---
title: "EUDR: what is a traceability provider for?"
description: "From 30 December 2026, the importer alone answers for its EUDR statement. What software, satellite imagery or an audit can do, and what to demand of them."
canonical: https://projetcelsius.com/en/blog/eudr-traceability-software-provider/
author: "Sébastien Pierfederici"
datePublished: 2026-10-26
dateModified: 2026-10-26
language: en
translationOf: https://projetcelsius.com/blog/eudr-choisir-prestataire-tracabilite/
---

# EUDR: what is a traceability provider for?

**Author**: Sébastien Pierfederici
**Published**: 2026-10-26
**Section**: Practical guide
**Canonical URL**: https://projetcelsius.com/en/blog/eudr-traceability-software-provider/
**French original**: https://projetcelsius.com/blog/eudr-choisir-prestataire-tracabilite/
**Source**: Projet Celsius (https://projetcelsius.com/en/), a climate strategy consultancy of engineers and PhDs based in Paris and Marseille.

> An EUDR traceability provider can collect suppliers' geolocation data, cross-check it against forest maps, document the risk or submit the statements. The company that places the product on the market **signs and is solely answerable**, from **30 December 2026** for large and medium-sized companies. The [EU regulation on imported deforestation](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02023R1115-20260918) requires **no software**, and the Commission's system is free. The right purchase depends on your supply chains, their origins and the evidence the tool delivers.

## Key takeaways

- **The company that submits the statement remains solely responsible**, even with an authorised representative or a certificate.
- **The Commission's system is free**: it files the statements, but it does not assess the risk.
- **Choose the provider step by step**: collection, forest maps, risk assessment or filing of statements.
- **Demand evidence plot by plot**, with no mixing with commodities of unknown origin.

From **30 December 2026**, the EUDR (EU Deforestation Regulation) applies to large and medium-sized companies that place cocoa, coffee, soya, palm oil, rubber, wood or cattle on the EU market. No batch may enter that market any longer **without a due diligence statement** submitted beforehand. By submitting it, the company **assumes responsibility** for the product's compliance, as [the Regulation](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02023R1115-20260918) puts it. France's Ministry of Ecological Transition adds that no tool is **officially approved** to guarantee that compliance.

The right purchase is therefore decided supply chain by supply chain. It depends on [the company's role in each supply chain, as operator, downstream operator or trader](https://projetcelsius.com/en/blog/eudr-who-is-affected/), and on the **risk level of the country of origin**. The sections below take these providers one by one, then the cases according to the product's origin.

## What does an EUDR traceability provider do?

Due diligence comes down to **5 steps**: collect the information on each plot, cross-check it against forest maps, assess and mitigate the risk, submit the statement, then keep the file for 5 years. The provider market has split along the same lines.

### The 6 families of providers

No family covers all 5 steps on its own, and each one sells its own step:

- Software platforms for collection and statements open a **portal to suppliers**, store the evidence and submit the statements to the Commission's system.
- Satellite imagery specialists **cross-check plot boundaries** against forest cover maps and deforestation alerts, then assign a risk score.
- Field collection tools, such as GPS apps or the internal control systems of cooperatives, **record the points and polygons** of plots that no one has mapped yet.
- Certification and third-party verification schemes provide **a chain of custody** and audits, which the Regulation treats as complementary information.
- Inspection and audit bodies **check suppliers on site**, which serves to mitigate a risk, or review the internal audit function of a large company.
- Consultancies map **supply chains by customs code**, set the company's role in each one, and write the due diligence system and the contract clauses.

### The authorised representative, the only delegation the text provides for

The Regulation recognises only one form of delegation: **the authorised representative**. Any person established in the Union may act as one, under a **written mandate**, even from outside the supply chain, and may represent several operators, the Commission's FAQ specifies. The representative submits the statement on the operator's behalf, and the operator **retains responsibility** for the product's compliance.

