EUDR Article 31 substantiated concerns: how to submit one

A substantiated concern under Article 31 of Regulation (EU) 2023/1115 is a reasoned, evidence-backed claim that a named operator, downstream operator or trader is not complying with the EUDR. Anyone — a competitor, an NGO, a local community, an employee — can submit one, either to a competent authority or directly to the business concerned, and the recipient is legally obliged to act on it, not just acknowledge it.

What counts as a substantiated concern

The regulation sets a deliberately low bar on who can file and a deliberately high bar on what they must bring. A substantiated concern has to be a duly reasoned claim, based on objective and verifiable information, that points to non-compliance — not a suspicion, a tip-off, or a general allegation about a sector or country. The Commission's EUDR guidance gives examples of what that evidence base looks like in practice: satellite-derived forest cover data showing clearance on a specific plot after the 31 December 2020 cut-off, land registry or concession records inconsistent with a supplier's claimed production area, documented testimony from people with direct knowledge of a supply chain, or an audit finding that was not followed up.

A concern does not have to prove non-compliance to qualify — that is what the resulting assessment is for. It does have to let the recipient reconstruct the reasoning: which product, which operator or trader, which plot or supply chain, and why the evidence points to a problem. A concern that cannot be traced to a specific consignment or production area is unlikely to meet the threshold, however genuine the underlying worry.

Who can submit one, and to whom

Any natural or legal person can submit a substantiated concern. In practice this has meant NGOs and environmental monitoring groups, local and Indigenous communities affected by land use near a production area, competitors with supply-chain visibility into a rival's sourcing, and individuals including employees or former employees of an operator or trader.

There are two routes, and they trigger different obligations:

• To a competent authority in the Member State where the operator or trader places products on the market, or where it is established. The authority itself must assess the concern.
• Directly to the operator, downstream operator or trader named in the concern. The business itself then has to investigate, not simply forward the complaint and wait.

Filing with the business first does not exhaust the option of filing with the authority too, and a concern sent to one does not stop a parallel approach to the other. Our TRACES filing guide covers the due diligence statement process a concern ultimately tests; this is the mechanism that can reopen that file after submission.

What a competent authority must do on receipt

Once a competent authority receives a substantiated concern, it must assess the claim's merits without undue delay, and do so diligently and impartially — it cannot dismiss a concern because the filer is a competitor or an advocacy group rather than, say, a customer. Assessment can include document requests, interviews, and checks that go beyond the authority's routine annual sampling.

A credible concern is one of the few things that can bring forward a check outside a business's normal risk-category cycle. Our inspections guide sets out how the ordinary 9%/3%/1% annual check targets work by country risk category; a substantiated concern sits outside that quota entirely; it is additional, not a slice of it.

Where the assessment turns up a high risk of non-compliance, the authority can use its interim-measures power under Article 23 of the regulation to suspend the product's placing on the market, or ask customs to hold it at the border, while it finishes checking. That is a separate, later-numbered provision from Article 17, which deals with the authority's obligation to act immediately once a check under Article 16 has flagged a relevant product — the two are often run together in commentary, but a substantiated concern feeds into the Article 16/17 check process, with Article 23 as the power the authority then reaches for.

The 30-day feedback rule

The authority must tell the person who submitted the concern what it did about it, within 30 days of receipt, unless the Member State's own national law sets a different procedure. That feedback has to cover whether an investigation was opened or closed, and the reasoning behind that decision — not merely that the concern was "received" or "under review".

This matters for a filer deciding whether to escalate. A concern that gets no substantive reply inside 30 days, or a reply that does not explain the authority's reasoning, is itself something the filer can raise with the authority's own oversight body or, in principle, under the Member State's administrative review procedures.

Confidentiality and whistleblower protection

Member States must protect the identity of a person who submits a substantiated concern, and of anyone who investigates one, in line with Directive (EU) 2019/1937 — the EU's general whistleblower protection law. In practice this means an authority should not disclose who raised a concern to the business it concerns without that person's agreement, and retaliation against an employee who reports in good faith is unlawful under the same directive, independent of anything the EUDR itself says.

A filer who wants to stay anonymous to the business, but not to the authority handling the claim, should say so explicitly when submitting — authorities vary in how proactively they offer this, and national whistleblower bodies can usually advise on the specific procedure.

