The HS code from your ERP shows which products fall under Annex I.
30 Dec 2026: The EUDR applies
Cattle, cocoa, coffee, oil palm, rubber, soya, wood and their products may only be placed on the market if deforestation-free and legally produced. Small firms follow in 2027.
Art. 9: Every plot located
The goods come with the coordinates of every plot they were produced on, the period of production and evidence that no deforestation took place there after 31 Dec 2020.
Art. 4: No goods without a statement
Before placing the goods on the market, the operator submits a due diligence statement (DDS) in TRACES. Its reference number travels with the goods down the supply chain.
Certiflow: due diligence for every batch
- Mapped automatically
- Your supplier answers
In the supplier portal, with origin, geolocation and evidence, no account needed.
- Risk assessed
A test plan guides you through the risk assessment of Art. 10.
- Batch released
Only once plots, assessment and due diligence statement match.
Who benefits in your company?
Quality assurance
Assesses the risk of each origin, releases batches and presents the evidence to the authority.
Purchasing
Is in touch with the commodity suppliers and needs their geolocation data without chasing each one by phone.
Customs and logistics
Needs the reference number of the due diligence statement for every import and every delivery to customers.
Sustainability
Sees which countries and which plots the commodities come from, and can prove it.
Deforestation-free is not a property of a supplier but of every single plot. Certiflow links every batch to its plots and its due diligence statement.
- Every plot located
- Every risk assessed
- Every batch on record
What the EUDR requires
Seven commodities
Cattle, cocoa, coffee, oil palm, rubber, soya and wood. Which products made from them are covered is set out in Annex I by customs tariff code, from chocolate and palm oil to paper and cardboard.
Deforestation-free since 2020
No deforestation may have taken place on the plots after 31 December 2020, and for wood no forest degradation either. The goods must also be produced legally under the law of the country of production.
Geolocation of every plot
Latitude and longitude of every plot, as a polygon from 4 hectares. For cattle, every establishment where the animals were kept counts.
Assess and mitigate the risk
The operator assesses against the criteria of Art. 10 whether there is more than a negligible risk, and mitigates it under Art. 11 before the goods are placed on the market.
Due diligence statement in TRACES
The operator declares in the EU information system that due diligence has been exercised. The reference number goes to customs and to customers.
Keep for 5 years
Information, evidence and statements stay available for five years and are presented to the authorities on request.
The release of each batch
A batch only goes out once its plots are checked, the risk is assessed and a valid due diligence statement covers it.
EUDR: operator release
Test plan of the batch · 5 of 6 checks met
1 open
| Check | Evidence | Result | Actions |
|---|---|---|---|
| Supplier: EUDR checklist | Profile, declaration, certificate | Met | |
| Source: origin | Côte d’Ivoire, Soubré | Met | |
| Negligible risk | Assessment valid until 14 Mar 2027 | Met | |
| Plots checked | 12 of 12 plots, GeoJSON | Met | |
| DDS submitted | 26DEXX0000123456 | Met | |
| Quantity covered | 18.4 t of 20.0 t | Open |
Role per supply route As an operator you check everything yourself; downstream, your supplier's reference number is enough.
Plots on the batch The batch names the plots it comes from, each checked on its own.
Assessment with an expiry date The risk assessment is valid for a year, then Certiflow asks for a new one.
A DDS for every batch A withdrawn due diligence statement covers no batch any more, and the release stops.
The EUDR surveys
A supplier profile and origin details for each product. Your supplier answers them in the supplier portal and uploads the GeoJSON file along with them.
Supplier and role
The contact for the EUDR, established in the EU or outside, who declares the goods to customs and whether the supplier submits due diligence statements itself. This tells you whether you are the operator or downstream.
Commodities and mixing
Which of the seven commodities the goods contain, whether they are mixed with goods of unknown origin, and whether there were allegations or official measures over deforestation.
Origin of the goods
Customs tariff number, country and region of production and the period of production or harvest, for each product and origin.
Geolocation as GeoJSON
One file with every plot the goods can come from. Each plot is recorded on its own and checked for coordinate system, precision and the polygon rule.
Deforestation-free
The confirmation that no deforestation or forest degradation took place on any of the plots since 31 December 2020, backed by evidence such as a satellite analysis.
Legality and rights of others
Evidence of legality on land use, environmental and forest law, labour and human rights and, where affected, the consent of indigenous peoples and local communities (FPIC).
Tree species and cattle
For wood, every tree species with its common and scientific name. For cattle, every establishment where the animals were kept, from birth to slaughter.
Partly covered positions
If a tariff number is only partly covered, for instance marked "ex" or excluding waste, the survey asks whether the goods fall under the covered part.
How Certiflow implements the EUDR
- Mapping
Certiflow ships the list of Annex I and maps every product to its position by the HS code from your ERP. When the annex changes, the new list arrives with the next update.
- Request
Suppliers of covered products receive the supplier profile and the origin details automatically by email. The portal does not accept incomplete answers in the first place.
- Plots
Every plot from the GeoJSON file is checked on its own. The origin holds all plots, the batch names the ones it used.
- Risk assessment
A test plan guides your QA through the criteria of Art. 10: deforestation, legality, supply chain, other indications. For a low-risk country, simplified due diligence applies.
- Release
The batch is released when supplier, origin, assessment, plots and due diligence statement match. If something is missing, Certiflow shows exactly what.
