Why Manual EUDR DDS Filing Fails at Scale

Manual EUDR filing can work when submission volumes are low. The trouble starts when teams are processing hundreds or thousands of Due Diligence Statements, correcting errors under time pressure, and trying to keep customs and internal records aligned.

Three features of the EU Deforestation Regulation's Information System make that difficult:

• A submitted Due Diligence Statement can usually be amended or withdrawn for only 72 hours, and that window may close sooner.
• The Information System stores no reusable master data for fields such as HS codes or scientific names.
• Bulk submission requires a SOAP API integration that must pass Commission conformance testing before it can connect to production.

None of these constraints makes manual filing impossible. Together, however, they make it increasingly fragile as submission volume and operational complexity grow.

This article explains where that fragility comes from, using the regulation, its implementing acts, and the European Commission's own guidance.

Why the 72-hour correction window matters

Article 5(1) of Commission Implementing Regulation (EU) 2024/3084 states that the Information System enables users to amend or withdraw a Due Diligence Statement within 72 hours after the reference number was made available.

That is the standard correction window. Article 5(3) closes it earlier once any of these events occurs:

• you are notified of an intention to carry out a check on the DDS or the product, for the period of the check;
• the relevant product is placed on or made available on the Union market;
• the reference number is provided or made available to customs authorities before release for free circulation or export.

Article 5(2), as amended by Implementing Regulation (EU) 2026/1565, adds a fourth: a DDS can no longer be amended or withdrawn once it has been referenced in a grouped statement.

Article 5(4) provides a limited exception. A competent authority may extend the period by no more than 8 calendar days, but only after the initial 72 hours have expired, following an individual and reasoned request, and for circumstances beyond the user's control. The request must also confirm that none of the Article 5(3) blockers applies.

For operations teams, the practical implication is straightforward: errors must be found in less than 72 hours and, in many cases, before the reference number reaches customs. A process that finds mistakes during a month-end review will often find them too late to use the normal amendment route.

The system does not remember anything for you

Many manual workflows assume that the portal will remember frequently used product information. It does not.

Commission FAQ v5, section 7.4, is explicit: the Information System does not store frequently used data such as HS codes or scientific names for autofill. What it offers instead is the ability to duplicate a previously drafted or submitted statement, plus an import button for production place information from a predefined GeoJSON file. The Commission adds that it remains the operator's responsibility to make the necessary changes in any duplicated statement.

Duplicate-and-edit can save time, but it can also carry an old value into a new consignment. A scientific name may be valid in form while being wrong for the current shipment, and the error may not be noticed until the amendment window has closed.

Teams that need reusable master data with validation attached must therefore maintain it outside the Information System.

The size limits are real and they are reachable

FAQ v5, section 7.12, sets out what one DDS can hold:

Section 7.16 adds a 25 MB file limit, which the Commission notes allows for more than one million geolocation points or polygon vertexes in total. Where a file exceeds it, the recommended fixes are cartographic: points instead of polygons for areas under 4 hectares and for cattle supply chains, and reduced vertex resolution that still represents the area legitimately.

At higher volumes, these geometry decisions are safer to validate systematically than during manual filing.

Geolocation has a defined shape

Article 2(28) EUDR requires at least six decimal digits for latitude and longitude. Per FAQ v5, section 7.17, the system validates digit count and, where fewer than six are supplied, fills the remaining digits with zeroes rather than rejecting the file.

In practice, an under-precise coordinate may be accepted and padded rather than rejected. An internal validation step is needed if the original precision matters to the submission.

Section 7.26 confirms GeoJSON is the only accepted format for uploading geolocation data in a file, because it is the only non-proprietary standard supporting the required extra properties with an enforced coordinate system. Exclusive use was announced in April 2024.

The EUDR API, in specifics

The available EUDR API documentation is more specific than the Commission's main registry interface may suggest.

The Commission's due diligence registry page confirms you can manage Due Diligence Statements and Simplified Declarations in bulk through a machine-to-machine connection via an Application Programming Interface, and states that the API reference documentation for economic operators is publicly available on CIRCABC. The Commission advises consulting that folder regularly, because the specifications are revised as the rules change.

Two details matter when scoping an integration.

It is SOAP, not REST. The Commission's published API specification for operators lists the required technical expertise as the ability to develop SOAP web service calls, and distributes WSDL and XSD files per service. Authentication uses your EU Login username together with a separate Authentication Key generated in the system, under a WS-Security policy enforcing confidentiality, non-replay, and username-with-digest-password credentials over HTTPS. Treat that Authentication Key as a credential: the Commission's own guidance states it is private and should only be used with your application.

You have to pass conformance tests first. Systems connecting to the central EUDR system must pass a set of Conformance (CF) tests in an EU-hosted testing environment before they are allowed to connect to production. The Commission specifies four as a minimum:

• performing a basic connection with authentication;
• submitting a DDS;
• retrieving the reference number of a previously submitted DDS;
• managing errors that occur when submitting a DDS.

Three further tests are proposed on top:

• amending a previously submitted DDS;
• retracting a previously submitted DDS;
• retrieving another operator's DDS given its reference and verification numbers.

Together, these form the CF1 through CF7 test surface. