Working backwards: what real traceability looks like under EUDR enforcement

When the European Union extended the EUDR implementation timeline, many operators interpreted it as breathing room. The more accurate read is that it created a period in which EUTR - the regulation that preceded EUDR and remains fully in force - has become the active enforcement front. Authorities such as the NVWA in the Netherlands are following supply chain evidence with a level of rigour that has caught a number of businesses off guard.

‍

The central lesson from recent enforcement activity is straightforward: having documents is not the same as demonstrating compliance. This post sets out what the difference looks like in practice, and why end-to-end traceability is the only approach that holds up under scrutiny.

‍

Documentation that arrives too late has already failed

Consider a scenario that will be familiar to anyone working in timber due diligence: a supplier is found to be non-compliant under EUTR and responds by submitting a package of documents intended to demonstrate that the relevant product was, in fact, legally sourced. The documentation is credible in places. But it arrives after the import has already happened.

‍

Under EUTR, due diligence runs upstream of the shipment, and EUDR will apply the same logic. Evidence must be gathered, assessed and on record before goods cross the border to be placed on the market, not assembled retrospectively when a question is raised. Late documentation does not satisfy the regulation; it simply confirms that the process was not carried out correctly. Nor can a company repair the gap with promises about the future. 

‍

In a recent EUTR case, a company facing a penalty offered an undertaking to improve its due diligence process for future shipments in an attempt to have the penalty set aside. The undertaking was rejected and the penalty stood. The message for EUDR is clear: compliance is judged on what was in place at the point of placing goods on the market, not on what a business commits to doing next time.

‍

The problem compounds when the documents themselves are examined closely. Transport records and log reference numbers do not reconcile. The chain, under scrutiny, does not hold.

‍

Authorities follow the chain 

There is a common assumption in the trade that a compliance check means reviewing a set of certificates and confirming they are present. What NVWA and equivalent competent authorities actually do is follow the evidence end to end: farm/forest-level records, processing documents, individual instances of movement and transformation, all the way through to the import.

‍

They look for where the chain breaks. A supplier who accepted documentation at face value, without verifying that the numbers connect, will have missed exactly what an authority will find. 

‍

A recent EUTR penalty case shows how this plays out in practice. The sawmill involved could not present the Competent Authority with clear records of log input, sawn output and conversion. Without them, there was no way to demonstrate that the sawn timber it produced came from the logs recorded as arriving at the mill, which left open the risk that logs from undocumented sources had been mixed into processing. The gap was not in any single document but in the link between them, and that link is precisely what authorities test.

‍

The question regulators are asking is not whether documents exist. It is whether they form a coherent, unbroken account of the product's journey.

‍

Sufficient due diligence, not proof of legality

A point that is frequently misunderstood, and worth stating directly: EUTR, like EUDR, does not require operators to prove that timber is legal. It requires them to demonstrate sufficient due diligence to minimise the risk that it is not. This is a meaningful distinction.

‍

Proving illegality in a third country would, in most cases, require the active cooperation of that country's own authorities. Cooperation that is rarely available and not a reasonable basis for a compliance framework. The regulation is built around something achievable: a robust, documented process for gathering evidence and assessing risk.

‍

What matters is whether that process was carried out, and whether the evidence gathered would satisfy a reasonable examiner that genuine care was taken at each step. A complete, coherent audit trail is what that looks like in practice.

‍

You start at the end, and work backwards

The instinct is to build a compliance record in the direction of travel - farm/forest certification and legality first, then harvesting licence, processing, shipment. The practical reality of due diligence, when you are an importer, is different: you begin with what you have in front of you (the goods that have arrived, or are about to), and you work backwards through the supply chain until you reach the standing tree.

‍

This is not a workaround. It is how evidence is actually gathered and verified. The question at each stage is: can we link this step, clearly and with documentation, to the step before it? Where that link cannot be made, there is a gap in the due diligence - and a gap that a regulator will find.

