Supplier Risk Under EUDR

Filed under EUDR Risk Assessment and Mitigation Explained

Plot record: legal status and review details

Jurisdiction: European Union
Status: Current consolidated Regulation (EU) 2023/1115, including the 2025 amendment and September 2026 consolidation. Main obligations are not yet generally applicable on the verification date.
Application: Generally 30 December 2026; 30 June 2027 for qualifying micro and small operators established by 31 December 2024, except products covered by the EUTR; selected new Annex I entries apply from 30 December 2027. Check actor and product-specific rules.
Relevant provisions: Articles 2(26), 3, 4, 5 and 9 to 13

Review this page when:

Amendments to Articles 2 to 13
Updated Commission guidance or FAQs
Changes to country benchmarking or production origins
New evidence, substantiated concerns or supply-chain changes

Assess the supplier as part of the product chain

Supplier risk concerns whether the business supplying relevant products can provide reliable evidence and maintain controls that support EUDR compliance. It belongs within an assessment of the actual goods. A supplier can have excellent procedures for one sourcing programme and unresolved weaknesses in another, so approval of the legal entity should not automatically approve every origin and purchase.

Article 10 makes information reliability, chain complexity, mixing and histories of non-compliance relevant to the operator assessment. These criteria allow scrutiny of supplier conduct without inventing a separate statutory supplier certification. The risk assessment and mitigation framework links those findings to the release decision for defined products.

Begin by establishing what the supplier does. A producer, collector, processor and export agent have different visibility and controls. The contracting company may never handle the commodity physically. Identify which business maintains the producer register, controls purchases, stores mixed material and supplies the records used to connect the finished goods with production.

Test capability and evidence ownership

Ask the supplier to demonstrate how an actual lot is assembled from its records. Follow origin identifiers from production evidence through purchase, transport, storage and processing. This is more revealing than accepting a policy describing an ideal process. Determine who checks incoming data and what happens when farm boundaries, production periods or quantities do not reconcile.

Check whether information is first-hand, independently verified or repeatedly passed along. A supplier may be responsive while merely forwarding another intermediary declaration. The operator needs to understand the source and limitations of the evidence. Copies of the same underlying assertion do not become independent confirmation because several different businesses have signed covering letters.

Assess the handling of changes. New farms, emergency purchases and subcontracting often introduce risk into otherwise stable arrangements. Request records showing when a new source was approved, what evidence was checked and which lots received its material. If the supplier cannot distinguish old and new source sets, a historical approval may be applied beyond its evidential scope.

Use history without making it destiny

Article 10 includes information on previous EUDR non-compliance among operators and traders in the relevant chain. Examine what happened, which goods and processes were affected and whether corrective actions were effective. A repaired data-entry weakness and a repeated pattern of fabricated origins require different responses, even if both appear under a generic incident heading.

Credible concerns from workers, communities, authorities or other sources also deserve evaluation. Give the supplier a fair opportunity to explain discrepancies, but do not treat denial as resolution. The relevant question is whether objective evidence addresses the concern and its connection to the products. Preserve both the concern and the response in the assessment record.

Commercial behaviour can guide investigation without itself proving non-compliance. A refusal to identify supplying farms, unexplained document changes or pressure to ship before verification can indicate that more work is needed. Conversely, long trading history and prompt replies do not establish that a new plantation is deforestation-free or that an unresolved land claim has disappeared.

A supplier with two sourcing programmes

Imagine a rubber exporter running a mapped direct-purchase programme alongside purchases from local collectors. The exporter submits the direct-programme farmer file for every customer. The operator should establish whether its intended products were made solely from that programme, and how the exporter prevents collector material from entering the same processing and storage stream.

If records show separate identified inputs, controlled production runs and reconciled output, those controls can be assessed. If processing pools are shared without a reliable source connection, a customer allocation in the sales system may not establish the origins of the actual product. The favourable direct-programme file cannot simply be extended to the entire export business.

Mitigation might involve independent review of intake records, checking the collector network, obtaining missing production evidence or using a demonstrably segregated product stream. Supplier capacity building can improve purchase recording and mapping, particularly for smallholders. However, an improvement project scheduled for the next season does not resolve missing evidence for goods awaiting the present decision.

Make supplier findings operational

Convert findings into precise purchasing conditions: permitted source sets, required evidence, advance notice of changes and controls over outsourced processing. Such conditions are practical measures, not statutory safe harbours. Test their implementation and specify what evidence is needed before lifting a hold. A contractual promise alone cannot remove a demonstrated product risk.

Use deforestation prevalence analysis to target geographical questions instead of judging all suppliers through a uniform national score. A supplier operating near a changing forest frontier may need stronger source verification than its other operations. Equally, satisfactory local evidence should be evaluated on its merits rather than dismissed through a broad sector stereotype.

Keep roles accurate. Operators exercising full due diligence assess their relevant products; downstream operators and traders have distinct Article 5 obligations, including specified responses to concerns. For the operator decision, document the remaining product risk after mitigation. If it is more than negligible, changing the supplier rating to conditionally approved does not authorise placing those goods on the market or exporting them.

Primary sources on the record

Articles 2(26), 3, 4, 5 and 9 to 13. This entry was checked against the consolidated text dated 18 September 2026. Consolidated texts are documentation tools; the authentic acts are those published in the Official Journal.

Check the current sources and the guidance of the relevant competent authority for your situation. This page is not legal advice or a compliance determination.