The due diligence statement (DDS) is the document that turns an operator’s due diligence under the EUDR into a legal commitment. It is short, but each field has consequences. This article goes through the fields as they stand in Annex II of Regulation (EU) 2023/1115, as amended by Regulation (EU) 2025/2650, and explains what happens once the statement is submitted. For the full picture, see our EUDR guide.
Who has to submit a due diligence statement?
Only operators: the companies that place a relevant product on the EU market for the first time, or export it. Before placing the product on the market, the operator must exercise due diligence, conclude that the risk of non-compliance is negligible, and then make a statement available to competent authorities through the EUDR Information System (Article 4(2)).
Regulation (EU) 2025/2650 narrowed this. Before it, non-SME traders were treated like operators and downstream companies often had to file their own statements referencing upstream ones. Now:
- Downstream operators (companies placing products made from products already covered by a statement) and traders do not submit statements.
- They keep the name, postal address and email of their suppliers and customers.
- Where their supplier is an operator, they also keep the reference numbers of the statements.
- Non-SME downstream operators and non-SME traders register in the Information System.
Micro or small primary operators in low-risk countries, who sell what they grow themselves, submit a one-time simplified declaration instead.
What are the fields of a due diligence statement?
Annex II lists the content. After the 2025 amendment, it has five items.
1. Who is the operator?
The operator’s name and address and, where products enter or leave the EU market, the EORI number (the customs identification number). This ties the statement to a legal entity that customs and competent authorities can identify.
2. What is the product, and how much?
- The Harmonised System code of the product.
- A free-text description, including the trade name.
- For products containing or made from wood, the full scientific name of the species.
- The quantity. For products entering or leaving the market, this is expressed in kilograms of net mass and, where applicable, in the supplementary unit set for that HS code.
A mismatch between the statement’s HS code or quantity and the customs declaration is one of the simplest things for an authority to spot.
3. Where was it produced?
The country of production and the geolocation of all plots of land where the commodities were produced. For cattle, the geolocation of all establishments where the animals were kept. If the product mixes commodities from several plots, every plot must be included.
Geolocation means latitude and longitude with at least six decimal digits. For plots of more than four hectares used for commodities other than cattle, it means a polygon describing the plot’s perimeter. In the Information System, locations can be drawn on a map, entered as coordinates, or uploaded as GeoJSON.
This field is where most of the work lies. For cocoa, coffee or rubber sourced from smallholders, a single container may represent hundreds or thousands of plots.
4. The declaration
The statement includes fixed text: “By submitting this due diligence statement the operator confirms that due diligence in accordance with Regulation (EU) 2023/1115 was carried out and that no or only a negligible risk was found that the relevant products do not comply with Article 3, point (a) or (b), of that Regulation.”
Point (a) is deforestation-free since the 31 December 2020 cut-off date; point (b) is production in accordance with the relevant legislation of the country of production.
5. Signature
“Signed for and on behalf of”, with the date, the name and function of the signatory, and the signature.
The former item on referencing existing statements was deleted in 2025, together with the rules it served.
What does the statement not contain?
The statement is a declaration, not the evidence. It does not include the risk assessment, the deforestation analysis, land titles or supplier audits. Those belong in the operator’s due diligence records, what many companies call the due diligence report, which the operator keeps for five years and shows to competent authorities on request.
This distinction matters. Submitting a statement makes the operator responsible for the product’s compliance (Article 4(3)). If an authority checks the operator, it examines the due diligence system and the documentation behind a specific product (Article 18). A statement with correct fields and no evidence behind it does not protect anyone.
What happens after you submit a DDS?
Under Implementing Regulation (EU) 2024/3084, as amended by Implementing Regulation (EU) 2026/1565:
- Automated risk profiling. Every statement is profiled on submission and assigned a risk status. The status is visible only to authorities.
- Reference number and verification number. The system assigns both. The verification number adds security: other users can only see a statement if you share both numbers.
- Possible delay or rejection. Competent authorities may delay making the reference number available while they check a product. Where a high risk is identified, they may reject the statement within the period set in Article 17(3). A rejected statement no longer covers the product.
- Passing it on. The operator communicates the reference number to the downstream operators and traders it supplies (Article 4(7)), and makes it available to customs before release for free circulation or export (Article 26(4)).
- Record-keeping. The operator keeps a record of the statement for five years.
The system also offers grouping (one statement referencing several earlier ones) and contingency reference numbers for unexpected outages of more than 60 minutes, which the Commission must organise by 30 December 2026.
Can you submit statements automatically?
Yes. The Information System can be used through its web interface or through web services (an API) with common technical specifications published by the Commission, updated in 2026. For operators handling many shipments, automated submission is the practical route: the statement is generated from the records that already hold the product, quantity and plot data, and the reference number is written back to the shipment.
The Commission also runs an acceptance environment, a replica of the production system for testing. Submissions there have no legal value, and it needs its own registration.
How do you make statements reliable?
Every field in the statement is only as good as the data behind it. Three habits make the difference:
- Collect geolocation at the source, with validation while the field agent is still with the farmer.
- Keep the link from plot to shipment, so the statement lists the plots the product actually came from rather than a whole supply base.
- Generate statements from records, not by re-keying data into forms.
Farmer1st produces due diligence reports and statements from plot-level data and submits them to EU TRACES, the EUDR Information System, through direct integration. See EUDR compliance, Geo & polygons and Data integration.
Frequently asked questions
Can one due diligence statement cover several shipments?
Yes, within limits. A statement covers the products it describes, and the Information System now allows grouping: a new statement can reference earlier statements by the same user, and its single reference number then stands in for them, including at customs. Statements used in a grouping can no longer be amended or withdrawn.
Does a chocolate or coffee brand have to submit its own statement?
Not if it buys products already covered by a statement from an EU operator. In that case it is a downstream operator: it keeps supplier and customer details and, as the first company after the operator, the reference numbers. Non-SME downstream operators must register in the Information System.
How long must a statement be kept?
Operators keep a record of each statement for five years from the date it is submitted through the Information System. The underlying evidence, the information, risk assessment and mitigation records, must also be kept for five years.
Updated ·
