EUDR: what is a traceability provider for?

From 30 December 2026, the EUDR (EU Deforestation Regulation) applies to large and medium-sized companies that place cocoa, coffee, soya, palm oil, rubber, wood or cattle on the EU market. No batch may enter that market any longer without a due diligence statement submitted beforehand. By submitting it, the company assumes responsibility for the product's compliance, as the Regulation puts it. France's Ministry of Ecological Transition adds that no tool is officially approved to guarantee that compliance.

The right purchase is therefore decided supply chain by supply chain. It depends on the company's role in each supply chain, as operator, downstream operator or trader, and on the risk level of the country of origin. The sections below take these providers one by one, then the cases according to the product's origin.

1What does an EUDR traceability provider do?

Due diligence comes down to 5 steps: collect the information on each plot, cross-check it against forest maps, assess and mitigate the risk, submit the statement, then keep the file for 5 years. The provider market has split along the same lines.

The 6 families of providers

No family covers all 5 steps on its own, and each one sells its own step:

• Software platforms for collection and statements open a portal to suppliers, store the evidence and submit the statements to the Commission's system.
• Satellite imagery specialists cross-check plot boundaries against forest cover maps and deforestation alerts, then assign a risk score.
• Field collection tools, such as GPS apps or the internal control systems of cooperatives, record the points and polygons of plots that no one has mapped yet.
• Certification and third-party verification schemes provide a chain of custody and audits, which the Regulation treats as complementary information.
• Inspection and audit bodies check suppliers on site, which serves to mitigate a risk, or review the internal audit function of a large company.
• Consultancies map supply chains by customs code, set the company's role in each one, and write the due diligence system and the contract clauses.

The authorised representative, the only delegation the text provides for

The Regulation recognises only one form of delegation: the authorised representative. Any person established in the Union may act as one, under a written mandate, even from outside the supply chain, and may represent several operators, the Commission's FAQ specifies. The representative submits the statement on the operator's behalf, and the operator retains responsibility for the product's compliance.

The authorised representative is not the customs representative: French customs points out that these are distinct functions, and it also checks, at the same importer, the carbon border declaration. A micro-enterprise may also entrust its statement to the next buyer in the chain, which cannot resell the product without having submitted it.

What stays with the company

Several tasks cannot be delegated, whatever the contract says:

• The conclusion that the risk is zero or negligible, without which the product may not be placed on the market, and the review of that assessment at least once a year.
• The accuracy of the geolocation data and of the proof of legality, for which the operator is answerable whichever intermediaries collected them, according to the Commission.
• Keeping the information for 5 years and reviewing the company's due diligence system at least once a year.
• For a company that is not an SME, a compliance officer, an independent audit function and an annual public report, coordinated with its sustainability statement.

2Are there already free tools for the EUDR?

Yes, for submitting statements and for mapping. The Commission provides, free of charge, the means to submit statements and to check that a plot was not covered by forest at the end of 2020.

The Commission's information system

The information system is a module of the TRACES platform. It is used to submit and manage statements, and its map lets you draw, enter or import plots in GeoJSON format. A test server, with no legal value, lets you practise.

The system has been open again since 30 June 2026, according to the French ministry, and the Commission regularly trains operators online. For volume, an application programming interface, published in 2024, submits statements directly from software. A 25 MB file holds more than a million geolocation points.

Forest maps at 31 December 2020

The EU Observatory on deforestation publishes a global forest cover map at 31 December 2020, the Regulation's reference date, at 10-metre resolution. The Commission's FAQ also cites open-access tools, such as Whisp from the FAO (the UN Food and Agriculture Organization), and the French ministry lists others, from Copernicus to OpenStreetMap.

These maps settle nothing on their own. According to the Commission's guidance document, the Observatory is neither exclusive nor mandatory and has no legal value. A plot that falls in forest on the map is not non-compliant for that reason: it is the signal for a check, with imagery and documents to back it.

