EUDR: due diligence, geolocation and verifiable evidence for coffee, cocoa, timber and soy
Equipo Proovik · Sep 8, 2026 · 9 min read
The EUDR (Regulation (EU) 2023/1115) requires anyone placing coffee, cocoa, timber, soy, palm oil, rubber or cattle products on the EU market to carry out due diligence in three steps: collect information, assess risk and mitigate it. The information must include the geolocation of every plot where the commodity was produced and the date or range of production. Evidence becomes verifiable when its fingerprint is fixed to a date, so anyone can check it existed before the sale unaltered.
Who the EUDR applies to
The Regulation distinguishes operators, who place a product on the EU market for the first time or export it, from traders, who buy and sell it once it is already on the market. Operators carry the main burden; traders that are not SMEs have equivalent obligations.
Typical operators:
- A roaster importing green coffee from Colombia or Ethiopia.
- A cocoa importer bringing in beans or cocoa paste for chocolate makers.
- A sawmill or timber yard importing sawn wood, panels or pulp.
- A feed manufacturer buying soybeans or soybean meal from outside the Union.
The derived products covered (leather, furniture, paper, chocolate and so on) are listed in Annex I.
The three steps of due diligence
Article 8 structures due diligence in three steps documented for every batch or shipment. This is the evidence each step usually produces.
1. Collect information (Art. 9)
Product description, quantity, country of production, supplier and customer details, and the geolocation of all plots of land where the commodity was produced, together with the date or time range of production. Plus information showing the product is deforestation-free and was produced in accordance with the legislation of the country of production.
- A file such as
plots-finca-la-esperanza.geojsonwith the polygon of each plot. - Supplier contract and invoices identifying the batch.
- Certificate of origin or exporter declaration.
2. Assess risk (Art. 10)
The operator judges whether there is a risk that the product does not comply, considering the risk level of the country or region, the presence of forests, the reliability of the supplier and the complexity of the chain. Typical evidence: a country risk report, an overlay of the polygons on forest cover maps at the cut-off date, and the supplier's history.
3. Mitigate risk (Art. 11)
If the risk is not negligible, action is needed before placing the product on the market: requesting more information, commissioning independent audits or field verification. Evidence: an audit report, plot sampling results, an improvement plan agreed with the supplier.
With all of this, the operator submits a due diligence statement through the EU information system before placing the product on the market or exporting it. Its reference number follows the product down the chain.
The date problem: evidence has to exist before you sell
A competent authority can ask, years after a shipment: did this geolocation and this risk assessment already exist when you submitted the statement, or were they completed afterwards? A GeoJSON file on your own server does not answer that: its metadata is written by whatever program saved it and can be changed without trace.
The answer is fixing the fingerprint of each piece of evidence in a record nobody controls. You compute the file's SHA-256 (64 characters that change completely if a single byte changes) and write it into a transaction on a proof-of-work blockchain, whose block timestamp is covered by the mining work. As explained in what a blockchain timestamp is, the result is a proof of existence and prior date that anyone can check without trusting the issuer.
The table summarises how each kind of evidence is anchored and what the anchor proves.
| Evidence | Who produces it | How it is anchored | What the anchor proves |
|---|---|---|---|
| Plot GeoJSON | Producer or cooperative | File sealed on receipt | Those polygons existed on that date and were not edited later |
| Supplier contract and invoices | Supplier and operator | Signed PDF sealed | Existence and integrity of the document at the seal date |
| Country and batch risk assessment | Operator or consultant | Each version of the report sealed | The assessment predates the statement |
| Audit report | Independent auditor | Delivered report sealed | The report has not changed since delivery |
| Receipt, transformation and shipping of the batch | Operator (warehouse, roaster, sawmill) | Chained and anchored EPCIS 2.0 event | Each step was recorded at that moment and in that order |
| Submitted due diligence statement | Operator | Receipt with reference number sealed | The statement existed with that content before shipping |
The anchor proves when a piece of data existed and that it was not altered, not that it is true. A false polygon, once sealed, is still false; what can no longer happen is changing it later unnoticed.
