The EUDR Information System: Registration, Duties and Current Status 2026

Updated on September 3, 2026. Reading time about 18 minutes.

The EUDR Information System is the European Commission's central platform through which companies submit their due diligence statements under the EU Deforestation Regulation. From December 30, 2026, most companies will have no way around it. After several months of revision, the system has been fully open again since the end of June 2026, and with Implementing Regulation (EU) 2026/1565 the final technical rules have been in place since July. This article explains which companies must register in the EU information system, how the due diligence statement and reference number work, what changed in 2026 and which steps are due now.

What is the EUDR Information System?

The EUDR Information System is the register operated by the European Commission under Article 33 of Regulation (EU) 2023/1115, in which operators submit their due diligence statements (DDS) and receive a reference number for them. Micro-enterprises and small primary producers submit a simplified declaration there and receive an identification number. These numbers are passed on to the first downstream customer and are a mandatory part of the customs declaration on import and export. The competent authorities of the member states, in Germany the Federal Office for Agriculture and Food (BLE), together with the customs authorities, use the system for their controls.

Important for context is what the system does not do. It checks the submitted data for formal and technical validity and internally creates a risk profile, but it does not assess whether the declared areas are actually deforestation-free. In its FAQ the Commission explicitly makes clear that the system offers no satellite imagery or advanced GIS functions and that users should verify the accuracy of their geolocation data with other tools. The substantive due diligence, that is information gathering, risk assessment and, where necessary, risk mitigation, must be fulfilled before submission. Responsibility for this remains with the operator.

Who must use the EUDR Information System?

Since the amendment by Regulation (EU) 2025/2650, the EUDR distinguishes four roles in the supply chain. Which role a company holds is determined separately for each relevant product. A company can therefore hold several roles at the same time, for example as an importer of cocoa beans and as a downstream operator for the chocolate produced from them.

Operators: importers, first placers on the market and exporters

An operator within the meaning of Article 2(15) EUDR is anyone who, in the course of a commercial activity, places relevant products on the market for the first time or exports them and is not a downstream operator. These are typically importers who release goods from third countries into free circulation, domestic primary producers such as forestry businesses, farmers or cattle keepers, and exporters who export products for which no declaration yet exists. Operators must fulfil the full due diligence obligation and submit a due diligence statement in the EUDR Information System before placing on the market or exporting. They are the actual main users of the system.

Micro-enterprises and small primary producers: simplified declaration instead of due diligence statement

For this group, Article 4a EUDR created a heavily simplified procedure. It covers natural persons as well as micro and small enterprises that are established in a country with a low risk of deforestation and place relevant products on the market or export them directly, which they have themselves grown, harvested, obtained or raised there.

Instead of recurring due diligence statements, micro-enterprises and small primary producers submit a one-off simplified declaration whose content is set out in Annex III EUDR. Instead of geographic coordinates, they may state the postal address of their business or their areas. If the required information is already held in national databases, the member state can provide it directly in the information system under Article 4a(4), in which case the producer's own submission is not needed. In any case, micro-enterprises and small primary producers must hold an identification number from the system before placing on the market.

Downstream operators: no own due diligence statement, but record-keeping obligations

Anyone who places relevant products on the market or exports them that were manufactured using other relevant products for which a due diligence statement or simplified declaration already exists is a downstream operator under Article 2(15b) EUDR. The classic example from the guidance is the chocolate manufacturer who buys cocoa beans on the Union market and makes chocolate from them.

Downstream operators do not have to fulfil their own due diligence and do not submit a due diligence statement. Under Article 5(3) EUDR they must record the identity of their suppliers and commercial customers and keep it for five years. Only those supplied directly by an upstream operator must additionally record the reference or identification numbers received. The Commission's FAQ make clear that this happens passively: the obligation to pass numbers on lies with the upstream operator, and the numbers need neither be actively requested nor checked for content. Downstream operators that are not SMEs must additionally register in the information system under Article 5(2) EUDR before they place relevant products on the market or export them. Where there are substantiated concerns, they must also check whether due diligence was fulfilled upstream.

