Filed under EUDR Due Diligence Explained: Information, Risk and Compliance
Plot record: legal status and review details
- Jurisdiction
- European Union
- Status
- Current consolidated Regulation (EU) 2023/1115, including the 2025 amendment and September 2026 consolidation. Main obligations are not yet generally applicable on the verification date.
- Application
- Generally 30 December 2026; 30 June 2027 for eligible micro and small operators, subject to the timber exception; some newly added products apply from 30 December 2027. Check the product and actor-specific rules.
- Relevant provisions
- Articles 4(3), 4a, 5, 9 and 12
Review this page when:
- Amendments to Articles 3 to 13
- New Commission due diligence guidance or FAQs
- Changes to country benchmarking
- Application dates and product-scope changes
There is more than one five-year clock
EUDR record retention is not governed by a single date for every document. Article 9 requires information and evidence to be kept for five years from placement on the market or export of the relevant products. Article 4(3) requires ordinary due diligence statements to be kept for five years from their submission through the Information System. Those events may occur on different dates.
Article 12 adds a requirement to keep due diligence documentation for at least five years, including records, measures and procedures under Article 8. It also requires records of system updates to be kept for five years. A retention schedule should identify each category and its trigger rather than deleting the entire supplier file five years after onboarding.
The due diligence system should preserve the connection between goods, evidence, assessment and statement. Retaining the statement alone leaves out the basis for the operator's declaration. Retaining a supplier's current documents alone may fail to show what evidence the operator actually checked before the relevant placement or export.
Define the records that explain the decision
An Article 9 evidence package includes descriptions, quantities, production countries, locations, production dates or ranges, supplier and required recipient identities, and evidence of deforestation-free status and relevant production legality. Retain the underlying information and its relationship to the relevant product. A spreadsheet containing file names is useful as an index but cannot replace inaccessible source documents.
Risk records should show the information evaluated, applicable criteria, concerns, conclusions and reviewer. Where mitigation was necessary, keep the selected measures, findings and reasons why the resulting risk was no or negligible. Records should distinguish a completed task from a resolved concern. An audit invoice, for example, does not provide the audit findings on which a release decision relied.
System records include the procedures used, changes made, review results and responsibilities. Preserve previous versions where needed to explain earlier transactions. If a revised procedure introduces a new evidence check, the business should be able to identify which procedure applied at the date of an older decision, without presenting the improved current version as though it had always existed.
Apply the clocks to an actual transaction
Suppose an ordinary operator submits a statement in November, then places the covered goods on the market in December. The statement retention period runs from its submission date. Article 9 information retention runs from the placement date. A document deletion rule based only on the earlier statement date could remove evidence before its Article 9 period has expired.
If reliable evidence is reused for later placements, those later transactions create their own relevant information-retention requirements. A historical land record initially collected years earlier may remain part of a later decision. Retaining it only until five years after its original upload would not necessarily preserve the evidence for five years after the later placement.
A practical system can link shared evidence to all decisions that rely on it and calculate the latest applicable retention requirement. Keep the legal minimum distinct from any justified longer retention for other requirements, disputes or authority requests. Do not assume the EUDR itself imposes a universal indefinite retention period; identify the basis for any extended schedule.
Preserve usability, access and integrity
Evidence must remain available to competent authorities on request. Choose formats and systems that preserve readability, source information and the links between records. An encrypted archive is useful only if the business retains the keys and can retrieve the required material. A scanned document should remain readable enough to identify names, dates, plots and relevant conditions.
Supplier portals and commercial platforms can change ownership, access terms or file versions. Agree export rights and preserve the evidence needed for your own obligations. A broken web link to a supplier's certificate is not equivalent to a retained copy of the record checked at the time. Where online data is dynamic, preserve a dated record of the information relied upon and how it was verified.
Restrict editing and retain correction history. If a plot coordinate is corrected, keep the original entry, the correction, its reason and affected decisions. Backups should protect against accidental loss, while access controls should reflect commercial sensitivity and applicable data-protection requirements. Retention is not a reason to give every employee unrestricted access to producer identities and location information.
Test retrieval and recognise different actor rules
Test retrieval using a specific lot or transaction, not just a supplier name. A reviewer should be able to move from the product to its origins, evidence, risk decision and required reference, and then identify relevant recipients. Check whether older software codes, staff departures or reorganised folders break the connection. Resolve those weaknesses before an authority request makes them urgent.
Article 4a exempts qualifying micro or small primary operators from the specified ordinary statement retention provision and establishes their distinct declaration regime. Downstream operators and traders have separate Article 5 record duties. Do not copy the ordinary operator schedule to every actor without considering those differences, and do not interpret one exemption as removal of every evidence or compliance responsibility.
Connect retention management to the annual system review. Check expiring records, unresolved concerns, supplier access and restoration from backups. Use the current Articles 4, 9 and 12 to identify the exact minimums. A defensible archive allows the business to reconstruct what it knew, what it checked and why it released the specific goods.
Primary sources on the record
Articles 4(3), 4a, 5, 9 and 12. This entry was checked against the consolidated text dated 18 September 2026. Consolidated texts are documentation tools; the authentic acts are those published in the Official Journal.
Check the current sources and the guidance of the relevant competent authority for your situation. This page is not legal advice or a compliance determination.