Two different things: what goes in the DDS and what you keep
The DDS is a summary submitted in TRACES. Due diligence is everything behind it: the information you collect (Art. 9), the risk assessment (Art. 10) and, where needed, risk mitigation (Art. 11). The DDS may only be submitted if the risk is negligible or nil, and the information must be kept for five years from submission (Art. 12).
So a DDS can be accepted by TRACES and still fall short: TRACES checks that the data is there and consistent, not that you carried out due diligence.
What the DDS submitted in TRACES contains
Annex II of Regulation (EU) 2023/1115 sets the content. In practice, TRACES asks for:
- The operator: name, address and, for imports and exports, its EORI number. Without an EORI on the operator's profile, TRACES rejects imports.
- The product: CN or HS code from Annex I, description and quantity. For imports and exports the net mass in kilograms is mandatory.
- The country of production and the geolocation of all plots (Art. 9(1)(d) and 2(28)): a point for plots of 4 hectares or less and a polygon for larger ones, except for cattle.
- For timber, the scientific and common names of the species.
- The statement that due diligence was carried out and the risk is negligible or nil. Submitting it is the signature.
The supplier's data does not go in the DDS: not its name, email or tax ID. It goes in your due diligence record.
What you must keep for five years
Article 9(1) lists the information you must collect and be able to show the competent authority:
- Description of the product, quantity and country of production.
- Geolocation of the plots and the date or time range of production (Art. 9(1)(d)).
- Name, postal address and email of whoever supplied the product to you (Art. 9(1)(e)).
- Name, postal address and email of whoever you supply it to (Art. 9(1)(f)).
- Adequately conclusive and verifiable information that the product is deforestation-free (Art. 9(1)(g)) and was produced in line with the law of the country (Art. 9(1)(h)).
The supplier's email is mandatory because the Regulation says so: it lets the authority follow the chain and contact the supplier. A generic company address (sales, export or sustainability) is fine.
What is not mandatory
The supplier's tax ID is not required by the Regulation. It helps identify the supplier beyond doubt and, in the EU or Brazil, validate it against an official register, but you can submit without it.
Sourevo's trust levels (0 to 3) are our aid to assess risk, not a legal requirement. In Sourevo every warning says whether the Regulation requires it, TRACES requires it or it is a recommendation.
Geolocation is mandatory; the GeoJSON file is not
What is mandatory is the coordinates of every plot. GeoJSON is just the format they usually come in. Plots can come from a file, be entered by hand or be reused from earlier shipments of the same supplier: there is no need to upload them every time.
The exception: if your product is already covered by another DDS (for example, the seller's), you can refer to its reference number instead of repeating the plots.
When you may submit: negligible or nil risk
The risk assessment (Art. 10) considers, among other things, the country risk (Implementing Regulation 2025/1093), the complexity of the supply chain and the information on the plots. If the risk is not negligible, it must be mitigated first (Art. 11): ask the supplier for evidence, review doubtful plots or leave them out of the batch.
A plot showing forest loss after 31-12-2020 in the satellite check is not deforestation on its own (in acacia or eucalyptus plantations that existed in 2020, harvesting also shows as loss), but it has to be reviewed and the explanation and evidence kept.
How the satellite check works
Each plot is compared with the EU forest map of 2020, which does not change; tree cover loss from the University of Maryland, published once a year; and Global Forest Watch deforestation alerts, updated every few days.
That is why a result stays valid for 30 days: Sourevo only re-checks new plots, plots whose shape changed and plots not checked for over a month, and reviews the plots of statements already submitted every month. If you would rather check a plot right away, "Check again" queries the data at that moment.
How to prove in five years that you complied
When a DDS is submitted or amended, Sourevo freezes the record: what was sent to TRACES, the supplier's and operator's data at that moment, each plot's satellite result with its date, the risk assessment, the warnings accepted and the documents used, with their SHA-256 fingerprint. None of it changes if you later edit the supplier.
From each DDS you can download the record to print or save as PDF, and a ZIP with the record, the data and the original documents. It is what you would show in an inspection.
Frequently asked questions
- Is the supplier's email mandatory?
- Yes, in your due diligence record: Article 9(1)(e) asks for the name, postal address and email of whoever supplies you. It does not go in the DDS and TRACES does not ask for it.
- Do I need the supplier's tax ID to submit?
- No. The Regulation does not ask for it. It helps identify the supplier and, where there is an official register, validate it.
- Do I have to upload the GeoJSON with every shipment?
- No. What is mandatory is that the batch has the geolocation of its plots; you can reuse the ones you already hold for the supplier.
- Can I submit if the satellite flags loss on a plot?
- Only if, after review, the risk is negligible (for example, a rotation plantation that already existed in 2020, with evidence from the supplier). Otherwise, remove it from the batch or mitigate the risk first.