EUDR Information System: Everything You Need to Know

For almost two years, EUDR conversations have ended the same way: "let's wait until the system is up". That argument is gone. The EUDR Information System reopened in late June 2026, the regulation setting out how it works entered into force on 17 July, and statements submitted there now carry legal value.

New to the Regulation? Start with our complete guide to the EUDR: who it applies to, the 2026-2027 deadlines, geolocation and penalties.

For any company placing coffee, cocoa, soya, palm oil, rubber, wood or cattle on the EU market — or supplying those commodities into it — this changes the nature of the problem. Until now it was a regulatory question. It is now an operational task with a screen, a form and a date: 30 December 2026 for large and medium-sized companies.

This article covers what matters: what the system actually is, how we got here, what changed in July 2026, how a company registers step by step, and what needs to be in place before the first statement is filed.

What the EUDR Information System is (and why it is not the same as TRACES)

Start with the name, because the two are used interchangeably and they are not the same thing.

The Information System is the tool created by Article 33 of Regulation (EU) 2023/1115. It is where operators submit Due Diligence Statements (DDS), where downstream operators and traders that are not SMEs register, and where competent authorities and customs consult that information.

TRACES is the European Commission platform the system currently runs on — the same infrastructure used for years for animal health and phytosanitary controls, with a dedicated EUDR module.

The distinction is not pedantry. Implementing Regulation (EU) 2026/1565, in force since 17 July 2026, removed the reference to TRACES from the legal text. Not because TRACES is going away, but so the Commission can move the underlying IT infrastructure in future without amending the law. In practice: the obligation is to file in the Information System; today the entry point is TRACES.

Timeline: from 2024 to the 2026 relaunch

The sequence explains why so many companies reached mid-2026 having never logged in:

Late 2024 — Implementing Regulation (EU) 2024/3084 sets out the operating rules for the Information System, which goes live. Registration opens. Use is voluntary, since the obligation has not yet started.
December 2025 — Regulation (EU) 2025/2650 postpones application and introduces simplifications. The dates move to 30 December 2026 and 30 June 2027.
16 February 2026 — Access to the Information System is restricted while it is rebuilt to reflect the new rules.
4 May 2026 — The Commission publishes the simplification package: updated guidance, the fifth iteration of the FAQs, and the report to the European Parliament and the Council. The interpretative framework is settled.
Late June 2026 — The Information System reopens with its core functionality. Restrictions on creating new accounts are lifted.
13–17 July 2026 — Implementing Regulation (EU) 2026/1565 is adopted and enters into force, updating how the system operates.
20 July 2026 — The third edition of the Commission guidance is formally published in the Official Journal, C series, in all 24 official languages.
Late July 2026 — Commission training sessions for companies begin. The remaining functionality arrives over the summer.
15 October 2026 — The rule attributing each statement to a specific competent authority starts to apply.
30 December 2026 — Application for large and medium-sized operators and traders.
30 June 2027 — Application for operators that are natural persons or micro and small undertakings, provided they were established as such by 31 December 2024.

One nuance on that last date is widely misread. The obligations apply to micro and small companies from 30 December 2026, not 2027, where the timber products they place on the market were already covered by the former EU Timber Regulation — logs, sawn wood, wood-based panels, pulp and paper, and also wooden furniture under 9403 30, 9403 40, 9403 50, 9403 60 and 9403 90 30, now 9403 91. The reason is straightforward: that regulation is repealed on 30 December 2026 and those products cannot sit unregulated for six months. For timber products outside that older list, such as wood charcoal or seats under heading 9401, the deferral does apply.

One more piece completes this picture. On 13 July the Commission also adopted a delegated act amending Annex I, the list of products in scope: Delegated Regulation (EU) 2026/2102, published in the Official Journal on 17 September and in force since 18 September 2026. Its exclusions already apply; the products it adds only from 30 December 2027.

