A map can show where cocoa, coffee, soy, rubber, palm oil, wood or cattle were produced. It cannot, by itself, show that the commodity in a particular shipment actually came from those locations, that every relevant source has been identified, that the material was not mixed with material of unknown or non-compliant origin, or that it was produced in accordance with the applicable legislation.

This distinction is central to the EU Deforestation Regulation (EUDR).

Geolocation is essential. But it is the beginning of the investigation, not the end.

The real compliance question is broader:

Can the operator demonstrate, using reliable and consistent evidence, why the product can be connected to its declared production areas, why it meets the EUDR’s requirements, and why the remaining risk is no more than negligible?

That is a very different question from simply asking whether coordinates have been collected.

What should you know about the EUDR?

The Regulation will apply from 30 December 2026 to large and medium-sized operators and to micro and small operators already covered by the EU Timber Regulation. For other micro and small operators, it will apply from 30 June 2027. It covers cattle, cocoa, coffee, oil palm, rubber, soy and wood, as well as relevant products listed in Annex I. The latest dates and scope information are available on the European Commission’s EUDR page.

Under the EUDR, operators must demonstrate that relevant products are deforestation-free, were produced in accordance with relevant legislation in the country of production and are covered by the required due diligence statement or simplified declaration, where applicable.

Geolocation is an essential part of that process. But it is the beginning of the investigation, not the end.

For operators required to carry out due diligence, the core challenge remains the same: collecting information is not the same as proving compliance. 

Geolocation identifies the declared place of production. Due diligence must establish whether the product can be reliably connected to that place, whether the required legal and deforestation-free conditions are satisfied, and whether the evidence supports a defensible conclusion.

What does geolocation establish?

Operators generally need to collect the geographic coordinates of the plots where the relevant commodities were produced. For plots larger than four hectares, other than those used for cattle, the coordinates must be provided as polygons. Different rules apply to cattle establishments and to micro and small primary operators using simplified declarations.

Geolocation helps operators identify the production area and assess whether deforestation or, where relevant, forest degradation occurred after the EUDR cut-off date of 31 December 2020.

The European Commission explains that operators can use remotely sensed data, including satellite imagery and aerial photographs, together with other evidence such as time-stamped and geotagged field photographs. 

More detail is available in the Commission’s EUDR implementation FAQ.

However, coordinates alone do not establish:

• Whether the declared plot is genuinely connected to the product
• Whether every relevant production plot has been identified
• Whether commodities were mixed with material of unknown or non-compliant origin
• Whether supplier documents are authentic and consistent
• Whether the commodity was produced legally
• Whether allegations or other risk signals affect the supplier or production area
• Whether the supply chain contains unidentified intermediaries or processing stages

Geolocation answers “where?”

EUDR due diligence must also answer “what, who, how and on what evidence?”

The critical distinction: origin, legality and risk

A robust EUDR assessment can be understood through three connected questions.

Origin

Did the product come from the declared production areas?

The operator needs to establish a credible connection between the relevant product and its declared plots or establishments.

Legality

Was it produced in accordance with the relevant legislation?

A product can be deforestation-free and still raise questions about whether it was legally produced in the country of production.

Risk

Is the available evidence sufficient to support a conclusion?

Even where information appears complete, the operator must consider its reliability, consistency and the relevant risk factors.

This produces an important principle:

A valid polygon is evidence of location. It is not, by itself, evidence of provenance, legality or negligible risk.

What does EUDR due diligence require beyond the map?

For operators required to conduct due diligence, geolocation forms part of a broader three-stage process.

Where an operator is required to conduct due diligence, the Regulation establishes a process centred on information collection, risk assessment and, where necessary, risk mitigation.

 Article 8 of the EUDR defines these stages as:

1. Information collection: Under Article 9, operators must collect information about the relevant product, quantity, country of production, supplier, commercial client, production date and geolocation. They must also obtain sufficiently conclusive and verifiable evidence that the product is deforestation-free and was produced legally.

The objective is not to create a large document collection for its own sake.

The objective is to build an evidence chain in which the individual pieces of information support the same conclusion.

2. Risk assessment: Under Article 10, operators must evaluate the collected information against criteria including country risk, deforestation prevalence, supply-chain complexity, document reliability, possible mixing or circumvention, Indigenous peoples’ rights and relevant concerns about companies in the supply chain.
3. Risk mitigation: If the assessment identifies more than a negligible risk, Article 11 requires the operator to take adequate and proportionate measures. 

Depending on the circumstances, this may involve:

•  obtaining additional evidence
• verifying information with the issuing authority 
• conducting independent audits or surveys 
• Investigating the supplier or corporate structure
• resolving inconsistencies in traceability records
• Changing sources or segregation controls

The important point is that risk mitigation is not simply a documentation exercise.

It is an investigation into whether the unresolved issue can actually be explained and reduced to a negligible level.

The European Commission’s EUDR implementation FAQ explains that operators must be able to demonstrate how they checked the collected information against the risk-assessment criteria and how they reached their conclusion.

