EUDR Record Keeping: Article 12 Requirements, Due Diligence Systems & Evidence

EUDR record keeping is sometimes treated as a document-storage exercise: submit the Due Diligence Statement (DDS), save the reference number, and retain the supporting files. Article 12 establishes a broader framework. Operators must establish and keep up to date a due diligence system, review it at least annually, update it when new developments could influence the system, keep records of those updates for five years, and retain documentation related to due diligence for at least five years.

This means the compliance record is not limited to the final DDS. It should demonstrate how the operator’s due diligence system was established, how it was applied, how risks were assessed and mitigated, what evidence was used, what procedures and measures were maintained, and how the system evolved over time.

For larger operators, Article 12 also introduces an annual public reporting obligation covering their due diligence system and steps taken to fulfil Article 8 obligations. The reporting requirements include a summary of specified Article 9 information, conclusions of risk assessment, measures taken under Article 11, information and evidence used to assess risk, and, where applicable, consultation processes.

Key Takeaways

• Maintain a Due Diligence System
• Review the System Regularly
• Keep Records for Five Years
• Document Risk Assessment
• Record Risk Mitigation
• Maintain DDS Records
• Connect Evidence Across the Supply Chain
• Keep an Audit-Ready Evidence Trail
• Update Records When Circumstances
• Make Documentation Accessible to competent authorities when requested.

Article 12: The Context Behind EUDR Record Keeping

Article 12 connects three important responsibilities: maintaining a due diligence system, reporting on that system where applicable, and retaining documentation. These responsibilities sit alongside the operational due diligence requirements in Article 8.

Under Article 12(1), operators must establish and keep up to date a framework of procedures and measures the due diligence system to ensure relevant products they place on the market or export comply with Article 3.

Article 12(2) requires operators to review that system at least once a year. If they become aware of new developments that could influence the system, they must update it and keep a record of those updates for five years.

Article 12(5) requires operators to keep, for at least five years, all documentation related to due diligence, including records, measures and procedures pursuant to Article 8, and to make that documentation available to competent authorities upon request.

The practical implication is important: an EUDR-ready record should show not only the outcome of a due diligence exercise, but also the system, process, evidence and decisions behind that outcome.

Discover how businesses can collect the right information, assess deforestation and legality risks, implement risk mitigation, maintain evidence, and build an audit-ready due diligence workflow. Read the Full Blog →

What Does Article 12 Mean for EUDR Record Keeping?

• Record the due diligence system: Maintain the framework of procedures and measures used to fulfil due diligence obligations.
• Keep the system up to date: Changes to processes, information or relevant developments should be reflected where they influence the due diligence system.
• Review at least annually: Operators must review their due diligence system at least once a year.
• Record system updates: Keep a record of updates to the due diligence system for five years.
• Retain due diligence documentation: Keep records, measures, procedures and other documentation related to due diligence for at least five years.
• Preserve risk evidence: Retain the information and evidence used to assess risk and the conclusions reached.
• Document mitigation: Preserve measures undertaken to address identified risks.
• Support regulatory access: Documentation must be available to competent authorities upon request.
• Support reporting where applicable: Operators within Article 12(3) must publicly report annually on their due diligence system and steps taken to fulfil Article 8 obligations.

What Records Should Businesses Keep for EUDR?

The exact record set depends on the operator’s role, product and supply-chain circumstances. Article 12 provides the core record-keeping framework, while the due diligence workflow determines the evidence that needs to sit behind the compliance decision.

• Due diligence system procedures and measures.
• Records of annual due diligence system reviews.
• Records of updates made to the due diligence system.
• Information and evidence collected for due diligence.
• Article 9 information and supporting records.
• Supplier and producer information.
• Production country and geolocation records.
• Risk assessment conclusions and supporting evidence.
• Risk mitigation measures and supporting evidence.
• DDS records and relevant reference or verification information.
• Related products, quantities, batches and shipments.
• Relevant customs and downstream records.
• Amendment, withdrawal and corrective-action history where applicable.
• Supporting documents and relevant communications.
• Consultation information where applicable under Article 12(4)(c).