Traders: same obligations as downstream operators

A trader under Article 2(17) EUDR is anyone who merely makes relevant products available on the market without placing them on the market for the first time or altering them, for example wholesalers or retail chains. Traders are subject to the same obligations as downstream operators, including the registration obligation for non-SMEs.

Authorised representatives and companies outside the EU

Under Article 6 EUDR, operators and traders may appoint an authorised representative to submit declarations on their behalf. Legal responsibility for the conformity of the products remains with the operator. If a person established outside the Union places relevant products on the market, under Article 7 EUDR the first person established in the Union who makes these products available on the market is deemed to be the operator. In practice this is the EU importer. Third-country companies can register and act through authorised representatives, but the obligations lie with the first actor in the EU.

Who is not affected

Service providers without ownership rights in the goods, such as freight forwarders, carriers or customs representatives, are, according to the guidance, neither operators nor traders. Micro, small and medium-sized downstream operators and traders do not have to register but only have to fulfil their record-keeping obligations. Products for purely private use also do not fall under the regulation.

EUDR deadlines: When the obligation applies

Whether a company counts as an SME is determined under Article 2(30) EUDR on the basis of the size classes in Article 3 of the Accounting Directive 2013/34/EU as amended by Delegated Directive (EU) 2023/2775. What matters is that at least two of the three criteria, balance sheet total, net turnover and average number of employees, are not exceeded on the balance sheet date. The Commission's FAQ make clear that the group thresholds of the Accounting Directive are not relevant for the EUDR; each company is classified individually according to its own figures.

Size determines two things. First, the registration obligation for downstream operators and traders, which applies only to non-SMEs. Second, the date of application. According to the Commission guidelines, the essential obligations apply from December 30, 2026. For operators that were established as micro or small enterprises up to December 31, 2024, the date of application shifts to June 30, 2027. However, this extension does not apply to wood and wood products that were already covered by the annex to the EU Timber Regulation (EU) No 995/2010. Micro and small enterprises in the timber sector are therefore already obliged from December 30, 2026. Medium-sized companies benefit from no extension.

A further deadline concerns the product scope. With the Delegated Act on Annex I adopted on July 13, 2026, cattle hides and leather, retreaded tyres, seed soy and vehicle seats, among others, are removed from the scope, while instant coffee, certain palm oil derivatives and frozen cattle tongues are newly added. For the newly added products the regulation applies only from December 30, 2027. The Delegated Act is still in the scrutiny phase by the European Parliament and the Council until mid-September 2026 and enters into force only upon publication in the Official Journal.

Development of the system from 2024 to 2027

• In November 2024 the Commission opened registration; on December 4, 2024 the production system and the training environment went live.
• On February 16, 2026 the Commission temporarily restricted access to implement the changes of Regulation (EU) 2025/2650 technically. The production server remained accessible in read mode; new registrations and submissions were suspended.
• At the end of June 2026 the reopening followed with the core functions of the amended regulation; in early July the registration block was lifted.
• On July 13, 2026 the Commission adopted Implementing Regulation (EU) 2026/1565 on the information system and the Delegated Act on the product scope. The Implementing Regulation entered into force on July 17, 2026.
• On July 20, 2026 the third version of the guidance appeared in all EU languages in the Official Journal; at the end of July the Commission resumed the online training sessions.
• On October 15, 2026 the amended rules on the assignment of declarations to the competent authorities take effect.
• On December 30, 2026 the application begins for large and medium-sized companies and the timber sector. By this date the Commission must also provide the status page with the contingency arrangements.
• On June 30, 2027 the application begins for the remaining micro and small enterprises.

New rules since July 2026: Implementing Regulation (EU) 2026/1565

The Implementing Regulation (EU) 2026/1565 amends the previous Implementing Regulation (EU) 2024/3084, which has governed how the EUDR Information System works since December 2024. The main changes in detail.

