Due diligence (Articles 8 to 12)

9.1 What it is and who it applies to

Due diligence is the set of measures an operator takes before placing a product on the market or exporting it, in order to demonstrate that it complies with Article 3. It applies to all operators, including MSPOs and those using the simplified regime of Article 13 (Guidance, section 4). It is not a box-ticking exercise: it must reflect the characteristics of the business and of the supply chains of each product, and there is no mandatory standard form or questionnaire (FAQ 5.16).

9.2 Step 1 — Information requirements (Article 9)

The operator collects, organises and keeps for five years, with supporting evidence, the following information for each product:

All of this must be made available to the competent authorities on request (Article 9(2)).

Date or time range of production (FAQ 1.25). For products other than cattle, it is the date of harvest or extraction, or the duration of the production process; where precision is not possible, the crop year or harvest season is accepted. For cattle, it is the life of the animal, from birth to slaughter.

Suppliers who do not hand over data. If the operator cannot obtain the required information, it must refrain from placing the product on the market (FAQ 1.27). National legislation prohibiting data sharing does not release the operator (FAQ 1.31).

9.3 Step 2 — Risk assessment (Article 10)

The operator verifies and analyses the information collected and any other relevant documentation, and may only place the product on the market if it concludes that there is no risk, or that the risk is negligible. The assessment must in particular take the Article 10(2) criteria into account:

Points of interpretation from the Guidance (sections 4.a and 4.b) and the FAQ:

• The list is not exhaustive; the operator may apply other criteria that help determine the likelihood of illegality or deforestation.
• The criteria must be adapted to the operator's products and, where a product comes from several sources or geolocations, risk must be assessed for each source or geolocation.
• If any criterion reveals non-negligible risk, the product presents non-negligible risk.
• The Guidance offers guiding questions: where was it produced; what is the risk classification, the forest cover and the prevalence of deforestation and of illegal production; what product-specific risks are there; is the chain complex; are there indications that a company in the chain has been involved in illegality or deforestation; is there certification information; are there corruption concerns or sanctions; did suppliers hand over verifiable documents promptly.
• The assessment must be documented, reviewed at least annually and made available to the authorities; the operator must be able to show how it analysed the information against each criterion and how it arrived at the level of risk (Article 10(4)).
• Data analytics and artificial intelligence tools can support prioritisation, consistency checks and anomaly detection, but final responsibility remains with the operator (Guidance, section 6.b).

9.4 Complexity of the chain

Complexity is an express criterion (Article 10(2)(i)) and grows with the number of processors and intermediaries between the plot and the operator, with the use of several relevant products to make a new one, and with sourcing from several countries. Short chains make it easier to demonstrate negligible risk, especially under the simplified regime (Guidance, section 5). Guiding questions from the Guidance:

• Did the product pass through several processors or stages before reaching the EU market?
• Does it contain commodities from several plots or countries?
• Is it highly processed, containing several other relevant products?
• For wood: more than one species? Traded in more than one country? Processed in third countries?

The existence of unidentified stages in the chain may lead to the conclusion that the risk is not negligible (Guidance, section 5).

9.5 Step 3 — Risk mitigation (Article 11)

Where the assessment does not conclude that risk is nil or negligible, the operator adopts, before placing the product on the market, measures adequate to reach that level. Article 11(1) lists examples:

• requiring additional information, data or documents;
• carrying out independent surveys or audits;
• taking other measures relating to the information requirements;
• supporting suppliers — smallholders in particular — with capacity building and investment.

The operator must have policies, controls and procedures that are adequate and proportionate to manage risk, including risk management practices, reporting, record-keeping, internal control and compliance management. For non-SME operators it is mandatory to appoint a compliance officer at management level and to maintain an independent audit function to check the policies, controls and procedures (Article 11(2)).

Mitigation decisions must be documented, reviewed at least annually and made available to the authorities (Article 11(3)).

9.6 The due diligence system (Article 12)

The operator must establish and keep up to date a "due diligence system" — the framework of procedures and measures that ensures products comply with Article 3.

• Review at least annually, and an update whenever relevant new developments arise; records of the updates kept for five years (Article 12(2)).
• The review may be carried out internally, by a person not involved in the procedures, or by an external body; it must identify gaps, and management must set deadlines for correction (Guidance, section 8).
• The review must check whether there are documented procedures for collecting and recording information, assessing risk and setting measures according to the level of risk; whether those responsible know and carry out each step; and whether the controls actually identify and exclude products with non-negligible risk (Guidance, section 8).
• Non-SME operators publish, annually and in a widely accessible manner (including on the internet), a report on their due diligence system, containing: a summary of the information under Article 9(1)(a) to (c); the conclusions of the risk assessment and the mitigation measures, with a description of the evidence; and, where applicable, a description of the consultation of indigenous peoples, local communities, holders of customary rights and civil society (Article 12(3) and (4)). The first report covers 2027 and is published after 30/12/2027; anyone already reporting those elements under another EU rule (CSDDD, CSRD) need not repeat them (FAQ 5.14 and 9.9).
• All due diligence documentation is kept for at least five years (Article 12(5)).

9.7 Document retention periods