EUDR competent authority inspections: what they check and what to have ready

A competent authority check examines the due diligence statement you filed and the system behind it: plot-level geolocation, chain of custody back to the plot, the risk assessment that justified your conclusion, and legality evidence for the country of production. Checks are risk-based rather than random, can be announced or unannounced, and every Member State must check a minimum share of trade from each risk category every year. Most are desk checks of documents filed through the EU information system; some become on-site visits.

Who actually carries out the checks

Each Member State designates its own competent authority under Article 14 of Regulation (EU) 2023/1115, and enforcement structure varies. Germany's checks run through the Bundesanstalt für Landwirtschaft und Ernährung (BLE), which operators upload evidence to through its own service portal. The Netherlands uses the Nederlandse Voedsel- en Warenautoriteit (NVWA), which ran pilot inspections across 20 operators in several sectors before the main application date, then published the gaps it found. There is no single EU-wide inspectorate: you deal with the authority in the Member State where you place products on the market or export from, and its procedure, portal and language are its own.

Authorities are not working in isolation. The EU information system that holds your due diligence statement also gives every competent authority visibility of reference numbers, verification numbers and the geolocations attached to them, so a check in one Member State can draw on filings made anywhere in the EU.

How often you actually get checked

Article 16 obliges every competent authority to run an annual check plan and to hit minimum quantified targets, set against the risk category of the country or area of production:

Country risk category	Minimum share of relevant operators/trade checked each year
High risk	9%
Standard risk	3%
Low risk	1%

These are floors, not caps — an authority can check more, and will if it has reason to. Plans must build on indicative risk criteria the Commission sets at EU level and always cover high-risk countries specifically, on top of the authority's own national risk criteria. See our country benchmarking guide for how a country ends up in each category and what that does to your own due diligence obligations.

Selection is not limited to the annual plan. An authority must also check whenever it receives relevant information pointing to a specific risk, including a substantiated concern submitted by a third party — a competitor, an NGO, or a member of the public — under Article 31. A credible, well-evidenced concern about a named operator's supply chain can trigger a check outside the ordinary cycle, regardless of that operator's risk category.

What a check actually looks at

A competent authority check is not a re-run of the automated validation TRACES performs when you submit a due diligence statement. That automated step only confirms the filing is complete — a reference number and verification number, nothing more. A check goes behind the filing to the due diligence system that produced it:

• The due diligence statement itself — reference number, verification number, and whether the product description, CN code and quantity match what actually moved.
• Geolocation data — plot polygons for production units above four hectares, points for smaller ones, and whether the coordinates plausibly correspond to the product and country claimed. Our geolocation guide covers what counts as a valid plot record.
• Chain of custody — can you trace the consignment back from your own stock to the specific plot(s) it came from, through every intermediary, without a gap?
• The risk assessment — the Article 9 information you collected and the Article 10 analysis built on it: country and area risk, supplier record, complexity of the supply chain, and the deforestation-free conclusion drawn from them. Our risk assessment guide sets out what authorities expect to see at this stage.
• Legality evidence — proof the product complies with the production country's land use, environmental, labour, tax, human rights and FPIC (free, prior and informed consent of indigenous peoples) laws, not only that it is deforestation-free. A supplier's one-line self-declaration does not satisfy this on its own; the pilot inspections run in the Netherlands flagged exactly this gap as common.
• Your due diligence system as a whole — a documented standard operating procedure that shows due diligence was actually carried out on this consignment, not a generic policy that exists but was never applied.

Documents and records to have ready

What an inspector asks to see is, in practice, the file your due diligence system should already be producing for every consignment. At minimum, keep ready:

• The due diligence statement, reference number and verification number for each relevant consignment.
• Supplier contracts and correspondence establishing the plot(s) of production.
• Geolocation records in the format Article 9 requires.
• Your written risk assessment and any mitigation measures applied.
• Legality evidence for the country and commodity concerned.
• Records showing who in your organisation carried out the due diligence and when.