Simplified declaration (Article 4a)

The system accepts simplified declarations from micro-enterprises and small primary producers and assigns them an identification number. If a member state provides the information from national databases, the system issues the identification number for the respective producer, and the member state communicates it to them. Updates are possible; the identification number is retained, but each update triggers a new risk profile. Withdrawal is possible as long as the declaration has not been referenced in a summary.

Summary of declarations (Article 8a)

Users can bundle several already submitted due diligence statements or simplified declarations by submitting a new, summarising declaration that refers to the reference or identification numbers of the individual declarations. The individual declarations then receive their own status, and the summarising declaration legally takes their place. For passing on within the supply chain and to customs, the number of the summarising declaration is then sufficient. Once incorporated into a summary, the individual declarations can no longer be changed or withdrawn. The rule mainly relieves actors who would otherwise have to manage many individual numbers, and helps with technical limits such as file size.

Contingency arrangements in the event of a system outage (Article 15a)

For the first time it is bindingly regulated what happens in the event of a malfunction. By December 30, 2026 the Commission provides a public website with information on the availability of the system and on the contingency measures. In the event of an unplanned unavailability of more than 60 minutes, users are notified digitally, and for affected products an emergency reference number and an emergency identification number are available so that goods flows do not come to a standstill.

Risk profiles, delay and rejection (Articles 6 to 8)

Every submitted declaration automatically receives an electronic risk profile and a risk status. This status is visible only to authorities, customs and the Commission, not to the submitting company. The competent authority can delay the provision of the reference number in order to carry out checks, and can reject a declaration where there is a high risk of non-compliance. A rejection is only possible as long as the reference number has not yet been provided to the user. A rejected product is treated as a product without a due diligence statement and may not be placed on the market.

Load limiting and assignment to authorities

Under Article 15(4), to safeguard availability, the Commission may set technical limits for file sizes and the frequency of interactions and take measures against faulty or duplicate submissions. This is relevant for automated connections because bulk queries can be throttled. In future, due diligence statements are assigned to the authorities of the member state in which the operator is established. For operators outside the EU, the identifier given at registration decides. This assignment rule applies from October 15, 2026.

Wood species and interfaces

If a product contains wood, the full scientific names of the wood species must be stated in the due diligence statement. For automated submission, the technical specifications of the application programming interfaces were revised. The reference to the TRACES infrastructure was deleted from the legal text in order to give the Commission long-term flexibility regarding the technical platform.

Reference number, identification number and verification number

The EUDR Information System works with three different identifiers that are frequently confused in practice.

The reference number is assigned to each due diligence statement after the risk profile has been created. It is the number that the operator passes on to its first downstream customer and states in the customs declaration on import and export. The identification number is the counterpart for the simplified declaration of micro-enterprises and small primary producers. It accompanies the products instead of a reference number and remains in place even when the declaration is updated. The verification number is a security code that the system issues in addition to every reference or identification number. Only someone who holds the reference number and the verification number can view the content of a declaration in the system, and even then the geolocation data only if the submitter has granted release. According to the Commission's FAQ there is no obligation to pass the verification number on to customers.

Due diligence statement (DDS): content, geolocation and limits

The content of a due diligence statement is set out in Annex II EUDR. In addition to the details of the operator, it contains, for each relevant product, the HS code, the description of the goods, the quantity, the country of production and the geolocation of all plots of land on which the relevant commodities were produced. For cattle, the geolocation of the establishments where the animals were kept must be given. For plots of more than four hectares, polygons are mandatory; smaller areas can be described as a point with latitude and longitude. By submitting, the operator confirms that due diligence has been fulfilled and that there is no or only a negligible risk, and assumes responsibility for conformity.

For practical work, some technical conditions that the Commission describes in its FAQ are important. Geolocation data can be entered manually on the map or uploaded as a file in GeoJSON format; the system supports the WGS 84 coordinate system (EPSG:4326). A single due diligence statement may contain at most 200 product lines and must not exceed the file size of 25 MB. There is no function for saving frequently used master data, but existing declarations can be duplicated as a template.