What changed with the July 2026 regulation

Implementing Regulation (EU) 2026/1565 does not touch the content of the statement — the required data remains that of Annex II of the Regulation itself. What changes is how the system works. Five developments stand out.

Simplified declaration for micro and small primary operators

The simplified declaration for micro and small primary operators is now built into the system. It has its own identifier, distinct from the reference number of a standard due diligence statement, and its own update rules. It is the route that stops a smallholder from having to carry the same documentary burden as a multinational.

Grouping of statements

The system now allows statements previously filed by the same user, or by their authorised representative, to be grouped under a new statement. The individual statements are replaced by the grouped one, can no longer be amended or withdrawn, and it is the grouped reference number that goes to customs. The limit is worth stressing, because it is widely misread: it consolidates your own statements, not your suppliers'.

It reads like a technical footnote and is probably the change with the largest practical impact: it saves operators with thousands of statements from having to hand customs an unmanageable list of reference numbers, and cuts the risk of clearance being held up.

Contingency planning

Before 30 December 2026 the Commission will publish a system status page and the measures planned for unplanned outages lasting more than 60 minutes, including a contingency reference number. It is an explicit acknowledgement that a system outage cannot be allowed to halt trade.

Attribution to a competent authority

From 15 October 2026, each statement is attributed to the competent authority of the Member State where the operator is established. Where the operator is established outside the EU, it is attributed to the Member State associated with its unique identifier. For an exporting company acting as an operator, that means knowing in advance which national authority will supervise it.

Automated risk profiling

This is the development most worth understanding. Every submission — whether a standard statement or a simplified declaration — goes through automated electronic risk profiling, which assigns it a risk status that is not disclosed to the user. The reference number is only released once profiling is complete. For as long as a statement is flagged as high risk, the competent authority can reject it; once the reference number has been issued, it can no longer do so.

Put differently: the quality of the data submitted is no longer judged only by an inspector at some later date. The system scores it at the moment of filing.

Alongside these sit relevant operational details: the Commission may impose technical limits on file size and interaction frequency, anti-duplication measures apply, and data is retained for five years from submission. Where statements have been grouped, the five years run from the grouping date; for simplified declarations, from their withdrawal.

How to register in TRACES, step by step

Registration is simpler than most companies fear. Four steps.

Create an EU Login account. This is the single sign-on identity for European Commission services, created with a corporate email address. If the company already uses another EU system, it probably has one.
Create the economic operator profile in TRACES and select the relevant activity: importer or exporter, domestic producer, trader or authorised representative. Since the June relaunch there are also roles for micro and small primary operators, downstream operators and traders. Companies importing or exporting relevant products identify themselves with their EORI number — the same one already used at customs. Companies established outside the EU that act as operators also need an EORI, issued by a Member State authority, and their account requires an additional validation procedure; that Member State is the one that will supervise their statements.
Validate the profile and add users. This step deserves care: before creating the company from scratch, check whether it already exists in the system and link to it. Duplicate companies in TRACES are a classic problem and are painful to clean up.
Start creating and managing statements.

The two environments: test and production

This is where most time is lost, and it warrants a clear warning.

There are two servers. The production environment is the real one: statements filed there carry legal value. The acceptance environment — that is its official name, though everyone calls it the test environment — is the replica for learning and rehearsing: nothing filed there has any legal effect.

The addresses differ and are worth keeping to hand: production at eudr.webcloud.ec.europa.eu/tracesnt/login and acceptance at acceptance.eudr.webcloud.ec.europa.eu/tracesnt/login.

They are independent environments: registering in one does not grant access to the other. The Commission spells this out: registering an account in one environment does not automatically grant access or registration in the other, and users should complete separate registrations for each. It is the mistake we see most often among companies approaching the system for the first time.

The practical consequence is a window that will not stay open. Between now and December there is room to rehearse in the test environment with real data, measure how long it takes and find out what is missing. From 30 December, every statement counts.

