EUDR record keeping: what you must keep, and for how long

You must keep EUDR due diligence documentation for five years from the date the product was placed on, made available on, or exported from the EU market — and produce it to a competent authority on request. What exactly counts as "documentation" differs by role: a primary operator keeps far more than a downstream trader who only passes on a reference number.

This is an obligation in its own right, separate from the due diligence statement itself. A competent authority can ask for your records at any point inside that five-year window, including years after the consignment has sold through and the relationship with that supplier has ended. Being unable to produce them is itself an infringement, regardless of whether the underlying product was actually deforestation-free.

Who has to keep what

Regulation (EU) 2025/2650 concentrated the due diligence statement on the operator who first places a product on the EU market, but it did not concentrate the record-keeping duty — that still runs through the whole chain, just at different depths.

Your position	What you keep	For how long
Operator placing first on the EU market	Full due diligence documentation: product description, quantity, country (and region/plot) of production, geolocation, supplier and customer names and addresses, and evidence the product is deforestation-free and legally produced	5 years from placing on, making available on, or exporting from the market
Non-SME downstream operator or trader	The due diligence statement reference number for each consignment, plus names and addresses of who supplied and who was supplied	5 years
SME trader	The due diligence statement reference number, plus supplier and downstream customer names and addresses	5 years
Micro/small primary operator using the simplified declaration	The simplified declaration and the basis for low-risk sourcing	5 years

The common thread is the reference number. Once Regulation (EU) 2025/2650 took the filing obligation off downstream buyers, the reference number became the thing that actually has to survive in your own systems — not the full dossier, but the number that lets a competent authority trace back to it. What changed under the December 2025 amendment covers who files what in more detail.

What the full documentation actually contains

For the operator who files, the due diligence information required under Article 9 of Regulation (EU) 2023/1115 is the baseline, and it is this file — not just the statement — that has to be retrievable for five years:

• A description and the quantity of the product.
• The country, and where relevant the region, of production.
• Geolocation of every plot of land where the commodity was produced — polygons above four hectares, points below, every establishment for cattle. The geolocation rules in full cover the mechanics.
• The name, address and contact details of every business that supplied the product.
• Where the product has already been sold on, the name and address of the trader or operator it went to.
• Adequately conclusive and verifiable information that the product is deforestation-free — produced on land that was not deforested or degraded after 31 December 2020 — and that it was produced in accordance with the relevant laws of the country of production.
• Your risk assessment and, where risk was found to be more than negligible, the mitigation measures taken.

None of this is new paperwork invented for retention purposes. It is the same information you had to assemble to file the statement or justify the simplified declaration in the first place. The retention obligation is simply that you cannot discard it once the statement is filed and the goods have moved.

Format matters as much as content

The regulation does not prescribe a filing system, only that the information must be available and producible. In practice that means two things worth checking now rather than when a request lands. First, geolocation data has to stay in a usable format — a polygon stored as a PDF map extract is not the same as one stored as coordinates a competent authority can plot, and reconstructing the latter from the former after the fact is slow. Second, where a product passed through more than one of your own legal entities before reaching the EU market — a group with a non-EU sourcing arm and a separate EU importing entity, for instance — the records need to be retrievable as a single file against the consignment, not split across two entities' systems with no shared reference. Which EUDR deadline applies to you touches on the entity question from the size-band side — a group's figures, not just the filing entity's own, usually decide your size band; the record-keeping consequence follows the same logic regardless of which date applies to you.

When the five years starts

The clock starts from placing on, making available on, or exporting the product from the EU market — the commercial event, not the date you did the paperwork. For most businesses that means the invoice date or the date of customs clearance, whichever your due diligence system is built around.

This matters for consignments near a year-end or near a supplier change, because the same shipment can trigger two different clocks for two different parties in the chain: the date you placed it on the market might be weeks after the date your supplier exported it. Keep the date your own obligation is anchored to, not the date somewhere else in the chain.

The EU's own Information System separately stores the data in a submitted due diligence statement for five years from the date of submission, under Article 12(5) of Implementing Regulation (EU) 2024/3084. That is the Commission's retention of what you filed, not your retention obligation, and the two periods run from different starting points. The system holding a copy does not reduce what you have to keep yourself, and it is not a substitute if your own records cannot show how you reached the conclusions in the statement.

Retention is not the same as the annual report

Do not confuse the five-year retention duty with the separate obligation, under Article 12 of Regulation (EU) 2023/1115, for non-SME operators to review their due diligence system annually and publish a public report on it. The report is a summary of your due diligence system and how it operated; the retained records are the underlying evidence a competent authority can ask to see behind that summary, or behind any individual consignment, at any time inside the five years. SMEs are not required to publish the annual report, but they are not exempt from retaining records.

What this looks like in practice

For most businesses, the practical failure mode is not deleting records on purpose — it is losing the link between a due diligence statement reference number and the specific purchase order, invoice or goods-in record it belongs to, because that link lived in someone's inbox or a spreadsheet nobody owns after they leave.

A workable approach:

• Store the DDS reference number against the purchase order or goods-in line in whatever system you already use for that, not in a separate compliance folder that falls out of sync.
• Keep supplier and customer names and addresses with the transaction record they relate to, not as a standalone contacts list that cannot be tied back to a specific consignment.
• Name an owner for the retention record itself. A request from a competent authority has a response deadline; "nobody currently owns this" is not a defensible answer to it.
• Set a deletion date five years out rather than relying on someone remembering to keep the record, and make sure nothing in your data retention policy elsewhere — a generic "delete customer data after two years" rule, for instance — quietly overrides it first.

The SME compliance checklist sets this kind of ownership question out in full for businesses building a due diligence system from nothing.

What happens if you cannot produce the records

A competent authority's request is not limited to consignments it currently suspects are non-compliant — checks are also run at the baseline rate set by each country's risk tier under Implementing Regulation (EU) 2025/1093, so a request can arrive for a shipment you had no particular reason to expect scrutiny on. Country benchmarking explained sets out those check rates.

Failing to produce records on request is treated as a failure of due diligence in its own right under the penalty regime, which carries fines of at least 4% of annual EU-wide turnover for serious infringements, confiscation of the product and revenue, and exclusion from public procurement. What EUDR penalties actually cost covers the enforcement side. The point to take from it here is narrow but important: you do not need to have done anything wrong with the product for an unanswerable records request to become the infringement.

Confirm this before you rely on it

The five-year period, running from the date of placing on, making available on, or exporting the product, is consistently stated across the regulation's own text and every secondary source we checked, and we treat it as settled. The precise sub-paragraph numbering of the retention duty within Articles 4 and 5 is reported inconsistently between secondary sources, which may reflect renumbering from Regulation (EU) 2025/2650 rather than a substantive difference — we were not able to confirm the current numbering against the regulation's consolidated text this run, so check the article reference itself if you need to cite it precisely. The obligation itself is not in doubt; only the exact sub-paragraph label is.

Check what the EUDR requires of your business, including what you will need to keep once you are filing.