EUDR compliance is a process, not a technology
Epoch's services walk operators through the due-diligence and Know-Your-Supplier obligations introduced by Regulation (EU) 2023/1115, from data submission to a Due-Diligence Statement (DDS) that EU TRACES will accept, with the audit trail to back it up.
Audience. EU operators and traders importing soy, timber, cattle, rubber, coffee, cacao, palm oil and their derivatives; member-state competent authorities evaluating DDS submissions.
About this document. This is the executive overview (~12 pages). For the full methodology, per-criterion Article 10.2 detail, per-commodity operational notes, full FAQ set, glossary, and source citations, see The Epoch EUDR Compliance Process (full reference, 39 pages).
Not legal advice. Epoch's interpretation of the law and a "sufficient-effort" approach to comply with it. Consult counsel for binding interpretation.
The Two-Pillar Test
EUDR places two conditions on every relevant product placed on the EU market. Both must be satisfied.
No conversion from forest since 31 December 2020. Verified per plot by satellite analysis.
Compliant with the laws of the country of production. Verified per supplier, supply base or country through documentary evidence the operator collects under Article 9.1(h); Epoch's Article 10.2 risk signals flag where to focus.
Behind those two pillars, Epoch produces three distinct risk assessments, scored independently and never merged into one number:
- Deforestation (deforestation-free pillar) — a per-plot satellite verdict against the 2020 cutoff (deforestation-free / critical / not assessed). The only signal that makes a plot non-compliant.
- Article 10 risk (legal pillar) — a per-supply-base procedural composite scored low / medium / high that sets how much due diligence is owed, not pass/fail.
- Legality (legal pillar) — a producer-attributable adverse-media signal flagging breaches of the country's applicable laws (Article 9.1(h)), independent of the plot verdict.
The country's Article 29 risk tier sits above all three as a routing gate between simplified and full due diligence.
Article 9 defines the geolocation and information requirements. Article 10 defines the fourteen risk criteria. Article 11 defines mitigation when risk is non-negligible. Article 23 restricts market access for non-compliant products; Article 25 requires Member States to set the maximum fine at no less than 4% of EU-wide turnover. The simplification package (Regulation (EU) 2025/2650) postponed application to 30 December 2026 for large/medium operators and 30 June 2027 for small/micro operators.
The Six-Step Process
A closed loop. The first three steps move forward; supplier engagement (step 4) feeds back into the full-resolution checks (step 3) until every flagged plot is resolved; the audit trail (step 5) accumulates throughout; and only when the loop is closed does the DDS lodge with EU TRACES (step 6).
Supplier data submission
Plot polygons (preferred) or a first-mile aggregation point. Operator-provided.
Initial risk screening
Real-time. Article 10.2 (a)–(n), plus legality and governance signals. Deterministic + AI-assisted.
Full-resolution deforestation checks
12 h turnaround. Six-source ensemble + natural-forest mask. Deterministic.
Supplier engagement
Conditional. Triggered when Article 10 risks or specific plots flag. Operator-led, logged.
Audit trail
Continuous, immutable. Every operation timestamped and dataset-versioned.
DDS submission to EU TRACES
Operator-signed, or Epoch on behalf as authorised representative.
Operator vs. Epoch Responsibilities
The operator placing the product on the EU market is the legally accountable party under EUDR Articles 8–13. The work is split: Epoch operationalises the methodology and the audit trail; the operator brings supply-chain knowledge, evidence Epoch cannot manufacture, and the final-judgement calls the regulator expects. The legally binding compliance determination remains the operator's.
