EUDR has a long memory. Operators must keep the information behind every due diligence statement for five years, retrievable when a competent authority asks, and downstream companies carry a parallel five-year duty for the statements they rely on. The filing is public infrastructure; the evidence file is yours to build. This guide specifies what goes in it, how to organise it so an audit is boring, and the review duties that come attached.
The legal skeleton
- Operators: Article 9 obliges you to collect the listed information and keep it for five years from the placing on the market or export, available to authorities on request.
- Downstream operators and traders: keep the reference and verification numbers of the statements covering what you bought, plus the identity of who supplied you and who you sold to, for five years. Since the 2025 amendment, downstream companies never file their own DDS; the record-keeping duty is their whole obligation, which makes losing a supplier's reference number the entire failure mode. The roles guide covers who is which.
- Article 13 users: simplified due diligence has its own paper duty: documentation demonstrating negligible circumvention and mixing risk, held to the same standard.
The per-consignment file, itemised
For an operator, a complete file for one consignment contains:
- Commercial identity: product description, HS code, quantities reconciled to shipping documents; supplier and buyer identities with contact records.
- Plot data, versioned: the geolocation file exactly as delivered by the supplier, every corrected version, and the final filed GeoJSON, with production date ranges. Never overwrite a plot file; supersede it.
- Screening evidence: outputs of each screening run with dataset names, run dates and per-plot verdicts, including runs on geometry you later replaced.
- The assessment: the written risk assessment conclusion, flags raised and their resolution, mitigation steps taken.
- Legality evidence: export permits, harvest or movement documents, certification records used as evidence, land-status checks.
- The statement itself: DDS reference and verification numbers returned by TRACES, your internal reference, and any upstream numbers you referenced. The filing walkthrough shows where these come from.
- Contracts: the clauses obliging suppliers to deliver plot data and notify changes.
Structure beats volume
Authorities do not grade archives by weight; they ask pointed questions ("show us the due diligence behind reference 26XX...") under Article 16 checks or after a substantiated concern, and measure how long you take to answer. The design rule is one join key: a plot identifier that connects supplier records, geometry versions, screening verdicts and filed statements. If you keep your own properties in the GeoJSON (TRACES ignores unknown properties, so plot IDs travel for free), the filed artefact and your evidence file stay joined by construction. Five years also outlives laptops, staff and email retention policies: the file belongs in a system, not an inbox.
The annual duties on top
Article 12 requires operators to maintain a due diligence system, review it at least once a year, and update it when circumstances change (a supplier switch, a tier reclassification, a new commodity). Non-SME operators must additionally report publicly each year on their due diligence system and the steps taken. Both artefacts, the review note and the report, join the file.
Why the discipline pays
The penalty framework scales with culpability: an operator who can produce a coherent file demonstrating real due diligence is in a categorically different conversation with an authority than one who filed statements over data nobody kept. plotvera's document packs are built around this: every screening verdict, geometry version and filed statement is archived together per consignment, so the five-year question has a one-click answer.