EUDR Compliance System: How Precise Geodata Secures Market Access and Reduces Supply Chain Risks

The EU Deforestation Regulation makes market access conditional on one document: a due diligence statement filed in the EUDR Information System before a covered product is placed on the EU market or exported from it. Large and medium companies file from 30 December 2026, micro and small operators from 30 June 2027.

Who must comply with the EUDR, and by when?

The regulation covers seven commodities, cattle, cocoa, coffee, oil palm, rubber, soya and wood, plus the products derived from them, including leather, chocolate, furniture, paper, charcoal and printed matter. If a company places any of these on the EU market under its own name or exports them, it is an operator and owes a full due diligence statement. A company that only buys and resells goods already on the market is a trader, and the depth of its obligation depends on its size.

I have covered this in more depth here: Satellite Deforestation Monitoring for EUDR: Tools and Plot Data.

The classification decides more than the deadline. A mid-sized roaster importing green coffee is an operator even though it never sets foot on a farm, and it carries the geolocation obligation for every plot behind every lot.

What must the geolocation data look like?

This is where most EUDR programmes are won or lost, and it is the part vendor pages describe least precisely.

• Coordinates in decimal degrees, WGS84, with at least six decimal places. Latitude between -90 and +90, longitude between -180 and +180.
• A single point for plots of four hectares or less and for livestock establishments.
• A polygon of at least four coordinate points for plots larger than four hectares, exchanged as GeoJSON.
• Every plot linked to the supplier that farms it and to the lot it delivered into.
• The whole set retained for at least five years from the date the product was placed on the market.

The last point is the one that turns a plot list into supply chain mapping. Coordinates on their own prove nothing; what a competent authority asks is which plot fed which lot through which supplier. Companies that already run structured supplier data for compliance mostly need to extend it by a plot level, not to start over.

How do you get from supplier data to a submitted due diligence statement?

Four steps, in this order, and only the fourth one produces the document that grants market access.

1. Gather information: commodity, quantity, country of production, plot geolocation, supplier identity and evidence that production was legal under the law of the country of origin.
2. Assess risk: check the collected data against the cut-off date of 31 December 2020, country risk class, complexity of the chain and any indication of illegal harvesting.
3. Mitigate: where risk is more than negligible, gather additional evidence, audit or drop the plot, then reassess.
4. Submit: file the statement in the EUDR Information System and receive a reference number and a verification number, which are passed to downstream operators and quoted at customs.

Two practical limits shape the design. Statements can be filed in bulk through the system's API rather than one by one, which matters as soon as plot counts run into the thousands. And a single statement is capped at roughly 25 MB, around 30,000 to 40,000 coordinate points, so large networks split one shipment across several statements and have to keep the reference numbers straight afterwards.

What does simplified due diligence actually remove?

The Commission classifies producing countries as low, standard or high risk, and for goods from low-risk countries operators may apply simplified due diligence. The relief is narrower than the name suggests: it removes the risk assessment and mitigation steps, steps two and three above. It does not remove the geolocation obligation, the information gathering or the statement itself.

Low risk is also not a permanent verdict on a given lot. If an operator obtains information pointing to deforestation after 31 December 2020, or to illegal production, the full procedure applies again for that consignment, whatever the country classification says.

Where EUDR compliance data projects fail, and when to build instead of buy

The failure modes I see in geodata projects are dull and repetitive, which is exactly why they are worth naming. Supplier plot data arrives as a scanned hand-drawn map or a PDF sketch instead of coordinates. The same plot appears under different IDs from two suppliers, so one field is counted twice. And coordinates land in the sea or in the wrong hemisphere, usually because latitude and longitude were transposed or a decimal separator was lost in an export.

Before I call a supplier's geodata good enough to file, it has to pass three checks: every plot resolves to a location on land inside the stated country of production, every plot carries one named supplier and one lot, and the underlying evidence document exists and can be produced on request. Data that fails any of the three is not a small quality issue, it is a statement you cannot defend.

If you want to go deeper: Scope 3 Supply Chain Tracking: From Data Sources to a Workable Approach.

On building versus buying: I have built compliance tooling myself, and the deciding question is not the feature list. It is whether the system stores the evidence and its provenance, or only the resulting green flag. A handful of plots and stable suppliers can be run in a controlled spreadsheet plus a document archive. Hundreds of suppliers delivering in a dozen formats need bought infrastructure, and the selection criterion should be evidence handling, not dashboards. The same logic applies to other supply chain risk data you already collect.

Frequently asked questions