EUDR Information System Evidence Checklist

Filed under EUDR Information System and Due Diligence Statements Explained

Plot record: legal status and review details

Jurisdiction: European Union
Status: Current amended law, with the substantive application dates distinguished from system operation.
Application: General application: 30 December 2026; most qualifying micro and small operators: 30 June 2027, subject to Article 38 exceptions and product-specific dates.
Relevant provisions: EUDR Articles 4, 4a, 5, 9 and 12; Implementing Regulation 2024/3084, as amended, Articles 4a, 5, 7, 8a and 10

Review this page when:

Amendment of the EUDR or Information System implementing rules
Commission system release, user manual or API specification change
Applicable obligation dates pass

Keep enough evidence to reconstruct the record

An effective EUDR Information System evidence file links the legal entity, approved declaration data, supporting due diligence conclusion, submission result and affected products. It should also preserve changes and any relevant communications. The checklist below is a practical record design, not a claim that the regulation mandates a separate screenshot or document for every suggested item.

Use the legal record type as the starting point. An ordinary statement, an Article 4a simplified declaration and a non-SME downstream registration have different purposes. Retaining a registration confirmation does not prove a particular import is covered by an ordinary statement. Equally, a downstream trader should not be asked to manufacture an operator's evidence file merely because its obligations include collecting prescribed information.

Identity and authority to act

Record the responsible legal entity, its role for the product flow and the basis of the selected declaration route. Keep the relevant registration details and establish which users or representatives are allowed to act for that entity. Where a representative submits, preserve the mandate and the arrangements for the operator to review and retain the resulting record.

A group company register can be useful where several related entities share staff or software. It should distinguish their identifiers and activities clearly. The practical test is whether a reviewer can explain why the entity shown in the submission is responsible for the actual transaction. A familiar brand name or common company email domain is not sufficient evidence of that relationship.

Approved information and source versions

Keep the product descriptions, relevant codes, quantities and units, country information and production locations used in the submission. Retain the source files and the version approved for use, especially where location data was transformed into GeoJSON or corrected before uploading. If staff calculated a mass or converted a unit, preserve a sufficient explanation to understand the result.

For an ordinary statement, connect the information to the completed due diligence and risk conclusion. For a simplified declaration, retain the eligibility assessment and the Annex III information, including the estimated annual quantity. The Information System guide explains why those files are different from merely exporting the final electronic form.

Submission outcome and identifiers

Record the environment, submission time, responsible user and outcome. Retain the ordinary reference number or the simplified declaration identifier in a clearly labelled field. Store the associated verification information with appropriate access controls. A training record should be unmistakably separate from a production record so it cannot be mistaken for evidence supporting a live transaction.

Do not record only that the data was sent. Where processing is incomplete or identifiers are not yet available, record the unresolved status and the action taken. A receiving team should be able to see whether it has a usable regulatory record for its purpose or only evidence that somebody started a submission. This distinction also helps investigate interrupted API requests without creating duplicates.

Product allocation and customer communication

Maintain the association between the submitted record and the goods it covers. Useful internal references may include purchasing orders, lots, production batches, deliveries and customs records, depending on the flow. Choose enough detail to reconstruct the association rather than collecting every available logistics document without a clear purpose.

Where the operator communicates reference numbers or declaration identifiers under Article 4(7), retain evidence of what was supplied and which products it related to. For downstream Article 5 records, distinguish purchases directly from operators from purchases from downstream operators or traders. The legal identifier-collection requirement is not identical in those two cases, although broader commercial traceability arrangements can be agreed.

Amendments, withdrawals and grouping history

For any attempted correction, keep the reason, changed information, relevant transaction events and system outcome. The ordinary statement amendment window and lockouts should be checked before action. If an authority is asked for a reasoned extension, retain the request and decision rather than relying on a staff member's recollection of a phone call.

Where the prescribed grouping mechanism is used, retain the individual-to-grouped identifier mapping and confirm that communications use the controlling identifier required by Article 8a. Simplified declaration updates retain their declaration identifier under the amended rules, so preserve the update history rather than assuming a stable identifier means the underlying information never changed. The September 2026 user guide describes deployed declaration version tracking, so retain the specific version used as well as its identifier.

Retention, access and a reconstruction test

Apply the relevant legal retention duty to each record category. Operators' due diligence and statement records and downstream Article 5 information have their own requirements. Do not assume the platform's personal-data retention rules replace the business's duty to keep required evidence. Plan access after staff departures, supplier changes and software migrations, and protect sensitive location and security information throughout.

Finish by selecting one actual or realistic sample transaction and reconstructing it without asking its original handler. Identify the responsible entity, reviewed origins, declaration, identifiers, affected products and subsequent changes. The system error guide helps investigate missing stages. If the exercise fails, fix that specific gap in the evidence process before treating the entire workflow as ready for routine release.

Primary sources on the record

EUDR Articles 4, 4a, 5, 9 and 12; Implementing Regulation 2024/3084, as amended, Articles 4a, 5, 7, 8a and 10. This entry was checked against the consolidated text dated 18 September 2026. Consolidated texts are documentation tools; the authentic acts are those published in the Official Journal.

Check the current sources and the guidance of the relevant competent authority for your situation. This page is not legal advice or a compliance determination.