A due diligence statement can cover several batches or shipments of different products. The Commission recommends that a declaration cover no longer a period than one year from submission, because the due diligence system under Article 12 EUDR must be reviewed annually. As soon as the quantity declared in the statement has been fully placed on the market or exported, a new declaration is needed for further quantities. The more shipments a declaration covers, the greater the risk that a breach affecting one shipment will affect all products falling under it.

Status of a due diligence statement

According to the Commission's user manual, a due diligence statement passes through several statuses. As a draft it can be edited freely. After submission the system creates the risk profile and issues the reference number; the declaration receives the status available. Only from this point may the reference number be used. Available declarations can be changed or withdrawn as long as the reference number has not yet been used in a customs declaration, the product has not yet been placed on the market, or the declaration has not been selected by the authority for a control. If a declaration is rejected by the authority, it can no longer be used. With Implementing Regulation (EU) 2026/1565 further statuses are added, in particular for declarations that have been merged into a summary. The user manual is currently being adapted to the new legal situation; the current version is available on CIRCABC.

EUDR registration: production and acceptance server

The EUDR Information System consists of two separate environments. Declarations submitted on the production server have legal effect and can be controlled by the authorities. The acceptance server is a functionally identical training environment in which submissions can be tested without legal effect. Registration in one environment does not automatically apply to the other; both require a separate sign-up.

Authentication runs via EU Login, the Commission's central sign-in service. In addition, a unique identifier must be given at registration. Companies that import or export relevant products need a valid EORI number of an EU member state for this. Purely domestic actors, that is operators, downstream operators and traders without an EORI number, can alternatively register via the VAT identification number, the tax number, in certain cases the Global Location Number or other national identifiers. An overview with access points, user manual and training videos is provided by the Commission's page on the information system. In the event of technical problems, support is available at sante-traces@ec.europa.eu.

EUDR API: automated submission

Companies with a high submission volume can manage due diligence statements and simplified declarations via a machine-to-machine interface. The reference documentation for economic operators is publicly available on CIRCABC. The Commission expressly points out that development teams should regularly check the folder for updates, since the specifications were revised with the Implementing Regulation and further functions were announced for late summer. Anyone who operates or plans an integration should test it against the acceptance server and cover the new roles, the simplified declaration and the summary function. Compliance software such as the EUDR solution from Polygon One handles this connection and submits due diligence statements directly from the supply chain analysis.

EUDR and customs: reference number and code C716 in the customs declaration

When relevant products are released into free circulation and on export, the reference number or identification number becomes a mandatory entry in the customs declaration under Article 26 EUDR. Other customs procedures such as customs warehousing, inward processing or temporary admission are, according to the Commission's FAQ, not affected. Customs recognises EUDR-relevant goods by the tariff number and then requires a matching TARIC document code. Without a valid number and code the goods are not cleared. Since the reference number is only issued after submission of the due diligence statement, the entire due diligence check must be completed before the shipment reaches customs.

The TARIC codes set by the Commission for the EUDR apply equally to import and export.

For downstream operators that export products already covered by a declaration, the Commission's FAQ provide for a separate TARIC certificate code with which they are exempt from stating a reference number. For products that were placed on the market for the first time during the transition period before the date of application, the Commission has set the conventional reference number 99EU9999999999, which may be used on export and re-import of such products instead of a regular reference number, provided that the first placing on the market during the transition period can be demonstrated. The TARIC codes were set with the original version of the regulation; the current status in the Electronic Customs Tariff (EZT) is always decisive.

Two practical details from the web seminar of the Directorate-General of Customs are particularly relevant for companies. A reference number can be used for several customs declarations as long as the quantity declared in the statement is not exceeded, for example one declaration for 1,000 kg of coffee for two declarations of 500 kg each. Conversely, several reference numbers can be stated in one customs declaration. If several goods are in one declaration, each EUDR-relevant item needs its own document code. Further information is provided by the BLE's page on the customs declaration.

Important for delimitation: this customs interface only applies at the EU external border. Anyone who places goods on the market for the first time within the EU, for example a German forestry business selling wood, does not file a customs declaration. There, control is carried out solely by the competent authority.

Training and official sources

Since the end of July 2026, the Commission has again been offering free virtual training on the EUDR Information System. On the Commission page the following dates are currently published with registration links, each at 2:00 p.m. (CEST):

• September 3, 8, 10 and 15, 2026 for upstream operators on submitting due diligence statements
• September 17, 2026 for micro-enterprises and small primary producers on the simplified declaration

Further dates are announced there. Anyone who wants to stay informed about changes to the system can subscribe to the Commission's EUDR newsletter. The current versions of the guidance (third version, July 2026) and FAQ (fifth version, May 2026) as well as the infographics on supply chain scenarios explain the roles and obligations using concrete examples.

Germany: BLE, implementing act, administrative regulation

In Germany the BLE is the competent authority for control and enforcement.

The federal cabinet adopted the national implementing act for the EUDR on August 12, 2026. It transposes the EU requirements one to one, governs responsibilities and sanctions and now goes to the Bundestag. In addition, on August 7, 2026 the Federal Ministry of Agriculture presented the draft of a General Administrative Regulation, which is intended to secure relief for agriculture and forestry in the enforcement by the federal states, for example stating the postal address instead of geolocation data for German micro-enterprises and small primary producers and collective declarations via forestry associations. The administrative regulation is still under coordination and is intended to enter into force on December 30, 2026.

EUDR Information System or compliance software: what the register does not cover

The information system is the destination of the process, not the process itself. It receives finished due diligence statements, issues reference numbers and makes them available to the authorities for controls. Everything that comes before happens outside the system: the collection of geolocation data, documents and supplier information under Article 9, the risk assessment under Article 10 and the risk mitigation under Article 11. Anyone who relies solely on the register has no tool for these steps and has to map them with spreadsheets, emails and folder structures. This is precisely where the problems arise in practice.

Three gaps weigh particularly heavily. First, the system gives no substantive feedback. The risk status is visible only to authorities, and faulty geolocation data, such as invalid polygons, coordinates in the wrong country or insufficient precision, only comes to light at submission or at customs, when the shipment is already on its way. Second, the system offers nothing for collecting data from suppliers, which experience shows is the most time-consuming part and can take days to weeks. Third, the register stores only the declaration itself, not the evidence, assessments and decisions that you must document under Article 12 in an annually reviewed due diligence system and keep for five years for controls.

A compliance software such as Polygon One starts before the information system and, at the end, hands over only the finished declaration. The process follows the structure of the regulation. After importing suppliers and articles, an automatic scope check based on the HS codes checks which articles fall under the EUDR at all. For data collection you invite your suppliers into a supplier portal, in which they provide geolocation data, documents and questionnaires without their own account and in four languages, invite sub-suppliers themselves and are followed up via automatic reminders. The plot import checks geolocation data before it is taken over for country plausibility, coordinate precision and geometry errors and shows problem rows before they enter a declaration. The risk analysis evaluates satellite imagery for deforestation risks and documents for legal risks; identified risks are handled in the system and the decisions recorded in reports. Only then do the due diligence statements arise from orders, which are submitted directly from the platform via the connection to the information system, without manual transfer and with a documented reference number. Roles, permissions and an audit log record who decided what and when, and all data is held on servers in the EU.

The legal classification remains important. Even the best software does not relieve you of your responsibility under Article 4. What it delivers is a structured, documented and auditable due diligence process that is comprehensible in a control and grows with you in ongoing operations when new articles, suppliers or orders are added.

Checklist: how to prepare for the EUDR Information System

The remaining months until the date of application should be used purposefully. Sensible steps in this order:

1. Clarify your role, and do so separately for each relevant product. Only from this does it follow whether you must submit declarations, only register or merely keep records.
2. Classify your company size according to the Accounting Directive in order to determine the date of application and the registration obligation.
3. Set up registration on the production and acceptance server and configure EU Login, with a valid EORI number for import and export.
4. Carry out test submissions in the training environment to try out formats, roles and the new functions such as the summary.
5. Check the geolocation data of all suppliers early for completeness and geometry. Otherwise faulty polygons only come to light when a shipment is already on its way.
6. Firmly integrate the creation of the due diligence statement into the ordering and shipping process so that the reference number is in place before the customs declaration, and brief the customs department or the forwarder on the codes.
7. For high volumes, test the API connection against the acceptance environment and take the updated specification into account.
8. Define retention processes for declarations, reference numbers and evidence over at least five years.

Frequently asked questions about the EUDR Information System

Does every company have to register in the EUDR Information System?

No. Those who must register are operators that submit due diligence statements, micro-enterprises and small primary producers for their simplified declaration, authorised representatives, and downstream operators and traders that are not SMEs. Micro, small and medium-sized enterprises at the downstream tier do not have to register but only have to fulfil their record-keeping obligations.

What is the difference between reference number and identification number?

Every due diligence statement of an operator receives a reference number. The one-off simplified declaration of a micro-enterprise or small primary producer receives an identification number. Both numbers accompany the goods in the supply chain and are stated in the customs declaration on import and export.

Is the EUDR Information System the same as TRACES NT?

Technically, the EUDR Information System runs on the Commission's TRACES platform; the sign-in pages accordingly carry the tracesnt suffix. Legally, the system is an independent register under Article 33 EUDR. With Implementing Regulation (EU) 2026/1565 the reference to TRACES was deleted from the legal text so that the Commission can change the technical platform if needed.

From when do due diligence statements have to be submitted?

From December 30, 2026 for large and medium-sized companies as well as for micro and small enterprises in the timber sector. The remaining micro and small enterprises that were established as such up to December 31, 2024 must submit from June 30, 2027. For products newly added by the Delegated Act, the obligation applies from December 30, 2027.

How long is a due diligence statement valid?

A due diligence statement can cover several shipments and batches. The Commission recommends a period of no more than one year from submission. As soon as the declared quantity has been fully placed on the market or exported, a new declaration is needed for further quantities.

What data do I need for a due diligence statement?

Details of the operator, and for each product the HS code, description of the goods, quantity and country of production as well as the geolocation of all production areas. Areas over four hectares must be stated as a polygon, smaller ones can be stated as a point. For wood, the scientific names of the wood species must be given. Geolocation data can be uploaded as a GeoJSON file.

What happens if the EUDR Information System goes down?

Implementing Regulation (EU) 2026/1565 provides for contingency arrangements. In the event of an unplanned unavailability of more than 60 minutes, users are notified, and for affected products an emergency reference number and an emergency identification number are available. By December 30, 2026 the Commission provides a public status page.

As a downstream operator, do I have to submit my own due diligence statement?

No. Anyone who processes or resells products for which a due diligence statement or simplified declaration already exists does not submit their own declaration. They must document suppliers and customers, and as the first customer of an operator additionally record the numbers received, and register as a non-SME.

What is the TARIC code C716?

C716 is the document code with which the customs declaration indicates that a due diligence statement exists for the goods. As the document number, the reference number from the EUDR Information System is entered. Without a valid code and reference number, EUDR-relevant goods are not cleared on import and export.

Does the information system check whether my goods are deforestation-free?

No. The system checks the formal and technical validity of the submission and creates an internal risk profile for the authorities. Whether the areas are actually deforestation-free and the production was legal must be checked and documented beforehand by the operator as part of their due diligence.

Conclusion

The EUDR Information System is operational, the technical rules are final, and the Commission is actively training. This removes one of the biggest question marks of recent years, and the focus shifts to the companies themselves. The distribution of roles has become significantly clearer since the amendment of the regulation; the main burden lies with importers, primary producers and exporters. Anyone who builds and tests their supplier data, geolocations and processes now will go into December without time pressure.