EUDR due diligence system under Article 12: structure, responsibilities and annual review, with a Word template and a worked example

The due diligence statement shows the authority what you checked for one delivery. The due diligence system under Article 12 of Regulation (EU) 2023/1115 shows how your company goes about it every time: who collects the information, who assesses the risk, who releases a delivery and where the evidence is kept. There is no official template, and the Commission does not plan one (Commission FAQ 5.16). This page sets out what belongs in the system and what the enforcement authority checks, with a Word template of twelve building blocks and a worked example for a fictitious furniture importer.

Get an EUDR Software Demo

Save up to 80% of your time and costs with our software!

Book a 30-minute demo →Or start with the 2‑minute EUDR check

What Article 12 requires and from whom

Article 12 of the EUDR requires every operator to have a “framework of procedures and measures” that ensures its products are deforestation-free, legally produced and covered by a statement. The Regulation calls this the due diligence system. It means the procedure you lay down in the company, not a piece of software: who does what, under which rules and with which evidence. Article 12 does not require written form as such, but because the authority examines the system and updates have to be recorded for five years (Article 12(2), Article 18(1)(a)), in practice you cannot do without a document. The system must be reviewed at least once a year and updated straight away when new developments arise, and all due diligence records must be kept for at least five years (Article 12(1), (2) and (5)).

The obligation follows the role, not the size. Small importers need a system too; for micro or small primary operators it generally consists of collecting the information (Commission guidelines, section 4(c)). Since the amendment by Regulation (EU) 2025/2650, traders and downstream operators no longer carry out due diligence themselves and therefore need no system (Commission FAQ 5.1). Operators that are not SMEs also need a compliance officer, an independent audit function (Article 11(2)) and an annual public report (Article 12(3) and (4)). Which size class your company falls into under the EUDR, with the thresholds, is explained in the article on roles and obligations; which role you have for each product is shown by the EUDR check.

“As a rule” means that the Regulation, the guidelines and the FAQ say nothing explicit about special cases, for example a small primary operator whose company as a whole exceeds the thresholds. A company that imports itself and also buys within the EU needs the system for the imported part; Article 5 governs the purchases within the EU. Whether the compliance officer and the audit function fall away under simplified due diligence under Article 13 is an open question (see below).

Looking for the template for the due diligence statement you submit in the information system? It is in the article on the due diligence statement.

What the authority checks in your system

In a check, the authority examines the due diligence system with its risk assessment and risk mitigation procedures and the records that show it works, together with the documents on a specific product and the due diligence statement (Article 18(1)). For the inspection quota, an operator only counts as checked once both have been examined (Article 16(11)). Under the Commission guidelines, data collection, risk assessment and risk mitigation must be causally related and reflect the company’s business and the supply chains of its products (section 4(a)).

Germany’s Federal Office for Agriculture and Food (BLE) applies this yardstick to the system as a whole and to the individual deliveries covered by a statement (BLE slides of 24 September 2026, slide 32). In its web seminar of 15 October 2026 it described a check as starting from the reference number of one statement: from there it identifies the company and examines its system with reference to that delivery. This is the authority’s own account, so it reflects administrative practice. For your system, it means every building block should state in which record its implementation can be found for a specific delivery.

There are first experiences from the Netherlands. In dry runs by the Dutch inspection authority NVWA, companies had made good progress in setting up their systems, according to the Dutch Government; the weak point was risk mitigation, especially where supply flows are mixed along the chain (Kamerstuk 36 518, No. 17, of 9 October 2026, in Dutch). Who checks in Germany, how often and which fines the draft act provides for is covered in the article on enforcement and penalties; the status page tracks the legislative procedure.

Get an EUDR Software Demo

Save up to 80% of your time and costs with our software!

Book a 30-minute demo →Or start with the 2‑minute EUDR check

The twelve building blocks of a due diligence system

The twelve building blocks follow the path an inspector takes: from the individual delivery through assessment and information back to the framework. Each block names its legal basis and the record that proves it has been put into practice. You work through the risk assessment criteria with our Excel risk assessment template; the system defines who does that, when and under which rules.

Several building blocks have their own working aids: for block 1 the list of CN codes under Annex I, for block 4 the supplier questionnaire, the guide to geolocation data and the GeoJSON checker, for block 5 the country risk list and the risk assessment, for block 6 the measures catalogue in the risk assessment template, for block 8 the template for the due diligence statement, the guide to submitting in the information system, the article on the reference number and the one for freight forwarders and customs brokers, for block 11 the checklist in the article on checks.

Mixed businesses: importing and buying within the EU

Many companies import part of their goods themselves and buy another part within the EU. For the imported goods they are operators and need the system. For goods that another operator has already placed on the market, they are traders or downstream operators with the obligations of Article 5. The template keeps both in one document but separate: the twelve blocks for imports, Annex A for purchases within the EU. That way it stays clear which obligation comes from where.

