Submitting a due diligence statement in the EUDR Information System: step by step in TRACES and via the API

The short version

• Only operators submit. Whoever places a relevant product on the EU market for the first time or exports it without prior placing on the EU market submits a due diligence statement beforehand, directly or through an authorised representative. Micro or small primary operators established in a low-risk country who place on the market or export what they produced there submit a one-time simplified declaration instead. Downstream operators and traders submit nothing, and the system does not technically allow them to.
• The route has five steps: EU Login, an account with the role “Operator”, the company with an identifier, then the statement in seven fields and finally submission with “Submit” and “Confirm & Sign”.
• The numbers only appear in status AVAILABLE. The system assigns the reference number and the verification number after the automatic risk profiling. The authority may hold them back for up to three working days, 72 hours for perishable goods, and extend that period.
• A 72-hour correction window. For that long an available statement can be amended or withdrawn, but not once the number has gone to customs, the product has been placed on the market or exported or the statement sits in a grouping, and not during an announced check. After expiry the authority can extend it on request by at most eight calendar days.
• Hard limits. 25 MB of geolocation, 1,000 “Production Place” entries per product line and 10,000 per statement, where one entry may hold all plots of one country of production, 50 drafts per operator and up to 1,000 statements in one grouping. For the number of products per statement the Commission states 200 or 100, depending on the document.
• Test first, then submit. The Commission's acceptance environment is separate from the live system, and accounts only work in one of the two.

Who does what in the Information System

Since the amendment by Regulation (EU) 2025/2650 the division of labour is clear: due diligence statements only come from the start of the chain. The Commission says so explicitly in its FAQ: no downstream operator and no trader has to submit a statement, and the Information System does not technically allow them to, even when customers ask for one.

Two traps from the transition. Large companies previously registered with the activity “Trader” have to add the new activity “EUDR Non-SME Downstream Operator or Trader” actively, otherwise the registration duty under Article 5(2) is not met. And customs representatives or forwarders without ownership of the goods are neither operators nor traders. If you want them to submit the statement, they need a separate written mandate as authorised representative, distinct from the customs mandate.

Which role you have for which product is answered by the EUDR check. The roles in detail are explained in the article on operators and traders.

Before the first statement: access and registration

The Information System is a module of TRACES, the Commission's trade platform. The entry point is eudr.webcloud.ec.europa.eu/tracesnt, where everything starts with “Request an access”.

1. Create an EU Login. The account belongs to a real person, not to a shared mailbox, because submissions in TRACES are legally attributed. The Commission advises a work email address. The link to set the password is valid for 90 minutes. Two-factor sign-in can be set up in EU Login. We recommend it because the reference numbers from the system end up in customs declarations.

2. Account and role. After the first sign-in you choose the role “Operator”. It covers operators, primary operators, downstream operators, traders and authorised representatives. Since Implementing Regulation (EU) 2026/1565 each user creates a single account and adds further roles under it.

3. Find or create the company. The search asks for country and company name. If the company already exists, tick it and send “Request authorisation”. The first user of a company is approved automatically, all further users by colleagues with administrator rights. If it does not exist, “+ Create a new operator” appears after the search. The form asks for name, country, address, at least one identifier and the activity. Companies established in the EU are validated automatically. Afterwards sign out and in again, otherwise the new rights are not visible.

4. The right identifier. Importers and exporters need an EORI number in the registration, otherwise field 2 of the statement form does not even offer the activities Import and Export. The EORI consists of the country code of the issuing Member State and up to 15 characters. For domestic production and for downstream operators the guide names the VAT number, tax number or national company number as first choice. At registration TRACES accepts eleven identifier types in total, including DUNS and GLN.

5. Companies established outside the EU. They need an EORI from a Member State, issued where they intend to clear goods first, and an email to the helpdesk of DG SANTE with company name, address and EORI, with the competent authority of the EORI Member State in copy. Only then does the helpdesk validate the account. Under the validation rules such companies can only choose the activity Import in the due diligence statement.