How to submit a due diligence statement in the EUDR Information System, step by step

In short: once the account is set up, the operator fills in the statement (activity, product, quantity, country and geolocation), signs it and submits it. The system automatically runs risk profiling and, once it is complete, assigns a reference number and a verification number. The reference number is the one that goes in the customs declaration and the one passed on to customers. The statement can only be amended or withdrawn within 72 hours of receiving the number, and never once it has been used.

The steps

Log in with the operator role (or authorised representative role) in the production environment. Anything submitted in the acceptance environment has no legal value.
Click "Create" and choose the role (or "Representing" if an authorised representative is acting), add an internal reference if you want one and, in the "Statement Details" form, choose the activity: "Import", "Export" or "Domestic" (production in the EU), as described in the EUDR Information System user guide of 16-9-2026. The operator's details are filled in from the profile; if an authorised representative is acting, it states which operator it represents.
Add the products. For each line: HS code with at least the digits listed in Annex I (FAQ 7.24), description and trade name, full scientific name of the species if wood is involved (Art. 4(2) of Implementing Regulation 2024/3084), and quantity in kilograms of net mass, without packaging, plus the supplementary unit where it is uniform for the declared code (Annex II, point 2; FAQ 7.18 and 7.22).
Add the places of production. Country of production and geolocation, entered manually on the map or by importing a GeoJSON file (FAQ 7.4 and 7.8). Each country goes separately. What data and which format are required is explained in EUDR geolocation.
Decide whether the geolocation is visible to customers who hold the reference number and the verification number (FAQ 3.6 and 7.7).
Click "Submit" and then "Confirm & Sign". The statement includes the text of Annex II, point 5 (due diligence has been carried out and no or only negligible risk was found) and the signature with name, function and date.
Wait for the risk profiling. Every statement goes through automatic profiling, and the result is not shown to the user. If a high risk is detected, the competent authority can delay the number or reject the statement; once the reference number has been issued, it can no longer reject it (Arts. 6 to 8 of Implementing Regulation 2024/3084, as amended by Implementing Regulation (EU) 2026/1565).
Use the numbers. The reference number goes in the customs declaration with document code C716 (more in EUDR and customs: code C716) and is passed on to customers that are downstream operators or traders (Art. 4(7) of the Regulation). The verification number is a security key: passing it on is not mandatory, although a customer that is not an SME may ask for it to carry out checks in the case of a substantiated concern (FAQ 3.6.1). Both can be validated in the system (FAQ 7.25).

You must submit the statement and have the reference number before lodging the customs declaration (FAQ 5.20).

Can a statement be amended or withdrawn?

Situation	Amend or withdraw?	Source
Within 72 hours of the system providing the reference number	Yes	FAQ 7.6
The number has already been used in a customs declaration	No	FAQ 7.6
The product has already been placed on the market or exported	No	FAQ 7.6; Art. 5(3)(b) Impl. Reg. 2024/3084
The authority has notified that it will check it	No, while the check lasts	FAQ 7.6
The statement has been grouped into another one	No	Art. 5(2) Impl. Reg. 2024/3084

For your own records, each statement can be exported to PDF (FAQ 7.14).

Can I reuse earlier statements?

Duplicate: a statement already submitted can be copied as the basis for the next one; the operator is responsible for correcting the data (FAQ 7.4).
Several shipments under one statement: a single statement can cover several batches, as long as it is submitted before the first one and covers no more than one year (FAQ 5.19). And one customs declaration can carry several reference numbers (FAQ 5.20).
Group: since July 2026, your own statements can be grouped under a new one, whose number replaces the individual ones for customs and customers (Art. 8a Impl. Reg. 2024/3084). Only statements from the same user, or from its authorised representative for the same operator, can be grouped: it cannot be used to group suppliers' statements.
Other companies' statements: the downstream operator does not submit a statement; it only keeps the number given by its supplier, and the system does not allow it to submit one (FAQ 3.10.1). Nor can suppliers' statements be included in your own statement: Implementing Regulation 2026/1565 only allows referencing your own statements (Art. 8a), and with the supplier's numbers you can only check their validity in the system.