European Commission, JRC, 2026

The forest map at 31 December 2020, from Ghana to Côte d'Ivoire

Global map of forest cover 2020, version 4, EU Observatory on deforestation

In green, forest cover at 31 December 2020, the Regulation's reference date, at 10-metre resolution (version 4, September 2026). On this screenshot of southern Ghana and eastern Côte d'Ivoire, the forest appears as islands with sharp edges. The map has no legal value: a plot that falls in forest is checked, with imagery and documents to back it.

What no public tool does

The Commission's system is not a geographic information system: it displays no satellite imagery in the background. Nor does any public tool handle the tasks that take the most time:

• Collecting geolocation data and evidence from tier 2 or tier 3 suppliers, then chasing them until the answer is usable.
• Judging, document by document, whether production complies with the legislation of the country of origin, from land rights to logging permits.
• Assessing the risk against the 14 criteria of the Regulation, mitigating it when it is not negligible and documenting the conclusion.

The French ministry sums it up: no tool can, on its own, ensure compliance with the Regulation, nor relieve its user of responsibility.

3Which provider for which products?

Cocoa, coffee, soya, palm oil, rubber, wood and cattle fall under the same Regulation, but the purchasing need changes from one supply chain to another, according to the company's role and the country of origin of the product far more than to its size. The list of covered products and customs codes first sets the supply chains to examine.

Downstream or in trade, little to buy

A company that processes a product already covered by a statement, or resells it, submits no statement. It keeps the contact details of its suppliers and customers for 5 years, and the reference number only if its supplier is the operator. The Commission speaks of passive collection: a module of its management software is usually enough, with registration in the system if the company is not an SME.

A low-risk origin: collect and submit

For a product from a low-risk country, the operator may apply simplified due diligence, without risk assessment or mitigation. The exemption applies only after assessing the complexity of the supply chain and the risk of mixing with other origins, and geolocation is still required. The need then centres on collection and submission.

In its cost estimate, the Commission report of 4 May 2026 counts 51% of importers, against 20% previously, at half the standard cost. The authorities check at least 1% of operators from these origins every year.

A standard-risk origin: assess and mitigate

For a standard-risk origin, the operator assesses the risk against 14 criteria, from the presence of forests to corruption and supply chain complexity. Where needed, it mitigates the risk with additional information, independent surveys or audits. This is where satellite imagery and audits are justified, and where checks rise to 3% of operators.

The example of cocoa from 3 origins

A cocoa bean importer buys from Ghana, Côte d'Ivoire and Ecuador, an example constructed for this article. The Commission classifies Ghana as low risk, and Côte d'Ivoire and Ecuador as standard risk. The company therefore runs 2 due diligence regimes, and the services it buys will not be the same for the 3 supply chains.

Simplified due diligence applies only to Ghanaian batches kept separate from end to end. As soon as a silo, a grinding run or a statement mixes the origins, the whole batch reverts to full due diligence, with all its plots declared. Ghana has rolled out a national cocoa traceability system, which can feed collection without removing the need to check.

4How to choose an EUDR traceability provider, and at what price?

A provider is judged on what it delivers, on its answers to a few precise questions and on the promises it does not make. The same grid works for software for a Bilan Carbone® (the French carbon accounting method), a digital product passport provider or the auditor of your environmental claims.

What it must deliver

The useful deliverable is a file per plot and per batch, kept for 5 years and exportable:

• Plot boundaries in GeoJSON format, the only format the Commission's system accepts, with their date or period of production.
• The cross-check of each plot against a forest map at 31 December 2020, and a record of the check whenever a plot falls in forest.
• Proof of legality and of the absence of deforestation, sufficiently conclusive and verifiable, linked to the plot it covers.
• Separation of origins at every stage, since the Commission considers mass balance, which mixes traced and untraced volumes, non-compliant.

