Supplier geodata for the EUDR: requirements, formats, validation, with a template in CSV and GeoJSON

The short version

• Point or polygon. Plots up to four hectares may be supplied as a single coordinate pair, above that the Regulation requires a polygon. For cattle, points for the establishments are enough, whatever their size.
• Six decimals, WGS84. The Regulation requires at least six decimal digits. The Information System truncates longer values to six digits and pads shorter ones with zeros. It does not reject short coordinates, it only makes them look precise.
• In GeoJSON the order matters. Longitude first, then latitude. Swapped values are the most common error in supplier files.
• The system has hard limits. 25 MB of geodata per due diligence statement, 1,000 production places per commodity line, 10,000 per statement, 50 drafts per account.
• Only four properties are read: ProducerName, ProducerCountry, ProductionPlace and Area. Everything else is ignored, and so are these four when they are misspelt.
• Responsibility stays with the operator. Data received from cooperatives, certifiers or service providers does not shift liability for its accuracy.

What the Regulation requires

Article 9(1)(d) requires, for every product in scope, the geolocation of all plots of land where the relevant commodities were produced, together with the date or time range of production. Where commodities come from several plots, each plot has to be given. For cattle, the geolocation refers to all establishments where the animals were kept. Annex II repeats these items as mandatory content of the due diligence statement.

Article 2 defines the terms behind them.

Geolocation (point 28) is the geographical location of a plot of land in latitude and longitude, with at least one coordinate pair and at least six decimal digits. For plots above four hectares used for commodities other than cattle, it has to be provided as a polygon with enough points to describe the perimeter.

Plot of land (point 27) is land within a single real-estate property under the law of the country of production that is homogeneous enough to assess the deforestation risk as one unit. Not the cooperative, not the village, not the mill's supply shed. According to the Commission FAQ, a plot may cover the whole property if it is homogeneous, or only the cultivated part; a farm that cultivates half its land for the EU market may declare the whole farm or only that half. A land-registry entry is not a precondition: where registers are missing, the land actually used is the plot.

Establishment (point 29) is, for cattle, the place where the animals were kept, from the farm of birth to slaughter. Cattle born before 29 June 2023 are outside the Regulation.

Date or time range of production. The FAQ spells this out: for all commodities other than cattle, the date of production is the harvest date and the time range is the duration of the production process, for timber the duration of the felling operations. Where nothing more precise is available, the crop year or harvest season may be used. For cattle, the time range is the lifetime of the animal from birth to slaughter. The date of shipment or of the invoice is never what is meant.

Personal data. The statement needs coordinates, the country of production and the area, not the farmers' names. The FAQ is explicit: unless farmers are operators or direct suppliers themselves, no personal information is required from them, the geolocation of the plot is sufficient. Anyone who nevertheless enters a smallholder's name as ProducerName processes personal data and has to follow data-protection rules. The Information System stores such data for a limited period under the implementing regulation on its operation.

Point or polygon: the four-hectare threshold

The rule is well known, the detail less so.

Up to four hectares a point is enough. One coordinate pair inside the plot. The area is mandatory: if it is missing, the system inserts four hectares as the default. Downwards the limit is practically open, the system only requires a value of at least 0.0001 hectares, one square metre.

Above four hectares a polygon is required. For commodities other than cattle, the system rejects a point with an area above four hectares with an error. The polygon has to describe the actual perimeter, not a rectangle around the farm.

Cattle are the exception. Point coordinates for the establishments are enough, whatever the area. All establishments where the animals were kept are required, including intermediate ones. For live cattle imported into the EU this applies up to the first placing on the market.

One polygon per plot. The FAQ leaves no room here: each polygon describes one single plot of land, contiguous or not. If a consignment comes from twelve parcels, the statement needs twelve geometries. A polygon around an area that only partly consists of plots of production is not allowed.

No upper or lower limit for plots. The Regulation sets no minimum and no maximum size, as long as the plot captures the actual area of production. The area of a polygon is not limited in the system either, only the file size.

Composite products. For furniture with several wood components, all plots where the wood used was produced have to be given. If a product contains several commodities, chocolate with cocoa and palm oil for instance, due diligence applies only to the commodity under which the product is listed in Annex I.

