The European Union Deforestation Regulation (EUDR) requires companies to assess whether relevant products are deforestation-free and legally produced.

But what happens when new information appears after the initial assessment?

A supplier may become subject to regulatory action. A media investigation may connect a producer to illegal land use. New satellite evidence may contradict the declared production data. An audit may identify problems that were not visible when the original decision was made.

In these situations, companies may need to reconsider their previous conclusion.

The key question is not whether the original assessment was “wrong”. It is whether new information changes the evidence or risk on which that assessment was based.

EUDR due diligence should therefore be treated as a defensible decision-making process, not simply a one-time approval.

The EUDR will apply from 30 December 2026 to large and medium-sized operators and from 30 June 2027 to most micro and small operators. The application dates are confirmed on the European Commission’s EUDR page.

What is a substantiated concern under the EUDR?

A substantiated concern is a specific claim that a company or product may not comply with the EUDR.

The claim must be:

• Supported by objective and verifiable information
• Based on clear and logical reasoning
• Connected to a specific company, product, supplier or activity
• Serious enough that intervention by a national enforcement authority may be required

The EUDR calls these national enforcement bodies competent authorities.

According to the European Commission’s EUDR implementation frequently asked questions, a substantiated concern should identify, where possible:

• The company or supply-chain actor involved
• The product, commodity or shipment concerned
• The suspected breach
• Where and when it may have occurred
• The evidence supporting the claim

For example, a general report about illegal harvesting in a country would not necessarily be a substantiated concern against a particular company. There must be a clearer connection to that company, its suppliers or its products.

A substantiated concern can be submitted directly to a competent authority or brought to the attention of an operator, downstream operator or trader.

For companies receiving such information, however, the practical issue is slightly different: they should not focus only on whether the information already satisfies the formal threshold of a “substantiated concern”. They should first ask whether it could change the company’s own assessment of EUDR risk.

What is the difference between a risk signal and a substantiated concern?

Not every negative article, allegation or alert will meet the formal definition of a substantiated concern.

However, companies should not ignore information simply because it has not yet reached that threshold. The EUDR also refers more broadly to new information indicating that a product may be at risk of non-compliance.

Examples include:

• Regulatory or court action involving a supplier
• Credible media or civil-society investigations
• Certification suspensions or serious audit findings
• Conflicting production, ownership or geolocation records
• Evidence of mixing with material of unknown origin
• Information received from employees or business partners
• New evidence of deforestation or illegal land use

The first question should not be: “Has this allegation already been proven?”

It should be: “Could this information affect our assessment of a supplier or product?”

This distinction is important because waiting for an allegation to become formally “substantiated” can itself create a compliance problem.

A useful internal approach is to treat new information as a risk signal first, then determine whether the available evidence is sufficient to establish a substantiated concern or otherwise requires reassessment and mitigation.

Which companies must respond?

The EUDR distinguishes between different company roles:

• An operator places a relevant product on the European Union market for the first time or exports it.
• A downstream operator places or exports a relevant product made from products already covered by an upstream declaration.
• A trader supplies a relevant product that has already been placed on the European Union market.

The Regulation also distinguishes between small and medium-sized enterprises (SMEs) and larger companies. The term SME includes micro, small and medium-sized enterprises. A company that exceeds the relevant SME thresholds is treated as a non-SME.

The European Commission’s 2026 EUDR guidance explains the main responsibilities:

The precise action depends on the company’s role, size, the nature of the new information and whether the relevant notification or verification obligation has been triggered.

Companies should therefore identify their EUDR role before an incident occurs and document who is responsible for reassessment, escalation, notification and approval.

What should a company do when a new risk signal appears?

Preserve the original information

Save the original article, report, email, alert or document.

Record:

• When it was received
• Who received it
• Where it came from
• Which company or product it mentions
• Whether a translation was required

Do not rely only on a short internal summary. Important names, dates and qualifications may be lost.

Preserve the source in its original form wherever possible, including the date of publication or receipt and the relevant surrounding context.

This creates an auditable record of what the company actually knew and when it knew it.

Identify what may be affected

Connect the information to the relevant:

• Supplier or producer
• Commodity and product
• Shipment or batch
• Production period
• Plot of land or establishment
• Due diligence statement
• Customers or downstream recipients

This determines whether the concern affects one shipment, one supplier or a wider sourcing relationship.

Do not assume that the scope of the issue is limited to the product explicitly mentioned in the original alert.

Check whether the same supplier, producer, plot, intermediary, certification scheme or sourcing route is connected to other products or previous due-diligence assessments.

Check the evidence

Assess whether the information is specific, credible and independently verifiable.

Ask:

• Does it identify who, what, where and when?
• Is it supported by official records, photographs, audit findings or identifiable testimony?
• Can the information be confirmed through another reliable source?
• Are multiple publications reporting independently, or repeating one original claim?
• Is the named company definitely the same entity as the supplier?
• Does the evidence relate to the relevant production area and period?

A frequently repeated allegation is not necessarily independently confirmed.

At the same time, lack of independent confirmation does not mean the information can simply be disregarded.