| Obligation | What the operator provides | When | What Epoch handles |
|---|---|---|---|
| First-mile data (Article 9 geolocation) | Plot polygons or first-mile aggregation points | Before first submission per supplier; refresh on sourcing change | Validation, normalisation, geocoding; supply-shed delineation; commodity-detection stack derives plots from a shed |
| Article 9 TRACES fields | Factual values | Per DDS submission | TRACES-schema pre-validation; structured capture in audit trail |
| Legality evidence (Article 9.1(h)) | Primary documents (titles, permits, certifications, audit reports, training records, grievance logs) or proxy evidence with a written explanation | Per supplier; refresh ≥ annually | Surfaces relevant laws via Article 10.2 (h)(l)(m) signals; structures engagement to timestamp evidence |
| Supplier engagement on flagged plots | Reach out, request evidence, decide exclusion / further evidence | Per flag | In-platform engagement channel; audit-trail capture of every request, response and upload |
| Risk determination (Article 10.6) | Final judgement call (legally the operator's) | Per DDS submission | Composite Article 10 score, per-criterion breakdown, deforestation verdict |
| Article 11 mitigation | Operational artefacts (training, audit cycle, grievance log, evidence-of-effect) | Ongoing for non-negligible-risk suppliers | Engagement channel; structured capture of mitigation evidence by supplier and period |
| Audit-trail retention (Article 12, 5 yr) | Legal duty | Continuous | Platform retention for the full 5-yr period; CA event-log export on request |
| DDS submission | Legal responsibility for accuracy | Per shipment | Submission via Epoch's TRACES integration as authorised representative if appointed |
Evidence depth is risk-proportional, per Articles 10.6 and 13:
- Article 9 obligations are not negotiable by risk. Plot polygons and the Article 9.1 information set are required at the same depth regardless of perceived risk.
- Articles 10 and 11 scale with risk. For sources benchmarked low-risk by the Commission under Article 29, simplified due diligence under Article 13(1) lifts the baseline Article 10 / 11 burden while keeping Article 9 in place. Article 13(2) snaps Article 10 and 11 back into force the moment the operator obtains substantiated concerns (Article 31) or any information pointing to non-compliance, and the Article 3 substantive prohibition (no deforestation, legal, with DDS) is never lifted.
- "Low risk" is a score, not a judgement call. Country-tier low-risk under Article 29 is a published Commission designation. Per-supply-base risk is the composite Article 10 score computed by Epoch (see full reference doc §5.5). Inspectors will defer to those numbers, not the operator's narrative.
Two Input Modes
What "plot" means. EUDR Article 2(27) defines a plot of land as "land within a single real estate property, as recognised by the law of the country of production, which enjoys sufficiently homogeneous conditions to allow an evaluation of the aggregate level of risk of deforestation and forest degradation associated with relevant commodities produced on that land". The "within a single" wording is a containment rule: a plot polygon cannot straddle two real-estate properties, but a single property can hold one plot or several (one per commodity, one per distinct homogeneous zone). In producer countries without a functioning cadaster or formal tenure, the Commission's FAQ 1.6 accepts producer-submitted geolocation of the de-facto productive unit: "the absence of a land registry or formal title should not prevent the designation of land that is de facto used as a plot of land." Operationally, Epoch works against that unit: the homogeneous, contiguous productive area of the target commodity (or, for cattle, the pasture).
The operator provides exact production plots — polygons for plots over 4 ha, point + plot-area for plots under 4 ha. Every check runs against the actual sourcing footprint.
The operator provides a single coordinate or navigable address: sawmill, palm mill, soy silo, washing station, slaughterhouse, cooperative buying centre. From that single point, Epoch generates a commodity-specific supply shed (a travel-time isochrone calibrated per commodity), detects every plot of the target commodity inside that shed directly from satellite imagery, and runs compliance checks across that detected set. Detected plots are included by default; the supplier reviews them and excludes the ones not in their supply chain (or those flagged for non-deforestation causes such as natural disturbance or non-agricultural infrastructure). The DDS is filed against the remaining in-chain plots. This screening-then-exclusion approach is more comprehensive and objective than relying on supplier-declared plot lists alone, particularly where per-supplier plot data is incomplete or of low integrity (smallholder networks, cooperative aggregation, informal first-mile chains).
The commodity-detection stack: Forest Data Partnership (FDP) layers for palm/cocoa/rubber/coffee, GLAD annual soy mapping for soy, Global Pasture Watch for cattle, and Epoch's harvest-event detection for timber.
