Asking Suppliers for EUDR Data: What Operators Need

From 30 December 2026, a company that imports cocoa, coffee, palm oil, rubber, soya, wood or cattle products needs the reference number of a due diligence statement to clear them through customs. Micro and small importers follow on 30 June 2027, except for most wood products. That statement rests on data that sits at the very start of the supply chain: on farms, plantations and in forests, often several trading steps away. If the data does not arrive, the statement cannot be filed and the goods cannot be sold.

That makes the EUDR a purchasing question long before it becomes a customs question. Get the request right once, with the right data in the right format before the order, and it turns into routine. Send every supplier the same long questionnaire, and you wait at the border.

What Your Role Means for the Supplier Request

Your role under the EUDR decides how much you need from your suppliers, and the role is set per product, not per company. A manufacturer that imports one input and buys the rest in the EU is the operator for the imported input only.

If you are not sure which role you hold, our guide on EUDR obligations of downstream operators and traders walks through the roles with examples. The rest of this article is about the operator's request.

What Operators Need from Suppliers

Operators have to collect a defined set of information for every relevant product, back it with evidence, and keep it for five years. The EUDR calls these the information requirements. Some of it comes from your own records. The rest has to travel up the supply chain to you.

The table also shows where requests go wrong. Asking a supplier for your own customer list wastes a question. Asking a direct supplier for geolocation when it buys from a trading house, which buys from cooperatives, sends the question to someone who cannot answer it. Ask early who actually holds the plot data.

‍

Geolocation: Points, Polygons and the Four Hectare Rule

Under the EUDR, geolocation is the latitude and longitude of a plot of land, given with at least six decimal digits. For plots of up to four hectares, a single point is enough. For larger plots used for any commodity other than cattle, the perimeter has to be described as a polygon. For cattle, the geolocation refers to every establishment where the animals were kept, not to pasture plots.

The EU Information System takes coordinates in the GeoJSON format, uploaded as a file or entered by hand. If a file carries fewer than six decimals, the system fills the missing digits with zeros. The upload passes, but the location is no more precise than before, so ask suppliers for real six digit precision.

The system also checks the shape of the data. Polygons must be closed, and shapes whose sides cross are not processed. Points that become identical once rounded to six decimals cause errors. Holes inside a polygon are not supported: depending on the case, the system rejects the polygon or reads only its outer boundary, which adds the hole to the plot. Split such plots into separate polygons instead. A point without a stated area counts as four hectares.

Supplier templates often build in errors of their own. Four are worth checking for:

• The polygon rule set at "4 hectares or more". The law requires a polygon only above four hectares. A plot of exactly four hectares can be a point.
• The production date tied to 31 December 2020. That date is the cut-off for deforestation. Whether a product is in scope depends on when it was produced (from 29 June 2023 onward) and when it is placed on the market.
• Species names in one free text column. For wood, the system expects pairs of common and scientific names, often several per product.
• A declared plot size that does not match the drawn shape. A plot stated as eight hectares that covers less than one on the map invites questions in a check.

Low-Risk Countries, Certificates and Small Producers

Sourcing only from low-risk countries does not remove the need for geolocation. It allows simplified due diligence, which drops the risk assessment and risk mitigation steps. The information requirements stay in full. The operator also has to check that low-risk goods are not mixed with goods from other origins. If anything points to a risk, full due diligence applies again.

A certificate supports the risk assessment, but it does not replace the data. FSC, PEFC, RSPO and similar schemes can help, as far as they cover the information the EUDR asks for. The operator still carries out due diligence, still needs the geolocation, and stays responsible for the result.

Small producers in low-risk countries have one shortcut. A micro or small primary operator sells what it grew, raised or harvested itself. It files a one-time simplified declaration instead of a due diligence statement and may give the postal address of its plots instead of coordinates. The shortcut belongs to the producer itself. An importer that buys from small farms is not a primary operator and still needs coordinates.

When Suppliers Can't or Won't Share Plot Data

Without the required data, the operator cannot place the product on the market. The Commission's FAQ leaves no room here: a supplier that does not deliver the information blocks the sale. National laws in the country of production that restrict sharing such data do not exempt the operator either.

Suppliers are free to share the data outside the EU Information System, by file, portal or email. The format is rarely the hard part. Trust and timing are.

• Ask before you order. Make the data set a condition in the purchase contract or order confirmation, not a request at shipment.
• Explain why you ask. The data is a legal condition for your customs clearance, not curiosity about their sourcing.
• Ask only for what the law needs. A request that stays within the information requirements gets answered faster than a long sustainability survey.
• Plan an alternative. For critical goods, know which second supplier can deliver the data if the first one cannot.

How Often to Ask

One due diligence statement can cover several shipments and products, so the request follows your supply periods. The Commission recommends that a statement cover no more than one year, because the operator reviews its due diligence system once a year. Once the quantity a statement covers has been placed on the market, a new statement is needed.

The timing is fixed by customs. For imports, the reference number goes into the customs declaration, so the statement has to be filed, and the data has to be complete, before the goods are released. A practical rhythm is a full data set per supply period and a short confirmation per delivery that the goods come from the declared plots.

What You Pass On to Your Own Customers

Most operators are also suppliers, and they pass on far less than they collect. The operator gives the reference number of its due diligence statement to direct business customers that are downstream operators or traders. There is no legal duty to pass on geolocation or other due diligence data.

You can still choose to share more. When filing, an operator can allow supply chain members who hold the reference number and the verification number to see the geolocation in the Information System. You have no duty to share the verification number. Larger customers may ask for it when they look into a substantiated concern.

Customers will still ask for more. Our guide for downstream operators and traders explains what they actually need.

One Request for PPWR and EUDR

Many companies will ask the same suppliers for EUDR and PPWR data, often about the same products. Wooden pallets, paper and cardboard packaging are the obvious overlap. Under the EUDR, packaging is only covered when it is placed on the market as a product in its own right. Packaging that only supports, protects or carries another product is out of scope. Settle that question first, because it decides whether a packaging supplier gets an EUDR request at all.

Where both laws apply, one request works better than two. A supplier record has three levels:

• Supplier: identity, contact details and role, shared by both laws.
• Delivery: date, delivery note and quantity, shared by both laws, plus the EUDR reference number where one applies.
• Product: materials and recycled content for the PPWR Declaration of Conformity, and plots, production dates and evidence for the EUDR.

The same logic reaches beyond packaging. CBAM also asks for data below company level, but for the installation that made the goods rather than the plot of land. One supplier record with a module per regulation keeps that difference visible without a third data silo. The PPWR hub covers the packaging side.

The EUDR supplier request comes down to three decisions: which role you hold for each product, which data the law needs for that role, and when it has to arrive. Operators that settle all three before they order goods arriving after 30 December 2026 will file on time. Operators that settle them at the border will not.

How Sunhat Supports Your EUDR Supplier Data

Most of the data the EUDR asks operators for sits with suppliers, often several trading steps away, and arrives in every format from spreadsheets to PDFs. The work lies in asking once, checking that coordinates, production dates and species names hold up before you file, and keeping everything retrievable for five years.

Sunhat already brings supplier data for PPWR and other regulations together on one platform. Book a demo and learn how you can build your EUDR supplier requests on that same supplier data before 30 December 2026.