Do FSC, RSPO or Rainforest Alliance certification satisfy EUDR due diligence?

No. FSC, RSPO, Rainforest Alliance, PEFC and every other certification or third-party verified scheme can support an EUDR risk assessment, but none of them replaces the due diligence statement, the plot-level geolocation, or the operator's legal liability. Article 10(2) lets you "take into account" certification evidence — it does not let you substitute it for your own due diligence system.

Why this question keeps coming up

Certification schemes were built for a different job. FSC verifies forest management against its own standard; RSPO verifies palm oil production against its principles and criteria; Rainforest Alliance and PEFC do the same for their respective scopes. All of them predate the EUDR, none of them was designed around Regulation (EU) 2023/1115's specific requirements, and none of them issues a due diligence statement or files anything in TRACES on an operator's behalf.

A supplier handing over an FSC or RSPO certificate and calling it "EUDR-ready" is one of the most common gaps compliance consultants report finding in 2026 gap analyses. It is an understandable mistake — the schemes genuinely do verify sustainable sourcing — but it is not what the regulation asks for.

What Article 10(2) actually allows

Article 10 of Regulation (EU) 2023/1115 sets out the risk assessment every operator and, where simplified due diligence does not apply, trader must carry out before placing a relevant product on the EU market. Article 10(2) lists the criteria that assessment has to weigh, and point (n) lets you bring in "complementary information on compliance with this Regulation," including information from certification or other third-party verified schemes, as one input among several.

That is the full extent of the role certification plays. It can:

• Feed into the risk assessment as supporting evidence for a supply chain's legality or deforestation-free status.
• Reduce the verification burden where a scheme's audit trail overlaps with the data you would otherwise have to gather yourself.
• Strengthen your file if a competent authority later questions your risk assessment.

It cannot replace the due diligence statement, remove the need for the information Article 9 requires you to collect, or shift legal responsibility away from the operator placing the product on the market. The regulation is explicit that certification schemes "should not substitute the operator's responsibility as regards due diligence." No certification scheme currently holds any formal recognition or safe-harbour status under the EUDR — there is no equivalent of the "recognised voluntary scheme" status that exists under the Renewable Energy Directive for biofuels.

The four gaps every scheme shares

Independent gap analyses comparing FSC, RSPO, Rainforest Alliance and PEFC against the EUDR's own requirements converge on the same four shortfalls, whichever scheme you hold:

• Cut-off date misalignment. The EUDR requires deforestation-free production after 31 December 2020. Certification audit cycles do not verify against that specific date — a forest management unit certified in 2024 was not necessarily checked against what was growing on each plot on 31 December 2020.
• No plot-level geolocation. Schemes certify a forest management unit, a mill, or a grower group — not the geolocation of every individual plot of production the EUDR's Article 9 and geolocation rules require, down to a single point or polygon per plot over 4 hectares.
• Incomplete legality scope. A scheme's legality checks rarely map one-to-one onto the "relevant legislation" test in Article 2(40), which covers land use, environmental, forest, third-party rights, labour, human rights, tax, anti-corruption, trade and customs law in the country of production.
• No transfer of liability. Whatever a certifier has audited, the operator who places the product on the EU market carries the legal obligation and the penalty exposure if something is wrong. A certifier's audit report does not become a legal shield.

One widely cited 2024 comparison against 24 compliance indicators found FSC, the highest-scoring scheme, covering only around 58% of them. RSPO, Rainforest Alliance and PEFC scored lower still. None of this makes the schemes worthless — it means they close part of the gap, not all of it.

What the Commission is actually building

In its 4 May 2026 simplification report (COM(2026) 191 final) the European Commission confirmed it will not create a list of certification schemes that satisfy EUDR due diligence outright. Instead it committed to a web-based repository of certification and third-party verified schemes, populated by the scheme owners themselves, setting out transparently what each scheme does and does not cover against the regulation's requirements. The Commission expects the repository to be available by December 2026.

The repository is a transparency tool, not an approval list. It will tell you what a scheme claims to verify so you can judge how much of your risk assessment it genuinely supports — it will not create a scheme whose certificate you can submit instead of a due diligence statement. Treat any supplier or consultant claiming otherwise, before or after the repository launches, with scepticism.

What you still have to do, certified or not

Holding a certified supply chain does not change which of the core obligations apply to you — only how much work the risk assessment step takes.

