EUDR record-keeping: five years, an annual review, a public report
Three separate obligations that get conflated: keep the evidence for five years, review the system once a year, and, if you are not an SME, publish an annual report on it. Each has a different audience and a different failure mode.
Updated 31 July 2026, 4 min read
1. Keep the evidence for five years
Operators keep documentation of the due diligence exercised, the Article 9 information, the risk assessments, and the mitigation measures, for five years from the date the product was placed on, made available on, or exported from the market. Traders keep records of who supplied them, who they supplied, and the reference numbers, for the same period.
Two things about that clock catch people out. It runs from the transaction, not from the calendar year, so a five-year retention policy applied to an annual folder loses records early. And it applies per consignment, so a plot you sourced from in 2027 and again in 2030 needs its evidence retained on two separate clocks.
What "keep" has to mean in practice
The standard is that you can produce the material to a competent authority on request. That is a higher bar than having it somewhere.
- Retrievable by consignment and by plot. An authority asks about a specific shipment or a specific piece of land. Archives organised by supplier or by month cannot answer either question quickly.
- Including the imagery you relied on. Satellite datasets get reprocessed and revised. Re-running a screen in 2031 will not reproduce what you saw in 2026, so the evidence has to be the image and result as they stood at the time of the decision, not a pointer to a live service.
- Including the reasoning, not just the output. A stored "pass" with no record of what was examined is the most common weakness in an inspection.
- Surviving staff turnover and system migration. Five years is long enough that the person who made the determination has usually left and the tooling has usually changed.
Email is not a records system. Most of the substantive work, chasing a cooperative for coordinates, resolving an alert, agreeing what a supplier could and could not evidence, happens in email and spreadsheets. If that is where it stays, the record dies with the mailbox. The determination has to be written down somewhere structured, attached to the plot and the consignment.
2. Review the system annually
The due-diligence system has to be reviewed at least once a year, and updated whenever something material changes, a new supplier, a new origin, a country reclassified, a substantiated concern, or new information about an existing plot. Where the review produces changes, you keep a record of them for five years too.
A review that is worth doing asks four questions:
- Did the country classifications we relied on change? A country moving from low to standard risk retrospectively removes the simplified route you used, and the chains that relied on it need full assessments.
- Did our scope change? Annex I moved in May 2026. Products you correctly excluded before then may now be in. Re-check.
- Where did the process actually fail? Rejected submissions, plots that could not be mapped, suppliers who could not evidence legality. These are the real findings.
- Are the controls being followed? Non-SMEs need an independent audit function checking the policies, controls and procedures, not the operating team marking its own homework.
3. Report publicly, if you are not an SME
Operators and traders that are not SMEs must publish annually, as widely as possible including on the internet, a report on their due-diligence system. It covers the steps taken to comply, and it is a public document, read by customers, NGOs and journalists as well as regulators.
Companies already reporting under CSRD can integrate the EUDR report into that reporting, which avoids maintaining two parallel narratives about the same supply chain. That integration is worth planning deliberately: an EUDR report describing a well-controlled cocoa chain sitting next to a sustainability report describing the same chain in different terms is the kind of inconsistency that generates substantiated concerns.
The public report is a commitment, not a description. What you publish about your due-diligence system becomes the standard you are held to. Describe what you actually do. An aspirational account of plot-level verification that your files cannot support is worse than a modest one that they can.
What to keep, concretely
| Record | Why it matters in an inspection |
|---|---|
| Plot geometry as submitted | The exact coordinates or polygon that went into the statement, not a later corrected version. |
| Screening results and imagery | What the datasets showed at the time, with dates and source versions. |
| Alert investigations | Each flagged plot: what was examined, what was concluded, by whom, when. |
| Legality evidence | Permits, tenure documents, supplier attestations supporting the Article 3(b) test. |
| Risk determinations | The Article 10 assessment and its conclusion, per consignment or per chain. |
| Mitigation actions | What was asked for, what came back, what changed as a result. |
| Statements and reference numbers | Linked to consignments and to the customs declarations that used them. |
| Upstream references relied on | For downstream operators: the numbers, and what you did to satisfy yourself they were sound. |
| Annual reviews and audit findings | Evidence the system was maintained rather than built once. |
Related
Sources
Every claim on this page is drawn from Regulation (EU) 2023/1115 as amended, the Commission’s guidance and FAQ, and the implementing and delegated acts. Read the consolidated text on EUR-Lex.
Konstata is compliance software, not legal advice. Verify obligations against the consolidated EUDR text on EUR-Lex.
Doing the work