The authorised representative is not the customs representative: French customs points out that these are distinct functions, and it also checks, at the same importer, [the carbon border declaration](https://projetcelsius.com/en/blog/what-is-cbam/). A micro-enterprise may also entrust its statement to the next buyer in the chain, which **cannot resell** the product without having submitted it.

> **What is a due diligence statement?** It is the declaration, submitted online before the product is placed on the market or exported, that the product is **deforestation-free after 2020** and legal. The system assigns it a reference number, which customs checks. A submitted statement may be amended or withdrawn **within 72 hours**, unless it has already been used at customs.

### What stays with the company

Several tasks cannot be delegated, whatever the contract says:

- The conclusion that **the risk is zero or negligible**, without which the product may not be placed on the market, and the review of that assessment at least once a year.
- **The accuracy of the geolocation data** and of the proof of legality, for which the operator is answerable whichever intermediaries collected them, according to the Commission.
- **Keeping the information for 5 years** and reviewing the company's due diligence system at least once a year.
- For a company that is not an SME, **a compliance officer**, an independent audit function and an annual public report, coordinated with [its sustainability statement](https://projetcelsius.com/en/blog/csrd-2026-who-is-in-scope-after-omnibus/).

> A tool, a certificate or an authorised representative may prepare the EUDR statement, but none of them signs it in place of the company.

## Are there already free tools for the EUDR?

**Yes, for submitting statements and for mapping.** The Commission provides, free of charge, the means to submit statements and to check that a plot was not covered by forest at the end of 2020.

### The Commission's information system

[The information system](https://green-forum.ec.europa.eu/nature-and-biodiversity/deforestation-regulation-implementation/information-system-deforestation-regulation_en) is a module of the TRACES platform. It is used to **submit and manage statements**, and its map lets you draw, enter or import plots in GeoJSON format. A test server, **with no legal value**, lets you practise.

The system **has been open again since 30 June 2026**, according to the French ministry, and the Commission regularly trains operators online. For volume, an **application programming interface**, published in 2024, submits statements directly from software. A 25 MB file holds more than **a million geolocation points**.

### Forest maps at 31 December 2020

[The EU Observatory on deforestation](https://forest-observatory.ec.europa.eu/forest/rmap) publishes a **global forest cover map** at 31 December 2020, the Regulation's reference date, at **10-metre resolution**. The Commission's FAQ also cites open-access tools, such as Whisp from the FAO (the UN Food and Agriculture Organization), and [the French ministry](https://www.deforestationimportee.ecologie.gouv.fr/actualites-17/article/outils-au-service-de-la-mise-en-oeuvre-du-rdue) lists others, from Copernicus to OpenStreetMap.

These maps settle nothing on their own. According to [the Commission's guidance document](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:C_202603896), the Observatory is neither exclusive nor mandatory and has **no legal value**. A plot that falls in forest on the map is not non-compliant for that reason: it is **the signal for a check**, with imagery and documents to back it.

### What no public tool does

The Commission's system is not a geographic information system: it displays **no satellite imagery** in the background. Nor does any public tool handle the tasks that take the most time:

- Collecting geolocation data and evidence from **tier 2 or tier 3 suppliers**, then chasing them until the answer is usable.
- Judging, document by document, whether production **complies with the legislation** of the country of origin, from land rights to logging permits.
- Assessing the risk against **the 14 criteria** of the Regulation, mitigating it when it is not negligible and documenting the conclusion.

The French ministry sums it up: no tool can, **on its own**, ensure compliance with the Regulation, nor relieve its user of responsibility.

## Which provider for which products?

Cocoa, coffee, soya, palm oil, rubber, wood and cattle fall under the same Regulation, but the purchasing need changes from one supply chain to another, according to **the company's role** and **the country of origin** of the product far more than to its size. The [list of covered products and customs codes](https://projetcelsius.com/en/blog/eudr-who-is-affected/) first sets the supply chains to examine.