If the required information cannot be obtained, or if the risk cannot be reduced to a negligible level, the operator must not place the affected product on the EU market or export it.

Geolocation identifies the declared place of production. Due diligence must establish whether the product can be reliably connected to that location and whether the wider evidence supports a conclusion of negligible risk.

Can the product be connected to the declared plots?

The first practical question is whether the geolocation information can be connected to the specific product being assessed.

Imagine a coffee shipment supported by valid geolocation data. Satellite imagery shows no relevant post-2020 deforestation. The supplier has provided a declaration stating that the coffee originated from the identified farms.

At first sight, the file may appear complete.

But suppose the production records indicate that the declared plots could not plausibly have produced the stated quantity, while transport records show an intermediary that does not appear in the supplier’s original account of the supply chain.

The polygons may still be technically correct.

The problem is that the evidence does not yet establish a reliable connection between the product and those polygons.

The evidence file should bring together the relevant:

• Product description and CN code
• Commodity and quantity
• Country of production
• Date or time range of production
• Direct supplier and commercial client
• Plots of land or cattle establishments
• Documents supporting deforestation-free and legal production

Where relevant, the evidence file should also connect these elements with production records, transport records, processing records and other information needed to explain the movement and identity of the product through the supply chain.

These elements should tell one consistent story. Dates should correspond with the production period. Quantities should be plausible in relation to the identified origin. Supplier, transport, processing and batch records should not introduce unexplained changes in the product’s identity or source.

This is particularly important for bulk commodities and aggregated supply chains. A valid polygon does not resolve a traceability gap if the operator cannot demonstrate that the product came from that polygon.

Does the evidence support legal production?

A deforestation-free finding is not the same as a legality finding.

The EUDR separately requires commodities to have been produced in accordance with relevant legislation in the country of production. 

Depending on the jurisdiction and circumstances, this can involve legislation concerning:

• Land-use rights
• Environmental protection
• Forest-related rules
• Third-party rights
• Labour rights
• Human rights protected under international law
• Free, prior and informed consent
• Tax, anti-corruption, trade and customs rules

The exact evidence will vary because national legal and administrative systems differ. It may include:

• permits, 
• land-use records, 
• contracts, 
• judicial decisions, 
• environmental assessments 
• agreements with Indigenous peoples or local communities.

The important question is not simply:

“Do we have a document?”

It is:

“What does this document actually prove, who issued it, is it authentic and current, and is it consistent with the other evidence?”

A clean satellite image cannot establish whether a producer had the legal right to use the land or whether a supporting permit was genuine.

A supplier declaration cannot, by itself, establish that an underlying permit is genuine.

And a certificate cannot automatically resolve a contradiction elsewhere in the evidence.

How should operators assess EUDR risk?

The EUDR does not prescribe one universal scoring model. The assessment must be conducted case by case and address the relevant criteria in Article 10.

The following process provides a practical way to turn those requirements into a documented assessment.

Define the assessment unit

Assess one relevant product and sourcing flow at a time. Record its commodity, CN code, quantity, supplier, production country, production period and all associated plots or establishments.

Where a product combines material from multiple suppliers, countries or plots, ensure that every source is included in the assessment.

Build the Article 9 evidence file

Collect the required traceability, deforestation and legality information. Do not record only the final conclusion.

For each item, retain:

• The original source
• The retrieval or issue date
• The entity or authority that produced it
• Any necessary translation
• The product, supplier or plot to which it relates

This creates an evidence chain, rather than simply a document repository.

Test the information for consistency and reliability

Compare the evidence across supplier declarations, commercial records, corporate information, permits, geolocation data and production dates.

Ask:

• Do the documents refer to the same producer and production area?
• Can each document be verified with its issuing source?
• Are names, dates, quantities and plot details consistent?
• Are any documents incomplete, expired or unusually amended?
• Are there unexplained intermediaries or missing stages?
• Does the evidence prove the relevant claim, or does it only repeat a supplier’s declaration?

Also ask:

• Does the volume claimed make sense in relation to the declared origin?
• Are there contradictions between official, commercial and supplier-provided records?

Contradictions are not administrative inconveniences. They are risk signals.

Assess the Article 10 risk factors

Evaluate the full set of relevant risks, including:

• The EUDR risk classification of the country or region
• The presence and prevalence of forests, deforestation or forest degradation
• The reliability of the information and its sources
• Corruption, document falsification and weaknesses in law enforcement
• Indigenous peoples’ presence, claims and consultation
• Human-rights concerns, armed conflict or applicable sanctions
• The complexity of the supply chain
• The risk of mixing with products of unknown or non-compliant origin
• The risk of circumvention
• Previous concerns involving the supplier or other companies in the chain
• Relevant substantiated concerns
• Information from certification or third-party verification schemes

Country classification is only one factor. A low-risk classification does not make supplier evidence automatically reliable, particularly if information indicates possible non-compliance or circumvention.