Per-Commodity Supply-Shed Defaults
| Commodity | Default | Approx. one-way distance | First industrial aggregation point |
|---|---|---|---|
| Cattle | 180 min | ≈ 100–150 km | Slaughterhouse (state-licensed / SIE) |
| Soy | 120 min | ≈ 30–80 km | Grain elevator / trading post |
| Palm oil | 90 min | ≈ 50 km | Palm-oil mill |
| Timber | 180 min | ≈ 60–100 km | Sawmill |
| Rubber | 120 min | ≈ 60–80 km | Crumb rubber / RSS factory |
| Cocoa | 90 min | ≈ 22–40 km | Cooperative fermentation & drying centre |
| Coffee | 60 min | ≈ 25–35 km | Cooperative wet mill (washing station) |
Operators can override these defaults (long-haul transport, river-supplied basins, federally-licensed slaughterhouses) or substitute an administrative-jurisdiction boundary. Timber is a special case: the supply-shed pipeline detects harvest events (clear-cuts, selective cuts) over a configurable look-back window (default 1 year), and treats each detected harvest patch as a plot.
Initial Risk Screening
A single synchronous call returns five outputs across the supplier portfolio:
Location validation
Geometry hygiene, jurisdiction containment, commodity-presence checks, statistical implausibility (regular grids, cherry-picked clusters).
Crude deforestation check
30 m forest-loss screen against named, versioned reference datasets (full list and version pins in the Epoch technical / API documentation).
Article 10.2 risk assessment
Every Article 10 criterion is scored with one of three method classes: deterministic (pixel-level overlay against named, versioned datasets), LLM + grounding (open-web evidence aggregation for governance / corruption / human-rights signals — flags risk, never decides), or operator-supplied (FPIC documentation, certifications, internal traceability data).
Infrastructure risk
Proximity to roads, ports, processing infrastructure (OSM, GFW).
Natural-hazard exposure
Fire, flood, drought, landslide. Not a compliance signal; surfaced for forward-looking supply-continuity decisions.
The Article 10.2 composite score classifies each supply base into one of three tiers, which drives the evidence-collection burden:
Low
Simplified DD under Article 13 may apply where the country is Commission-benchmarked low-risk. Article 9 information still required.
Medium
Standard DD. Full Article 9.1(h) pack; Article 11 mitigation only for the specific flags that fire.
High
Enhanced DD. Primary documents preferred over proxies; recent audit cycles; active Article 11 mitigation; recurring re-assessment.
Risk categories and mitigation actions
Screening sorts every supplier and plot into a small, fixed set of categories on four independent axes, each mapped to a defined action. The axes are scored separately and never collapsed into a single number.
Deforestation (per plot, satellite verdict)
| Category | What it means | Operator action |
|---|---|---|
| Deforestation-free (green) | No post-2020 forest loss on the assessed plots. | Good to go. Reference in the DDS and audit trail. |
| Critical — supply-shed (red) | Non-compliant plots in the first-mile catchment; a meaningful share are expected false positives (wide catchment, natural loss, hazards). | Hold impacted batches. Supplier submits actual plot detail; exclude non-sourced plots with justification. |
| Critical — supplier plots (red) | Non-compliant plots on geometry the supplier declared as their own. | Hold. Supplier provides deforestation-free plot detail plus justification of exclusions / anti-mixing. |
| Not assessed | Geolocation too imprecise or low-confidence to screen. | Data-quality issue: resubmit better geolocation, reassess. |
A "critical" flag resolves through five pathways, in order of frequency in supply-shed mode:
- Exclusion via justification — supplier confirms the plot is not in their chain; it is dropped from the DDS, evidence in the audit trail. Dominates the resolution mix in supply-shed mode.
- Reclassification (sensing correction) — where Epoch's signal was wrong (cloud, regrowth, boundary artefact), the operator or supplier can reclassify the plot from non-compliant to compliant, basis recorded.
- Compliant case — real loss that is not EUDR Article 2(3) agricultural conversion (natural disturbance, non-agricultural infrastructure, managed-forest harvest); closes with evidence.