### Downstream or in trade, little to buy

A company that processes a product already covered by a statement, or resells it, submits **no statement**. It keeps the contact details of its suppliers and customers for 5 years, and the reference number **only if its supplier is the operator**. The Commission speaks of passive collection: a module of its management software is usually enough, with registration in the system if the company is not an SME.

### A low-risk origin: collect and submit

For a product from a low-risk country, the operator may apply **simplified due diligence**, without risk assessment or mitigation. The exemption applies only after assessing the complexity of the supply chain and the **risk of mixing** with other origins, and geolocation is still required. The need then centres on collection and submission.

In its cost estimate, the [Commission report of 4 May 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026DC0191) counts **51% of importers**, against 20% previously, at half the standard cost. The authorities check at least **1% of operators** from these origins every year.

### A standard-risk origin: assess and mitigate

For a standard-risk origin, the operator assesses the risk against **14 criteria**, from the presence of forests to corruption and supply chain complexity. Where needed, it mitigates the risk with additional information, **independent surveys or audits**. This is where satellite imagery and audits are justified, and where checks rise to **3% of operators**.

### The example of cocoa from 3 origins

A cocoa bean importer buys from **Ghana**, **Côte d'Ivoire** and **Ecuador**, an example constructed for this article. The [Commission classifies](https://green-forum.ec.europa.eu/nature-and-biodiversity/deforestation-regulation-implementation/eudr-cooperation-and-partnerships/country-classification-list_en) Ghana as low risk, and Côte d'Ivoire and Ecuador as standard risk. The company therefore runs **2 due diligence regimes**, and the services it buys will not be the same for the 3 supply chains.

Simplified due diligence applies only to **Ghanaian batches kept separate** from end to end. As soon as a silo, a grinding run or a statement mixes the origins, the whole batch reverts to full due diligence, with all its plots declared. Ghana has rolled out a national cocoa traceability system, which can feed collection without removing the need to check.

## How to choose an EUDR traceability provider, and at what price?

A provider is judged on **what it delivers**, on its answers to a few precise questions and on the promises it does not make. The same grid works for [software for a Bilan Carbone® (the French carbon accounting method)](https://projetcelsius.com/en/blog/carbon-accounting-software-vs-consultancy/), [a digital product passport provider](https://projetcelsius.com/en/blog/digital-product-passport-provider/) or [the auditor of your environmental claims](https://projetcelsius.com/en/blog/empco-green-claims-audit/).

### What it must deliver

The useful deliverable is **a file per plot and per batch**, kept for 5 years and exportable:

- Plot boundaries in **GeoJSON format**, the only format the Commission's system accepts, with their date or period of production.
- The **cross-check of each plot** against a forest map at 31 December 2020, and a record of the check whenever a plot falls in forest.
- Proof of legality and of the absence of deforestation, **sufficiently conclusive and verifiable**, linked to the plot it covers.
- **Separation of origins** at every stage, since the Commission considers mass balance, which mixes traced and untraced volumes, non-compliant.

### Questions to ask before signing

These questions, 6 in all, quickly separate 2 offers that look alike on paper:

- Down to which tier of suppliers do you collect geolocation data, and what do you do with a supplier that **does not respond**?
- How do you handle **a plot that falls in forest** on the 2020 map, and who decides what happens next?
- Who writes **the risk conclusion**, and on which documents, stored where, is it based?
- What happens to our data, and **in what format** do we get it back, if we change tool or provider?
- Does your tool submit through the Commission's interface, and how does it **track the status** of each statement submitted?
- For a certification, does the standard require **the 2020 cut-off date**, traceability down to the plot and separation of origins?

### Promises that should raise a red flag

Some promises contradict the Regulation or the Commission. The most frequent, an officially approved tool or guaranteed compliance, runs up against the French ministry's position: **no tool is officially approved**, either by the Commission or by a national authority.

