EUDR request from your customer: what you owe as a supplier, with a reply template (Word)

Your customer writes that before the end of the year it needs your “EUDR certificate”, the geolocation of every plot of origin and a signed supplier declaration. Many manufacturers and wholesalers are receiving letters like this now, because from 30 December 2026 their own customers have obligations under Regulation (EU) 2023/1115. Some of what they ask for is owed by nobody under the Regulation, and some of it the EU Information System (TRACES) does not even allow.

The table below shows, for seven typical requests, what each role owes; the matching reply template comes as a Word file and a PDF in English and German. If you are the one sending questionnaires to your own suppliers, the supplier questionnaire covers the other side.

Get an EUDR Software Demo

Save up to 80% of your time and costs with our software!

Book a 30-minute demo →Or start with the 2‑minute EUDR check

Role first, then the answer

The Regulation has three roles along the supply chain, and each owes its customer something different. You determine the role per product and supply relationship (Commission guidelines, section 2).

• If you imported the goods or produced them in the EU, you are the operator (Article 2(15)) and you submit the due diligence statement. For imports this is normally whoever is named as importer in the customs declaration (guidelines, section 2(a)). If you are a micro or small primary operator (Article 2(15a)), you instead submit a one-off simplified declaration and give your customers the declaration identifier you receive for it (Article 4a(2), Article 4(7)).
• If you bought the goods in the EU and made another covered product from them, with a new CN code, you are a downstream operator (Article 2(15b), Commission FAQ 3.1.1).
• If you resell the goods unchanged, you are a trader (Article 2(17)).

Size also counts, measured per legal entity. An SME exceeds at most one of the three limits of EUR 25 million balance sheet total, EUR 50 million net turnover and 250 employees (Article 2(30), Commission FAQ 3.10). Downstream operators and traders that are not SMEs must register in the information system (Article 5(2)). The EUDR check works out your role for a product from its CN code; what each role has to do is explained in Trader or operator?, and the thresholds are under EUDR for SMEs.

Several roles in one company

A wholesaler can be the operator for imported paper and a trader for paper bought from European mills. A company that turns its own imports into another covered product, such as logs into sawn wood, is then the first downstream operator and does not have to pass the import reference number on to its customers (Commission FAQ 3.8). In a group, each legal entity counts on its own (FAQ 3.8, 3.13). So answer requests per product group.

When your customer has no role of its own

A business that buys covered products in the EU and uses them itself, or turns them into something not listed in Annex I (the list of covered products), does not make a relevant product available and has no role. The Commission’s examples are a car maker that fits tyres bought in the EU and a company that roasts coffee and uses it in pastries (Commission FAQ 2.10 example 1, FAQ 3.7). The same goes for a printer that uses the paper to print catalogues or books, because printed matter of Chapter 49 has not been in Annex I since Regulation (EU) 2025/2650. If it prints labels or folding cartons instead, the product stays in Chapter 48 and the printer is a downstream operator (FAQ 3.1.1). An operator does not have to pass reference numbers on to customers without a role or to consumers (FAQ 3.6.1). A customer outside the EU is, on our reading, neither a downstream operator nor a trader; what applies on export is set out in the table under When there is no number.

The seven requests suppliers are receiving

Several of them often arrive in one form; the labels A1 to A7 come up again in the table and in the reply template.

1. A1 Reference and verification number for each delivery. “Please provide the EUDR reference number and the verification number for every delivery.” Only an operator owes the reference number to its first customer, and nobody owes the verification number.
2. A2 A copy of the due diligence statement, or a statement for the customer. “Please send us your due diligence statement” or “Please submit a statement for our orders.” Nobody owes a copy, and downstream operators and traders cannot submit a statement at all.
3. A3 Geolocation of the plots. “Please send the polygons of all plots as GeoJSON.” Only whoever submits the due diligence statement needs them; nobody has to pass them on.
4. A4 “EUDR certificate” or confirmation. “Please send us your EUDR certificate” or “Please confirm that all deliveries are EUDR compliant.” You reply with the information the Regulation sets out for your role, and you can add certificates such as FSC or PEFC.
5. A5 Supplier declaration or self-declaration. A form with fields for role, size and registration, often with a ready-made sentence such as “We confirm that all goods are deforestation-free and legally produced.” The Regulation does not ask traders and downstream operators to vouch for their suppliers’ due diligence.
6. A6 Questionnaire on risk, origin and legality. It asks about the country of production, the risk level, evidence of legality and your own risk assessment. Only the operator makes a risk assessment, and it is a record for the authority.
7. A7 Contract clauses. Liability, indemnity, audit rights or a duty to cooperate, written into the framework agreement. The Regulation does not govern such clauses.

What you owe, by request and role

Read the column for your role for the goods in question. The letters mean: O owed, an obligation under the Regulation. V voluntary. N not owed. C not owed, but a condition for your customer, who may not place the goods on the market without it.

You owe a number only in the first column. Voluntary means the Regulation does not prohibit it; whether you do it is a question of contract and confidentiality, including towards your own suppliers.

In the four columns within the EU, your customer also needs your name, registered trade name or registered trade mark, postal address, email address and, if available, web address for its records under Article 5(3). The duty to inform applies there too (Article 4(5), Article 5(5)). Neither applies to suppliers outside the EU; their customer does, however, need their name, postal address and email address for its information under Article 9(1)(e).

Numbers per delivery: who, to whom, in what form

The operator gives the reference number only to the first downstream operator or trader (Article 4(7) read with Article 5(3)(a)), so the number travels exactly one step down. The first customer does not have to ask and may assume in good faith that a supplier who sends none is not an operator (Commission FAQ 3.4, 3.5). If it knows that its supplier is an operator, however, it may not resell the goods without the number (FAQ 3.5, Article 5(1)). It links the numbers to incoming goods, not to outgoing ones, and keeps them for five years (FAQ 3.4, Article 5(4)). It does not have to pass them on. The German enforcement authority BLE (Federal Office for Agriculture and Food) confirmed this in its answers to a chamber of commerce (IHK) webinar of 21 May 2026.

How the number is passed on is up to you. The Commission mentions the invoice, an email or other documents accompanying the product (FAQ 3.8); according to the BLE, it does not go through the information system. Only the customs declaration on import and export has to carry the number, and on export by a downstream operator not even that (FAQ 7.21). Agree a fixed place with your customer, such as a separate line on the invoice that refers to the item.

The verification number adds a layer of security to the data in the statement. You do not have to pass it on (FAQ 3.6.1), but you may share it confidentially. Without it your customer cannot check the validity of the reference number in the information system (FAQ 7.25). Customers that are not SMEs may ask for it when they have substantiated concerns. The due diligence system template shows how to record internally which numbers you passed on.

Geodata and statement content: what may stay confidential

The Regulation contains no obligation to share geodata along the chain (Commission FAQ 7.15). As the operator you decide, with a tick box when you submit the statement, whether customers that are not SMEs can see the geodata in the information system. Even then they can view them only where they have substantiated concerns and hold the reference and verification number (FAQ 3.6; User Guide version 3.0, section 8.2). The authorities see them in any case (FAQ 7.7). Only customers that are not SMEs may view the content of the statement, and only where they have substantiated concerns (User Guide section 8.2); anything you upload in addition is visible to the authorities only (FAQ 7.23). Outside the system, the exchange is a matter for the contract.

As a downstream operator or trader you usually do not hold the geodata at all. If you do, on our reading you should pass them on only with the upstream supplier’s consent, and where they contain the names of producers, data protection law applies as well. The guide to submitting in TRACES explains how the release works in the information system. Which geodata you need from your suppliers as an operator is set out on the page on geodata.

What you always owe: reporting non-compliance risks

This obligation applies to every role in the EU and to every size. If you learn that a product you have already supplied may not comply, you inform the competent authority and the downstream operators and traders you supplied without delay (Article 4(5) for operators, Article 5(5) for downstream operators and traders). A substantiated concern can also be the trigger, meaning a duly reasoned claim based on objective and verifiable information (Article 2(31)). In the Commission’s view you are aware of it even if it reaches you by email, in a meeting or through the media (FAQ 3.6.2). In Germany, the draft act provides for a fine of up to EUR 50,000 for failing to inform or informing late; against legal persons with a total turnover above EUR 1.25 million, the fine can reach 4 percent of EU-wide total turnover (Bundestag printed paper 21/8278, section 14; more under enforcement and penalties).

Customers that are not SMEs must, where there are substantiated concerns, verify that due diligence was exercised, and they may not resell the goods until then (Article 5(6)). On our reading the Regulation does not oblige you to answer their questions. If your customer’s notice contains new information about a risk, however, the duty to inform in the previous paragraph applies to you (Article 4(5), Article 5(5)). Without information from you, the customer can also fulfil its duty to verify by giving the authority details of its supply chain and its concerns; the authority may then inform you of the concerns, and the same obligations apply to you (Commission FAQ 3.6.2).

Get an EUDR Software Demo

Save up to 80% of your time and costs with our software!

Book a 30-minute demo →Or start with the 2‑minute EUDR check

When there is no number

Some requests cannot be answered with a number because none exists for the delivery. Say so explicitly and give the reason, or your customer will keep waiting for something that is not coming.

For customers without a role of their own, such as printers of catalogues, building block B9 d asks about the use. Whether a CN code is covered is shown by the Annex I list and the scope checker (Excel), the codes by the TARIC glossary. There are separate pages for suppliers outside the EU and companies in the United Kingdom, the GeoJSON checker for geodata and an article on export and re-import.

Liability and contract clauses: what the Regulation covers

By submitting the due diligence statement, the operator assumes responsibility for the product’s compliance (Article 4(3)). Appointing an authorised representative does not change that (Article 6(1)). Downstream operators and traders have information duties and, if they are not SMEs, a duty to verify where there are substantiated concerns (Commission FAQ 3.11). Everyone owes assistance during checks to the authority (Article 4(6), Article 5(7)), not to the customer.

The Regulation provides for no customer audit rights, indemnities or contractual penalties. Whether you accept such clauses is decided under contract law, so have drafts reviewed before you sign. How buyers question their suppliers is shown in the supplier questionnaire.

The reply template (Word and PDF)

The reply template is a Word document in two parts. On the first two pages, a worksheet just for you, you tick your role, your size and the type of request. Then comes the letter: you use only the building blocks from the table that match your ticks and, as an operator, add the list of deliveries as an annex. Placeholders are in square brackets, and notes with legal references sit in grey boxes that you delete before sending.

• Download: Reply template for EUDR customer requests (DOCX)
• Download: Reply template to read and print (PDF)
• Download: German version of the reply template (DOCX)
• Download: German version (PDF)

The template is a working document, not an official form; the Regulation sets no format for replies to customers. You may use and adapt it freely within your company.

Three example replies (fictitious)

The cases come from sectors where suppliers are currently receiving many requests. Companies, figures and numbers are invented.

Example 1: a furniture retailer with two supply routes

Möbelhandel Beispiel GmbH, a furniture retailer and SME with 38 employees, sells acacia dining tables imported from Vietnam by Import Muster GmbH and upholstered chairs that a German manufacturer builds from beech bought in the EU. A furniture store chain with 900 employees and EUR 200 million turnover asks for “an EUDR certificate for all wooden items and the geolocation of the plots of origin”.

A business that buys from a trader needs only the trader’s company details (Article 5(3)(a)). Möbelhandel Beispiel GmbH keeps the importer’s numbers for the dining tables for five years without having to pass them on; for the chairs there are none, because the manufacturer is a downstream operator. The article for furniture importers covers what else applies to wooden furniture.

Example 2: a paper wholesaler with two roles

Papiergroßhandel Muster KG, a paper wholesaler with 260 employees and EUR 140 million turnover, is not an SME. It imports coated paper (4810) from Brazil and is the operator for it. It also resells uncoated paper (4802) unchanged as a registered trader; that paper comes from mills in Finland and Germany that are themselves downstream operators. Druckerei Beispiel GmbH, a printer, prints catalogues from the paper and resells a small part unprinted. It asks for “the reference number for each delivery and a confirmation that the paper is EUDR compliant”.

For the paper that becomes catalogues (Chapter 49, not listed in Annex I), the printer has no role, and the wholesaler owes it no number (Commission FAQ 2.10, 3.6.1). For the part it resells unprinted, the printer is a trader and the importer’s first customer; since the wholesaler cannot tell which part that is, the number goes on every invoice for imported paper. More on the sector in the article on paper and packaging.

Example 3: a tyre importer as operator

Reifenimport Muster GmbH, a tyre importer with 120 employees and EUR 30 million turnover, is a medium-sized undertaking and so an SME without a deferral; its deadline is 30 December 2026. It imports new passenger car tyres (4011 10 00) from Thailand, which is classified as low risk. If the suppliers’ information shows that the natural rubber comes exclusively from plantations in Thailand, and the assessment of the supply chain for circumvention and mixing has found nothing, simplified due diligence under Article 13 applies (Commission guidelines, section 4(e)); the geolocation of the rubber plots remains mandatory. Reifenhandel Beispiel AG, a wholesaler that is not an SME, wants the geodata, a copy of the statement, the verification number, the risk assessment, an audit right and an indemnity.

Reifenhandel Beispiel AG buys directly from the operator as a trader and so receives the number without qualification. The importer provides the verification number voluntarily; without it, the customer could not check validity or, where there are substantiated concerns, view the content of the statement (Commission FAQ 7.25; User Guide section 8.2). More cases from the sector are in the article on rubber and tyres.

Common mistakes

1. Promising more than the role requires. A trader confirms “deforestation-free and legal” although it does not have to check the due diligence upstream and usually cannot (Commission guidelines, section 4(d)).
2. Passing on suppliers’ numbers as if it were mandatory. All that is required is the link to incoming goods (FAQ 3.4), and numbers passed on easily end up against the wrong delivery.
3. Spreading the verification number openly. It does not belong in customer portals, catalogues or open mailing lists, because it adds a layer of security to the data in the statement (FAQ 3.6.1).
4. Not asking what the customer does with the goods. Consumers, businesses that use the goods themselves and printers that use the paper for catalogues or books need no number (FAQ 3.6.1, 2.10). If a printer makes labels or folding cartons from it, the product stays within Annex I, and a printer supplied by the operator gets the number (Article 4(7), FAQ 3.1.1).

How Polygon One helps

An operator that supplies many customers has to be able to name the right reference number for every delivery. Polygon One builds the due diligence statement from your captured data and sends it to the EU Information System (TRACES) through the interface. The reference number lands back in the record automatically, ready for the customs declaration and for your customers, and an API connects Polygon One to your ERP. If you buy from an operator yourself, Polygon One stores their reference numbers with the verification number for every delivery, so you can find them straight away during an inspection. Your suppliers enter their plots through a portal without login.

Which role you have and what you tell your customer is your decision. Responsibility for due diligence stays with your company; the enforcement authority sees it the same way. More on the EUDR software page.

Frequently asked questions

Do we have to send our customer a due diligence statement?

No. The Regulation does not oblige anyone to send their customer the statement or a copy of it (Commission FAQ 3.6.1). If you are the operator, you owe your first customer the reference number (Article 4(7)). If you are a downstream operator or trader, you do not submit a statement at all; the information system does not allow it (FAQ 3.10.1). Your customer then needs your company details under Article 5(3).

Our customer is asking for an “EUDR certificate”. What do we send?

The information the Regulation sets out for your role. As an operator that is the reference number of the due diligence statement for each delivery; as a downstream operator or trader it is your role and your company details. You can add certificates such as FSC or PEFC; according to Commission FAQ 5.7 they help with the risk assessment, but they do not replace due diligence (Commission guidelines, section 10).

Do we have to pass our supplier’s reference number on to our customer?

No. Only an operator owes reference numbers to its first customer. If you are the first downstream customer yourself, you do not have to pass on your suppliers’ numbers, but you may. All that is required is that you link the numbers to incoming goods and keep them for five years (Commission FAQ 3.4, Article 5(4)); the BLE takes the same view.

Do we have to give our customer the geolocation of the plots?

No. The Regulation contains no obligation to pass geodata along the supply chain (Commission FAQ 7.15). As the operator you decide when submitting the statement whether customers that are not SMEs can see the geodata in the information system where they have substantiated concerns (FAQ 3.6; User Guide section 8.2). If you supply an importer from outside the EU, however, it cannot submit a statement without your geodata.

Do we have to send the verification number?

No. There is no obligation to pass the verification number on (Commission FAQ 3.6.1), but you may share it confidentially. Without it your customer cannot check the validity of the reference number in the information system (FAQ 7.25).

Do we have to sign our customer’s supplier declaration?

The Regulation does not require such a declaration. Fill in what concerns your role: role, size, registration in the information system where it applies and, as an operator, the reference numbers. Further commitments, for instance that you as a trader have checked your suppliers’ due diligence, are not required either (Commission guidelines, section 4(d)); have any such commitment reviewed by a lawyer.

Our customer is a printing company. Does it still get a reference number?

It depends on what it makes from the paper. If it prints catalogues, brochures or books, which are printed matter of Chapter 49, it is neither a downstream operator nor a trader for that paper, because these products are not listed in Annex I; you do not have to pass the number on for it (Commission FAQ 2.10, 3.6.1). If it prints labels (4821) or folding cartons (4819), the product stays in Chapter 48 and therefore in Annex I. The printer is then a downstream operator, and if you supply it as the operator, you owe it the reference number (Article 4(7), FAQ 3.1.1). For paper it resells unprinted, it is a trader and gets the number as well.

What do we have to do if we learn of a problem in our supply chain?

Inform the competent authority and the downstream operators and traders you supplied with the product without delay, whatever your size (Article 4(5) for operators, Article 5(5) for downstream operators and traders). In Germany, the draft act provides for fines for failing to inform or informing late (Bundestag printed paper 21/8278, section 14, not yet passed).

We are a small company with a deferral until 30 June 2027. What do we tell customers who want numbers from 30 December 2026?

If you were established as a micro or small undertaking by 31 December 2024 and act as an operator, the obligations apply to you from 30 June 2027 (Article 38(3)), except for timber and paper covered by the Annex to the EU Timber Regulation. Until then there is no reference number for your deliveries; your customers prove with an invoice or delivery note that the goods were placed on the market before that date (Commission FAQ 9.1, 9.2). As a trader or downstream operator you are bound from 30 December 2026.

Sources and status: Regulation (EU) 2023/1115 as amended by Regulations (EU) 2024/3234 and (EU) 2025/2650 and Delegated Regulation (EU) 2026/2102, consolidated version of 18 September 2026 (EUR-Lex), Article 1(2), Article 2(15), (15a), (15b), (17), (30) and (31), Article 4(3) to (7), Article 4a(2), Articles 5, 6, 7, 9, 10, 13, 26(4), 37 and 38, Annex I. Implementing Regulation (EU) 2024/3084 as amended by Implementing Regulation (EU) 2026/1565. Implementing Regulation (EU) 2025/1093 (country benchmarking). Commission guidelines, OJ C/2026/3896 of 20 July 2026, sections 2, 2(a), 2(c), 4(d), 4(e) and 10. Commission FAQ on EUDR implementation, version 5 (April 2026, revised 21 August 2026), questions 2.10, 3.1.1, 3.4, 3.5, 3.6, 3.6.1, 3.6.2, 3.7, 3.8, 3.10, 3.10.1, 3.11, 3.13, 5.6.1, 5.7, 7.7, 7.15, 7.21, 7.23, 7.25, 9.1 and 9.2. EUDR Information System User Guide for economic operators, version 3.0 of 16 September 2026, sections 6.2(a), 8.1 and 8.2. DG TAXUD, TARIC data on Regulation (EU) 2023/1115, revision 1 of 23 September 2026, codes Y129, Y133, Y141, Y187, Y188, Y190 and Y196. German Federal Office for Agriculture and Food (BLE): answers to the webinar “EUDR: Offene Fragen aus der Unternehmenspraxis” of 21 May 2026, published by the Bavarian chambers of commerce (BIHK), in German; the BLE statements reflect the administrative view of the German enforcement authority, not case law. German Government draft act, Bundestag printed paper 21/8278, section 14 (not yet passed). Interpretations on customers outside the EU, on sharing geodata and on cooperation in case of substantiated concerns are marked as our reading. As of 6 November 2026. The examples are fictitious. This article is not legal advice.

Photo: Gabrielle Henderson / Unsplash