‍

Mixing compliant and non-compliant material is the risk that traceability is designed to prevent. The only way to do so is to maintain an unbroken chain at every stage, including within the mill, during processing and while goods are in transit. Transport is easy to overlook, but authorities do not. In a 2026 EUTR case, a penalty was imposed in part because the operator could not demonstrate that the logs had travelled by a logical route. The Competent Authority concluded that this increased the risk of compliant and non-compliant material being mixed along the way. Every movement between origin and market is a point where the chain can break, and each one needs to be accounted for.

Information overload is a compliance failure too

A separate challenge is operational rather than legal: suppliers, when asked for documentation, frequently respond by sharing everything. Every internal record, every peripheral certificate, every tangentially related document they can locate - in the hope that volume signals effort. The result is information overload that makes meaningful review harder, not easier, and creates opportunities for the specific gaps to go unnoticed within the noise.

‍

What works is precision. The request for documentation should specify exactly which documents are required - named as they are named in the country where they were issued, not in generic English terms. "Forest management plan" means different things in different jurisdictions. What is needed is the specific approval document, under its local name, in its local language, alongside the specific supporting documents that the legal framework of that country requires: proof of forestry tax payment, business licence to operate, annual operating plan, harvesting licence. Each document listed, named, numbered.

‍

Whilst this sounds like it might imply more work for suppliers, we know from experience that what suppliers are asking for is clarity. In most cases, having a clear expectation of what their buyers require saves them (and the buyer) a great deal of guess work and time.

‍

Sent correctly, a document request comes back with exactly what is needed, labelled as requested, without the surrounding noise. That is the difference between a review that can be done thoroughly and one that is, in practice, a surface-level check.

‍

The translation layer that changes how operators work

Operators sourcing from multiple countries face a compounding version of this problem: each country has its own legal framework, its own document types, its own naming conventions, in different languages. Building that knowledge from scratch for each sourcing country is a significant undertaking, and the knowledge depreciates when laws or administrative processes change.

‍

Within Interu, the country-level ruleset holds the specific documents required under each sourcing country's legal framework. An operator working with timber from the Republic of Congo, from Gabon, from Malaysia, each under a different legal regime, can navigate all three from the same interface, with the document names, their local language equivalents, and the evidence requirements for each country already mapped. The translation layer is particularly useful here: it removes the ambiguity that comes from working across languages and reduces the risk that a document is misidentified or overlooked.

‍

The practical effect is less time spent on administrative management, and more confidence that the evidence gathered will hold up when an authority follows the chain.

‍

Due diligence is a process, not a document count

The pattern that emerges from current EUTR enforcement is consistent: the operators who are exposed are those who treated compliance as a documentation exercise rather than an evidence-gathering one. They collected what was offered, reviewed it at a surface level, and moved on.

‍

What regulators require, and what the regulation was always designed to produce, is a different discipline. It starts with knowing what documents a given supply chain should generate, by country and by legal framework. It continues with requesting those documents precisely, verifying that they reconcile with one another, and maintaining the chain from shipment back to the standing trees. Individual trees tend to lose their individual identity when entered into a batch for processing. However, if all the trees used in a batch are recorded correctly, it is possible to link individual trees processed in a batch back to the forest or forests where they were harvested. The absence of any link in that chain is the gap that enforcement will find. 

‍

EUDR, when it comes into full effect, will raise the formal requirements. The approach - working backwards, end to end, with precision at every step - is already a way to meet what the current regulation demands.

‍

Build a due diligence process that holds up under scrutiny

Interu is built for operators and their suppliers who need to demonstrate compliance, not just gather paperwork. Country-level document rulesets that name exactly what you need and what it's called in each sourcing country. End-to-end traceability from standing tree to shipment. A translation layer that makes working across multiple jurisdictions practical rather than painful. 

‍

If EUTR enforcement activity has raised questions about whether your current due diligence process would stand up to scrutiny, we would be glad to show you how Interu approaches it. Book a demo here.