EUDR traceability: plot geolocation, due diligence statements and the dates as amended

TL;DR

• EUDR traceability means linking every batch of cattle, cocoa, coffee, oil palm, rubber, soya or wood products back to the geolocation of the plots of land where the commodity was produced. As amended, the EU Deforestation Regulation applies from 30 December 2026, and from 30 June 2027 for micro and small operators established by 31 December 2024.
• Only the operator that first places the product on the EU market, or exports it, files a due diligence statement in the EU information system. Downstream operators and traders pass on its reference number and keep records of who supplied them and whom they supplied.
• A QR code on the consumer pack does not satisfy any EUDR obligation. Where GS1 identifiers and Digital Link help is upstream: tying batches, shipments and plots together so the right reference numbers and geolocation data travel with the goods.

Regulation (EU) 2023/1115, the EU Deforestation Regulation or EUDR, bans seven commodities and the products made from them from the EU market unless they are deforestation-free, legally produced and covered by a due diligence statement. EUDR traceability is the practical core of that test: an operator has to know, and prove, the exact plots of land behind every relevant product it places on the market. The rules have been amended three times since 2023, and the dates, roles and product list that most summaries quote are now out of date.

This guide follows the consolidated text of 18 September 2026. Everything below is stated as of October 2026.

When does the EUDR apply?

The EUDR was originally due to apply from 30 December 2024. Regulation (EU) 2024/3234 moved that to 30 December 2025. Regulation (EU) 2025/2650 moved it again and rewrote the duties of companies further down the chain.

The dates cover Articles 3 to 13, 16 to 24, 26, 31 and 32: the prohibition, due diligence, checks, penalties and customs controls. Products produced before 29 June 2023 are outside the Regulation, apart from the timber transition in Article 37. A Commission proposal of September 2026 on the EU's outermost regions, COM(2026) 661, would touch the EUDR too, but it is not law.

Which commodities and products are covered?

Article 1 names seven relevant commodities: cattle, cocoa, coffee, oil palm, rubber, soya and wood. What is regulated is the list of relevant products in Annex I, by Combined Nomenclature code. A product not listed there is out of scope, whatever it contains. Delegated Regulation (EU) 2026/2102 rewrote parts of Annex I in September 2026.

Annex I now also excludes samples, products used for testing, and packing materials used only to support, protect or carry another product. Labels and marketing materials that only accompany another product are excluded from the paper entry.

Who has to do what: operators, downstream operators and traders

Regulation (EU) 2025/2650 replaced the original split between operators and traders with three roles, plus a light regime for small producers.

A European chocolate maker buying cocoa butter covered by an importer's statement is therefore a downstream operator. It files no statement of its own, but must keep its supplier's details, the upstream reference numbers and its own customers' details for at least five years, and report any product it learns is at risk. An operator that is a natural person or microenterprise may also mandate the next, larger company in the chain to file the statement for it under Article 6(3), while keeping the legal responsibility.

What goes into the due diligence statement?

An operator collects the information in Article 9, assesses risk under Article 10, mitigates it under Article 11, and proceeds only if the risk is negligible. It then submits a due diligence statement through the EU information system under Article 4(2). Annex II sets out its content:

1. The operator's name, address and, for imports and exports, its EORI number.
2. The HS code, a free-text description with the trade name, the full scientific name of any wood species, and the quantity in kilograms of net mass and, where applicable, the supplementary unit.
3. The country of production and the geolocation of all plots of land where the commodities were produced.
4. A fixed declaration that due diligence was carried out and no or only negligible risk was found, and a signature.

By submitting the statement, the operator assumes responsibility for the product's compliance. Statements and the Article 9 evidence are kept for five years. Where every commodity comes from low-risk countries, Article 13 allows simplified due diligence: the information is still collected and the statement still filed, but the risk assessment and mitigation steps fall away unless a risk comes to light.

How does plot geolocation work under Article 9?

