Every layer of EUDR enforcement reads the same thing: the coordinates of a plot and whether that ground was forest in 2020. That's where readiness should point, and there's time to get it there.

By Jinal Surti, Co-Founder & CEO, Epoch Blue. Last updated 3 August 2026.

Earlier this year, before the deadline takes effect, the EU held rehearsals. National authorities in several member states ran preparedness "dry runs," sitting down with real companies and their real due diligence files to see what an inspection would surface. The verdict that came back is worth pinning above every compliance desk: "simply collecting data and documents is not enough."

I've spent most of this year talking with compliance leads building toward 30 December 2026, when the EU Deforestation Regulation starts applying to large and medium operators. Almost all of them circle the same quiet question: when the regulator finally looks, how deep will they look, and what will count as enough?

What the check reads

Picture the three instances where a check can take place, because all three are open to scrutiny the same day the law applies.

The first is the moment you file. Under the new rules for the EU's Information System, every Due Diligence Statement gets an automated risk score the instant it's submitted, and that score is seen by the authorities. They can hold your statement's reference number, and reject it before the number ever issues, in which case the goods count as having no DDS at all.

The second is the border. Customs now expects a valid DDS reference on the shipment, and a missing or flagged one can be suspended while a competent authority takes a look. The regulation gives them three working days, or 72 hours for perishables, to decide.

The third is the audit. Every member state has to check a minimum share of operators each year, scaled to country risk. Article 16 sets the floor at 1% of operators for low-risk origins, 3% for standard-risk, and 9% for high-risk (plus 9% of the volume). Brazil, Indonesia and Côte d'Ivoire all sit in the standard tier, meaning a rolling one-in-thirty-three are inspected and full due diligence. Audits aren't only random, either. Anyone (an NGO, a whistleblower, a competitor) can file a substantiated concern that forces an authority to look, and the names of infringing companies get published.

Here's what those three checks have in common: none of them reads your supplier questionnaire. The silent score reads your geolocation. The border reads a reference number that's only as good as the plot behind it. And the auditor reads the ground itself, then asks you to prove a specific plot, whether it's a real parcel, whether it was forest on the 31 December 2020 cut-off, and whether it's legal.

We also know that Competent Authorities are looking at three specific checks:

  1. Circumvention: Are the plots being underreported? Does the declared volume match the volume of commodity possible to grow in the plots submitted? The competent authorities will need to feel confident that undisclosed sources of commodity haven’t been introduced into the supply chain. This is a check that we run whether or not the plots were provided by a supplier or detected by us.
  2. Cherry Picking: Are non-compliant plots specifically not included in the declaration? The competent authorities will have the exhaustive picture of the entire supply shed - all the plots for a commodity that are likely sources of the commodity for a producer. If the statistical deforestation is significantly higher than the deforestation in the declared plots, they will ask questions. So just because you remove a plot from your submission, doesn’t mean the NCAs won’t see the plot.
  3. Plot Boundary Validity: Have the field boundaries been manipulated to specifically include non-compliance areas? We identify plot boundaries by taking into account the commodity growing areas within a cadastral unit. So field boundaries detected by Epoch don’t risk having this validity check fail.

That's the line between company-level ESG and production geography, and enforcement lands entirely on one side of it. An ESG rating describes how a company manages its suppliers. A DDS check asks a physical question about a piece of land, and a supplier survey answers the first, not the second.

"We'll be ready" and "we'll pass" are inherently different

In my mind, the fine floor is the least of your worries. Beyond the base 4% of EU-wide annual turnover, authorities can also confiscate the goods and the revenue they earned, bar you from public procurement, or hold the product off the market. The encouraging part is that it all hinges on something you can check before you file.

Being proactive is what will determine your true risk come 30 December. Without access to the score silently assigned by the Information System, any statement that seems fine on paper could still be flagged without warning. Geolocation is the one requirement with no exception. No coordinates, equals no market access. Declaring a whole region "in excess" to cover a gap doesn't help either, since one non-compliant plot in that set makes the entire declared set non-compliant.

Closing that gap is doable, and it's one of the things Epoch works on, one route among several. We take the case where the supplier never sends coordinates: we locate a supplier's sites, map the supply sheds around them, detect the individual production plots, and run the deforestation assessment plot by plot against the 2020 cut-off, then flag where a legality problem is likely. What comes out is DDS-ready geolocation and a deforestation verdict built to hold up to the look an auditor gives it, without waiting on a questionnaire.

What to do with the five months left

  • Check your coordinates diligently. For each lane, ask whether your DDS geolocation points at a real plot you can see from orbit, or at a region, a district, or a supplier's mailing address. Only the first survives a check. Check for circumvention risk, plot boundary validity and risk of cherry picking, because NCAs will.
  • Don’t rely on supplier data. Where a supplier can't or won't hand over coordinates, get them from the land itself. A survey you're still sending in December is a DDS you can't file. Have a plan B if you don’t get the data from your supplier. Because in many cases, you won't!
  • Legality should not be underestimated. The dry runs showed legality is the leg that fails, so know which of the eight areas of production-country law applies at each origin before an inspector asks.

When the first check comes, it won't ask how hard you tried with your suppliers. It'll ask what's true at the coordinate. There are five months to get to a plain yes, at plot level, for every lane that matters.

The competent authorities have explicitly stated what they intend to check, so use that guidance to build a process that holds up to that scrutiny.

—————————————————————————————————————

Going deeper on 12 August with Assent. We're running a 45-minute session with our platform partner, Assent, on how a supplier-data program can become source-level traceable before December for products containing rubber, wood, and other in-scope commodities. Hosted by Epoch's Jinal Surti and Assent's Noah Taetle. Save your seat for "From Supplier Data to Source-Level Traceability: EUDR Readiness With Assent and Epoch."

If you'd like to learn more about how we generate DDS-ready plot geolocation and run the deforestation assessment behind a defensible DDS without supplier data, or put the product to work in your supply chain, reach out to us here.

Or, subscribe to our newsletter to get the latest on supply chain risk management, EUDR, deforestation, water stress, and the latest trends in geospatial AI.