A low-risk country classification does not make supplier evidence automatically reliable, particularly if information indicates possible non-compliance or circumvention.

Record findings, not just scores

For every risk factor, record:

• The evidence reviewed
• The source and date
• The finding
• Any contradiction or unresolved question
• The effect on the overall risk conclusion
• The action required

An organisation may use internal labels such as Supported, Concern identified and Unresolved. These are not EUDR legal categories, but they can help prevent unanswered questions from disappearing inside an overall numerical score.

Reach and approve a product-level conclusion

The regulatory conclusion must be whether there is no or negligible risk, or whether the risk remains more than negligible.

Document why the evidence supports the conclusion, who reviewed it and when it was approved. 

A strong assessment should be reconstructable.

An independent reviewer should be able to reconstruct the reasoning without having to interview the original analyst.

Mitigate and reassess unresolved risk

Where the risk is more than negligible, obtain additional information or verification. Measures may include:

• Requesting further documentation from the supplier
• Verifying records with the issuing authority
• Conducting independent surveys or audits
• Investigating corporate ownership and supplier history
• Reviewing local-language regulatory, court and media sources
• Resolving inconsistencies in traceability records
• Changing sourcing or segregation controls

After mitigation, the evidence should be reassessed. 

The objective is not to make the file look complete. The objective is to determine whether the underlying risk has actually been reduced to negligible.

The product should not proceed until the remaining risk is negligible.

Why evidence quality matters more than document quantity

One of the easiest mistakes in due diligence is to confuse a large file with a strong file.

A hundred documents do not necessarily provide stronger evidence than ten well-verified documents.

The critical questions are:

1. What does each document prove?
2. Who produced it?
3. Can its authenticity be verified?
4. Does it relate to the specific product, supplier or production area?
5. Is it current?
6. Is it consistent with the other evidence?
7. Does anything in the wider evidence contradict it?

This is why EUDR due diligence should be thought of as an evidence assessment, not a document-collection exercise.

Can certification replace the assessment?

Certification and third-party verification can contribute useful information, but they do not replace the operator’s due diligence.

The operator should establish what the scheme covers, how audits are conducted, whether the relevant plots and suppliers fall within its scope, how non-conformities are handled and whether the certification evidence is current.

This is particularly important where certification permits models that can include material from different sources or where the certified status does not itself establish that every component of the relevant product satisfies EUDR requirements.

The Commission’s FAQ states that operators remain responsible for breaches even when certification supports their assessment.

A certificate is one source of evidence. It is not the EUDR conclusion.

Where can external intelligence support EUDR due diligence?

Some EUDR questions can be resolved through geospatial analysis, supplier records and internal traceability systems. 

Others require investigation beyond those sources.

Additional intelligence may be needed where:

• The producer or supplier’s identity is unclear
• Corporate ownership or business relationships are difficult to establish
• Permits or other official records need independent verification
• Relevant information is available only in local languages
• A supplier has been associated with illegal land use, environmental offences or corruption
• Civil-society reports or media allegations require contextual assessment
• Conflicting evidence needs to be reconciled
• New information appears after the original risk assessment

This is where a broader research capability can complement geospatial and traceability systems.

A Data Pro’s Risk Intelligence services can support these investigations through multilingual research across corporate registers, regulatory sources, court records, official publications, media and other publicly available information.

This research should complement, not replace, the operator’s geospatial analysis, legal interpretation or responsibility under the EUDR. 

Its role is to help answer questions that cannot be resolved from the original supply chain evidence alone. 

The real test: can the decision be defended?

This leads to a more useful way of thinking about EUDR due diligence.

The practical test is therefore not simply: “Do we have the coordinates?”

Nor is it:

“Do we have enough documents?”

The better question is:

“Could an independent reviewer understand why we believe this product came from these plots, was produced legally and presents no more than a negligible risk of non-compliance?”

That is the difference between data collection and defensible due diligence.

A coordinate identifies a place.

A document records a claim.

An investigation tests that claim.

A risk assessment connects the evidence.

And a defensible EUDR conclusion explains why the evidence is sufficient.

What you should takeaway from this article

The map is only the beginning.

Geolocation is fundamental to EUDR traceability. But a coordinate or polygon is not a complete due diligence assessment.

Operators must be able to connect the product to the declared production area, assess deforestation and legality, evaluate the reliability of the evidence, examine supplier and supply-chain risks and mitigate any risk that is more than negligible.

The strongest due-diligence systems therefore do more than collect geolocation data.

They create an auditable chain of reasoning from the physical product to the final regulatory conclusion.

The practical test is therefore not simply: “Do we have the coordinates?”

But “Can we demonstrate, with reliable and consistent evidence, why we believe this product came from these production areas, was produced legally, is deforestation-free, and presents no more than a negligible risk of non-compliance?”

When the answer to that question can be reconstructed and defended, the map has finally become part of a due-diligence system rather than a compliance checkbox.

Speak to a risk and compliance expert

FAQs