Who Must Register in the EUDR Information System?

Registration follows the business's legal role

Operators that must submit due diligence statements need the appropriate registered access to the EUDR Information System. The simplified declaration route also requires the relevant system arrangements for qualifying micro or small primary operators, unless a Member State makes the prescribed existing information available under Article 4a(4). Separately, Article 5(2) expressly requires non-SME downstream operators and non-SME traders to register before their covered placing, making available or export activity.

That final requirement is easily misunderstood. Registration by a large downstream business is not the same as a duty to submit a fresh due diligence statement for every purchase. The revised actor model separates the operator's statement obligation from downstream information and cooperation duties. A company's registration project should follow that distinction rather than an older software workflow designed around universal downstream resubmission.

Establish the legal entity and activity first

Start with the entity that conducts the transaction. A group brand, warehouse address or purchasing department is not necessarily the legal operator. Record the company's legal name, establishment, identification details and activities for each product flow. Then determine whether it is an operator, downstream operator or trader, and whether the relevant size category changes its registration duties.

For example, a large EU distributor buying covered products already placed on the market by an operator may be a non-SME trader. It must register under Article 5(2), but ordinarily collects the information specified by Article 5 rather than making the operator's declaration again. If that same entity directly imports a different covered product, its operator role for that flow creates a different submission workflow.

Do not assume that every subsidiary can use the parent's identity simply because both share an enterprise software system. The Information System framework connects registration, authority attribution and statement responsibility to the actual regulated entity. Document group arrangements before creating accounts that staff will later have to unwind.

EU Login is an authentication layer

A personal EU Login identifies an individual user of Commission services. It should not be confused with the operator's legal identifier, the organisation's registration record or the reference number of a statement. A staff member may authenticate successfully but still lack permission to act for the correct organisation in the EUDR platform.

The amended implementing rules provide for a single Information System account with different roles under it. Set access according to the work people actually perform, and keep the registration information current. Shared personal passwords weaken traceability and make it harder to remove access when a staff member leaves. Use the supported organisational access arrangements rather than creating uncontrolled duplicate identities to work around a permissions problem.

Representatives and primary operators

An authorised representative may submit on the operator's behalf under the applicable mandate. That arrangement does not move the operator's underlying responsibility to the software provider or consultant. Confirm who is represented, which activities are authorised and how the operator receives the final submission record and identifiers. A representative working for several clients must select the correct operator context for each action.

The Article 4a route requires a separate eligibility assessment. A micro or small primary operator is not simply any micro or small business. Where a Member State uses information already available in a legally established database, the primary operator still needs the declaration identifier before the relevant placing or export. A national database entry alone should not be treated as proof that the necessary system step has been completed.

Timing and preparation

Registration should be ready before the activities to which the obligation applies. The current general substantive application date is 30 December 2026, with the later date for most qualifying micro and small operators subject to the exact Article 38 rules. System availability before those dates supports preparation; it does not mean every obligation started when an account was opened.

Allow practical time to verify entity details and user permissions. If the business needs both acceptance access for training and production access for legal submissions, manage them separately. A successful training login does not demonstrate that the production organisation is registered or that the intended production user has the appropriate role.

A registration completion check

Before signing off readiness, ask a user to confirm the displayed organisation, identifier, permissions and environment. Check who maintains company information after a merger, address change or staff departure. Keep the decision explaining why the entity registered as an operator, a non-SME downstream operator or a non-SME trader, together with the date and the person who reviewed it.

Where registration fails, diagnose the identity and permissions layers before duplicating the organisation. The system error guide distinguishes account access, business validation and submission problems. That distinction saves time because an invalid organisation context cannot be fixed by changing a product's coordinates, and a valid organisation account does not guarantee a statement's content is complete.

Keep an access owner for each registered entity. That person should know how to approve new staff, review existing roles and arrange access removal without interrupting the company's ability to retrieve records. Periodically compare the authorised users with current responsibilities. A former consultant's continuing access and a new employee's missing permissions are different problems, but both can result from treating registration as a one-off technical task.