Chain of custody with EPCIS 2.0
The EUDR also expects you to know which batch came from which plots and whose hands it passed through. The GS1 standard for that is EPCIS 2.0, which describes every step of a product as an event with what, when, where and why. The pillar page on EPCIS 2.0 traceability explains the five event types with a full example. Applied to a coffee roaster:
- Receiving ObjectEvent: the green coffee batch, with its GTIN and lot number, is received at the warehouse identified by its GLN, linked to the reference number of the due diligence statement.
- TransformationEvent: several green coffee lots are consumed and a new roasted lot comes out. This is the event that connects the finished product with the plots of origin.
- AggregationEvent: bags from the roasted lot are grouped onto pallets with their SSCC for shipping.
Each event carries the hash of the previous one and its own hash is written to Kaspa, so the batch history cannot be rewritten without notice. The GS1 Digital Link QR on the packaging resolves to the batch's public page, where a customer or an inspector sees the chain of events and the anchoring of each one. The articles on coffee traceability and on food traceability and regulation give more sector context.
What the regulation says
In summary, Regulation (EU) 2023/1115 of the European Parliament and of the Council of 31 May 2023 provides the following:
- Article 3. Relevant products may be placed on the EU market or exported only if they are deforestation-free, have been produced in accordance with the relevant legislation of the country of production, and are covered by a due diligence statement.
- Article 2. A product is deforestation-free if the commodities were produced on land that has not been subject to deforestation after 31 December 2020. Geolocation means latitude and longitude coordinates with at least six decimal digits; for plots of more than four hectares used for commodities other than cattle, it is described using polygons.
- Article 8. Due diligence comprises information collection, risk assessment and risk mitigation.
- Article 9. The information required includes the geolocation of all plots of land where the commodities were produced and the date or time range of production.
- Articles 12 and 33. The due diligence statement is submitted through the EU information system before placing on the market or exporting.
- The operator must keep the due diligence documentation for five years.
On timing: application of the Regulation was postponed from its original date. Under the calendar in force when this guide was written (September 2026), the obligations apply from 30 December 2026 for large and medium-sized companies and from 30 June 2027 for micro and small enterprises. Always check the consolidated text on EUR-Lex before planning.
As for the evidential value of time stamps, Regulation (EU) 910/2014 (eIDAS) states in Article 41(1): "An electronic time stamp shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic time stamp." The guide on qualified and non-qualified time stamps explains the difference.
How to do it with Proovik
Proovik does not grant EUDR compliance and does not replace the EU information system: the statement is submitted where the Regulation says, with the data the Regulation requires. What Proovik adds is proof that each piece of evidence existed on a date and has not been altered since.
- Seal the due diligence files. In the browser, at certify a document, or via the API with
POST /api/certifysending only the SHA-256. The file never leaves your system. You receive a PDF certificate with the PVK-PROOF/1 package, which anyone can check on the verification page without Proovik. - Record the chain of custody. EPCIS 2.0 events are recorded via the API, chained by hash, signed per actor and anchored on Kaspa; the GS1 Digital Link QR on the packaging leads to the batch's public page. To see it, visit the traceability service or get in touch.
It proves existence, prior date and integrity of every file and event; it does not prove authorship or truthfulness. It is a non-qualified electronic time stamp, without the presumption of Article 41(2) eIDAS; getting started is free and needs no account. What verification checks exactly is explained in how to verify a proof without relying on the provider.
Frequently asked questions
Does the EUDR require me to use a blockchain?
No. The Regulation requires information, risk assessment and mitigation, and a statement submitted through the EU system; it prescribes no technology. Anchoring evidence on a blockchain shows, if challenged, that it existed on a date and was not modified, but it is neither a requirement nor a substitute for the statement.
How precise do the coordinates have to be?
The Regulation defines geolocation as latitude and longitude with at least six decimal digits, which corresponds to a precision in the order of tens of centimetres. For plots larger than four hectares used for commodities other than cattle you must provide polygons, not a single point. A GeoJSON file with those polygons is the usual format.
What if my supplier will not provide geolocation?
Without geolocation you cannot complete the information step or submit the statement. Make delivery of polygons per batch a contractual term, seal the file the moment it arrives, and keep a record of your requests. If the supplier cannot provide it, the risk is not negligible and you need another source.