The Five-Year Record-Keeping Requirement

Article 12 establishes a minimum five-year retention period for records of updates to the due diligence system and for documentation related to due diligence. The five-year requirement should therefore be considered at two levels: the evidence supporting individual due diligence activities and the history of how the operator’s due diligence system was maintained and updated.

This distinction is important. A company may have completed a risk assessment and submitted a DDS, but it should also be able to demonstrate the procedures and measures used to reach that decision and how its due diligence system was reviewed or updated over time.

Annual Review and Updates to the Due Diligence System

Article 12(2) requires operators to review their due diligence system at least once a year. It also requires an update when operators become aware of new developments that could influence the system.

From a record-keeping perspective, the review itself should be treated as a documented compliance activity. Businesses should be able to show when the system was reviewed, what was considered, whether changes were identified, what was updated, and when the revised process became effective.

• Annual review date and responsible team.
• Scope of the review.
• Relevant regulatory or operational developments considered.
• Identified gaps or changes required.
• Updated procedures or measures.
• Approval or ownership of the update.
• Effective date and version/history of the updated system.

Risk Assessment and Risk Mitigation Evidence

Article 12 links record keeping with the conclusions of the risk assessment and the measures undertaken under Article 11. For operators subject to the public reporting requirement, Article 12(4)(b) specifically identifies the conclusions of the risk assessment, measures undertaken, and the information and evidence used to assess risk.

A strong EUDR record should therefore preserve the reasoning behind the risk decision—not simply a final Compliant or Non-Compliant status.

• Risk assessment inputs.
• Evidence and information considered.
• Risk assessment conclusion.
• Identified risk factors or concerns.
• Mitigation measures undertaken.
• Evidence supporting mitigation.
• Final due diligence decision and rationale.

DDS Records Are One Part of the EUDR Record

The DDS is an important output of the EUDR workflow, but it should sit within a wider compliance record. Businesses should connect the DDS reference with the supplier, production location, geolocation, product, quantity, risk assessment, mitigation evidence and relevant shipment or customs records.

Supplier → Origin → Geolocation → Risk Assessment → Mitigation → DDS → Shipment → Customs

Connecting EUDR Records with Customs and Shipments

For relevant imports, the DDS reference number or applicable simplified declaration identifier forms part of the customs process. Where a DDS covers multiple shipments or batches, businesses need sufficient quantity- and shipment-level visibility to understand which activity is covered by the declaration.

A connected record should therefore allow teams to move from a DDS reference to the relevant shipment, batch, product and quantity, and back to the underlying supplier, origin and due diligence evidence.

Record Amendment, Corrective Actions and New Information

EUDR record keeping should preserve changes made after the original due diligence activity. Where information changes, new relevant information is received, or a substantiated concern affects an earlier compliance decision, businesses need a controlled process for assessing the impact and documenting subsequent action.

• Original assessment and decision.
• Date and source of new information.
• Affected supplier, product, location, shipment or DDS.
• Impact assessment.
• Corrective or mitigation action.
• Updated decision where applicable.
• Relevant authority or customer communication.
• Complete change and audit history.

Discover how businesses can connect information collection, supplier and plot data, risk assessment, mitigation, traceability, and evidence into a structured workflow for more efficient and audit-ready EUDR compliance. Read the Full Blog →

Article 12 and Annual Public Reporting

Article 12(3) requires operators who do not fall within the SME, including microenterprise, or natural-person categories to publicly report annually, as widely as possible, including via the internet, on their due diligence system and the steps taken to fulfil Article 8 obligations.

Article 12(4) specifies that the reporting includes a summary of certain Article 9 information, conclusions of risk assessment and measures under Article 11, a description of the information and evidence used to assess risk, and, where applicable, consultation processes involving indigenous peoples, local communities, customary tenure rights holders or relevant civil society organisations.