The purpose of this stage is to determine what the information establishes, what remains uncertain and whether the uncertainty itself changes the risk assessment.

Reopen the risk assessment

Compare the new information with the evidence used for the original decision.

Review whether it changes any of the factors listed in Article 10 of the EUDR, including:

• The reliability of documents and data
• Compliance with local legislation
• Supply-chain complexity
• Possible mixing or circumvention
• The supplier’s connection to deforestation or illegal activity

Document which conclusions remain supported and which require further investigation.

Do not simply add the new information to the file and leave the original conclusion unchanged.

Record explicitly:

• What part of the original assessment is affected
• Which evidence is now challenged or requires verification
• Whether the risk level has changed
• What additional evidence is required
• Who is responsible for resolving the issue
• When the reassessment should be completed
• This makes the reassessment a documented decision rather than an informal review.

Decide whether the product can proceed

If the risk is more than negligible, the company may need to request additional documents, verify information with public authorities, conduct an audit or commission further investigation.

These risk-mitigation requirements are set out in Article 11 of the EUDR.

A product that has not yet been placed on the market or exported should not proceed while the risk remains more than negligible.

Where an immediate notification duty applies, the company should not wait for the full investigation to finish before notifying the relevant competent authority.

The decision should be based on the current evidence, not on the fact that the product was previously approved.

A previous due-diligence conclusion does not make new contradictory evidence irrelevant.

Where the evidence cannot support a conclusion of no or negligible risk, the company should escalate the case rather than allowing the original approval to carry forward by default.

Record the response and final decision

The case file should show:

• What information was received
• Which products and companies were affected
• How the information was verified
• Whether the risk assessment changed
• What mitigation or notification followed
• Why the final decision was made
• Who reviewed and approved it

The objective is not simply to show that an alert was closed. It is to demonstrate how the company reached a defensible decision.

A strong case file should allow an independent reviewer to reconstruct the sequence:

new information → initial screening → affected products identified → evidence verified → risk reassessed → mitigation or notification → final decision

This is particularly important where the original conclusion is maintained despite the new information. In that situation, the file should explain why the new information did not alter the risk conclusion.

What if the new information cannot be verified immediately?

Uncertainty should not automatically be treated as either proof of non-compliance or proof that there is no problem.

Instead, companies should distinguish between:

• information that is verified;
• information that is credible but still under investigation;
• information that is contradicted by reliable evidence; and
• information that is unsupported or irrelevant to the product being assessed.

The appropriate response depends on which category the information falls into and whether it affects the applicable EUDR risk assessment.

Where the issue cannot be resolved quickly, the company should document the interim risk position, the controls applied to affected products and the steps required to reach a final decision.

What if the concern affects more than one supplier or product?

A new risk signal may reveal a systemic issue rather than an isolated incident.

For example, if several suppliers use the same intermediary, certification scheme, processing facility or sourcing region, the company should consider whether the information has implications beyond the product originally identified.

The appropriate response may therefore involve a targeted review of the wider sourcing relationship rather than a single transaction.

The scope should be evidence-based: broad enough to capture the plausible impact, but not so broad that unrelated products are automatically treated as affected.

Where can external intelligence support the investigation?

Some concerns can be resolved through supplier records and geospatial evidence. Others require research across corporate registers, regulatory notices, court records, local-language media and civil-society reporting.

A Data Pro’s Risk Intelligence services can help companies verify suppliers, investigate allegations, identify whether multiple reports provide independent evidence and preserve a clear research trail.

This can be particularly valuable where the new information concerns matters outside the company’s own supply-chain records—for example, corporate ownership, regulatory proceedings, court cases, local-language reporting or relationships between apparently separate supply-chain entities.

This research should support, not replace, the company’s legal, geospatial and compliance assessment. The final EUDR decision remains the company’s responsibility.

From alert to defensible decision

A mature EUDR process should treat new information as an input into an ongoing evidence and risk-management cycle.

The process can be summarised as:

1. Capture the signal
2. Preserve the source
3. Identify affected products and relationships
4. Verify the information
5. Reassess the relevant risks
6. Mitigate, escalate or notify as required
7. Record and approve the final decision

The objective is not to eliminate every allegation. It is to ensure that relevant information is assessed proportionately, that unresolved risks are not ignored and that the company’s final position can be defended.

Conclusion: A new signal may require a new decision

EUDR due diligence should not be treated as a one-time check.

When new information appears, companies should determine what it affects, verify the evidence, reconsider the original assessment and document the resulting action.

The practical question is:

Could we show how we identified, investigated and responded to information that challenged our original decision?

The stronger question is:

Could an independent reviewer reconstruct what we knew, what we investigated, what changed in our assessment and why we ultimately decided that the product could—or could not—proceed?

That is the standard a mature EUDR process should aim for.

A substantiated concern is not simply an allegation to be filed away. A new risk signal is not something to ignore until it becomes legally conclusive. Both should trigger a disciplined process of evidence review, risk reassessment and documented decision-making.

In practical terms:

New information → new evidence review → new risk assessment → new decision, where necessary.

Speak to a risk and compliance expert

FAQs