Who does what: the responsibility matrix

The matrix is a suggestion for a mid-sized trading company; your system has to reflect your own functions. What matters is that every task has exactly one accountable function and that the audit function is not involved in the processes it checks. In the template the matrix is Annex D.

Functions: MGT Management; CO Compliance officer (non-SMEs); PUR Purchasing; QS Quality and sustainability; CL Customs and logistics; WH Warehouse; SAL Sales; IT IT; AUD Audit function (non-SMEs). Letters: A accountable, R carries out the work, C contributes, I informed. Instead of the audit function, the annual review can also be carried out by a person within the company who is not involved in the processes (guidelines section 8).

Responsibility also covers the information system. A company has one account, under which several roles can be held (Article 10(1) of Implementing Regulation (EU) 2024/3084 as amended by Implementing Regulation (EU) 2026/1565). Whoever holds the ADMIN role manages requests from new users; the user guide recommends more than one ADMIN per account so that work can continue if someone is absent (version 3.0, section 1.7). Record who is ADMIN, who deputises, who submits statements and how access is withdrawn when someone leaves.

Compliance officer and independent audit function

What the Regulation lays down

Article 11(2) requires all operators to have adequate and proportionate policies, controls and procedures to mitigate and manage the risk of non-compliant products, including model practices for risk management, reporting, record keeping, internal control and compliance management. Operators that are not SMEs also appoint a compliance officer at management level and have an independent audit function that checks these internal policies, controls and procedures. Both obligations sit in Article 11, not Article 12. In the template they belong to building blocks 3 and 10.

What it leaves open, and how the template deals with it

Who can be the compliance officer, which powers the role needs and whether the audit function may sit inside the company is answered neither by the Regulation nor by the Commission’s guidelines or FAQ. The English text speaks of an “independent audit function”, which does not rule out internal audit. For the annual review under Article 12(2), the guidelines expressly allow a person within the company who is independent of those carrying out the procedures, or an external body (section 8).

The template therefore takes the following approach, which is our interpretation and not an official requirement: the compliance officer is a member of management or a manager reporting directly to management, appointed in writing, with a deputy and the right to refuse a release. The audit function may be internal or external as long as it is not involved in the processes it checks; the choice is justified in writing. According to its own account, the Dutch inspection authority NVWA asks in its checks whether someone has been appointed for the EUDR and whether management has been involved.

Simplified due diligence: an open question

An operator sourcing only from low-risk countries does not have to fulfil the obligations of Articles 10 and 11 under Article 13(1), once it has assessed supply chain complexity and the risk of circumvention and mixing. Whether this also removes the compliance officer and the audit function is not answered by any of the sources. In our interpretation the question is open. The template provides for both anyway, because any new information leads back to full due diligence under Article 13(2). The system itself and the report remain in every case.

Annual review and change log

At least once a year you check whether the system works (Article 12(2)). Section 8 of the Commission guidelines sets out what to look at. Are there documented procedures for collecting the information, for assessing risk and for the action to take at each risk level? Do the people responsible understand their steps and carry them out? Do controls ensure that products with a non-negligible risk are actually excluded? The review can be done by a person within the company who is not involved in the processes, or by an external body. Under the guidelines, management should set deadlines for any weaknesses found, and the steps and outcome of the review should be recorded.

Between two reviews you update the system as soon as something important changes: new suppliers or countries of production, a new country list, a new version of Annex I, the guidelines or the FAQ, a finding from a check or substantiated concerns. Every change goes into the change log, which is kept for five years. Because the system is reviewed every year, a due diligence statement should not cover deliveries over more than one year either (Commission FAQ 5.19). Risk assessments and mitigation decisions have their own annual reviews (Article 10(4), Article 11(3)).

The public report under Article 12(3)

Operators that are not SMEs report publicly every year, including on the internet, on their system and the steps they have taken to meet their due diligence obligation. The report contains an overview of products, quantities and countries of production, the conclusions of the risk assessment with an explanation of the information and evidence obtained and used for it, the mitigation measures taken and, where applicable, a description of the process for consulting indigenous peoples, local communities, other customary tenure rights holders or civil society in the area of production (Article 12(4)). Data protection rules take precedence; paragraph 4 does not require supplier names.

The first report covers the year 2027 and is published after 30 December 2027 (Commission FAQ 5.14). Companies that already include the information in a report under other EU value chain due diligence rules (Article 12(3)), and in the Commission’s view also in their CSRD sustainability report, do not have to repeat it (Commission FAQ 5.14). Companies without such a report publish the EUDR report on its own, for example on their website. An outline is in Annex G of the template.