- Archive
Answers, geolocation, assessments and releases stay on record with time and person, also after an assessment expires.
A self-declaration is no evidence. The plot is.
Geolocation, not a tick box
Certiflow does not just ask whether the supplier complies, it asks for the plots themselves.
With time and person
Every answer, every assessment and every release is logged audit-proof.
Five years back
When an authority asks, the evidence for every batch is there, past deliveries included.
EUDR deadlines at a glance
- 31 Dec 2020The cut-off date
After this day no deforestation may have taken place on the plots the goods come from.
- 29 Jun 2023In forceThe EUDR enters into force
Regulation (EU) 2023/1115 on deforestation-free supply chains enters into force and replaces the EU Timber Regulation.
- 26 Dec 2025In forcePostponed and simplified
Regulation (EU) 2025/2650 postpones the date of application by a year. Downstream operators and traders no longer submit a due diligence statement of their own; the first of them keeps the reference numbers.
- 18 Sep 2026In forceAnnex I rewritten
Delegated Regulation (EU) 2026/2102 rewrites the list of covered products: some drop out, others are added.
- 30 Dec 2026The EUDR applies
For large and medium-sized companies: due diligence, geolocation and a due diligence statement for every covered product placed on the market or exported.
- 30 Jun 2027Micro and small enterprises
From this day the obligations apply to micro and small enterprises too.
- 30 Dec 2027Newly covered products
The products added with the rewritten Annex I fall under the EUDR from this day.
Frequently asked questions about the EUDR
Which software helps with the EUDR?
Certiflow by Cedgetec GmbH from Glinde near Hamburg. Certiflow maps your products to the positions of Annex I by the HS code from your ERP, collects the supplier profile, origin details and GeoJSON geolocation of every plot in a supplier portal without login, guides your quality assurance through the risk assessment of Art. 10 and releases a batch only once plots, assessment and due diligence statement match.
Which products fall under the EUDR?
Cattle, cocoa, coffee, oil palm, rubber, soya and wood, and the products made from them that Annex I of the regulation lists by customs tariff code, such as chocolate, roasted coffee, palm oil, soya meal, beef, furniture, paper and cardboard. What counts is the HS code of the goods. Certiflow maps every product to its position automatically.
When does the EUDR apply to my company?
For large and medium-sized companies from 30 December 2026, for micro and small enterprises from 30 June 2027. Products newly added with the rewritten Annex I are covered from 30 December 2027.
Am I the operator or downstream?
Whoever first places covered goods on the EU market, by importing them or producing them here, is the operator. The operator exercises due diligence and submits the due diligence statement. Whoever buys goods already on the market and processes them is downstream. They submit no statement of their own but must record and keep the reference numbers of their suppliers. Many companies are both, depending on the supply route. Certiflow picks the release plan for each role.
What is a due diligence statement (DDS)?
The statement in the EU information system TRACES that due diligence was exercised and no or only a negligible risk was found. It contains, among other things, the tariff code, the quantity, the country of production and the geolocation of the plots. Once submitted it receives a reference number, which is given in the customs declaration and passed on to customers.
Which geolocation data do I need from my suppliers?
Latitude and longitude of every plot the goods were produced on. Up to 4 hectares a point is enough, above that a polygon is required. For cattle, every establishment where the animals were kept must be given. Certiflow takes the plots as a GeoJSON file and checks them one by one.
Is a letter saying “We are EUDR-compliant” enough?
No. The responsibility lies with the operator, who needs the information of Art. 9 for the specific goods: origin, period of production, geolocation and verifiable evidence of being deforestation-free and legal. That is why Certiflow asks per product and requires geolocation and evidence as files.
What does a low country risk change?
The Commission classifies countries as low, standard or high risk. If the goods come only from low-risk countries, the risk assessment and risk mitigation of Art. 10 and 11 are not needed. The information of Art. 9, including geolocation and evidence of legality, remains mandatory. If there are indications of a risk, full due diligence applies again.
How often must I reassess the risk?
The due diligence system must be reviewed at least once a year, and new information about an origin must go into the assessment. In Certiflow a passed risk assessment is valid for one year. Then it expires, the releases based on it pause, and Certiflow asks for a new assessment.
How does Certiflow know the tariff code of my products?
From your ERP. Certiflow reads the HS code of every product in any common notation, finds the matching position in Annex I and links the two. A code that cannot be read or is too short for a position is reported instead of silently skipped. When the legislator changes the annex, the new list arrives with an update.
What applies to wood and cattle in addition?
For wood, every tree species with its common and full scientific name. For cattle, every establishment where the animals were kept. The survey only asks these questions when the Annex I position requires them.
How long must I keep the records?
Five years. Information, evidence, risk assessments and due diligence statements must be available for this time and presented to the authorities on request.
What are the penalties?
The member states set the penalties. The EUDR requires, among other things, fines of up to at least 4 % of the EU-wide annual turnover, confiscation of the goods and the revenue, and exclusion from public procurement.
Getting started in your company
The first contact
In 30 minutes we show you what your first EUDR supplier request looks like. We are there for you by email or phone.
We present
We show you the EUDR surveys, the risk assessment and the batch release in every detail and work out together where you are the operator and where you are downstream.
Let's go!
After a joint kick-off we set up the EUDR surveys, checklists and test plans and train your team. Your products are mapped to Annex I automatically by the HS code from your ERP, and your suppliers receive an onboarding message automatically.