- A certificate presented as an exemption: certification is **not a green lane**, the Commission writes, and the operator remains required to exercise due diligence.
- A **self-declared** scheme, with no third-party attestation, which the Commission's guidance document considers less reliable by definition.
- An authorised representative that claims to **take on responsibility** for the statement, when the Regulation leaves it entirely with the operator.

### The price

Most offers are priced on quotation, and **no public fee schedule serves as a benchmark** for these services. The cost follows the **number of suppliers**, product references and standard-risk origins more than the size of the company: an importer with a single low-risk origin does not buy the same thing as a commodity trader with 10 origins.

The only public benchmark is collective. The Commission estimates that the simplifications made since 2023 cut the annual compliance cost for the companies concerned by **around 75%**, from €8.1 billion to €2.0 billion a year across the Union.

## What evidence should you ask suppliers for?

This is the longest part, to be launched well before **30 December 2026**, and **no tool speeds it up on its own**: the data originates with producers, cooperatives or commodity traders, often at tier 2 or 3.

### The data for each plot

The supplier sends the **geolocation of all the plots** where the commodity was produced, with the date or period of production. For cattle, this means every establishment where the animal was kept. [The precision required, point or polygon depending on the area](https://projetcelsius.com/en/blog/eudr-who-is-affected/), is detailed in our article on the Regulation.

Deforestation on a plot **disqualifies all the production** from that plot. A small producer in a low-risk country that has submitted a single simplified declaration sends **its declaration identifier** instead.

### Proof of legality

The Regulation requires sufficiently conclusive and verifiable information that the commodity was produced **in accordance with the legislation of the country of production**, such as land titles or logging permits. This information is linked to the plot and the batch, just as [the technical documentation for packaging](https://projetcelsius.com/en/blog/ppwr-technical-documentation-supplier-evidence/) links each piece of supplier evidence to a product reference.

### Contract clauses

The purchase contract sets what the supplier sends:

- Transmission, before shipment, of the geolocation data, the proof of legality and, if the supplier is itself an operator, **the reference number** of its statement.
- A **right to audit**, on documents or on site, so that a risk can be mitigated for an origin classified as standard risk.
- The **right to refuse a batch delivered without geolocation**, or mixed with commodities of unknown origin, with no penalty for the buyer.

A clause does not shift responsibility. When the producer supplies the geolocation, the operator **is answerable for its accuracy**, and false information constitutes an infringement, according to the Commission. To verify what a supplier sends, the methods are close to [those used to check supplier carbon data](https://projetcelsius.com/en/blog/verify-supplier-emissions-data/), and the request is worded like [a carbon data request to a supplier](https://projetcelsius.com/en/blog/customer-carbon-data-request/).

## Can the same data feed a Bilan Carbone®?

**Yes, and it is often the missing data.** The Regulation itself aims to reduce the Union's contribution to greenhouse gas emissions, and the geolocation of a plot also serves carbon accounting.

### Land-use change in scope 3

When a forest becomes a plantation, the carbon it stored is released into the atmosphere. In a Bilan Carbone®, these emissions go through **the emission factor** of raw material purchases, in [scope 3](https://projetcelsius.com/en/blog/scope-3-emissions-guide/). Yet the Base Empreinte emission factor database of ADEME (the French Agency for Ecological Transition) rarely distinguishes a material from deforested land.

For oil palm fruit, one of the few pairs in the database, the factor goes from **0.109 kgCO2e per kilo** without deforestation to **1.57 kgCO2e** with it, or 14 times more. Only plot-level data says which of the 2 applies.

The [GHG Protocol's Land Sector and Removals Standard](https://ghgprotocol.org/sites/default/files/2026-06/Land-Sector-and-Removals-Standard-v1.1.pdf), published on 30 January 2026, applies from 1 January 2027 in its version 1.1. It organises this calculation: **direct calculation** when traceability goes down to the plot, a statistical approach otherwise, and allocation over **at least 20 years**. Forestry is not yet covered, and [its rules differ from the Bilan Carbone® method on other points](https://projetcelsius.com/en/blog/bilan-carbone-vs-ghg-protocol/).