This creates another reason to maintain structured records: the underlying information needed for reporting should be retrievable from the same due diligence record rather than rebuilt manually each year.

Example: Coffee Importer Managing One DDS Across Six Shipments

Consider an EU coffee importer with one DDS covering a quantity that arrives in six shipments. The company needs to retain the DDS reference and connect it to the relevant supplier, production locations, geolocation, product and quantity. It should also maintain the relationship between the declaration, shipments and customs activity.

Under an Article 12-oriented record-keeping approach, the company also needs to preserve the procedures and evidence behind the due diligence decision and maintain records of relevant updates to its due diligence system. This makes the compliance record much more useful than a spreadsheet containing only the DDS number.

Common EUDR Record-Keeping Challenges

• Treating the DDS as the complete compliance record.
• Storing risk assessment evidence separately from the final decision.
• No documented history of annual due diligence system reviews.
• System updates made without retaining a clear update history.
• Supplier, geolocation, product and shipment records held in disconnected systems.
• Difficulty reconstructing why a particular risk decision was made.
• Manual tracking of mitigation and corrective actions.
• Limited visibility into records needed for annual reporting.
• Difficulty retrieving complete documentation during competent-authority checks.

How Digital EUDR Platforms Can Strengthen Record Keeping

A digital EUDR platform can help businesses manage the due diligence system and its evidence as a connected, searchable record. Supplier, origin, geolocation, risk assessment, mitigation, product, quantity, shipment and DDS information can be linked within the workflow.

• Centralize supplier and production-location records.
• Maintain geolocation and supporting evidence.
• Record risk assessments and mitigation decisions.
• Link DDS references to products, quantities and shipments.
• Maintain evidence and supporting documentation.
• Track system changes and compliance workflow history.
• Support audit and competent-authority information requests.
• Make records easier to retrieve for internal reviews and applicable reporting.

How TraceX Can Help with EUDR Record Keeping

TraceX EUDR Solutions helps businesses manage EUDR due diligence as a connected, searchable supply-chain record. Supplier information, production locations, geolocation, risk assessment, mitigation evidence, products, quantities, shipments and DDS references can be linked within the workflow.

TraceX can also help teams maintain a structured compliance history, making it easier to retrieve supporting evidence, connect records across the supply chain, monitor changes and support audit-ready EUDR processes.

EUDR Record-Keeping Checklist

• Is our due diligence system documented as a framework of procedures and measures?
• Has the system been reviewed at least once a year?
• Are updates to the due diligence system recorded and retained?
• Are Article 9 information and supporting records available?
• Can we retrieve the information and evidence used in risk assessment?
• Are risk assessment conclusions documented?
• Are Article 11 mitigation measures and evidence retained?
• Can we connect the DDS to suppliers, origin, geolocation, products and quantities?
• Can we trace DDS references to relevant shipments and customs records?
• Are corrective actions and changes preserved in an audit trail?
• Can we retrieve documentation for competent-authority requests?
• Can applicable annual reporting information be generated from structured records?
• Are required records retained for at least five years?

Conclusion: Build an EUDR Record, Not Just an EUDR Folder

Article 12 makes record keeping an ongoing part of the EUDR due diligence system. Operators must maintain a framework of procedures and measures, review it at least annually, update it when relevant developments could influence the system, retain records of those updates for five years, and keep due diligence documentation for at least five years.

For businesses, this means EUDR record keeping should connect the system, process, evidence and outcome. The strongest operating model links supplier and origin data with geolocation, risk assessment, mitigation evidence, DDS references, products, quantities, shipments, customs and system updates.

When these records are structured, connected and searchable, businesses are better prepared to demonstrate how due diligence was performed, respond to competent-authority requests, support applicable reporting obligations and maintain confidence in their EUDR compliance process.

Frequently Asked Questions