Questions to ask before signing

These questions, 6 in all, quickly separate 2 offers that look alike on paper:

• Down to which tier of suppliers do you collect geolocation data, and what do you do with a supplier that does not respond?
• How do you handle a plot that falls in forest on the 2020 map, and who decides what happens next?
• Who writes the risk conclusion, and on which documents, stored where, is it based?
• What happens to our data, and in what format do we get it back, if we change tool or provider?
• Does your tool submit through the Commission's interface, and how does it track the status of each statement submitted?
• For a certification, does the standard require the 2020 cut-off date, traceability down to the plot and separation of origins?

Promises that should raise a red flag

Some promises contradict the Regulation or the Commission. The most frequent, an officially approved tool or guaranteed compliance, runs up against the French ministry's position: no tool is officially approved, either by the Commission or by a national authority.

• A certificate presented as an exemption: certification is not a green lane, the Commission writes, and the operator remains required to exercise due diligence.
• A self-declared scheme, with no third-party attestation, which the Commission's guidance document considers less reliable by definition.
• An authorised representative that claims to take on responsibility for the statement, when the Regulation leaves it entirely with the operator.

The price

Most offers are priced on quotation, and no public fee schedule serves as a benchmark for these services. The cost follows the number of suppliers, product references and standard-risk origins more than the size of the company: an importer with a single low-risk origin does not buy the same thing as a commodity trader with 10 origins.

The only public benchmark is collective. The Commission estimates that the simplifications made since 2023 cut the annual compliance cost for the companies concerned by around 75%, from €8.1 billion to €2.0 billion a year across the Union.

5What evidence should you ask suppliers for?

This is the longest part, to be launched well before 30 December 2026, and no tool speeds it up on its own: the data originates with producers, cooperatives or commodity traders, often at tier 2 or 3.

The data for each plot

The supplier sends the geolocation of all the plots where the commodity was produced, with the date or period of production. For cattle, this means every establishment where the animal was kept. The precision required, point or polygon depending on the area, is detailed in our article on the Regulation.

Deforestation on a plot disqualifies all the production from that plot. A small producer in a low-risk country that has submitted a single simplified declaration sends its declaration identifier instead.

Proof of legality

The Regulation requires sufficiently conclusive and verifiable information that the commodity was produced in accordance with the legislation of the country of production, such as land titles or logging permits. This information is linked to the plot and the batch, just as the technical documentation for packaging links each piece of supplier evidence to a product reference.

Contract clauses

The purchase contract sets what the supplier sends:

• Transmission, before shipment, of the geolocation data, the proof of legality and, if the supplier is itself an operator, the reference number of its statement.
• A right to audit, on documents or on site, so that a risk can be mitigated for an origin classified as standard risk.
• The right to refuse a batch delivered without geolocation, or mixed with commodities of unknown origin, with no penalty for the buyer.

A clause does not shift responsibility. When the producer supplies the geolocation, the operator is answerable for its accuracy, and false information constitutes an infringement, according to the Commission. To verify what a supplier sends, the methods are close to those used to check supplier carbon data, and the request is worded like a carbon data request to a supplier.

6Can the same data feed a Bilan Carbone®?

Yes, and it is often the missing data. The Regulation itself aims to reduce the Union's contribution to greenhouse gas emissions, and the geolocation of a plot also serves carbon accounting.

Land-use change in scope 3

When a forest becomes a plantation, the carbon it stored is released into the atmosphere. In a Bilan Carbone®, these emissions go through the emission factor of raw material purchases, in scope 3. Yet the Base Empreinte emission factor database of ADEME (the French Agency for Ecological Transition) rarely distinguishes a material from deforested land.

For oil palm fruit, one of the few pairs in the database, the factor goes from 0.109 kgCO2e per kilo without deforestation to 1.57 kgCO2e with it, or 14 times more. Only plot-level data says which of the 2 applies.

The GHG Protocol's Land Sector and Removals Standard, published on 30 January 2026, applies from 1 January 2027 in its version 1.1. It organises this calculation: direct calculation when traceability goes down to the plot, a statistical approach otherwise, and allocation over at least 20 years. Forestry is not yet covered, and its rules differ from the Bilan Carbone® method on other points.

