EUDR due diligence: the three steps and DDS requirements

The EUDR due diligence process in three steps

These are not internal labels. They come from Article 8 of the EU Deforestation Regulation, which defines due diligence as the three actions below. The links open the relevant provisions in the current consolidated legal text.

Step 1: information required for EUDR due diligence

Article 9 sets the minimum information. A supplier certificate or purchase order is not enough. The records must connect the exact product to its production origin and support both the deforestation-free and legality findings.

Step 2: carry out and document the risk assessment

An EUDR risk assessment is not a supplier score alone. It tests whether the Article 9 evidence supports compliance for the particular products and supply chain. The conclusion must be documented and reviewed at least annually, and whenever relevant information changes.

Step 3: mitigate risk before the product proceeds

Risk mitigation must be adequate and proportionate to the problem found. It may mean obtaining stronger documents, checking source data, commissioning an independent survey or audit, changing controls, separating uncertain material, or helping a supplier produce reliable evidence.

Record the concern, the action taken, the new evidence, and why the remaining risk is negligible. A mitigation log that ends with “accepted by compliance” but does not explain the decision is difficult to defend.

Simplified due diligence is not no due diligence

Where all relevant products and commodities covered by the assessment were produced in countries or regions classified as low risk, Article 13 relieves the operator of the Article 10 risk assessment and the Article 11 mitigation steps — and of nothing else. The Article 9 information still has to be collected, and a normal Due Diligence Statement is still submitted under Article 4.

This is not the same as the simplified declaration. That is a separate regime under Article 4a, available only to micro and small primary operators, which file a one-time declaration and may give the postal address of their plots or establishment instead of geolocation. A standard operator sourcing from a low-risk country does not qualify for it.

If new information or a substantiated concern indicates possible non-compliance or circumvention, the operator must complete the full process. Country classification does not override contrary evidence about a product or supply chain.

What goes into an EUDR Due Diligence Statement?

A DDS is a structured declaration submitted through the EUDR Information System. Per Annex II it identifies the operator, the relevant product, the quantity, the country of production, and the geolocation of every relevant plot or cattle establishment. It also records the operator’s declaration that due diligence was carried out and found no or only negligible risk.

The production date or time range is not among the submitted fields. It is Article 9 information the operator must collect, organise, and keep for five years — so an implementation should hold it in the due diligence record and must not require or validate it as part of the submission payload.

Submit the DDS or simplified declaration before placing the product on the market or exporting it. For imports, its reference number or declaration identifier must be available before the customs declaration is lodged. One DDS may cover several batches or shipments, but not more product than the quantity it declares.

Certification can support the evidence. It cannot replace the process.

Certification and third-party verification can be useful supporting information. They may help establish production practices, chain of custody, or legality. They do not transfer the legal responsibility away from the operator.

Check what the scheme actually verifies, whether it covers the same product and production land, how current the evidence is, and whether it addresses every applicable EUDR requirement. Include it as one part of the documented assessment rather than treating the certificate as the conclusion.

Worked example: one coffee shipment

Due diligence system, records, and review

Non-SME operators also have public reporting and stronger internal-control requirements. The system should show who owns compliance decisions, how evidence is checked, how exceptions are escalated, and what prevents an unapproved product from proceeding.

Common questions

What does negligible risk mean under EUDR?

Under Article 2(26), negligible risk is the conclusion reached after assessing the product-specific and general information, and applying mitigation where needed, when there is no cause for concern that the product is not deforestation-free or was not produced in accordance with the relevant laws of the country of production. It is not a numeric threshold. Unresolved gaps, contradictions, unreliable evidence, or credible concerns mean the risk is not yet negligible.

What are the three steps of EUDR due diligence?

The three steps are collecting the information required by Article 9, assessing the risk of non-compliance under Article 10, and mitigating any risk that is more than negligible under Article 11. An operator must reach no or only negligible risk before placing a relevant product on the EU market or exporting it.

What must an EUDR due diligence statement contain?

Per Annex II, a DDS identifies the operator, the relevant product and commodity, the quantity, the country of production, and the geolocation of every production plot or cattle establishment. It also includes the operator's declaration that due diligence was carried out and found no or only negligible risk. The production date or time range is an Article 9 information requirement that the operator collects and retains — it is not a field in the submitted statement. The evidence and assessment behind the declaration likewise remain in the operator's due diligence system.

What is simplified due diligence under EUDR?

Two different things are often confused. Simplified due diligence under Article 13 applies when all relevant commodities and products covered by the assessment were produced in countries or regions classified as low risk: the operator is relieved only of the Article 10 risk assessment and the Article 11 mitigation steps. The Article 9 information must still be collected, and a normal DDS is still submitted under Article 4. Separately, the one-time simplified declaration under Article 4a is available only to micro and small primary operators, which may give the postal address of the plots or establishment instead of geolocation. If relevant information or a substantiated concern indicates possible non-compliance or circumvention, the full risk-assessment and risk-mitigation process must be completed.

Can certification replace EUDR due diligence?

No. Certification and third-party verification may support the evidence, but they do not replace the operator's legal responsibility. The operator must still collect the required information, assess risk, mitigate any risk that is more than negligible, and submit the applicable DDS or simplified declaration.

How long must EUDR due diligence records be retained?

Operators must retain due diligence records for five years from the date a relevant product is placed on the EU market or exported. This includes the information collected, risk assessments, mitigation decisions, procedures, and updates to the due diligence system.

Can one EUDR DDS cover multiple shipments?

Yes. One DDS can cover multiple batches or shipments when all products are covered by the due diligence and the legal requirements are met. Once the quantity covered by that DDS has been used, a new DDS is needed for additional quantities.

When must an EUDR DDS be submitted?

The applicable DDS or simplified declaration must be submitted before the relevant product is placed on the EU market or exported. For imports, the reference number or simplified-declaration identifier must be available before the customs declaration is lodged.

Do downstream operators and traders repeat upstream due diligence?

Not automatically. Under the current framework, non-SME downstream operators and traders must verify upstream due diligence when they obtain or become aware of information indicating a substantiated concern. They must not place, make available, or export the product unless that verification shows no or only negligible risk.

Continue your EUDR work

Need to map the operating process?