EUDR Information System: Everything You Need to Know

For almost two years, EUDR conversations have ended the same way: "let's wait until the system is up". That argument is gone. The EUDR Information System reopened in late June 2026, the regulation setting out how it works entered into force on 17 July, and statements submitted there now carry legal value.

For any company placing coffee, cocoa, soya, palm oil, rubber, wood or cattle on the EU market — or supplying those commodities into it — this changes the nature of the problem. Until now it was a regulatory question. It is now an operational task with a screen, a form and a date: 30 December 2026 for large and medium-sized companies.

This article covers what matters: what the system actually is, how we got here, what changed in July 2026, how a company registers step by step, and what needs to be in place before the first statement is filed.

What the EUDR Information System is (and why it is not the same as TRACES)

Start with the name, because the two are used interchangeably and they are not the same thing.

The Information System is the tool created by Article 33 of Regulation (EU) 2023/1115. It is where operators submit Due Diligence Statements (DDS), where downstream operators and traders that are not SMEs register, and where competent authorities and customs consult that information.

TRACES is the European Commission platform the system currently runs on — the same infrastructure used for years for animal health and phytosanitary controls, with a dedicated EUDR module.

The distinction is not pedantry. Implementing Regulation (EU) 2026/1565, in force since 17 July 2026, removed the reference to TRACES from the legal text. Not because TRACES is going away, but so the Commission can move the underlying IT infrastructure in future without amending the law. In practice: the obligation is to file in the Information System; today the entry point is TRACES.

Timeline: from 2024 to the 2026 relaunch

The sequence explains why so many companies reached mid-2026 having never logged in:

Late 2024 — Implementing Regulation (EU) 2024/3084 sets out the operating rules for the Information System, which goes live. Registration opens. Use is voluntary, since the obligation has not yet started.
December 2025 — Regulation (EU) 2025/2650 postpones application and introduces simplifications. The dates move to 30 December 2026 and 30 June 2027.
16 February 2026 — Access to the Information System is restricted while it is rebuilt to reflect the new rules.
4 May 2026 — The Commission publishes the simplification package: updated guidance, the fifth iteration of the FAQs, and the report to the European Parliament and the Council. The interpretative framework is settled.
Late June 2026 — The Information System reopens with its core functionality. Restrictions on creating new accounts are lifted.
13–17 July 2026 — Implementing Regulation (EU) 2026/1565 is adopted and enters into force, updating how the system operates.
20 July 2026 — The third edition of the Commission guidance is formally published in the Official Journal, C series, in all 24 official languages.
Late July 2026 — Commission training sessions for companies begin. The remaining functionality arrives over the summer.
15 October 2026 — The rule attributing each statement to a specific competent authority starts to apply.
30 December 2026 — Application for large and medium-sized operators and traders.
30 June 2027 — Application for operators that are natural persons or micro and small undertakings, provided they were established as such by 31 December 2024.

One nuance on that last date is widely misread. The obligations apply to micro and small companies from 30 December 2026, not 2027, where the timber products they place on the market were already covered by the former EU Timber Regulation — logs, sawn wood, pulp and paper. The reason is straightforward: that regulation is repealed on 30 December 2026 and those products cannot sit unregulated for six months. For timber products outside that older list, such as furniture, the deferral does apply.

One piece is deliberately missing from this picture. On 13 July the Commission also adopted a delegated act amending Annex I, the list of products in scope. It remains under scrutiny by the European Parliament and the Council and has not been published in the Official Journal, so it does not yet change which products are covered. We will cover it once it is published.

What changed with the July 2026 regulation

Implementing Regulation (EU) 2026/1565 does not touch the content of the statement — the required data remains that of Annex II of the Regulation itself. What changes is how the system works. Five developments stand out.

Simplified declaration for micro and small primary operators

The simplified declaration for micro and small primary operators is now built into the system. It has its own identifier, distinct from the reference number of a standard due diligence statement, and its own update rules. It is the route that stops a smallholder from having to carry the same documentary burden as a multinational.

Grouping of statements

The system now allows statements previously filed by the same user, or by their authorised representative, to be grouped under a new statement. The individual statements are replaced by the grouped one, can no longer be amended or withdrawn, and it is the grouped reference number that goes to customs. The limit is worth stressing, because it is widely misread: it consolidates your own statements, not your suppliers'.

It reads like a technical footnote and is probably the change with the largest practical impact: it saves operators with thousands of statements from having to hand customs an unmanageable list of reference numbers, and cuts the risk of clearance being held up.

Contingency planning

Before 30 December 2026 the Commission will publish a system status page and the measures planned for unplanned outages lasting more than 60 minutes, including a contingency reference number. It is an explicit acknowledgement that a system outage cannot be allowed to halt trade.

Attribution to a competent authority

From 15 October 2026, each statement is attributed to the competent authority of the Member State where the operator is established. Where the operator is established outside the EU, it is attributed to the Member State associated with its unique identifier. For an exporting company acting as an operator, that means knowing in advance which national authority will supervise it.

Automated risk profiling

This is the development most worth understanding. Every submission — whether a standard statement or a simplified declaration — goes through automated electronic risk profiling, which assigns it a risk status that is not disclosed to the user. The reference number is only released once profiling is complete. For as long as a statement is flagged as high risk, the competent authority can reject it; once the reference number has been issued, it can no longer do so.