The 2 dates do not coincide. The EUDR looks at deforestation **after 31 December 2020**, while the GHG Protocol standard looks back at least 20 years: a plot deforested in 2010 complies with the Regulation and still carries emissions in a 2026 carbon footprint assessment.

### Zero-deforestation commitments

The same geolocation serves climate commitments. The SBTi (Science Based Targets initiative) requires a dedicated forest, land and agriculture target when these emissions account for **at least 20%** of the total. Since version 1.2 of its guidance, dated 19 March 2026, the zero-deforestation commitment is to be met **no later than 2 years** after the target is submitted, and never after 31 December 2030. [Our SBTi guide](https://projetcelsius.com/en/blog/sbti-for-industrial-smes/) details these targets. Such a commitment has to be proven, and [verified by a third party](https://projetcelsius.com/en/blog/climate-commitments-third-party-verification/) before it is published.

At Projet Celsius, we find that the first purchase is rarely software. It is **the map of supply chains** by customs code, origin and role, which shows which of them call for a full risk assessment; the tool is then sized for those. Collection done plot by plot pays off a second time in [the calculation of a product's emissions](https://projetcelsius.com/en/blog/product-carbon-footprint-lca-pef-cfp/) and in scope 3, where generic factors **do not see deforestation**. For wood, the same origin data will soon serve [the digital product passport for furniture](https://projetcelsius.com/en/blog/espr-dpp-furniture/), and the emissions map that results guides [the reduction plan](https://projetcelsius.com/en/blog/how-to-reduce-company-carbon-footprint/).

## Key takeaways

- The EUDR applies **on 30 December 2026** to large and medium-sized companies, and the company that submits the statement bears sole responsibility for it.
- No tool is officially approved and **no provider signs in the company's place**, not even an authorised representative, which only submits on the operator's behalf.
- The **Commission's system is free** for submitting statements and mapping; it collects nothing from suppliers and does not assess the risk.
- The purchasing need is decided **supply chain by supply chain**: little downstream, collection and submission for a low-risk origin, assessment and audit for a standard-risk origin.
- Plot geolocation also serves **scope 3** and zero-deforestation commitments, where generic factors do not see deforestation.

For dates, covered products and penalties, [our article on the deforestation regulation](https://projetcelsius.com/en/blog/eudr-who-is-affected/) sets out the essentials, and [our scope 3 guide](https://projetcelsius.com/en/blog/is-scope-3-reporting-mandatory/) explains when these purchase emissions must be included in a carbon footprint assessment.

## Frequently asked questions

## Frequently asked questions

### Do you need software to comply with the EUDR?

No. The Regulation requires no software: the Commission's information system, a free module of the TRACES platform, lets you submit statements online or through an application programming interface, and draw or import plots. Software becomes useful when suppliers are numerous, to collect their data and chase them, or when statements run into the hundreds. No tool is officially approved, and none relieves the company of its responsibility.

### Can a provider submit the EUDR statement on my behalf?

Yes, if it is your authorised representative: a person established in the Union, holding a written mandate, may submit the due diligence statement on the operator's behalf. The operator retains responsibility for the product's compliance. The EUDR authorised representative is distinct from the customs representative, and the same authorised representative may represent several operators.

### Is certification enough to comply with the EUDR?

No. Using certification or third-party verification is a voluntary decision, and the Commission states that it does not constitute a green lane: the operator still exercises due diligence and is answerable for it. Information from a certified scheme serves as complementary information in the risk assessment, provided it meets the requirements of the Regulation, including plot geolocation.