6. At least two administrators. The Commission explicitly recommends more than one user with administrator rights. An administrator approves new colleagues under “Actors” > “Users” but cannot delete an activity once chosen; only authorities and the helpdesk can.

The acceptance environment. A test environment for getting to know and trying out the system runs at acceptance.eudr.webcloud.ec.europa.eu. Statements submitted there have no legal effect, and the accounts are not linked to the live system. All screenshots in the Commission's user guide come from this test environment, so the live system may look different in detail.

The due diligence statement step by step

The statement starts in the menu “Documents” > “EU Deforestation” with the button “Create”.

Step 1: role and internal number. You choose “As Operator” or, as authorised representative, “Representing Operator”. A window asks for an internal reference number. It is optional, only serves your own search and is not the reference number of the statement. The guide advises against spaces because they disturb later searches. If the field stays empty, the system assigns one when the statement is first saved.

Step 2: the seven fields. The form “Statement Details” has seven sections. Mandatory fields carry a red asterisk.

A statement covers exactly one activity. Anyone who imports and exports needs two statements. Within one activity a statement may contain several products, each with several production places, and cover several shipments.

Field 6 in detail. Every product line starts with “+ Add Commodity or Product” and the choice of the HS code from a tree or by keyword. The code must have at least as many digits as listed in Annex I of the Regulation and may be more precise up to the six-digit HS subheading. Eight-digit CN or eleven-digit TARIC codes do not belong here. Also mandatory:

• a description of the product;
• a quantity. For import and export the net mass in kilograms is mandatory, plus the supplementary unit for the HS codes listed for it in Annex 2 of the user guide, such as cubic metres for wood in the rough (4403) or number of items for tyres (4011). The system then preselects it. For domestic production one of net mass, volume or supplementary unit is enough, and the net mass may be estimated with a deviation of up to 25 per cent;
• for wood the scientific names of all species, chosen from a stored list. Article 9 of the Regulation requires you to also collect the common name of each species, and under the validation rules the system checks for at least one “Common Name”, more on that below;
• at least one production place with country of production, area in hectares and geolocation.

Net mass means the goods without packaging. If the statement covers several shipments, it is the total mass intended to be placed on the market or exported over a period for which due diligence has been carried out.

The production places. They are a mandatory element of every statement under Annex II point 3 of the Regulation. Only a grouping statement does not repeat them, because they come from the member statements. Each country of production needs its own entry. Coordinates enter the system in three ways: typed in manually as a point, drawn in the GeoEditor map tool as a point, rectangle or polygon, or uploaded as a GeoJSON file. What the file must contain, why uploads fail and which template to send to suppliers is covered in detail in the article on supplier geodata. One trap in the GeoEditor: clicking “Confirm” straight after the place search closes the window without a selection.

Step 3: save, submit, sign. “Create draft” turns the statement into a draft with its internal number. “Submit” followed by “Confirm & Sign” submits it. In the last window you confirm that due diligence was carried out and no or only a negligible risk was found. That window also holds a checkbox on the visibility of the geolocation. Its text still speaks of referencing in other statements, a function that no longer exists. According to chapter 8 of the guide, the checkbox today decides whether large downstream companies see your geolocation when they verify. Set it deliberately and after talking to your suppliers.

After submission: statuses, numbers, risk profile

Right after submission the system creates an automatic risk profile and assigns a risk status to the statement. Only authorities, customs and the Commission see it, never the submitter. Then it assigns the reference number and the verification number without delay.