The format the system actually reads

The Information System accepts geodata in two ways: through the map dialogue in the browser, the GeoEditor, or as a GeoJSON file. Through the API the same GeoJSON geometry is passed base64 encoded in the field geometryGeojson. Anyone with more than a handful of plots works with the file. The Commission's technical description, dated 17 August 2026, applies expressly to the user interface and the API alike.

Coordinate reference system. Only WGS84 (EPSG:4326) in decimal degrees is supported, as the GeoJSON standard RFC 7946 prescribes. Latitudes lie between minus 90 and 90, longitudes between minus 180 and 180. Other reference systems have to be converted first.

Order. In GeoJSON the longitude comes before the latitude. This is the most common source of error, because tables and everyday language use the opposite order. Swapped values rarely produce an error message; they produce a plot in the sea or on another continent.

Precision. The system stores six decimal places, roughly ten centimetres. Longer values are truncated, shorter ones padded with zeros. Both are treacherous: too many digits can make two neighbouring points identical after truncation and turn a valid geometry into an invalid one. Too few digits pass, but do not meet the Regulation, which requires at least six, and deliver false precision: four decimals mean about ten metres, not ten centimetres.

Permitted geometry types. Point, MultiPoint, Polygon, MultiPolygon and GeometryCollection, wrapped as Feature or FeatureCollection. LineString and MultiLineString are not valid areas and are rejected.

Polygon rules. A polygon consists of at least four coordinate pairs, and the first point is identical to the last, so the ring is closed. Self-intersecting shapes such as a figure of eight are not processed, nor are holes, the doughnut shape. If you need a hole, split the area into two half doughnuts.

Properties. The system reads exactly four optional properties: ProducerName, ProducerCountry as a two-letter ISO code, ProductionPlace and Area. The area in hectares is only evaluated for the geometry type Point. Any other properties may sit in the file; they are ignored. That also applies to the four names themselves when they are misspelt: "productionplace" does not become a production place. And the area has to be a number: "Area": "3" in quotation marks results in an area of zero. The Commission recommends always filling ProductionPlace, because the name is later the only readable orientation in the statement.

Two file variants. Type I is the file for one producer; it is used through the API and through the import at producer level. Type II contains several producers, grouped by ProducerName and ProducerCountry, with the country code per feature; it is read through the import at commodity level. The structure is the same, only the properties differ.

Separated by country. If a product comes from several countries, the production places have to be created separately per country, as Annex II point 3 requires. A file with plots in Belgium and Hungary is not accepted as one production place.

The limits of the Information System

These figures come from the Commission's validation rules and the FAQ. They decide how you cut your statements.

• 25 MB of geodata per due diligence statement, the total of all uploaded GeoJSON files. According to the Commission that is enough for more than one million points or polygon vertices.
• 1,000 production places per commodity line, that is per line with an HS code.
• 10,000 production places per statement.
• 2,000 referenced statements per statement.
• 500 species pairs of scientific and common name per commodity line; for wood at least one pair is mandatory.
• 50 drafts per account at any one time.

For smallholder chains these are the real planning figures. A coffee lot from Ethiopia with 3,000 parcels fits into one statement, one with 12,000 does not. Then you split, by consignment, by cooperative or by period. Noticing this at upload costs a day.

Polygons drive the file size. The Commission does the sum: a rectangle can be described with seven corner points instead of 168 points every half metre. Its advice: only two points per straight edge, only the corners, and points instead of polygons wherever the plot is below four hectares. The Regulation asks for a perimeter that describes the plot, not a centimetre survey.

What to request from suppliers

The request should be so unambiguous that it can be met without a follow-up question. A table with one row per coordinate point has proven itself, because it can be filled in any spreadsheet and converted into GeoJSON without loss.

Three sentences belong in the request as well: no personal data in the coordinate columns, one polygon per plot, and an assurance that the goods from these plots were not mixed with goods of unknown origin at any stage. The last sentence is not a formality: the FAQ rules out mass-balance systems that mix deforestation-free goods with goods of unknown origin. Once a batch is mixed, the whole batch is non-compliant.