The 2 dates do not coincide. The EUDR looks at deforestation after 31 December 2020, while the GHG Protocol standard looks back at least 20 years: a plot deforested in 2010 complies with the Regulation and still carries emissions in a 2026 carbon footprint assessment.

Zero-deforestation commitments

The same geolocation serves climate commitments. The SBTi (Science Based Targets initiative) requires a dedicated forest, land and agriculture target when these emissions account for at least 20% of the total. Since version 1.2 of its guidance, dated 19 March 2026, the zero-deforestation commitment is to be met no later than 2 years after the target is submitted, and never after 31 December 2030. Our SBTi guide details these targets. Such a commitment has to be proven, and verified by a third party before it is published.

At Projet Celsius, we find that the first purchase is rarely software. It is the map of supply chains by customs code, origin and role, which shows which of them call for a full risk assessment; the tool is then sized for those. Collection done plot by plot pays off a second time in the calculation of a product's emissions and in scope 3, where generic factors do not see deforestation. For wood, the same origin data will soon serve the digital product passport for furniture, and the emissions map that results guides the reduction plan.

7Key takeaways

• The EUDR applies on 30 December 2026 to large and medium-sized companies, and the company that submits the statement bears sole responsibility for it.
• No tool is officially approved and no provider signs in the company's place, not even an authorised representative, which only submits on the operator's behalf.
• The Commission's system is free for submitting statements and mapping; it collects nothing from suppliers and does not assess the risk.
• The purchasing need is decided supply chain by supply chain: little downstream, collection and submission for a low-risk origin, assessment and audit for a standard-risk origin.
• Plot geolocation also serves scope 3 and zero-deforestation commitments, where generic factors do not see deforestation.

For dates, covered products and penalties, our article on the deforestation regulation sets out the essentials, and our scope 3 guide explains when these purchase emissions must be included in a carbon footprint assessment.

Further resources

Frequently asked questions

1Do you need software to comply with the EUDR?

No. The Regulation requires no software: the Commission's information system, a free module of the TRACES platform, lets you submit statements online or through an application programming interface, and draw or import plots. Software becomes useful when suppliers are numerous, to collect their data and chase them, or when statements run into the hundreds. No tool is officially approved, and none relieves the company of its responsibility.

2Can a provider submit the EUDR statement on my behalf?

Yes, if it is your authorised representative: a person established in the Union, holding a written mandate, may submit the due diligence statement on the operator's behalf. The operator retains responsibility for the product's compliance. The EUDR authorised representative is distinct from the customs representative, and the same authorised representative may represent several operators.

3Is certification enough to comply with the EUDR?

No. Using certification or third-party verification is a voluntary decision, and the Commission states that it does not constitute a green lane: the operator still exercises due diligence and is answerable for it. Information from a certified scheme serves as complementary information in the risk assessment, provided it meets the requirements of the Regulation, including plot geolocation.

4What EUDR documents should you ask a supplier for?

The geolocation of all production plots with the date or period of production, the quantity, the country of production, the supplier's contact details, and sufficiently conclusive and verifiable information that there has been no deforestation after 2020 and that production was legal. If the supplier has itself submitted a statement in the Union, it also sends its reference number.

5How do you collect plot geolocation for the EUDR?

From producers, directly or through a cooperative, a commodity trader or a national traceability system, by a GPS survey in the field or by drawing on a map. The Commission's system accepts points and polygons in GeoJSON format, and France's Ministry of Ecological Transition lists free mapping tools. Whatever the intermediary, the operator remains responsible for the accuracy of the coordinates.

6What happens if the provider supplies false data?

The company that submits the statement is answerable: for the Commission, false geolocation is an infringement by the operator, even if a third party supplied it. The Regulation provides for a maximum fine of at least 4% of annual turnover generated in the Union, confiscation of the products and exclusion from public procurement for up to 12 months. At 24 October 2026, no French text had yet set out the details.

Ask Sébastien your questionA personal reply within 24 working hours

Send my questionor: sebastien@projetcelsius.com