Records must be kept for at least five years from the date the statement was submitted, and must be produced on request — our record-keeping guide sets out the full retention rule. Operators and traders are required to give inspectors all necessary assistance, including access to premises, systems and records; refusing or obstructing a check is itself treated as a form of non-compliance.

Desk checks versus on-site visits

Most checks start as desk checks: the authority requests your due diligence statement, supporting documents and system records, and reviews them without visiting. Article 16(13) allows some checks to be carried out with advance notice to the operator, but the authority must justify that choice in its own check report — unannounced checks are the default assumption, not an exception you can rely on.

A desk check that raises concerns, or a high-risk classification, or a substantiated concern under Article 31, can escalate to an on-site visit: physical inspection of premises, records and, where relevant, the goods themselves. Authorities can also use cross-checks against independent data — satellite-derived forest cover data such as the Commission's reference map is explicitly recognised as meeting the regulation's forest definition, which gives an inspector an external benchmark to test your plot coordinates against, independent of anything you submitted yourself.

What happens if a check finds a problem

Where a check identifies a high risk of non-compliance, Article 17 lets the authority take immediate interim measures — suspending the product's release onto the market or its export while further checks are carried out, including asking customs to hold a shipment. Where non-compliance is confirmed, Article 24 requires the authority to order corrective action: fixing formal gaps, preventing the product being placed on the market, withdrawing or recalling it, or, where withdrawal isn't possible, having it donated or disposed of under EU waste law. If you miss the deadline the authority sets for corrective action, it can carry the measures out itself at your cost.

Fines, confiscation, procurement exclusion and market bans sit under Article 25, separately from the check itself — our penalties guide covers what non-compliance actually costs once a check has gone against you.

Getting ready before a check happens

The NVWA's pilot findings and the German BLE's published expectations point the same way: authorities are not looking for a perfect record, they are looking for evidence that due diligence was actually done, consignment by consignment, and can be reconstructed on request. A policy document that was never applied to a real shipment fails a check as surely as no policy at all. If you have not yet worked out which deadline applies to your business, or whether you are in scope at all, our free checker will tell you in a few minutes, based on your size, products and supply chain, before you need to think about what an inspector will ask for.

FAQ

How likely is my business to actually be checked?

It depends on the risk category of your country or area of production, not your business's own size or history. Authorities must check at least 9% of trade from high-risk countries, 3% from standard-risk, and 1% from low-risk, every year, plus anything flagged by a substantiated concern or other specific risk information.

Can a check happen without warning?

Yes. Unannounced checks are the norm; advance-notice checks are the exception an authority has to justify in its own reporting under Article 16(13).

Does a validated TRACES submission mean I have passed a check?

No. The reference and verification numbers TRACES returns only confirm your filing is complete and internally consistent — they are not a finding that your due diligence is correct. A competent authority check goes behind the filing to the evidence and reasoning behind it.

What happens if an inspector asks for something I do not have?

You are required to give the authority all necessary assistance, including access to records and premises. A missing document is treated as a gap in your due diligence system, which can trigger corrective action under Article 24; refusing access altogether is treated as non-compliance in its own right.

Can a competitor or NGO trigger a check on my business?

Yes. Anyone can submit a substantiated concern under Article 31, and a competent authority must assess it. A well-evidenced concern can bring forward a check regardless of your risk category or your position in the annual plan.

Does certification (FSC, RSPO, Rainforest Alliance) mean I will not be checked as closely?

No scheme substitutes for your own due diligence statement or exempts you from a check. Certification can feed into your risk assessment, but it does not replace it.

Is the check the same for an operator and a trader?

The legal basis differs — operators are those placing products on the market or exporting them, and carry the due diligence statement obligation; non-SME traders have their own check obligations without filing a statement themselves since Regulation (EU) 2025/2650 removed that requirement from downstream operators and traders.

What if I disagree with a check's findings?

The regulation does not set a harmonised EU-wide appeal mechanism; recourse against a competent authority's decision runs through the administrative and judicial review procedures of the Member State concerned. Check your national authority's own guidance for its specific process.