EUDR supplier questionnaire: Excel template and model letter for your suppliers

Only your supplier knows where the plots are, when the harvest took place and whether production was legal, and without this information there is no due diligence statement. What you have to collect is set out in Article 9 of Regulation (EU) 2023/1115, but not how to get it. The right questions depend on your supplier's role, and most replies later fail on small points of format. For the request itself you will find a questionnaire as an Excel file and a model letter as Word and PDF below, in English and German.

Key facts

• Legal basis. Article 9(1) requires before placing on the market: a description of the product with the trade name and, for wood, the scientific name of the species, the quantity, the country of production, the geolocation of all plots with the production period, the name, address and email address of suppliers and customers, and adequately conclusive and verifiable evidence of deforestation-free and legal production.
• Geodata. Up to four hectares one coordinate pair with the plot size is enough, above that a polygon is mandatory; at least six decimal places in WGS84, one polygon per plot, in GeoJSON the longitude before the latitude (Article 2(28), Commission GeoJSON description of 17 August 2026).
• Harvest period. What is meant is the harvest date or the duration of the production process, not the loading or invoice date; where more precise details are missing, the harvest season is enough (Commission FAQ).
• Legality. What has to be demonstrated is compliance with the law of the country of production on land use, environment, forests, third parties' rights, labour, human rights, consent of indigenous peoples, tax, anti-corruption, trade and customs (Article 2(40)); for wood, a valid FLEGT licence counts as evidence of legality (Article 10(3)).
• Reference number. Only a supplier that placed the goods on the EU market itself owes it: it communicates the number to the first downstream customer (Article 4(7) in conjunction with Article 5(3)(a)), who records it with the verification number (Article 5(3)) and keeps it for at least five years (Article 5(4)). Producers outside the EU have no number; they provide geodata and evidence.
• Responsibility. The operator is liable for the accuracy of the information, whoever supplies it. The Regulation contains no obligation to share geodata along the chain, and names of individual farmers are not required.

As at 17 October 2026. Legal basis: Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650, consolidated version of 18 September 2026; Implementing Regulation (EU) 2024/3084 as amended by Implementing Regulation (EU) 2026/1565.

Who needs what from whom: the supplier's role decides

The most common mishap in supplier requests is the wrong question: geodata from a wholesaler in the EU that submits no statement of its own, or a reference number from a cooperative overseas that cannot have one. So first determine the supplier's role for the specific delivery. The EUDR check settles your own role in two minutes; the article on traders and operators explains the distinction.

A special case is the warehouse in the EU. If a supplier from Switzerland delivers from a German warehouse, what matters is whether the goods have already been released for free circulation. If so, whoever released them has fulfilled the due diligence and owes the number; if they are still under customs warehousing or inward processing, whoever releases them later becomes the operator, possibly you yourself (case described by the BLE).

What you need per plot of production

Article 9 names the information, Article 2 the definitions behind it. The table translates both into the fields of the questionnaire; the format rules in detail, the limits of the Information System and the Commission's error list are in the article on geodata from suppliers, which also holds the geodata template as CSV and GeoJSON.

From farmers who are not your direct suppliers the Regulation requires no personal data. Coordinates, country of production and area are enough, and the Information System reads only the properties ProducerName, ProducerCountry, ProductionPlace and Area anyway. Also ask for exactly the plots of the delivery, not the largest and not the known ones: whoever reports more plots as a precaution than the delivery actually came from has to fulfil due diligence for every one of them.

Reference numbers from suppliers in the EU

If you buy from an operator in the EU, the request is shorter, but not trivial. Under Article 4(7) the operator communicates the reference number of its due diligence statement to you. With the associated verification number you verify the statement in the Information System (verification function, also available as a CSV bulk check, Commission FAQ 7.25) and reference it in your own statement on re-export or re-import. The verification number is a security code and does not belong in open distribution lists; suppliers do not have to provide it unasked, and non-SMEs can request it in case of substantiated concerns. The text module for the request and the cheat sheet are in the article on the reference number, section requesting the reference number from your supplier.

The number only exists once the statement has the status “available”. The authority may withhold it for up to three working days, 72 hours for perishable goods. Within 72 hours of the number being made available, the supplier can still amend or withdraw the statement, as long as the number has not been communicated to customs and the goods have not been placed on the market (72-hour rule). So agree a fixed place for the number, such as a field on the invoice or delivery note linked to the item, and record it at goods receipt together with the verification number and the delivery item. It is kept for at least five years (Article 5(4)), and you do not have to pass it on.