- Third-party verifier reports — accredited verifiers supply legality (Article 9.1(h)) and Article 10 evidence into the audit trail.
- Supplier substitution — the only route for confirmed in-chain post-2020 conversion (no in-situ remediation under Article 9(1)(d)).
Article 10 risk (procedural composite, per supply base)
| Tier | Operator action |
|---|---|
| Low | Standard due diligence is sufficient. |
| Medium | Enhanced DD; scrutinise supplier documentation and sourcing claims. |
| High | Rigorous DD; seek added supplier evidence and confirm Article 11 mitigation before market placement. |
| Not assessed | No valid country/address; resolve and reassess. |
Legality risk (Article 9.1(h) adverse-media, producer-attributable)
Distinct from the Article 10 composite above. Article 10 risk is built from country-level governance datasets (CPI, WGI, sanctions, conflict). Legality risk is sourced from open-web adverse media — news reports, court records, enforcement actions, NGO investigations — and attaches to the producer, not the country. It is assessed against the eight Article 2(40) law categories: land-use rights, environmental protection, forest rules (including biodiversity), third parties' rights, labour rights, human rights, free prior and informed consent, and tax, anti-corruption, and trade and customs law. This obligation is never waived: Article 9.1(h) applies even for Commission-benchmarked low-risk countries where Article 10 and 11 are lifted under Article 13(1).
| Level | What it means | Evidence to clear |
|---|---|---|
| Low | No adverse-media coverage tied to the producer across the eight Article 2(40) law categories. | Good to go. Standard Article 9.1(h) documentation applies. |
| Medium | Adverse-media coverage exists at a national or sub-national level for this country and commodity but does not name this producer directly. | Collect Article 9.1(h) legality evidence across the applicable law categories, proportionate to the medium tier. Where a specific category is flagged, prioritise evidence for that category. |
| High | A verified adverse-media source names this producer in a specific allegation tied to one or more of the eight Article 2(40) law categories. | Supplier provides documents that directly address the flagged legality-risk category. The specific Article 2(40) law category is identified in the platform. |
| Not assessed | No valid producer address to screen. | Resolve producer detail, then reassess. |
EU country tier (Article 29). Commission-benchmarked low-risk countries route to simplified due diligence under Article 13(1), which lifts the Article 10 and 11 burden. Article 9 — including legality — remains in full force. The tier is a routing gate, not a score added to the three axes above.
Full-Resolution Deforestation Checks
A 10 m multi-source ensemble run against the 31 December 2020 cutoff:
GLAD-L, GLAD-S2, RADD (Sentinel-1 radar, cloud-penetrating), OPERA DIST-ALERT (NASA, Harmonized Landsat–Sentinel-2).
One annual institutional product: JRC TMF. One Epoch-operated time-series breakpoint detector: CCDC (Zhu & Woodcock 2014).
Each pixel of forest change reports the count of systems in agreement and a derived confidence band. The natural-forest reference mask combines DeepMind Natural Forest of the World (10 m) and JRC TMF (30 m); managed-forest tenure-exemption layers for 19 jurisdictions are applied. Every dataset version used is logged in the audit trail so any result can be reproduced under audit months later.
Managed-forest tenure-exemption jurisdictions (19)
Supplier Engagement
Two triggers escalate from automated checks to direct supplier engagement.
Elevated Article 10 risk fires before full-resolution analysis. The operator engages on the relevant category (governance, FPIC, sanctions, labour, supply-chain integrity). Sanctions matches are a stop-the-line.
Specific plots fail the 10 m check. Engagement is per plot: the supplier provides justifications for exclusion or non-compliance rebuttal.
Engagement happens in-platform: requests are templated per Article 10.2 category, sent with the relevant evidence pack pre-attached; responses (geojson, PDF, free text) are captured back into the audit trail. The full doc carries an operator evidence reference table mapping each evidence category (plot polygons, legality documents, third-party audit reports, sanctions screening, FPIC records, certifications, mitigation artefacts) to its Article-and-tier requirement, primary vs. acceptable-proxy form, and upload path (flag-driven engagement thread or standalone operator-initiated upload).