The template (Word)

The template is a Word document with a cover page, a change log, the twelve building blocks in three parts (framework, process per delivery, control and maintenance) and nine annexes, including a product list, a role table, a responsibility matrix, a record sheet for the annual review and an outline of the public report. Each block has required fields in square brackets, a grey note with the legal source that you delete before approval, and a line for the record that proves it is in place. Fields that only apply to operators that are not SMEs are marked.

• Download: EUDR due diligence system under Article 12, template with twelve building blocks and annexes (DOCX)
• Download: German version of the template (DOCX)

The template is a working tool, not an official form; the Commission prescribes no format (FAQ 5.16). You may use and adapt it freely within your company. It is not legal advice. Write your system in the blank template and use the worked example only as a benchmark, because a copied system does not reflect your supply chains, and that is exactly what the authority looks at.

Example: completed due diligence system (fictitious)

The fictitious Muster Holz & Möbel GmbH sells wooden furniture to furniture retailers and contract furnishers. With 310 employees, EUR 78 million turnover and a balance sheet total of EUR 41 million it is not an SME under the EUDR, and its deadline is 30 December 2026. It sources through three routes, and each route carries different obligations.

Two passages in the example show what matters. The release is built into the merchandise management system: without the status “EUDR cleared” on an order line, no customs order is issued. And the change log shows a real update. In January 2027 a factory visit at a Vietnamese manufacturer finds that wood of unknown origin is processed on the same line. The company withdraws simplified due diligence for this supplier, reports the finding to the BLE, carries out a full risk assessment, requires a separate line and a mass balance, and amends three building blocks.

The company, suppliers, figures and findings are invented. The example shows the structure and depth of a due diligence system, not real results. What furniture importers need to watch beyond this is covered in EUDR for furniture importers.

• Download: Worked example of a due diligence system, fictitious timber and furniture importer (DOCX)
• Download: German version of the worked example (DOCX)

Common mistakes

• The system copies the Regulation. It has to reflect your own business and your own supply chains (guidelines, section 4(a)). Without sourcing routes, suppliers and responsibilities it is of no help in a check.
• Information is collected but not assessed. In dry runs in spring 2025 the Dutch NVWA found that much of the information collected was not always assessed for risk and that no measures were derived from it (NVWA news item of 21 August 2025).
• The result has no reasons. A score or a mere overview of results is not enough for the BLE; each criterion needs its reasoning (slide 30 of 24 September 2026).
• The software assesses, but nobody knows how. The BLE expects companies to know the methodology of their tools and to hold the underlying sources themselves (slide 7). The system names each tool, what it delivers and who evaluates its results. Questions to ask providers are in the software comparison.
• A certificate is meant to replace the assessment. Certification schemes can help with the risk assessment, but they do not replace due diligence (Commission FAQ 5.7); as a mitigation measure they only complement it (BLE slide 33).
• Article 13 without an assessment. Low country risk on its own is not enough; complexity, circumvention and mixing have to be assessed and documented for each supply chain, and information collection stays complete (Article 13(1); BLE slides 26 and 27). For timber, what counts is the country where the tree was felled, not the country where the furniture was made. More in the country risk list.
• No link to the goods in the warehouse. The system describes procedures, but the goods carry no reference number and are not kept apart. The NVWA explicitly checks how the system and the physical product are linked.
• No trace of the review. A system still dated last year and without a change log does not show that it is maintained (Article 12(2)).
• An outdated version copied. Older templates and guides still require a system or a report from traders and downstream companies. Since Regulation (EU) 2025/2650, Article 12 no longer applies to them; it covers operators only.

How Polygon One helps

The due diligence system describes how your company works. The evidence it refers to is created delivery by delivery, and that is where Polygon One comes in. Suppliers enter their plots through a portal without login, and the overview shows for each supplier where data or evidence is still missing. Every plot is screened by satellite against 31 December 2020, the country risk comes from Implementing Regulation (EU) 2025/1093, and AI reads evidence and matches it to supplier, country and commodity. The compliance report records information, risk assessment and risk mitigation in one document, with the risk assessment giving a reason for each criterion, and the five-year retention duty is covered. The due diligence statement goes to TRACES through the interface, and the reference number comes back into the record automatically, ready for the customs declaration and for your customers. If you buy from an operator, Polygon One stores their reference numbers with the verification number for every delivery. An API connects Polygon One to your ERP.

The rating of each criterion, the release and the system itself remain your company’s decision and responsibility; the enforcement authority sees it the same way. More on the EUDR software page.

Frequently asked questions

Do SMEs need a due diligence system too?

Yes, if they are operators. Article 12(1), (2) and (5) apply to all operators, including micro or small primary operators, whose system generally consists of information collection (guidelines, section 4(c)). Only the compliance officer, the independent audit function and the public report are obligations of operators that are not SMEs.

Do traders and downstream operators need a due diligence system?