Organising the request: deadlines, reminders, escalation

Data collection is the longest part of an EUDR project because it touches two harvests and several intermediate stages. A sequence that has proven itself; in more detail in the timeline of the geodata article:

1. Sort your suppliers (weeks 1 and 2). Determine the role per supplier and product and estimate the number of plots. From this follows who owes geodata and evidence, who owes a reference number and who only company details, and whether one statement per delivery is enough (1,000 production places per commodity line, 10,000 per statement).
2. Send the request (week 3), staggered by volume. Model letter with questionnaire, geodata template or portal link and a date, not “as soon as possible”. Four weeks are reasonable if the supplier has the data; for evidence that first has to be obtained, six to eight weeks. Large suppliers first, they account for most plots.
3. Check the replies (ongoing). Format before content: syntax, value ranges, is the point in the country of production, does the hectare figure match the polygon, a polygon for every plot over four hectares, duplicates. Send errors back at once, while the matter is still fresh with the supplier; the checklist is in the geodata article.
4. Remind (deadline plus one day, plus two weeks). First reminder with a new two-week deadline and the list of missing fields. Second reminder to the supplier's management with the sentence that counts: without the information you may no longer place the goods on the market from the application date, and for the supplier that means the order.
5. Test (month 4). Submit test statements in the Commission's acceptance environment with the cleaned data set before the first real consignment sits at the port; accounts are valid in one environment only (submission guide).
6. Repeat. A new harvest means a new period, new suppliers mean new plots; a statement should not cover deliveries over more than one year from submission. Set the rhythm by the harvest season and agree that the supplier reports changes unasked.

When nothing comes. For producers outside the EU there is no shortcut: no geodata, no statement; no statement, no release for free circulation; and there is neither a de minimis threshold nor sampling. A supplier that persistently fails to deliver is a procurement risk and should be treated as such by purchasing, with alternatives before the application date. With a supplier in the EU, first clarify whether it is an operator at all and whether the goods have already been released for free circulation; if it remains an operator and delivers no number, you may not make the goods available without the information under Article 5(3). If in the process you receive indications of non-compliance, the timing matters: for goods you have already placed or made available on the market you must inform the competent authority without delay, regardless of your size (Article 4(5), Article 5(5)). Before placing on the market, that duty to inform falls on downstream non-SME operators and non-SME traders; in the case of substantiated concerns they must also check that due diligence has been exercised and may not otherwise place or make the goods available on the market (Article 5(6)).

The questionnaire (Excel)

The file is built so that a supplier can fill it in without a follow-up question. The sheet “Instructions” explains purpose, filling in, format rules for geodata, harvest period, evidence of legality, reference number and confidentiality. The sheet “Supplier master data” records once per supplier the company details and contact, the role under the Regulation (selection list), registration in the Information System, the identifier of a simplified declaration, the geodata format, consent to the visibility of the geodata, certifications, the segregation commitment and the confirmation of accuracy. The sheet “Deliveries and plots” has one row per plot of land: delivery, commodity (selection), product and CN code, wood species, quantity, country of production, region, plot ID, plot name, hectares, geometry (point, polygon, establishment), geodata format, file supplied, harvest period from and to, evidence of legality, role per delivery, reference or identifier number, verification number, certification, segregation confirmation and remarks. The sheet “Example (fictitious)” shows the table completed.

• Download: EUDR supplier questionnaire with instructions, master data, deliveries and plots, fictitious example (XLSX)
• Download: German version of the questionnaire (XLSX)

One file per supplier. The geodata themselves come in addition as a GeoJSON file, in the CSV template from the geodata article or through a portal; in the table the plot ID with the file name is enough. The questionnaire is a working aid and not an official form; it may be used, adapted and passed on to suppliers freely.

The model letter (Word and PDF)

A letter that gets answered gives the reason in two sentences and the legal basis in one, lists the information with its format, sets a date instead of “as soon as possible”, commits to confidentiality and names a contact person, with the request to report gaps early. What does not belong in it: threats of fines that do not affect suppliers outside the EU, and blanket wording such as “all relevant EUDR evidence”. The model follows this structure. Placeholders are in square brackets, one paragraph covers the case that the supplier is itself an operator in the EU, and a box at the top explains the application dates. An excerpt:

We therefore ask you to provide the following information for every delivery from [date or delivery] by [date]: geolocation of every plot of production, for plots up to four hectares one coordinate pair inside the plot with its size, for plots over four hectares a polygon describing the outline, in each case in WGS84 with at least six decimal places, as a GeoJSON file; harvest period per plot; product and quantity per delivery with the CN code; evidence that production complied with the law of the country of production; your confirmation that the goods delivered were at no stage mixed with goods of unknown origin.

• Download: model letter for the EUDR supplier request with placeholders (DOCX)
• Download: model letter for the EUDR supplier request (PDF)
• Download: model letter, German version (DOCX)
• Download: model letter, German version (PDF)

For suppliers in the EU from whom you only need the reference number, the shorter text module in the article on the reference number is enough; it asks for the role first and only then for the number.

Example: completed questionnaire (fictitious)

Musterfirma Kaffee Import GmbH in Hamburg, the same fictitious company as in the example for the risk assessment under Article 10, asks its exporter in Honduras about a delivery of green coffee from four plots. For comparison, the row of a fictitious supplier in the EU that is itself an operator follows below. The example is set in January 2027, after the date of application on 30 December 2026. Companies, plots, numbers and evidence are invented; the same rows are in the sheet “Example (fictitious)” of the questionnaire.

Row 2 is a point because the plot is under four hectares; the hectare figure is then mandatory. Row 1 carries a remark in the questionnaire that belongs in the risk assessment (neighbouring secondary forest, criterion (b)). Row 5 needs neither geodata nor evidence because the supplier placed the goods on the market itself; instead there are the reference number and the verification number, verified in the verification function at goods receipt.

Common mistakes

• The wrong question to the wrong role. Geodata from the trader in the EU, a reference number from the producer overseas. Clarify the role first.
• “Please confirm EUDR compliance.” What comes back is a sentence that cannot be used in any statement. Ask for fields per plot.
• Coordinates of the cooperative or the mill. What is required are the plots where production took place; the collection point is not a production place.
• Four decimal places, commas, acres. The system accepts the file and turns imprecision into apparent precision. Ask for the precision the Regulation requires.
• Too many plots. Plots reported as a precaution trigger full due diligence for each of them and weigh on criteria (i) and (j) of the risk assessment.
• A certificate as the answer. It is an aid, replaces neither geodata nor the statement, and mass balance does not prove segregation (Commission FAQ 5.7).
• Personal data of farmers. They are not required and make you a controller under data protection law. Coordinates, country and area are enough.
• No fixed handover point. Without a field on the invoice or delivery note the reference number gets lost in goods receipt; without a date the request gets lost in the supplier's inbox.

How Polygon One helps

Polygon One takes the media break out of the request: your suppliers receive a link to a portal without login and enter their plots themselves, as coordinates or as polygons. Polygon One puts every plot on the map, checks completeness and plausibility, flags anything that is missing or does not add up, and compares the plot by satellite with its state on 31 December 2020. Certificates and other evidence are read by an AI and matched to the right supplier, country and commodity. From the data the due diligence statement is generated and sent to TRACES; the reference number comes back into the record automatically. If you buy from an operator in the EU, Polygon One stores its reference numbers with the verification number for every delivery, so you find them straight away during an inspection. The questionnaire and the letter on this page are the route without a portal, and both can be combined. How the portal and the handover to TRACES work together in the product is shown on the EUDR software page.

Frequently asked questions

May I also ask my supplier in the EU for the geodata?

The Regulation only obliges the supplier to communicate the reference number (Article 4(7)). There is no obligation to share geodata along the chain; the Commission FAQ makes that clear. You may agree it by contract. If the supplier does not set the confidentiality flag in its statement, downstream operators and traders may see the coordinates in the Information System; non-SMEs may consult the content of the upstream statement in case of substantiated concerns.

Does the supplier have to provide the verification number?

The Regulation requires the reference number to be passed on. You need the verification number to verify the statement in the verification function of the Information System or to reference it in a statement of your own; suppliers do not have to provide it unasked, and non-SMEs can request it in case of substantiated concerns. In practice you ask for both, as in the text module of the reference number article, and treat the verification number as a security code.

Do I need the names and addresses of the individual farmers?

No. As long as the farmers are not operators themselves or your direct suppliers, the Regulation requires no personal data from them; the geolocation of the plot is enough. Whoever nevertheless enters names as ProducerName processes personal data under the rules of data protection law.

How often do I have to repeat the request?

With every new harvest and with every new supplier or new plot. A due diligence statement may cover several deliveries, but according to the Commission FAQ should not cover deliveries over more than one year from submission, because Article 12 requires the annual review of the due diligence system. Agree with the supplier that changes are reported unasked.

Is a certificate such as Rainforest Alliance or FSC enough as a reply to the request?

No. Under Article 10(2), point (n), and Commission FAQ 5.7, certification is an aid to the risk assessment insofar as it covers the necessary information. Geodata, harvest period, evidence and the statement remain mandatory, and mass balance certificates do not prove segregation. Only a valid FLEGT licence counts under Article 10(3) as evidence of the legality of wood.

What if the supplier does not want to disclose its plots?

In the due diligence statement you mark the geodata as confidential. Your customers then see only the reference number; the authorities see the plots in any case. Outside the system the contract decides what is passed on. There is no way around geolocation altogether, though: no geodata, no statement; no statement, no release for free circulation.

Sources and status: Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650 (consolidated version of 18 September 2026, EUR-Lex), Article 2(15), (27), (28) and (40), Articles 4, 4a, 5, 9, 10 and 12. Implementing Regulation (EU) 2024/3084 as amended by Implementing Regulation (EU) 2026/1565 (Information System, reference and verification number, 72-hour rule). Commission EUDR GeoJSON File Description (17 August 2026). Commission FAQ on the EUDR, version 5 (April 2026, revised 21 August 2026), among others questions 5.7 and 7.25. As at 17 October 2026. The example is fictitious. This article is not legal advice.