### What EUDR documents should you ask a supplier for?

The geolocation of all production plots with the date or period of production, the quantity, the country of production, the supplier's contact details, and sufficiently conclusive and verifiable information that there has been no deforestation after 2020 and that production was legal. If the supplier has itself submitted a statement in the Union, it also sends its reference number.

### How do you collect plot geolocation for the EUDR?

From producers, directly or through a cooperative, a commodity trader or a national traceability system, by a GPS survey in the field or by drawing on a map. The Commission's system accepts points and polygons in GeoJSON format, and France's Ministry of Ecological Transition lists free mapping tools. Whatever the intermediary, the operator remains responsible for the accuracy of the coordinates.

### What happens if the provider supplies false data?

The company that submits the statement is answerable: for the Commission, false geolocation is an infringement by the operator, even if a third party supplied it. The Regulation provides for a maximum fine of at least 4% of annual turnover generated in the Union, confiscation of the products and exclusion from public procurement for up to 12 months. At 24 October 2026, no French text had yet set out the details.

## Sources

- **Regulation**: [Regulation (EU) 2023/1115](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02023R1115-20260918) on deforestation-free products, consolidated version of 18 September 2026 (amended by Regulations 2024/3234 and 2025/2650 and Delegated Regulation 2026/2102): Articles 2, 4 to 6, 9 to 13, 16, 25 and 38.
- **Country classification**: Implementing Regulation (EU) 2025/1093 of 22 May 2025; [list of countries by risk level](https://green-forum.ec.europa.eu/nature-and-biodiversity/deforestation-regulation-implementation/eudr-cooperation-and-partnerships/country-classification-list_en), European Commission, accessed on 26 October 2026.
- **European Commission**: [guidance document C/2026/3896](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:C_202603896), OJ C of 20 July 2026 (sections 4, 5, 10 and 11); [FAQ on implementation, version 5](https://environment.ec.europa.eu/publications/faq-eudr-implementation_en), April 2026, published online in August 2026; [report COM(2026) 191](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026DC0191) of 4 May 2026; [information system page](https://green-forum.ec.europa.eu/nature-and-biodiversity/deforestation-regulation-implementation/information-system-deforestation-regulation_en), accessed on 26 October 2026.
- **France** (pages in French): Ministry of Ecological Transition, ["Outils au service de la mise en œuvre du RDUE" (tools supporting the implementation of the EUDR, RDUE in French)](https://www.deforestationimportee.ecologie.gouv.fr/actualites-17/article/outils-au-service-de-la-mise-en-oeuvre-du-rdue), 17 October 2025, and [page on the Regulation](https://www.deforestationimportee.ecologie.gouv.fr/reglement-europeen-contre-la-deforestation-et-la-degradation-des-forets/article/reglement-europeen-contre-la-deforestation-et-la-degradation-des-forets), 13 July 2026, accessed on 26 October 2026; [French customs, RDUE page](https://www.douane.gouv.fr/demarche/attester-de-la-conformite-de-ses-produits-avant-le-passage-frontieres-rdue).
- **Maps**: European Commission Joint Research Centre (JRC), global forest cover map 2020, version 4, 30 September 2026, doi 10.2905/JRC.3KATEH8, on [the EU Observatory on deforestation](https://forest-observatory.ec.europa.eu/forest/rmap).
- **Carbon**: [ADEME's Base Empreinte](https://data.ademe.fr/datasets/base-carboner), factors 42176 and 42177 (oil palm fruit, with and without deforestation, Agribalyse 3.1); [GHG Protocol, Land Sector and Removals Standard, version 1.1](https://ghgprotocol.org/sites/default/files/2026-06/Land-Sector-and-Removals-Standard-v1.1.pdf), 30 June 2026; [SBTi, FLAG Guidance, version 1.2, main changes document](https://files.sciencebasedtargets.org/production/files/Main-Changes-Document-for-Version-1.2-of-the-FLAG-Science-Based-Target-Setting-Guidance.pdf), 19 March 2026.