What about the simplified declaration?

It is only for micro or small primary operators: producers established in a low-risk country that place on the market or export what they themselves produce (Art. 2(15a) of the Regulation). It works differently from the ordinary statement:

It is submitted only once, with the estimated annual quantity (Annex III), and receives a declaration identifier instead of a reference number.
It can be updated when something substantial changes; the identifier stays the same and the declaration goes through risk profiling again. If the producer starts selling new products, it needs a new declaration or an update (FAQ 3.27).
It can be withdrawn unless it has been grouped. If the Member State already holds the data in an official database, it can upload it itself (Art. 4a(4) of the Regulation).
At customs it is declared with code C717.

What to have ready before the first statement

The system does not tolerate ambiguity. These are the inputs behind a statement, and the ones that most often arrive incomplete:

Geolocation of production plots, with coordinates to at least six decimal places. Polygons for plots larger than four hectares; a single point is sufficient for plots of four hectares or less. For cattle, geolocation of every establishment where the cattle were kept. Micro and small primary operators may provide the postal address of the plots or establishment instead of geolocation.
Evidence that no deforestation occurred after 31 December 2020 on those plots.
Proof of legality in the country of production: land use rights, applicable labour, tax and environmental law.
Batch-to-plot traceability, with harvest dates consistent with the documentation.
Product and supplier data, including the relevant HS commodity code and the quantity in kilograms of net mass.
The production date or time range for each plot.
A documented risk assessment concluding that risk is negligible, plus the mitigation measures applied where it is not.

One clarification, to avoid confusion: not all of this goes inside the statement itself. The form captures the operator's details, the HS commodity code and product description, the quantity in kilograms of net mass, the country of production and the geolocation. Evidence of no deforestation, legality documentation, supplier and customer data, and the risk assessment are not fields in the form: they are retained and produced when the authority asks for them.

If you want to go deeper into those two areas, we cover them in detail in what companies selling into Europe are actually asked for and in how legality and the risk-based approach work within due diligence.

The most common mistakes

From what we are seeing in companies coming to the system for the first time, five mistakes account for most of the delays:

Mixing up the environments. Practising in production, or trying to file in the test environment.
Duplicating the company instead of linking to the existing profile.
Not knowing who holds access. The person who registered changed role or left, and nobody else can get in.
Geolocation data that does not hold up: unclosed polygons, inverted coordinates, areas that do not match the farm documentation.
Leaving it until December. Access and data problems take weeks to resolve, and support will be overwhelmed at exactly that moment.

The blind spot: the system is ready, the Member States are not

There is an asymmetry worth factoring into any plan. While the European infrastructure moves forward, national implementation lags badly: as of July 2026 only three Member States — Czechia, Slovakia and Belgium — have national law in force with specific penalty amounts. Spain, among others, still has no penalty regime adopted, although the competent authority has been designated: the Directorate-General for Biodiversity, Forests and Desertification at Spain's Ministry for the Ecological Transition (MITECO), alongside one authority in each autonomous region.

That asymmetry is not a reason to wait. The regulation applies from 30 December 2026 regardless of whether a Member State has published its fines, and customs clearance does not depend on the national penalty regime. What it does mean is that real enforcement intensity in the first months will vary by port of entry.

How to prepare

The sensible sequence for the coming months is short.

Secure access: check who in the company has an account, with what role, and whether the organisation is registered once rather than three times.
File one complete statement in the test environment using a real purchase, time it, and note where it stalls.
Work on that bottleneck through the autumn — it is almost always in the same place: supplier information.

That third step is the one that consumes time, because it depends on third parties thousands of kilometres away. Collecting valid geolocation data, verifying legality documentation and analysing deforestation plot by plot do not scale manually once there are dozens of suppliers.

If you want to see how Coolx can help you centralise that information, assess risk plot by plot and generate and submit statements directly to the Information System, visit coolx.earth or talk to our team.