Article 9(1)(d) is the heart of EUDR traceability. The operator must hold the geolocation of all plots of land behind the product, with the date or time range of production. Deforestation or forest degradation on any plot disqualifies everything from that plot. Article 2 defines the terms:

• Geolocation means latitude and longitude with at least six decimal digits. For plots of land of more than four hectares, used for any commodity other than cattle, the plot must be described with a polygon tracing its perimeter.
• Plot of land means land within a single real-estate property, as recognised by the law of the country of production, with conditions homogeneous enough to assess its deforestation risk as one unit.
• For cattle, the geolocation refers to every establishment where the animals were kept.

Micro or small primary operators may give a postal address instead of coordinates under Article 4a(5). That relief covers producers in low-risk countries only; it does not reach an EU importer buying from smallholders in a standard-risk country. Geolocation is filed in the information system, not published, and nothing in the Regulation asks for it to be shown to consumers.

How does the country benchmarking work?

Article 29 sets up a three-tier classification of countries, or parts of countries: low, standard and high risk. The first list was adopted in Commission Implementing Regulation (EU) 2025/1093 of 22 May 2025, in force since 26 May 2025, and has not been amended as of October 2026.

• High risk: Belarus, the Democratic People's Republic of Korea, Myanmar and the Russian Federation.
• Low risk: a list of 140 countries, including all EU Member States, the United States, Canada, the United Kingdom, China, India, Vietnam and Ghana.
• Standard risk: every country not on either list. That includes several of the largest producers of relevant commodities, such as Brazil, Indonesia, Malaysia, Colombia and Côte d'Ivoire.

For operators, sourcing only from low-risk countries opens simplified due diligence, though Article 13 still requires them to rule out mixing with commodities of unknown or higher-risk origin. For authorities, the tier sets minimum annual check rates in Article 16: at least 1 % of operators, non-SME downstream operators and non-SME traders for low risk, 3 % for standard risk and 9 % for high risk.

Reference numbers, verification numbers and traceability through the chain

The information system is where EUDR traceability becomes a set of numbers. Its rules are in Implementing Regulation (EU) 2024/3084, as amended by Implementing Regulation (EU) 2026/1565 of 13 July 2026. After risk-profiling a submission, the system assigns:

• a reference number for the statement, or a declaration identifier for a simplified declaration; and
• an associated verification number, a security number that, together with the reference number, gives another registered user access to the statement's data.

Those numbers are how traceability moves down the chain:

• Under Article 4(7) of the EUDR, the operator must communicate the reference numbers, or declaration identifiers, to the downstream operators and traders it supplies.
• Under Article 26(4), the reference number or declaration identifier must be made available to customs before release for free circulation or export.
• Under Article 5(3), a downstream operator or trader buying from an operator must keep those reference numbers.

A statement can be amended or withdrawn within 72 hours of its reference number being issued. Users may also group earlier statements into a new one under Article 8a of the implementing rules and pass on the grouped reference number instead. Web services allow automated submission from ERP or traceability software.

What a QR code on the consumer pack does not do

• It is not the due diligence statement. The statement is submitted electronically to competent authorities through the information system. Printing it, or a link to it, on the pack has no legal effect.
• It is not how the reference number travels. Article 4(7) requires operators to communicate reference numbers to their business customers. Consumers are not part of that chain, and the verification number is a security credential that should not be printed on retail packaging.
• It does not replace geolocation. The plot coordinates are evidence held by the operator and filed with the authorities. Showing a map to shoppers does not discharge Article 9.
• It does not create a consumer claim you can make freely. A statement such as "deforestation-free" on pack is a voluntary environmental claim and has to meet the consumer law on green claims, covered in our guide to Directive (EU) 2024/825.

Where GS1 identifiers and Digital Link do help

The EUDR does not require any GS1 standard. It does require each product to be linked to its plots, suppliers, customers and statement numbers for five years, which is an identification and data-sharing problem.

