The EU Deforestation Regulation (EUDR) requires every operator and trader placing covered commodities on the EU market to complete a three-step due diligence process — information gathering, risk assessment, and risk mitigation — before filing a Due Diligence Statement (DDS) through the EU Information System. This checklist covers all three steps for all seven EUDR commodity groups: rubber, timber, palm oil, soy, cocoa, coffee, and cattle. A digital, interactive version is available at /tools/supply-chain-template.
What is EUDR due diligence?
Under Regulation (EU) 2023/1115, operators and traders must demonstrate that commodities placed on the EU market are deforestation-free (using a December 31, 2020 cutoff) and legally produced. The obligation spans three articles: Article 9 (information gathering), Article 10 (risk assessment), and Article 11 (risk mitigation). Supporting evidence must be retained for five years.
Enforcement begins December 30, 2026 for large and medium operators. Micro and small enterprises follow on June 30, 2027. The regulation applies regardless of country risk classification — low-risk sourcing still requires full due diligence, though inspection rates differ (1% low-risk, 3% standard-risk, 9% high-risk).
What this template covers
Complete each section sequentially — risk assessment depends on Step 1, and mitigation must address risks identified in Step 2.
Step 1: Information Gathering (Article 9)
- Identify the product description, trade name, and CN/HS code against Annex I
- Record the quantity of the product (net mass and, where applicable, volume or number of items)
- Identify the country (and where applicable, sub-national region) of production
- Collect geolocation coordinates for all production plots — polygons for plots over four hectares, centroids for four hectares or less (WGS84/EPSG:4326, six decimal places)
- Record the date or time range of production (harvest period)
- Obtain the name, postal address, and email of each supplier in the chain
- Obtain the name, postal address, and email of each buyer (where known)
- Collect evidence that the product is deforestation-free, using a December 31, 2020 baseline
- Collect evidence of legality: land-use rights, environmental protection, labour rights, indigenous peoples' rights, FPIC, tax obligations, and anti-corruption laws
- Obtain relevant certifications or third-party verification (these inform risk assessment but do not replace the operator's own due diligence)
Step 2: Risk Assessment (Article 10)
- Assess whether the information gathered under Step 1 is sufficient and reliable
- Evaluate the risk classification assigned to the country or sub-national region of production by the European Commission
- Assess the prevalence of deforestation or forest degradation in the production region
- Assess the risk of forest degradation in addition to deforestation
- Evaluate legality risk: whether the relevant laws of the country of production are effectively enforced
- Assess supply chain complexity — number of intermediaries, mixing risk with unknown-origin material
- Evaluate circumvention risk, including transshipment via non-producing countries
- Assess conflict, corruption, and governance risks in the country of production
- Consider concerns regarding forced labour, indigenous peoples' rights, and local communities' rights
- Cross-reference geolocation data against satellite deforestation alert systems and land-use change data
- Document the risk assessment conclusion: negligible risk or non-negligible risk, with justification
- If risk is non-negligible, proceed to Step 3 before filing the DDS
Step 3: Risk Mitigation (Article 11)
- Request additional information, data, or documentation from suppliers to address identified gaps
- Conduct independent verification of supplier data (satellite screening, third-party field audits)
- Verify geolocation data through independent sources or ground-truth validation
- Confirm that the chain of custody uses physical segregation or identity preservation — mass balance is explicitly prohibited under the EUDR
- Where applicable, commission independent field surveys or site inspections at the production origin
- Document all mitigation measures taken, the evidence obtained, and the residual risk conclusion
- Reassess whether risk has been reduced to negligible — if non-negligible risk remains after mitigation, the product must not be placed on the EU market
How to use this template
Step 1: Begin with one product line and one origin country. Complete the information gathering section, recording which items you can substantiate with evidence and which have gaps. The gap list becomes your immediate action plan.
Step 2: Work through the risk assessment items with your compliance and sourcing teams. Where data is insufficient to assess a factor, treat it as a gap — not as "low risk by default." Document your reasoning for each conclusion.
Step 3: For any non-negligible risks, assign specific mitigation actions with responsible owners and deadlines. Re-run the risk assessment after mitigation is complete.
Step 4: Once all three steps are complete and risk is assessed as negligible, compile the data required for your Due Diligence Statement. Use the EUDR DDS Preparation Checklist to organize the filing fields.
How to implement this in your organisation
Assign ownership. Your compliance officer or sustainability manager owns this checklist and is accountable for driving the three-step due diligence process to completion. Supply chain managers and procurement staff contribute supplier data and evidence from the field; legal teams validate legality documentation. Refer to the relevant commodity-specific checklist for operational details on evidence collection for each commodity group.
Set the review cadence. Reassess the due diligence process quarterly and immediately when triggered by a new supplier entering the supply chain, a new production plot, or a country risk reclassification by the European Commission. Event-driven triggers — such as deforestation alerts in a sourcing region or sanctions changes — also require prompt reassessment.
Define your escalation path. Any non-negligible risk finding that cannot be mitigated under Article 11 halts DDS filing for the affected consignment. The responsible team member escalates unresolved findings to the export manager within 48 hours, documenting the risk factor, evidence gap, and proposed mitigation measures.
Connect to existing workflows. Integrate information gathering into your supplier onboarding and periodic supplier review processes so evidence collection begins before the first consignment. Link risk assessment outputs to your procurement decision-making, and store completed due diligence records alongside export documentation for the mandatory five-year retention period.
Who needs this template
- Compliance officers establishing or auditing EUDR due diligence processes across multiple commodities or origins
- Supply chain managers mapping upstream sourcing to plot level and coordinating data collection from suppliers and cooperatives
- Exporters preparing to demonstrate to EU buyers that their products meet EUDR evidence requirements
- EU importers (operators) who bear primary legal responsibility for filing a DDS with adequate evidence
What happens if I only source from countries the EU classifies as low-risk?
Low-risk classification reduces inspection rates to 1% of operators annually and permits simplified due diligence. It does not exempt operators from the process. Information gathering, risk assessment, and a DDS filing are still required. Operators must still demonstrate that commodities are deforestation-free and legally produced, even when sourcing exclusively from low-risk jurisdictions.
Can I rely on supplier certifications instead of conducting my own due diligence?
No. Certifications such as FSC, RSPO, or PEFC can inform your risk assessment — the EUDR allows this as one input. They do not replace the operator's obligation to gather information, assess risk, and file a DDS based on their own evidence. The operator placing the product on the EU market retains primary liability regardless of upstream certifications.
What traceability methods are permitted under the EUDR?
Physical traceability from production plot to point of import is required. Mass balance approaches — mixing compliant and non-compliant commodities based on ratios — are explicitly prohibited. Permitted methods are identity preservation (single source maintained through the chain) and physical segregation (compliant batches kept physically separate from unverified material).
How long must I retain due diligence records?
Five years from the DDS filing date. Records must be available to competent authorities on request. This includes raw geolocation data, satellite imagery, supplier documentation, the risk assessment with its reasoning, mitigation measures taken, and the DDS submission reference. Incomplete records are treated as a due diligence failure.
Ready to move from checklists to evidence-grade traceability? ResourceLedger helps operators and exporters build defensible due diligence records — from geolocation capture to deforestation screening — so every DDS you file can be substantiated on demand. Book a demo to see how it works for your supply chain.