Put differently: the quality of the data submitted is no longer judged only by an inspector at some later date. The system scores it at the moment of filing.

Alongside these sit relevant operational details: the Commission may impose technical limits on file size and interaction frequency, anti-duplication measures apply, and data is retained for five years from submission. Where statements have been grouped, the five years run from the grouping date; for simplified declarations, from their withdrawal.

How to register in TRACES, step by step

Registration is simpler than most companies fear. Four steps.

Create an EU Login account. This is the single sign-on identity for European Commission services, created with a corporate email address. If the company already uses another EU system, it probably has one.
Create the economic operator profile in TRACES and select the relevant activity: importer or exporter, domestic producer, trader or authorised representative. Since the June relaunch there are also roles for micro and small primary operators, downstream operators and traders. Companies importing or exporting relevant products identify themselves with their EORI number — the same one already used at customs. Companies established outside the EU that act as operators also need an EORI, issued by a Member State authority, and their account requires an additional validation procedure; that Member State is the one that will supervise their statements.
Validate the profile and add users. This step deserves care: before creating the company from scratch, check whether it already exists in the system and link to it. Duplicate companies in TRACES are a classic problem and are painful to clean up.
Start creating and managing statements.

The two environments: test and production

This is where most time is lost, and it warrants a clear warning.

There are two servers. The production environment is the real one: statements filed there carry legal value. The acceptance environment — that is its official name, though everyone calls it the test environment — is the replica for learning and rehearsing: nothing filed there has any legal effect.

The addresses differ and are worth keeping to hand: production at eudr.webcloud.ec.europa.eu/tracesnt/login and acceptance at acceptance.eudr.webcloud.ec.europa.eu/tracesnt/login.

They are independent environments: registering in one does not grant access to the other. The Commission spells this out: registering an account in one environment does not automatically grant access or registration in the other, and users should complete separate registrations for each. It is the mistake we see most often among companies approaching the system for the first time.

The practical consequence is a window that will not stay open. Between now and December there is room to rehearse in the test environment with real data, measure how long it takes and find out what is missing. From 30 December, every statement counts.

What to have ready before the first statement

The system does not tolerate ambiguity. These are the inputs behind a statement, and the ones that most often arrive incomplete:

Geolocation of production plots, with coordinates to at least six decimal places. Polygons for plots larger than four hectares; a single point is sufficient for plots of four hectares or less. For cattle, geolocation of every establishment where the cattle were kept. Micro and small primary operators may provide the postal address of the plots or establishment instead of geolocation.
Evidence that no deforestation occurred after 31 December 2020 on those plots.
Proof of legality in the country of production: land use rights, applicable labour, tax and environmental law.
Batch-to-plot traceability, with harvest dates consistent with the documentation.
Product and supplier data, including the relevant HS commodity code and the quantity in kilograms of net mass.
The production date or time range for each plot.
A documented risk assessment concluding that risk is negligible, plus the mitigation measures applied where it is not.

One clarification, to avoid confusion: not all of this goes inside the statement itself. The form captures the operator's details, the HS commodity code and product description, the quantity in kilograms of net mass, the country of production and the geolocation. Evidence of no deforestation, legality documentation, supplier and customer data, and the risk assessment are not fields in the form: they are retained and produced when the authority asks for them.

If you want to go deeper into those two areas, we cover them in detail in what companies selling into Europe are actually asked for and in how legality and the risk-based approach work within due diligence.

The most common mistakes

From what we are seeing in companies coming to the system for the first time, five mistakes account for most of the delays:

Mixing up the environments. Practising in production, or trying to file in the test environment.
Duplicating the company instead of linking to the existing profile.
Not knowing who holds access. The person who registered changed role or left, and nobody else can get in.
Geolocation data that does not hold up: unclosed polygons, inverted coordinates, areas that do not match the farm documentation.
Leaving it until December. Access and data problems take weeks to resolve, and support will be overwhelmed at exactly that moment.

The blind spot: the system is ready, the Member States are not

There is an asymmetry worth factoring into any plan. While the European infrastructure moves forward, national implementation lags badly: as of July 2026 only three Member States — Czechia, Slovakia and Belgium — have national law in force with specific penalty amounts. Spain, among others, still has no penalty regime adopted, although the competent authority has been designated: the Directorate-General for Biodiversity, Forests and Desertification at Spain's Ministry for the Ecological Transition (MITECO), alongside one authority in each autonomous region.

That asymmetry is not a reason to wait. The regulation applies from 30 December 2026 regardless of whether a Member State has published its fines, and customs clearance does not depend on the national penalty regime. What it does mean is that real enforcement intensity in the first months will vary by port of entry.

How to prepare

The sensible sequence for the coming months is short.

Secure access: check who in the company has an account, with what role, and whether the organisation is registered once rather than three times.
File one complete statement in the test environment using a real purchase, time it, and note where it stalls.
Work on that bottleneck through the autumn — it is almost always in the same place: supplier information.

That third step is the one that consumes time, because it depends on third parties thousands of kilometres away. Collecting valid geolocation data, verifying legality documentation and analysing deforestation plot by plot do not scale manually once there are dozens of suppliers.

If you want to see how Coolx can help you centralise that information, assess risk plot by plot and generate and submit statements directly to the Information System, visit coolx.earth or talk to our team.