EUDR Due Diligence and DDS in Practice: Geolocation, the Information System and Filing Strategy

Under the EU Deforestation Regulation (EUDR), an operator must carry out due diligence in three steps (information collection, risk assessment and risk mitigation) and submit a due diligence statement (DDS) whose reference number is entered on the customs declaration. Once you know you are an operator, this is the next step. It is the most labour-intensive part of the EUDR, and the point where European customers press their Asian suppliers hardest for data.

Key takeaways

• EUDR due diligence has three steps: information collection (Article 9), risk assessment (Article 10) and risk mitigation (Article 11); the system must be reviewed at least once a year (Article 12).
• Geolocation needs six decimal digits; plots of more than four hectares (other than cattle) need polygons; uploads are GeoJSON only, up to 25 MB per DDS.
• One DDS can cover multiple shipments and products for up to one year (FAQ 5.19).
• Implementing Regulation (EU) 2026/1565, in force from 17 July 2026, adds DDS grouping, ERP integration and contingency arrangements.
• Certification is not a “green lane”, and mass balance models are not acceptable under the EUDR.

What are the three steps of EUDR due diligence?

Under Article 8 of the EUDR, due diligence consists of:

1. Information collection (Article 9)
2. Risk assessment (Article 10)
3. Risk mitigation (Article 11)

Operators must also establish and maintain a “due diligence system”, review it at least once a year, and keep records of updates for five years (Article 12(1) and (2)). Non-SME operators must additionally appoint a compliance officer at management level and have an independent audit function (Article 11(2)).

Step 1: what information must operators collect (Article 9)?

For each relevant product, EUDR operators collect, organise and keep for five years the following, with evidence:

Article 9(1)(d) contains a critical sentence: any deforestation or forest degradation on a plot of land disqualifies all commodities and products from that plot.

What are the EUDR geolocation requirements?

EUDR geolocation data must meet five technical specifications:

• Precision: latitude and longitude with at least six decimal digits (Article 2(28)).
• Points or polygons: plots of more than four hectares used for commodities other than cattle must be described with polygons; smaller plots may use a single point.
• Cattle: geolocation covers all establishments where the animals were kept, from birthplace until slaughter (Guidance, section 9).
• File format: the Information System accepts only GeoJSON for file uploads (FAQ 7.26).
• File size: a DDS is limited to 25 MB, enough for more than one million points. If exceeded, use points for plots under four hectares or simplify polygon vertices (FAQ 7.16).

Step 2: what does risk assessment cover (Article 10)?

Article 10(2) of the EUDR lists 14 risk assessment criteria, including:

• The country benchmarking tier of the country of production (part 3)
• Presence of forests and indigenous peoples
• Prevalence of deforestation, corruption, document falsification and weak law enforcement
• Supply chain complexity and difficulty of linking products to plots of land
• Risk of mixing with products of unknown origin or of circumvention
• Substantiated concerns received
• Complementary information from certification or third-party verified schemes

Section 5 of the Guidance offers questions to gauge complexity: how many processors and intermediaries, how many plots and countries of production, how highly processed, whether timber was traded through several countries. Any unidentified step in the supply chain can lead to a conclusion that risk is not negligible.

Step 3: risk mitigation (Article 11)

Under Article 11 of the EUDR, if the assessment does not show no or negligible risk, the operator must adopt mitigation measures before placing the product, until risk is negligible. Measures can include:

• Requesting additional information, data or documents
• Independent surveys or audits
• Supporting suppliers, in particular smallholders, through capacity building

If risk remains non-negligible after mitigation, the product cannot be placed.

How far legality checks need to go

Section 6 of the Commission’s EUDR Guidance explains that “relevant legislation of the country of production” means only laws concerning the legal status of the area of production, not every law applying during production. Examples are rules on land transfer and leases, protected areas, timber harvesting rights and indigenous land rights.

In its simplification review, the Commission announced repositories of producer-country legislation and of certification schemes. Where a first examination of available information indicates negligible risk, operators should not need in-depth data collection (COM(2026) 191).

Certification is not a green lane

Certification schemes such as FSC, PEFC and RSPO can complement EUDR risk assessment, but section 10 of the Guidance is clear:

• Certification does not replace the operator’s due diligence and is not a “green lane”.
• The scheme must meet Article 9 information requirements, including plot-level geolocation and the 31 December 2020 cut-off.
• Mass balance models mixing certified and uncertified material are not acceptable under the EUDR.

What goes into a DDS (Annex II)?

A due diligence statement must contain the information set out in Annex II of the EUDR:

1. Operator name and address; EORI number for imports and exports
2. HS code, description (trade name, scientific name where applicable) and quantity
3. Country of production and geolocation of all plots of land
4. Declaration that due diligence was carried out and no or only negligible risk was found
5. Signatory, date and function

The system issues a reference number, which the customs declarant enters on the import or export declaration (Article 26(4)).