Obligation	Still required with certification	What certification can help with
Collect Article 9 information (product, quantity, supplier, plot geolocation, proof of legal production)	Yes, in full	Can shorten supplier questionnaires where the audit trail already covers legality
File a due diligence statement in TRACES (or the simplified declaration, if you qualify)	Yes, always	No effect — no scheme files a DDS for you
Carry out a risk assessment under Article 10	Yes, unless simplified due diligence applies	Certification evidence is one input to the assessment under Art. 10(2)(n)
Confirm no substantiated concern on the specific supply chain	Yes	A clean audit history can support this conclusion
Five-year record retention	Yes	No effect
Legal liability for non-compliance	Stays with the operator	Not transferred by any certificate

If every country of origin for your product is benchmarked low risk, you can skip the risk assessment and mitigation steps entirely under Article 13 — that exemption comes from where you source, not from any certificate. EUDR country benchmarking explained sets out which countries currently qualify, and it is worth checking before you spend money chasing certification as a compliance shortcut.

Does this differ by commodity?

The underlying rule is the same across all seven EUDR commodities, but the practical weight of certification varies. Palm oil has the most developed scheme in RSPO, and a large share of EU-bound volume already moves through it; EUDR for palm oil traders and refiners covers what tracing crude and refined oil to source still requires beyond an RSPO certificate. Timber and wood products have the deepest FSC and PEFC penetration of any EUDR commodity, and the EU Timber Regulation's repeal makes the gap especially visible for importers who assumed FSC chain-of-custody already did the job; see EUDR for furniture and timber importers after the Timber Regulation repeal. Cocoa, coffee, soya and rubber each have narrower or more fragmented certification coverage, so the gap tends to be larger in practice, not smaller.

If you already hold certification

Use it, but use it correctly. Keep the certificate and the underlying audit reports on file as supporting evidence for your risk assessment. Map what the scheme actually checked against the EUDR's own list in Article 9 and Article 10(2), and treat anything it did not check — almost always the 31 December 2020 cut-off date and plot-level geolocation — as a gap you still have to close yourself, through your supplier data and your own documented risk assessment. Then file the due diligence statement itself in TRACES; see how to submit an EUDR due diligence statement step by step for the mechanics. Getting this wrong carries real exposure — EUDR penalties apply to a certified supply chain exactly as they apply to an uncertified one.

Run the free checker to see which of your obligations a certification can genuinely support, and which ones you still have to meet yourself, based on your actual role, size and sourcing countries rather than a general rule of thumb.

FAQ

Can I submit my FSC or RSPO certificate instead of a due diligence statement? No. Every relevant product placed on the EU market needs its own due diligence statement, or the Article 4a simplified declaration if you specifically qualify for it. A certificate is never an accepted substitute, whatever the scheme.

Does certification at least reduce how much due diligence I have to do? It can reduce the practical burden of the risk assessment step, because a scheme's audit evidence can serve as Article 10(2)(n) supporting information. It does not reduce the information you must collect under Article 9, and it has no effect on the filing requirement itself.

Is there an official list of EUDR-recognised certification schemes? Not yet, and the Commission's 4 May 2026 report confirmed there will not be an approval list in that sense. It committed instead to a transparency repository, populated by the scheme owners, expected by December 2026, describing what each scheme covers rather than certifying that it satisfies EUDR due diligence.

What exactly does a certification scheme usually fail to cover? Four gaps recur across FSC, RSPO, Rainforest Alliance and PEFC: none verifies specifically against the EUDR's 31 December 2020 deforestation cut-off date, none captures plot-level geolocation to the precision Article 9 requires, legality scope rarely matches Article 2(40)'s full list, and none transfers legal liability away from the operator.

If my supplier is certified, am I still liable if something goes wrong? Yes. Liability under the EUDR sits with the operator who places the product on the EU market, not with the certification body or the supplier's certifier. A clean certificate does not change who faces the penalty if a competent authority finds the due diligence statement deficient.

Does this apply equally to large and small operators? Yes. The requirement to carry out due diligence, and the limit on what certification can substitute for, does not vary by size. What does vary by size is the simplified declaration under Article 4a, available only to micro and small primary operators sourcing from low-risk countries — a separate mechanism from certification entirely.

Will the Commission's planned repository change any of this before December 2026? No. The repository is a transparency tool describing scheme coverage; it does not change the legal requirement to file a due diligence statement or to meet Article 9's information requirements. Treat any claim that a specific certificate will satisfy EUDR due diligence once the repository launches as incorrect.

Does simplified due diligence under Article 13 depend on certification? No. Article 13 depends entirely on whether every country of origin for the product is benchmarked low risk, not on whether the product is certified. A certified product from a standard or high-risk country still requires the full risk assessment.