(3)). The review cycle is compared below.

The one-year period in the last row is guidance, not an annual filing: the Commission considers that a statement should not cover shipments over more than one year from submission (FAQ 5.19).

Who Reviews the Due Diligence System?

The Commission considers that the reviewer is independent from those carrying out the procedures, or an external body (Guidance, section 8). Article 12 names no reviewer, and the review is distinct from the independent audit function that Article 11(2)(b) requires of non-SME operators.

Updating the System When New Information Appears

The system is updated on new developments, and a record of each update is kept for five years (Article 12(2)). On new information, including substantiated concerns, the operator immediately informs the competent authorities of the Member States where the products were placed and the downstream operators and traders supplied (Article 4(5), as replaced by Regulation (EU) 2025/2650).

What Must Non-SME Operators Report Each Year?

Operators that are not SMEs, including microenterprises, or natural persons publish an annual report on their system and the steps taken under Article 8, "as widely as possible, including via the internet" (Article 12(3)).

Who Counts as a Non-SME Operator?

A non-SME operator is an operator that is not an SME under Article 2(30), as replaced by Regulation (EU) 2025/2650, which refers to Directive 2013/34/EU. A medium-sized undertaking does not exceed at least two of three limits: balance sheet EUR 25,000,000, net turnover EUR 50,000,000, average employees 250 (Directive 2013/34/EU as amended by Delegated Directive (EU) 2023/2775). The individual legal entity counts, not the group (FAQ 3.10, 3.13); size classes are under EUDR for SMEs.

What the Annual Due Diligence Report Contains

The report contains the three items of Article 12(4), listed below.

• Point (a): a summary of the information collected under Article 9(1)(a) to (c).
• Point (b): the conclusions of the Article 10 risk assessment, the Article 11 measures, and a description of the information and evidence used.
• Point (c): where applicable, the consultation of indigenous peoples, local communities and other customary tenure rights holders or civil society organisations in the area of production.

Operators that also report under other Union value-chain due diligence acts, such as the CSDDD and the CSRD, may include the information in that reporting (Article 12(3)).

When Is the First EUDR Annual Report Published?

The first report covers 2027 and is published after 30 December 2027 (FAQ 5.14). The Commission considers that an operator need not repeat the content if it already reports under the CSDDD or the CSRD.

How Long Must EUDR Due Diligence Records Be Kept?

Records are kept for five years, counted from a different start for each record. The start points are compared below.

Before 17 July 2026 the system could store personal data for up to ten years; the limit is now five (Implementing Regulation (EU) 2024/3084, Article 12(5), as amended by Implementing Regulation (EU) 2026/1565).

Making Records Available to Competent Authorities

Records are made available to the competent authorities on request (Articles 12(5) and 9(2)). Who checks records is set out under EUDR competent authorities, and operators give all necessary assistance for checks, including access to premises and records (Article 4(6)).

EUDR Due Diligence Timeline: When Do the Obligations Apply?

The due diligence obligations apply from 30 December 2026 (Article 38(2)). Every date in force is on the EUDR timeline; operators that are natural persons or micro or small undertakings established as such by 31 December 2024 apply from 30 June 2027 (Article 38(3)), while products in the Annex to Regulation (EU) No 995/2010 apply from 30 December 2026.

No further delay is proposed as of 24 October 2026. The Commission's review of 4 May 2026 contained no legislative proposal, and the general review is due by 30 June 2030 (Article 34(2)).

Every rule on this page is checked against the consolidated text of Regulation (EU) 2023/1115; see our methodology and fact-checking.

This guide explains the rules; it is not legal advice for an individual case.

How Does EUDR Due Diligence Connect to Compliance, Deforestation-Free Evidence and Country Risk?

Due diligence is the core of the Article 3 test. It supplies the proof for EUDR compliance, which also needs a statement or declaration before placing or export.

The Commission positions quoted here come from the Guidance (Official Journal C, 20 July 2026) and the FAQ (April 2026), both non-binding (Article 15(5)).

Within Step 1, item (g) of Article 9 proves deforestation-free under the EUDR, and item (h) proves legality.

Due Diligence and Country Benchmarking

The country class changes the depth of scrutiny, not the duty. Standard and high-risk sourcing carry the same due diligence obligations, and the difference is enhanced scrutiny, with checks on 9 % of operators sourcing from high-risk areas (FAQ 6.9). Every class is listed under EUDR country benchmarking.

Due Diligence Under the EU Timber Regulation and the EUDR

The EUDR repeals the EUTR with effect from 30 December 2026. The transition under the EU Timber Regulation lets it apply until 31 December 2029 to timber produced before 29 June 2023 and placed from 30 December 2026 (Article 37).

EUDR Due Diligence FAQ

Five further questions concern software, certification, FLEGT, representatives and cost. More answers are in the EUDR FAQ.

Is Software Mandatory, or Only the EUDR Information System?

Only the EUDR Information System is mandatory, and it is free of charge (Implementing Regulation (EU) 2024/3084, Article 18(1)). Access to the EUDR Information System follows the roles of the system; what platforms do is covered under EUDR software, and none is required.

Does Certification Replace Due Diligence?

No: a certificate is complementary information under Article 10(2)(n), and no EUDR certificate exists (FAQ 5.7). What schemes prove is set out under certification and the EUDR; the operator still exercises due diligence and remains responsible.

Does a FLEGT Licence Replace Due Diligence?

No: a valid FLEGT licence counts only for legality under Article 3(b) (Article 10(3)). What FLEGT licences prove is set out there; they never prove that a product is deforestation-free.

Can an Authorised Representative Take Over Due Diligence Responsibility?

No: an authorised representative may submit the DDS, but the operator keeps responsibility (Article 6(1)). The mandate rules are under authorised representatives under the EUDR.

What Does EUDR Due Diligence Cost?

The Commission estimates EUR 10,000 per company per year as the central case for standard or high-risk sourcing (EUR 1,000 low, EUR 15,000 high), half for low-risk sourcing, and EUR 500 per micro or small primary operator (COM(2026) 191, 4 May 2026, section 5.1).