Filing strategy: one DDS can cover up to a year

The Commission’s EUDR FAQ 5.19 confirms that one DDS can cover multiple shipments and products for up to one year, provided that:

• Declared quantities cover everything actually placed; once used up, a new DDS is needed.
• In principle, commodities should already have been produced at filing; with stable plots and unchanged conditions, filing before harvest is possible.
• Finished goods need not yet exist. For wooden furniture, the trees should have been harvested, but the furniture need not yet be made.
• The same product must not be covered by several DDS from the same person.

The latest filing point is before the customs declaration is lodged (FAQ 5.20); the earliest is once due diligence is complete and all information is available (FAQ 5.21).

New Information System features (2026/1565)

In July 2026 the Commission adopted Implementing Regulation (EU) 2026/1565, amending the Information System rules in Implementing Regulation (EU) 2024/3084:

• Grouping: a new DDS can reference several earlier DDS and replace them with a single reference number, addressing file size limits and customs workflows (new Article 8a).
• System integration: web services with common technical specifications allow automated submission from ERP systems.
• One user, one registration: a unique identifier is required and registration data must be kept current.
• Contingency arrangements: if the system is unavailable, contingency reference numbers and contingency declaration identifiers keep operators compliant.
• Timing: in force from 17 July 2026; revised rules on attributing DDS to competent authorities apply from 15 October 2026.

The “EUDR data pack” suppliers should prepare

Suppliers to EU customers should prepare an EUDR data pack for each product line, covering:

1. Product list: HS/CN codes, product names, scientific names of wood species
2. Origin table: country of production and suppliers for each relevant commodity, including upstream tiers
3. Geolocation files: GeoJSON, six decimals, polygons above four hectares
4. Production periods: harvest or production date ranges per batch
5. Legality documents: land rights, harvesting permits, certificates and audit summaries
6. Segregation evidence: records showing EUDR inputs are physically separated from other sources

The more complete your data pack, the easier it is for customers to file their DDS, and the stronger your position on their supplier list.

FAQ

Can one DDS cover several shipments?

Yes. FAQ 5.19 confirms that one DDS can cover multiple shipments and products for up to one year, provided the declared quantities cover everything actually placed. Once the quantities are used up, a new DDS is needed.

What geolocation format does the EUDR Information System accept?

The Information System accepts only GeoJSON for file uploads (FAQ 7.26). Coordinates need at least six decimal digits, plots of more than four hectares (other than cattle) need polygons, and a DDS is limited to 25 MB.

When must a DDS be filed?

The latest filing point is before the customs declaration is lodged (FAQ 5.20), and the earliest is once due diligence is complete and all information is available (FAQ 5.21). The DDS reference number is then entered on the import or export declaration (Article 26(4)).

Does FSC or PEFC certification replace EUDR due diligence?

No. Section 10 of the Guidance states that certification does not replace the operator’s due diligence and is not a “green lane”. Mass balance models mixing certified and uncertified material are not acceptable under the EUDR.

What happens if risk remains after mitigation?

If risk remains non-negligible after mitigation, the product cannot be placed on the EU market or exported (Article 11). Any unidentified step in the supply chain can lead to a conclusion that risk is not negligible.

The series

1. EUDR in 2026: Seven Things to Know Before 30 December, After Two Rounds of Amendments
2. Which Role Are You? Determining Roles Under the EUDR: Operator, Downstream Operator, Trader, MSPO and Authorised Representative
3. Taiwan Is “Standard Risk”: What EUDR Country Benchmarking Means in Practice
4. EUDR Due Diligence and DDS in Practice: Geolocation, the Information System and Filing Strategy
5. The New EUDR Product Scope: What Delegated Regulation 2026/2102 Removed and Added
6. The ZC Methodology: An EUDR Compliance Roadmap from Scope Screening to Annual Maintenance

Next: The new product scope, what Delegated Regulation 2026/2102 removed and added.

Need help building a data pack or a DDS workflow? Book a 30-minute consultation.

This article provides general information and does not constitute legal advice.

Sources

• Regulation (EU) 2023/1115, consolidated, Articles 2, 8 to 13, 26, Annex II
• Implementing Regulation (EU) 2024/3084
• Implementing Regulation (EU) 2026/1565
• EUDR Operator API documentation (TRACES)
• European Commission EUDR FAQ, version 5: 5.19 to 5.21, 7.16, 7.26
• European Commission EUDR Guidance Document C/2026/3896, sections 5, 6, 9, 10
• COM(2026) 191 simplification review

Sources · Regulation (EU) 2023/1115, consolidated · Implementing Regulation (EU) 2024/3084 · Implementing Regulation (EU) 2026/1565 · EUDR Operator API documentation (TRACES) · COM(2026) 191 simplification review. This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.

EUDREU Deforestation Regulationdue diligencedue diligence statementDDSgeolocationGeoJSONInformation System