When the number takes its time. Normally it arrives without delay. If the statement triggers a risk criterion of the authority, the authority may hold back the numbers to check. The delay must be as short as possible and must initially not exceed the period in Article 17(3) of the Regulation: three working days, 72 hours for perishable goods, in each case from the moment the high risk is identified in the system. The authority may, however, extend this period at its discretion by further periods of three working days for as long as needed. So there is no fixed upper limit. Within that period the authority can also reject the statement. From the moment of rejection, the product of a rejected statement counts as a product without a due diligence statement and may neither be placed on the market nor exported. Once the reference number has reached the user, a rejection is no longer possible.

The two numbers. The reference number is unique per statement and has 14 characters in the Commission's examples. It goes to the first downstream customer and into the customs declaration. The verification number is a security code known only to the submitter and the authority. You may share it confidentially but do not have to. How you pass on the reference number is not prescribed by the Regulation; an invoice, email or delivery document is enough, as both the Commission and the German authority BLE confirm. Everything else about the number is in the article on the reference number.

The timeline in the form. After the first save the panel “Last Changes” at the bottom left shows four points in time: created, submitted, end of the amendment period (“Amend cutoff date”) and available from.

Amend, withdraw, copy: the 72-hour rule

The rule is in Article 5 of Implementing Regulation (EU) 2024/3084, as amended by Implementing Regulation (EU) 2026/1565.

The window. An available statement can be amended or withdrawn within 72 hours after the reference number has been made available. The technical API reference, however, counts the 72 hours from submission. If you want to be safe, count from there.

The four blocks. Even within the 72 hours it is over as soon as

1. the authority has announced a check of the statement or of the goods, for the duration of the check;
2. the product has been placed on the market or exported;
3. the reference number has been given to customs before release for free circulation or export;
4. the statement has been used in one of your own grouping statements.

The extension. Once the window has expired, the authority can extend it on an individual, reasoned request by at most eight calendar days, also retroactively. The request must name reasons beyond your control and show that none of the blocks applies.

Every amendment triggers a new risk profile. The system creates it for the whole amended statement, not just for the changed entries.

Before submission more is possible. A draft can be saved or deleted at will, and a submitted statement that is not yet available can be cancelled. For recurring deliveries there is “Copy As New”: it copies a statement in status draft, submitted or available into a new one that you adapt as a template. The system cannot store frequently used data permanently. And the number of drafts is limited to 50 per operator. Anyone who hits the limit has to submit or delete first.

What follows for practice. Only give the reference number to customs once the statement has been checked. A typo in quantity or HS code that is noticed after the customs declaration can no longer be fixed in the old statement.

Grouping many statements

Implementing Regulation (EU) 2026/1565 inserted a new Article 8a into Implementing Regulation (EU) 2024/3084 and thereby created a new tool. You can merge your own statements into a new statement that the user guide calls “Group Head”.

What for. The Commission mainly has in mind statements whose geolocation exceeds the 25 MB and customs processes that stall with many individual numbers. According to the user guide up to 1,000 statements fit into one grouping; the API validation rules state 2,000. If you want to be safe, stay at 1,000.

How. You create a new statement, save it with “Create draft” and select the statements in field 7 via “+ Grouping”. According to the guide only available statements of the same activity can be grouped, so imports only with imports. The API validation rules also accept archived statements. An operator can also combine due diligence statements with its own simplified declarations; an authorised representative only statements of the same represented company.

What the grouping statement itself must contain. It is a complete statement. Field 6 lists all products with the sum of their quantities, which you have to enter yourself. The system only takes over the geolocation from the included statements.

What applies afterwards. The included statements get the status GROUPED and are no longer valid on their own. From now on only the reference number of the grouping statement goes to customers and customs. If the grouping statement is withdrawn, the old statements do not come back to life; they stay grouped. On the grouping statement only its own content can be amended, not the list of included statements. The Commission itself says: use with caution.

Downstream: verify instead of submit

For downstream operators and traders the Information System is a verification tool.

Verify validity. Via the blue button “Verification” you enter the reference number and the verification number. The system answers with one of three results: valid, meaning available; not valid, meaning it exists but is not available; or not found. The result can be saved as a dated PDF. According to the Commission's FAQ there is also a bulk check by CSV file.

