EUDR risk assessment for timber: how importers are expected to evaluate suppliers

For timber importers, the EUDR risk assessment is not a paper exercise. Regulation (EU) 2023/1115 expects us to show how we checked the origin of the timber, how we assessed the risk of deforestation or illegality, and what we did when the information from suppliers did not hold together. The practical work sits with the importer placing timber on the EU market. Suppliers help, but the liability does not move upstream.

What the regulation expects from importers

The timber sector moves into scope on 30 December 2026. Unlike some other sectors, there is no separate SME grace period for timber operators. By the time goods are placed on the market, the due diligence system must already work in practice.

Under EUDR, we need three things before placing timber products on the EU market:

Information collection
Risk assessment
Risk mitigation where risk is more than negligible

The due diligence statement (DDS) must be filed in TRACES before the goods are placed on the market or exported. Authorities can request the underlying evidence later, and records must be retained for five years.

Most importers already collect supplier declarations, harvest permits, invoices, transport papers, and species lists. EUDR raises the standard because the assessment must connect the product to a specific plot of land and evaluate deforestation risk against that location.

What information we should expect from suppliers

The starting point is basic traceability. If the supplier cannot map a shipment back to harvest plots, the discussion usually ends there.

For timber products, suppliers should normally provide:

Scientific and trade names of species
Country of harvest
Geolocation coordinates for harvest plots
Date or time range of production and harvest
Quantity information
Documents showing legal harvest rights and compliance with local laws
Supply chain traceability from forest to export

The geolocation requirement causes most of the operational work. For plots above 4 hectares, importers are expected to hold polygon coordinates. For plots smaller than 4 hectares, a single point coordinate may be used. In practice, many suppliers still send spreadsheet coordinates with no indication of plot boundaries, no coordinate format, and no proof that the site relates to the harvested timber.

We have found it useful to standardise intake early. A fixed supplier template reduces back-and-forth. Coordinate format, species naming, concession references, and shipment identifiers should match exactly across documents.

How authorities are likely to view supplier evidence

EUDR does not require blind trust in supplier paperwork. Importers are expected to evaluate credibility. That means checking whether the documents make sense together and whether the origin data aligns with external information.

Authorities will probably focus on issues such as:

Coordinates that fall outside forest concessions
Plots located inside protected areas
Species volumes inconsistent with concession capacity
Documents reused across multiple shipments
Harvest dates that do not match transport records
Missing chain-of-custody links between sawmill and exporter

The free JRC Global Forest Cover map is expected to become one of the standard reference tools. Importers do not need advanced GIS departments, but we do need a repeatable process for checking whether coordinates correspond with forest cover and whether recent land-use change appears visible.

The country benchmarking system also matters. The European Commission classifies countries by risk level. A low-risk classification does not remove the need for due diligence, but it changes the level of scrutiny expected. Higher-risk origins will require more detailed assessment and usually more supporting evidence.

What a practical risk assessment looks like

Most timber importers already segment suppliers internally. EUDR pushes that process into a formal structure.

A workable assessment normally combines country risk, supplier performance, product type, and traceability quality. We should avoid treating all suppliers from one country the same way. Some concession operators maintain detailed GIS records and third-party audit trails. Others provide scanned permits with no harvest linkage.

In practical terms, a risk review often includes:

Checking geolocation data against satellite or mapping tools
Reviewing harvest rights and concession validity
Comparing species and volumes against concession data
Reviewing corruption and illegal logging exposure in the region
Testing whether supply chain documents connect cleanly
Reviewing previous non-compliance or enforcement history

The regulation uses the standard of “negligible risk”. That is a high threshold. If major gaps remain unresolved, the shipment should not move forward under the DDS.

Several importers are already separating suppliers into operational categories. For example, low-risk suppliers with stable concession sourcing may receive annual full reviews with shipment-level checks. Higher-risk suppliers may require review on every shipment, including polygon validation and additional legality evidence.

Where importers usually run into problems

The biggest issue is inconsistent upstream traceability. Tropical timber supply chains often pass through traders, processors, and exporters before reaching Europe. Somewhere along that chain, harvest plot detail gets diluted.

Mixed loads create another problem. If one container contains timber from many small plots, the geolocation dataset becomes large very quickly. Some operators still rely on PDF attachments and email chains. That approach becomes difficult once customs checks start at scale.

Species substitution also deserves attention. If invoices state one species while sawmill records show another commercial grouping, the inconsistency can trigger further review. Customs authorities and competent authorities will likely compare trade flows against known production patterns.

There is also a tendency to overestimate certification. FSC or PEFC certification may support a risk assessment, but certification alone does not replace EUDR due diligence. Importers still need geolocation data and their own assessment process.

Risk mitigation in practice

When risk is more than negligible, the importer must mitigate it before placing the goods on the market.

That can include:

Requesting corrected or expanded geolocation data
Obtaining independent legality verification
Using satellite analysis for land-use review
Conducting supplier audits
Reducing sourcing to verified concessions only
Suspending suppliers that cannot support traceability claims

Some importers are already revising contracts to make EUDR data delivery mandatory before shipment loading. That is sensible. Once cargo reaches the EU border, missing coordinates become an operational problem very quickly.

The regulation also carries meaningful penalties. Member States can impose fines of at least 4% of EU turnover. Authorities may also confiscate goods or revenues and exclude companies from public procurement procedures. Those measures move EUDR into the category of board-level compliance risk.

Preparing the business before 2026

The companies in the best position today are usually the ones that started mapping suppliers early. The technical side can be solved. The slower part is supplier alignment.

Most importers should already be testing:

How geolocation data enters internal systems
Who validates coordinates and documents
How DDS submissions will be managed in TRACES
Which suppliers create the highest unresolved risk
How evidence will be retained for five years

There is also a staffing point that often gets missed. EUDR work sits between procurement, compliance, logistics, and IT. If ownership is unclear, shipments stall while teams argue about responsibility.

For timber traders with broad sourcing portfolios, it is usually worth building a documented review workflow now rather than waiting for enforcement practice to settle. Authorities will expect importers to show a functioning process, not improvised email folders assembled after the fact.

goEUDR provides a managed filing service for companies preparing EUDR due diligence statements and supplier documentation workflows. That includes support for TRACES submissions, geolocation handling, and evidence organisation for timber imports.

This article is general information only and does not constitute legal advice. Importers should review their obligations under Regulation (EU) 2023/1115 with qualified legal and compliance advisers.