• GTIN plus batch or lot. Recording which statements and plots sit behind each GTIN and batch is the simplest way to answer an authority's question about a specific product.
• SSCC for shipments. Attaching the reference number to the pallet or container's SSCC keeps statement and goods together through ports and warehouses.
• GLN for parties and locations. A Global Location Number can identify a supplier or site. It gives the coordinates Article 9 demands a stable key, and cannot stand in for them.
• GS1 Digital Link on cases and pallets. A GS1 Digital Link QR code on outer cases or logistic labels, resolving to a restricted page for business partners, can give a receiving downstream operator the supplier details and statement reference numbers it must keep under Article 5. Access control matters: the same code on a consumer unit should resolve to consumer information, not to verification numbers.

Food brands already using a Digital Link for food labelling can let the same identifier anchor the internal EUDR record for each GTIN and batch. The same pattern underpins the Digital Product Passport, so one identification scheme can serve both.

What to do now

The main obligations apply from 30 December 2026, so this is now an execution plan.

1. Map your role for each product line. Operator, downstream operator or trader? Check your SME status under Directive 2013/34/EU and whether you were a micro or small undertaking by 31 December 2024.
2. Re-check your scope against the amended Annex I. Leather, printed matter, conveyor belts and soya for sowing are out; soluble coffee, palm oleochemicals and soap come in from 30 December 2027.
3. Collect plot geolocation from suppliers now. Six decimal digits, polygons above four hectares, establishments for cattle, production dates.
4. Classify your sourcing countries against Implementing Regulation (EU) 2025/1093 and decide where simplified due diligence is genuinely available.
5. Register in the information system if you are an operator, or a non-SME downstream operator or trader,.
6. Make reference numbers travel with the goods. Record them against GTIN, batch and SSCC and keep records for five years.
7. Keep consumer communication separate. Do not print statement or verification numbers on retail packs, and check any "deforestation-free" claim against green claims law.

Digital Link is a GS1 solution partner, and our platform assigns a standards-based GS1 Digital Link to each product and batch, with different pages for consumers and for authorised business partners. For the EUDR, that means one identifier that can carry reference numbers and plot data along the chain while the consumer pack stays clean. If you want help mapping your EUDR traceability data, get in touch and our legal team will review your case.

Frequently asked questions

When does the EUDR apply?

From 30 December 2026 for most companies, under Article 38 as amended by Regulation (EU) 2025/2650. Micro and small operators established by 31 December 2024 have until 30 June 2027, except for timber products under the EU Timber Regulation.

Does the EUDR still cover leather?

No. Delegated Regulation (EU) 2026/2102 deleted cattle hides, skins and leather from Annex I from 18 September 2026. The Commission will reconsider them in the general review due by 30 June 2030.

Do I need to file a due diligence statement if I buy from an EU importer?

Usually not. If everything you use is already covered by a statement or simplified declaration, you are a downstream operator: keep supplier and customer details and the upstream reference numbers for five years, and register if you are not an SME.

What geolocation precision does the EUDR require?

Latitude and longitude with at least six decimal digits, and polygons for plots larger than four hectares other than for cattle. For cattle, every establishment where the animals were kept.

Which countries are high risk under the EUDR?

Under Implementing Regulation (EU) 2025/1093, Belarus, North Korea, Myanmar and Russia. The Regulation lists 140 low-risk countries; all others, including Brazil, Indonesia and Côte d'Ivoire, are standard risk.

Can I put the due diligence statement reference number in a QR code on the pack?

It has no legal effect and is not advisable. The reference number goes to business customers and customs, not consumers; an access-controlled page behind a GS1 Digital Link on cases or pallets is the better place.

What are the penalties for breaching the EUDR?

Member States set them, but Article 25 requires fines with a maximum of at least 4 % of total annual Union-wide turnover, and confiscation of the products and of the revenues from them.