Filed under EUDR Due Diligence Explained: Information, Risk and Compliance
Plot record: legal status and review details
- Jurisdiction
- European Union
- Status
- Current consolidated Regulation (EU) 2023/1115, including the 2025 amendment and September 2026 consolidation. Main obligations are not yet generally applicable on the verification date.
- Application
- Generally 30 December 2026; 30 June 2027 for eligible micro and small operators, subject to the timber exception; some newly added products apply from 30 December 2027. Check the product and actor-specific rules.
- Relevant provisions
- Articles 4, 10, 11 and 12
Review this page when:
- Amendments to Articles 3 to 13
- New Commission due diligence guidance or FAQs
- Changes to country benchmarking
- Application dates and product-scope changes
Controls should prevent an unsupported release
EUDR internal controls are the procedures that make the operator's evidence and risk decisions work in daily purchasing, stock handling and sales. Article 11 requires adequate, proportionate policies, controls and procedures to manage identified non-compliance risks. The practical objective is to prevent a relevant product from proceeding when the applicable compliance requirements have not been met.
The due diligence system needs clear responsibility for data collection, evaluation, mitigation, statement submission and release. A policy saying suppliers must comply is weak if staff can dispatch stock before evidence is reviewed. Controls should address how that could happen, who would detect it and what action follows.
For non-SME operators, Article 11 specifically includes a compliance officer at management level and an independent audit function to check the relevant internal policies, controls and procedures. Smaller operators still need adequate and proportionate controls; their size does not remove the product conditions. Distinguish these governance requirements from the different revised duties for downstream operators and traders.
Control data quality and identity
Use stable identifiers for products, suppliers, production sources and lots. The same supplier may trade under several names, while similar farm names may refer to different places. Reconciliation rules should prevent records for one entity or plot from being accepted as evidence for another. Keep changes visible rather than silently overwriting the earlier data.
Check mandatory fields, units, date sequences and geographical plausibility. Coordinates in the sea, production after dispatch or a net-mass field filled with gross container weight should trigger investigation. Automated validation is helpful for these objective errors. It cannot by itself determine whether a land-use arrangement is legally valid or a historical land classification is correct.
Set an exception process. A reviewer should record the issue, the evidence requested, its resolution and any effect on the release decision. Avoid an override button that changes a warning to approved without preserving the reason and authorisation. Where a control produces too many false alerts, improve it while retaining coverage of the underlying risk.
Separate evidence, decision and dispatch
Assign release authority to a defined role and make the approved status visible to the teams moving the goods. A purchase order's approval is not automatically an EUDR product release. The latter depends on the relevant information, supported no or negligible risk conclusion, and required ordinary statement submission before placement or export.
Consider practical separation of duties where proportionate. A buyer under pressure to meet a deadline may gather evidence, while another qualified reviewer examines unresolved concerns. A small business may not have separate departments, but it can still document a deliberate second check for material exceptions. The appropriate design depends on actual risks and resources.
Ensure holds follow stock movements. If a lot is split, relabelled, transferred or processed, the control should preserve its status and evidence connection. Test whether employees can bypass a hold through a different order type, warehouse or manual spreadsheet. Such a bypass can matter more than the quality of the written policy.
Monitor mixing, changes and submissions
Quantity controls should connect recorded inputs, processing outputs and allocations to covered goods. Unexplained excess output or repeated allocations beyond available quantity require review. Account for legitimate yield and unit differences, but retain the explanation. A source balance should not create artificial certainty where unknown material can physically enter the same pool.
Supplier and origin changes need a trigger before release. Require relevant notification, compare the new flow with the accepted one and determine what evidence must be refreshed. The control should also detect changes initiated internally, such as substituting a component or warehouse, rather than relying entirely on supplier declarations.
For ordinary statement submissions, check that the product, quantities and origins align with the approved evidence and intended coverage. A reference number proves neither a sound assessment nor authority approval. Control access to submission accounts and preserve the submitted record. Build a documented response to system errors using current official procedures, rather than permitting employees to invent local fallback references.
Test controls against realistic failure cases
Select a successful transaction and trace it through evidence, assessment, statement and release. Then test exceptions: a changed plot, missing origin, expired relevant permission, unresolved rights concern and mixed stock. Ask whether the controls stop the affected goods, identify the responsible person and preserve a decision trail. Testing only easy approved purchases can miss the weaknesses that matter.
An independent audit function for non-SME operators should examine whether controls operate, not merely whether documents exist. Record findings, owners, corrective actions and verification of closure. Independence must be real enough to challenge the process being reviewed. An external supplier certificate does not automatically satisfy the requirement to check the operator's own internal controls.
Use findings to improve the system and its training. The system-building process should incorporate those changes and preserve update records. Annual review is required, with earlier action for relevant new developments. Verify governance and review duties against Articles 11 and 12. Effective controls make a supported compliance decision a condition of release, rather than a document assembled after the goods have gone.
Primary sources on the record
Articles 4, 10, 11 and 12. This entry was checked against the consolidated text dated 18 September 2026. Consolidated texts are documentation tools; the authentic acts are those published in the Official Journal.
Check the current sources and the guidance of the relevant competent authority for your situation. This page is not legal advice or a compliance determination.