What happens if the concern is sent straight to you

If your business receives a substantiated concern directly, rather than through a competent authority, you are not free to treat it as an unverified complaint to be noted and set aside. The obligation mirrors what Regulation (EU) 2025/2650 already expects of non-SME downstream operators and traders who come across any information suggesting non-compliance in their own supply chain:

Step	What it requires
Suspend	Stop placing the specific affected product on the market, or making it available, while you check the claim
Verify	Review the due diligence statement, geolocation and supporting evidence behind the product against the concern raised
Notify	Tell the competent authority in the Member State concerned that you have received the concern and what you are doing about it
Resume, or don't	Only place the product back on the market once you can show the risk is negligible; if you cannot, it stays suspended

Our risk assessment guide covers the Article 9/10 analysis a concern forces you to redo for the product in question, and our downstream operators and traders guide covers the wider notification duties that apply once you are a non-SME operator or trader further down the chain.

Doing nothing is the one option not available. A substantiated concern you received and ignored is, on its own, evidence that your due diligence system failed to respond to information it should have acted on — which is a worse position in a subsequent competent authority check than the underlying concern itself might have been.

How a substantiated concern differs from a routine check

A routine check follows a competent authority's annual plan, built on country risk category and the Commission's indicative risk criteria. A substantiated concern follows evidence about one named business, submitted by someone outside the regulatory system, and it can reach any operator or trader regardless of risk category or whether that business has ever been checked before.

The concern itself is a trigger, not a finding. Filing one does not establish non-compliance, and a business that receives one has not been found to have broken any rule — it has been given information it is now required to test. What follows a confirmed breach — corrective action under Article 24, or penalties under Article 25 — is the same regardless of whether the breach was first identified by a routine check or by a substantiated concern. Our penalties guide covers what a confirmed breach actually costs once that stage is reached.

If you are considering filing one

Gather the specifics before you submit: the product and, where possible, its CN code; the operator or trader's name; the plot, concession or supply-chain stage the evidence relates to; and the source of your evidence, with enough detail that the recipient can check it rather than take your word for it. A concern framed as a general allegation about a sector or a country, rather than a specific business and consignment, is far less likely to meet the "duly reasoned" threshold the regulation sets.

Decide at the outset whether you are filing with the competent authority, the business, or both, and whether you want your identity disclosed to the business under investigation. If you are unsure which Member State's authority has jurisdiction over the business you are concerned about, that depends on where it places products on the EU market or is established, not where you yourself are based.

If you are on the receiving end instead, and you are not yet sure whether your business is in scope of the EUDR at all, or which deadline applies to you, our free checker will tell you in a few minutes — worth knowing before a concern arrives, not after.

FAQ

Who can submit an EUDR substantiated concern?

Any natural or legal person — an individual, a competitor, an NGO, a community group, or a current or former employee. The regulation does not require the filer to be directly affected by the non-compliance alleged.

What makes a concern "substantiated" rather than just a complaint?

It has to be a duly reasoned claim based on objective, verifiable information — evidence a recipient can check, such as satellite forest-cover data, land records, or documented testimony — tied to a specific product, business and production area, not a general allegation.

Can I submit a concern anonymously?

Member States must protect the identity of the person who submits a concern and anyone who investigates it, in line with the EU's whistleblower protection directive. Say explicitly at submission whether you want your identity withheld from the business concerned.

How long does a competent authority have to respond?

It must inform you of the follow-up — whether an investigation was opened or closed, and why — within 30 days of receiving the concern, unless the Member State's own procedure sets a different timeframe.

What happens if my business receives a substantiated concern directly?

You must suspend placing the affected product on the market, verify the claim against your due diligence records, notify the competent authority, and only resume once you can show the risk is negligible.

Does filing a substantiated concern mean the business has broken the rules?

No. It is a trigger for assessment or investigation, not a finding. Non-compliance still has to be established before corrective action or penalties follow.

Can a substantiated concern trigger a check outside the normal inspection cycle?

Yes. It sits outside the annual risk-based check targets entirely and can bring forward a check on any operator or trader regardless of its country risk category.

Is there an EU-wide register of substantiated concerns that have been filed?

No public EU-wide register exists. Concerns are handled by the competent authority in the relevant Member State, or by the business concerned, and there is no harmonised public disclosure requirement for the fact that one was filed.