The finished template in CSV and GeoJSON is in the download, together with a small script that converts the filled table into a valid GeoJSON file and checks the system's rules on the way, and a four-page compass with fields, checklist, error catalogue and request letter.

• Download: EUDR geodata template as CSV, one row per coordinate point
• Download: EUDR geodata template as GeoJSON, one point and one polygon
• Download: EUDR geodata pack with templates, conversion script and instructions (ZIP)
• Download: EUDR Geodata Compass 2026 with checklist, error catalogue and request letter (PDF)

Validate before the system does

A rejected statement costs no fee, but it costs time, precisely when the goods are sitting at the port. The following checks can be automated before upload.

Syntax. Is the file valid JSON, are all rings closed, do polygons have at least four points, are the geometry types permitted, are the four property names spelt exactly?

Value ranges. Are all latitudes between minus 90 and 90, all longitudes between minus 180 and 180? A latitude above 90 is almost always a swapped column.

Plausibility. Does the point fall inside the stated country of production? This check finds swapped coordinates and sign errors reliably, because the plot otherwise lands in the Gulf of Guinea.

Area against geometry. Does the stated number of hectares roughly match the area of the polygon? A factor of two to three usually means the wrong unit, acres instead of hectares.

Threshold. Does every plot above four hectares have a polygon, and does every point have an area?

Duplicates and overlaps. Two suppliers reporting the same plot point to double counting. Overlapping polygons are a warning signal for the risk assessment, not just a data problem.

Size. Does the file stay below 25 MB and the number of production places below the limits?

Only then comes the substantive check: does the plot lie in an area deforested after 31 December 2020? The Commission guidelines name the EU Observatory on deforestation for this, whose map shows global forest cover in 2020, free of charge but expressly non-binding. It is complemented by current satellite data. That check is part of the risk assessment, not of format control, and it belongs in the file.

Why uploads fail: the Commission's list

The Commission's GeoJSON description lists sixteen typical errors. Grouped by cause:

1. Crossing lines, such as a figure of eight, and perimeters folded inwards.
2. Holes in the polygon that were not split into two areas.
3. Open polygons whose first and last point differ.
4. Invalid geometry types such as LineString.
5. Coordinates that only form a straight line.
6. Duplicate points after truncation to six decimals.
7. Syntax errors in the file, one missing bracket is enough.
8. Misspelt property names, such as "productionplace" instead of "ProductionPlace".
9. The wrong file format, such as PDF or text, or a password-protected file.
10. Coordinates outside the value ranges.
11. An invalid ISO country code.
12. The area as text instead of a number, which results in an area of zero.
13. More than 25 MB of geodata in one statement.

From our own practice come three causes that produce no error message in the system, only wrong data: longitude and latitude swapped, a comma instead of a full stop as the decimal separator from a German spreadsheet, and degrees, minutes and seconds instead of decimal degrees.

Confidentiality and sharing along the chain

Many suppliers do not want to disclose their plots to the buyer. There are two answers.

The confidentiality flag. Every due diligence statement carries the mandatory field geoLocationConfidential. Set to true, the coordinates are not passed down the supply chain; set to false, downstream operators and traders may see them. What is passed on in any case is the reference number, not the plot. How the number is shared and checked is in the article on the E1 reference number.

No duty to share. The FAQ makes clear that the Regulation contains no obligation to share geodata along the chain. Anyone who wants to exchange them outside the system may arrange that by contract.

Grouping. Anyone who combines several upstream statements into one statement of their own uses the system's grouping function: the new statement references the reference numbers, inherits their geodata and receives its own reference number. The grouped statements move to the status "grouped" and cannot be amended individually for as long as the grouping is active.

What applies when geodata are missing

Not every chain delivers coordinates. Three cases have to be kept apart.

Micro and small primary operators. Natural persons and micro or small enterprises established in a low-risk country that produced the commodities there themselves submit a one-off simplified declaration under Article 4a. They may replace the geolocation with the postal address of the plots or of the establishment, provided the address clearly corresponds to the location. That applies to this group only, not to the importer buying from them. For cattle farmers in the EU the declaration is waived where the information already sits in national databases.