Audit Trail and DDS Submission
Every operation against a DDS — initial screening, full-resolution check, supplier engagement, justification upload, exclusion decision, final DDS export — is logged with UTC timestamp, dataset versions, geometries (input and derived), and provenance labels (deterministic vs. probabilistic). Compliance status is computed from the trail rather than stored as a flat field, so status and evidence cannot drift apart. Operators can attach standalone supporting documents to the audit trail at any time — legacy evidence packs, third-party assessments, internal compliance memos — so anything that backs the DDS but isn't formally submitted to TRACES has one home.
Epoch pre-validates the geojson and the Article 9.1 fields against the TRACES schema; either operator-signed (the operator controls the submission) or on-behalf-of (Epoch submits as authorised representative and returns the reference + verification number). The audit trail is retained for the full 5-year Article 12 period and is exportable on competent-authority request.
Deterministic vs. AI-Assisted: The Division of Labour
Compliance verdicts are always produced by deterministic rules. Pixel-level overlay against named, versioned datasets (JRC TMF, GLAD L/S2, RADD, OPERA DIST, CCDC), with a uniformly-applied natural-forest mask. Any inspector can re-run a single plot from the same inputs and reach the same verdict.
AI-assisted components flag risk for engagement; they never decide compliance. Open-web evidence aggregation for Article 10.2 (h)(l)(m) (corruption, sanctions, news-based concerns) is surfaced separately with citations to dated, geographically-relevant sources. The Method column on the Article 10.2 table labels every criterion's provenance, so the basis of every flag is legible at the point it is raised.
Commodity Quick Reference
| Commodity | EUDR readiness | Structural problem | Key national / industry rails |
|---|---|---|---|
| Soy | Medium | Sub-national risk concentration (Trase); early mixing at country/terminal elevators | CAR (Brazil), AFIP (Argentina), RTRS, Donau Soja / Europe Soya |
| Timber & pulp | Medium, high variance | Broadest product scope (logs → furniture); industrial plantations vs. natural-forest concessions | SVLK (Indonesia), DOF / Sinaflor+ + CAR (Brazil), FLEGT TLAS, FSC / PEFC |
| Cattle | Low–medium | Birth → rearing → finishing → slaughter on different farms; indirect-supplier traceability gap | GTA, SISBOV, CAR (Brazil); NLIS (Australia); SENASA (Argentina); National RFID (Uruguay) |
| Rubber | Low–medium | 80–85% smallholder-grown; cup-lump vs. latex drive different shed sizes; West Africa scaling rapidly | GPSNR, FSC / PEFC, Rainforest Alliance, Fair Rubber Association; RAOT (Thailand) |
| Coffee | Medium | Wet vs. dry processing splits the geography; smallholder-dominated | FNC (Colombia), eATTS (Ethiopia), CONAB (Brazil), UCDA (Uganda); Rainforest Alliance, 4C, Fairtrade |
| Cocoa | Medium | West-African concentration; cooperative-level deforestation hot-spots; first-buyer (not first-farmer) documentation | GCTS (Ghana), SYDORE (Côte d'Ivoire), CFI, Rainforest Alliance, Fairtrade |
| Palm oil | Medium–high | Smallholder polygons missing in Indonesia/Thailand; pre-refinery mixing; peatland exposure | RSPO (10.2(n) evidence base), Universal Mill List, Trase; MPOB (Malaysia), GAPKI (Indonesia), Fedepalma (Colombia), NDPE |
Top FAQs
The full reference carries the full FAQ set. The shortlist operators ask most often.
Ready for EUDR Compliance?
Start verifying your supply chain with satellite-backed deforestation checks and first mile intelligence today.
The Epoch EUDR Compliance Process — Executive Overview. For the full methodology, per-criterion detail, per-commodity operational notes, full FAQ set, glossary, and source citations, see The Epoch EUDR Compliance Process (full reference).