No, not since the amendment by Regulation (EU) 2025/2650. Their obligations are in Article 5: details of suppliers and customers, with reference numbers where the supplier is an operator, five years of record keeping, informing the authority of new information and, for non-SMEs, registration and a check when substantiated concerns arise (Commission FAQ 5.1; guidelines, section 4(d)). If you also import yourself, you need the system for that part.

Is there an official form, and does the system need approval?

No. The Regulation prescribes no format and the Commission does not plan one (FAQ 5.16). Approval or certification is not foreseen. The authority examines the system during a check (Article 18(1)(a)).

Who can be the compliance officer?

For non-SMEs the Regulation only requires a compliance officer “at management level” (Article 11(2)(a)). The guidelines and the FAQ say nothing further. The template suggests a member of management or a manager reporting directly to management, appointed in writing, with a deputy and the right to refuse a release. This is our interpretation, not an official requirement.

Can the independent audit function be internal?

The Regulation does not say. The English text speaks of an “independent audit function”, which does not rule out internal audit; for the annual review under Article 12(2) the guidelines allow a person within the company who is independent of those carrying out the procedures, or an external body (section 8). In our interpretation, what matters is that the auditors are not involved in the processes they check. The template asks you to give reasons for your choice.

When is the first public report due?

For the year 2027, published after 30 December 2027 (Commission FAQ 5.14). Companies that already include the information in a report under other EU value chain due diligence rules do not have to repeat it (Article 12(3)). Article 12(4) sets out the content.

How often must the system be reviewed?

At least once a year, and straight away when something changes that could affect it, such as new suppliers, a new country list or a finding from a check. Every update is recorded and kept for five years (Article 12(2)). Risk assessments and mitigation decisions have their own annual reviews (Article 10(4), Article 11(3)).

Is our parent company’s policy or our old EUTR system enough?

As a starting point yes, as the system not without more. Obligations apply to each operator separately, and the company placing the product on the market remains responsible (Commission FAQ 3.13 and 5.3). Under the guidelines the system must reflect your own business and your own supply chains (section 4(a)). An EUTR system covers neither geolocation nor deforestation-free status.

What are the consequences in Germany if the system or the report is missing?

Under the draft act (Bundestag printed paper 21/8278, not yet passed) a missing or incorrect report can be fined up to EUR 50,000, documents not provided also up to EUR 50,000 and failure to keep records up to EUR 20,000; above a turnover threshold, legal persons face up to four percent of total turnover. There is no separate offence for a missing system. In our assessment, a missing system will usually mean that records are missing in a check or that due diligence itself has not been exercised; for the latter the draft provides for up to EUR 100,000. Details are in the article on checks and penalties.

Sources and status: Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650 (consolidated version of 18 September 2026, EUR-Lex), Article 2(15), (15a), (15b), (17), (28) and (30), Articles 3, 4, 4a, 5, 6, 7, 8 to 13, 16, 18, 26, 31 and 38, Annex I. Implementing Regulation (EU) 2024/3084 as amended by Implementing Regulation (EU) 2026/1565, Articles 8a, 10, 12 and 15a. Implementing Regulation (EU) 2025/1093 (country benchmarking). Commission guidelines, OJ C/2026/3896 of 20 July 2026, sections 4 to 4(f), 6(b), 7(b) and 8. Commission FAQ on EUDR implementation, version 5 (April 2026, revised 21 August 2026), questions 3.6.2, 3.13, 3.24, 4.15, 5.1, 5.3, 5.7, 5.8, 5.14, 5.16 and 5.19. EUDR Information System User Guide, version 3.0 of 16 September 2026, sections 1.7, 1.8 and 6.2. German Federal Office for Agriculture and Food (BLE): slides on the role of providers of support tools and the due diligence obligation of operators (in German) for the web seminar of 24 September 2026, slides 5, 7, 21, 26, 27, 30, 32 and 33; BLE web seminar on EUDR checks of 15 October 2026, recording published on 22 October 2026 (YouTube channel BZL-Fachinformationen, in German). The BLE statements reflect the administrative view of the German enforcement authority, not case law. Netherlands: Kamerstuk 36 518, No. 17 (adopted 9 October 2026); NVWA news item of 21 August 2025 (amended 19 December 2025) and the pages “Opzetten stelsel van zorgvuldigheidseisen voor de EUDR” (as of 12 October 2026) and “Controle door NVWA” (as of 6 October 2026), in Dutch. German Government draft act, Bundestag printed paper 21/8278, section 14 (procedure: referred to committee). Example: product scope of Indonesian FLEGT licences under Annex IA of the Voluntary Partnership Agreement between the EU and Indonesia (OJ L 150 of 20 May 2014). Interpretations on the compliance officer, the audit function and Article 13 are marked as our interpretation. As of 30 October 2026. The worked example is fictitious. This article is not legal advice.

Photo: Viktor Talashuk / Unsplash