Downstream operators and traders. They submit no statement of their own and therefore need no geodata, but the reference numbers of their suppliers. A processor demanding geodata from its suppliers may be demanding something it does not need. Which role you hold is what the T1 EUDR check settles in two minutes.

Everything else. No geodata, no statement; no statement, no release for free circulation. There is no de minimis and no sampling: all plots of the consignment are required, not the largest or the known ones. Where a statement references an upstream statement, production places may be omitted; but whenever a production place is created, its geolocation is mandatory.

The timeline

Data collection is the longest part of the project, because it touches two harvests and several intermediaries. A realistic sequence for a smallholder chain:

In the first month, compile the supplier list and the number of plots per supplier, so it becomes clear whether one statement is enough. In the second month, send the request with the template and a deadline, staggered by volume. In the third month, check what comes back, return errors and follow up. Only in the fourth month is there a clean dataset for test statements in the system's acceptance environment.

Start in September and you are ready by 30 December 2026. Start in November and you negotiate with customs in January. What else the due diligence statement has to contain is in the article on the E2 due diligence statement, the registration in the Information System step by step in the Information System article.

Frequently asked questions

Are coordinates of the cooperative or the mill enough?

No. What is required are the plots where production took place. The cooperative or mill is the collection point, not the place of production. The mill list is still the sensible first step, because it shows where data are missing.

How many vertices does a polygon need?

Enough for the shape of the plot to be recognisable. The minimum is four coordinate pairs, with the first identical to the last. The Commission recommends only the corners and two points per straight edge; a rectangle needs seven points, not 168. Very fine perimeters inflate the file and add nothing for the risk assessment.

What about plots exactly at the four-hectare threshold?

Up to and including four hectares a point is allowed; above that the Regulation requires a polygon, and the system rejects a point with more than four hectares. If you are close to the threshold and only estimate the area, deliver a polygon straight away. It remains valid even if the area is corrected later.

What if a supplier delivers only four decimals?

The system pads the missing digits with zeros and accepts the file. The Regulation still requires at least six digits, and four digits mean an uncertainty of about ten metres. Ask for the data in the required precision; for points in small parcels the uncertainty decides whether the point still lies inside the plot.

May we include farmers' names and phone numbers?

Not in the geolocation, and the system only reads ProducerName, ProducerCountry, ProductionPlace and Area anyway. From farmers who are not your direct suppliers the Regulation requires no personal information. You may keep contact data for your own traceability, but separately and under data-protection rules.

Do we have to pass the coordinates on to our customers?

No. The statement has the flag for confidential geolocation; set to true, the coordinates are not passed down the chain. What is passed on is the reference number. There is no duty to share geodata.

How long is a statement valid, and when do geodata have to be collected again?

A due diligence statement may cover several shipments and several products. According to the FAQ, however, it should not cover shipments over a period longer than one year from submission, because Article 12 requires the annual review of the due diligence system. A new harvest means a new period, new suppliers mean new plots.

Can we reuse geodata from certification schemes?

Technically often yes, legally only after checking. Certification schemes can support the risk assessment; they do not replace due diligence, and responsibility for the accuracy of the geodata stays with the operator, whichever intermediary supplies them. Also check whether the data match the consignment and not just the supplier's certified total.

What does a rejected upload cost us?

Nothing directly, a lot indirectly. Without a valid statement there is no reference number, without a reference number no customs declaration with document code C716, and without that no release. For goods with demurrage at the port, a faulty file is the most expensive line in the project.

Sources and status: Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650, Article 2 points 27 to 29, Articles 4a, 5, 9 and 12 and Annex II. Commission guidelines. Commission FAQ on the EUDR, 5th version, questions 1.2, 1.3, 1.4, 1.7, 1.8, 1.10, 1.14, 1.15, 1.25, 5.19 and 7.12 to 7.17. The Commission's EUDR GeoJSON File Description of 17 August 2026, the API and UI validation rules and the Operator API Reference V3. EUDR Information System user guide. Status 27 September 2026. This article is not legal advice.