As a rule, EU operators (excluding non-SME traders) must establish and maintain a Due Diligence System, comprising three steps. Initially, they gather required information outlined in Article 9, including product details, suppliers, production country, and proof of legal harvest. Crucially, they must obtain geographic coordinates of production sites and provide relevant data in a due diligence declaration via the Information System. Failure to gather this info results in a prohibition on marketing or exporting the product, constituting a Regulation violation and potential penalties.

Next, companies input collected data into their due diligence systems’ risk assessment pillar to evaluate the risk of non-compliant products entering the supply chain, using criteria described in Article 10. Operators demonstrate how they’ve cross-referenced collected information with risk assessment criteria.

Lastly, if a significant risk of non-compliance is detected, operators must take appropriate mitigation measures outlined in Article 11 to ensure the risk is insignificant, documenting these actions. Operators solely sourcing raw materials from low-risk countries enjoy simplified due diligence obligations. They gather information per Article 9 but aren’t obligated to assess or mitigate risks unless they receive or become aware of relevant information indicating non-compliance risks.