Consult the content. Only non-SMEs may view the content of the upstream statement, and only in case of substantiated concerns. They only see the geolocation if the submitter ticked the checkbox when submitting.

What is not required. The Commission does not require a routine check of every number. All downstream operators record name, address and email address of their suppliers and customers. Only first downstream customers, meaning customers of an operator, collect reference numbers and link them to incoming goods. All information is kept for at least five years. Suppliers do not have to provide the verification number; non-SMEs can ask for it in case of substantiated concerns. According to the BLE, the first downstream customer does not have to pass the number further down either.

Submission via the API

Anyone who submits many statements or generates them from an ERP submits through the Commission's interface. Since version 3, which reflects the amendments of Regulation (EU) 2025/2650, it is the only one; versions 1 and 2 are being switched off. The current reference is the technical documentation in version 1.2 of 11 September 2026, published in the system itself at eudr.webcloud.ec.europa.eu/tracesnt/help/eudr-documentation. The Commission points out that it may still be adapted. The user guide explicitly does not cover the interface.

Technology. SOAP web services over HTTPS. Authentication uses WS-Security: username, a password digest derived from the authentication key, a timestamp and the header WebServiceClientId. Due diligence statements go through the service EUDRDueDiligenceStatementServiceV3, simplified declarations through EUDRSimplifiedDeclarationServiceV3. An echo service in the acceptance environment only tests the connection and the credentials.

Access in three steps.

1. The company and at least one user exist in the web interface. The first user is the responsible person and must not be a placeholder.
2. The username is under “Edit Profile” > “Personal Information”.
3. Under “Web Services Access” click “Active”. The authentication key then appears. It is private, and the person behind the EU Login is responsible for everything submitted with it.

The Commission advises setting everything up and testing it in the acceptance environment first and then repeating the steps in production.

One technical user for several companies. Service providers and groups send the header BodyIdentity with the Web Service Access Identifier of the respective company in every request. It is shown in the web interface under “Directory” > “Operators” among the company's identifiers. Companies registered before this feature was introduced request it from the SANTE-TRACES helpdesk. For questions about the interface the subject of the email to this helpdesk starts with “EUDR API”; for the identifier it is “EUDR API — Web Service Access Identifier request”.

The six operations for due diligence statements.

No drafts, no notification. The interface has no drafts; the limit of 50 only applies in the web interface. Because submitDds only returns a UUID, you fetch the reference and verification number afterwards with getDds. The Commission asks you to poll no earlier than 30 minutes after submission because the risk profiling has to run first. The documentation describes no notification; the status is polled.

Limits. Five requests per second per IP address and 10,000 per minute across all users. In the Commission's examples the reference number has 14 characters and starts with the year and the country code, for example 26BE7XTVCZAQ2S. According to the change log, numbers of simplified declarations are also 14 characters long and start with an S, for example S26FRNMNBSA96Q.

Migrating from version 1 or 2. New namespaces and endpoints require new WSDL and XSD bindings. retractDds becomes withdrawDds, getDdsInfo becomes getDds, ddsIdentifier becomes uuid, associatedStatements becomes groupedDeclarations. The activity TRADE and the trader roles are gone, and the quantity model no longer has volume. Old statements remain readable through version 3. Next the Commission plans certificate-based authentication (mTLS), with a transition period for the current method.

The most common error when connecting. A bare “InternalSystemException” without details means WS-Security rejected the request before the business checks. The most common cause is spaces or line breaks in the password digest or nonce, often because the Base64 encoder wraps its output after 76 characters. Encode without line breaks and do not pretty-print the security header. A second sign-in error occurs when your own system clock deviates from server time by more than five minutes. The Commission assigns it to the error “Timestamp expired” and advises time synchronisation. Business errors come as BusinessRulesValidationException, for example EUDR-GROUPING-NOT-ALLOWED-ON-AMEND when a grouping is sent with an amendment.

Customs: when the number goes into the declaration

Order. First the statement, then the customs declaration. For import and export the statement must be available and its reference number issued before the declaration is lodged. One number may cover several declarations, and one declaration may carry several numbers.

Place in the declaration. The reference number goes with the documents, with document type and number from TARIC. Which code applies when, from C716 for the due diligence statement to the codes for simplified declarations and downstream exports, is in the glossary of TARIC codes.

Who counts as operator. For import it is usually the importer in the customs declaration, data element 13 04 000 000; for export the exporter, data element 13 01 000 000. Customs warehousing, inward processing, temporary admission and transit are not placing on the market. Anyone buying goods out of a customs warehouse should therefore clarify beforehand who releases them for free circulation first and submits the statement.

Quantities. Net mass in kilograms and, where applicable, the supplementary unit appear in the customs declaration in the same way. If a statement covers several shipments, it states the total quantity while each customs declaration only states the quantity of its shipment. Keep the allocation traceable.

Re-import. Anyone re-importing previously exported goods only counts as a downstream operator if they can show that the goods, or all relevant products contained in them, were already placed on the EU market and subject to due diligence, for example with customs declarations, invoices or transport documents. Otherwise the goods count as imported for the first time, and they submit a due diligence statement. As a downstream operator they give their suppliers' numbers in the customs declaration, with TARIC code C720 as a large company or C725 as an SME. If there are none, they use a conventional reference number from the Commission. Components that were never subject to due diligence need a statement of their own. Details and the special rule for goods from the transition period are in the article on export and re-import.

Not yet possible is lodging the customs declaration and the due diligence statement in one step. The Regulation provides for it, and the Commission plans it for the medium to long term. According to the Commission's FAQ, the link between the Information System and national customs systems is to run through the EU Customs Single Window CERTEX.

Where the Commission's documents contradict each other

Working through user guide, FAQ, guidelines and technical documentation, you come across differing statements. The most important:

The validation rules are chapter 10 of the API reference in version 1.2 of 11 September 2026; the user guide is dated 16 September 2026. Legally none of these documents counts, only the Regulation and its implementing regulations. Where the system checks differently, however, the system decides in daily practice. Hence the advice to try borderline cases in the acceptance environment before the goods are waiting in port.

What is still coming until mid-2027

• 15 October 2026: Due diligence statements are allocated to the authority of the Member State in which the operator is established, and for companies outside the EU according to the identifier from the registration.
• 30 December 2026: The obligations apply. Only operators established as micro or small enterprises by 31 December 2024 have more time. By then the Commission must publish a public page on system availability and emergency measures for unplanned outages of more than 60 minutes, including an emergency reference number for goods for which no statement can be submitted. The system announces planned maintenance in advance in its news section.
• 30 June 2027: The obligations also apply to micro and small enterprises that were already established as such on 31 December 2024. For products already covered by the EU Timber Regulation, 30 December 2026 remains their date.

In Germany the BLE is competent. The ministry draft of the implementing act (status 10 July 2026) assigns the federal states to domestic production and timber harvesting in Germany and provides for fines: up to EUR 50,000 if a due diligence statement is not submitted, is incorrect, incomplete or late, or if a reference number is not passed on, and for legal persons and associations with a total turnover above EUR 1.25 million up to 4 per cent of the total turnover achieved in the EU in the previous year. A missed registration of large downstream companies can cost up to EUR 20,000, and for legal persons and associations above EUR 500,000 of total turnover likewise up to 4 per cent. The draft has not been adopted yet. According to the draft, the BLE plans its own evidence portal that takes over data from the Information System and through which companies submit documents during checks.

How Polygon One helps: the software generates the due diligence statement for every product in scope and submits it to the Information System through the interface. The reference number comes back into the record, ready for the customs declaration and for your customers. Your suppliers deliver the geolocation through a portal without login, and Polygon One checks it for completeness and plausibility before it goes into the statement. More on the EUDR module product page.

• Download: EUDR submission checklist 2026 with field overview, statuses, deadlines and error patterns (PDF)

Frequently asked questions

Do we need a separate due diligence statement for every shipment?

No. One statement may cover several shipments, and one reference number may appear in several customs declarations. The condition is that the statement is in place before the first shipment, the due diligence covers all quantities concerned and the net mass reflects the total quantity of the period. How long that period may be is covered in the article on the due diligence statement.

Can our forwarder or customs representative submit the statement?

Only as authorised representative under Article 6 of the Regulation, meaning established in the EU, with a written mandate and its own registration with the activity “EUDR Authorised Representative”. It then creates the statement in the role “Representing Operator”. The customs mandate is not enough; they are two separate mandates. Responsibility for the compliance of the products stays with the operator in any case.

What if the reference number does not arrive?

Check the status. If the statement is SUBMITTED, the authority may be holding back the numbers for a check, which is allowed for three working days, 72 hours for perishable goods, and extendable at its discretion for as long as needed. Do not lodge a customs declaration without a number in that time. If it is REJECTED, the goods count as having no statement. Then only a new, corrected statement helps, once the reasons have been resolved.

Can we still correct a statement after the customs declaration?

No. As soon as the reference number has been given to customs, the statement is blocked, even within the 72 hours. For future shipments submit a new, correct statement, quickest via “Copy As New”. For an error with consequences for goods already cleared, talk to the competent authority.

Our customer asks us for a due diligence statement, but we are downstream. What now?

The system does not accept statements from downstream operators. Your customer needs your name, registered trade name or registered trade mark, postal address, email address and, if available, web address. Only an operator owes reference numbers to its first customer. If you are yourself the first downstream customer, you do not have to pass on your suppliers' numbers, but you may.

Do we need our suppliers' verification numbers?

Not for record-keeping. The verification number is only needed by those who want to verify a number in the system or, as a large downstream company, consult the content in case of substantiated concerns. Suppliers have no obligation to pass it on; large downstream companies may ask for it in case of substantiated concerns.

What happens if the Information System is down?

Planned maintenance is announced in advance in the system's news. For unplanned outages of more than 60 minutes the Commission must publish emergency measures by 30 December 2026, including an emergency reference number. According to the Commission's technical reference, the competent authority or customs then issue an emergency reference number, which must be replaced by a system-generated reference number once the system is restored. The binding emergency measures under Article 15a of the Implementing Regulation are still pending.

In which language do we fill in the statement?

The system is available in all official EU languages. The Commission recommends the language of the Member State whose authority handles the statement.

Do we have to use the acceptance environment?

No, it is voluntary. But it is the only place where you can try borderline cases such as very small plots, large geolocation files or many product lines without consequences. Anyone connecting through the API should start there, as the Commission recommends, because only there is the echo service for the connection test.

Sources and status: Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650, Articles 2, 4 to 6, 9, 17, 26, 28 and 38 and Annex II. Implementing Regulation (EU) 2024/3084 as amended by Implementing Regulation (EU) 2026/1565, Articles 2 to 8a, 10 and 15a. Commission guidelines C/2026/3896, sections 1 to 4 and 9. Commission FAQ on EUDR implementation, 5th version (published 21 August 2026), questions 3.4 to 3.15, 5.2 to 5.20, 7.1 to 7.29 and 8.1. Commission TARIC data on Regulation (EU) 2023/1115, revision 1 of 23 September 2026. EUDR Information System user guide, version 3.0 of 16 September 2026. EUDR Operator API Reference, version 1.2 of 11 September 2026 (API version 3), including chapter 10 on validation rules. Answers of the BLE to the webinar of 21 May 2026. Ministry draft of an act implementing the EUDR in Germany of 10 July 2026. Status 27 September 2026.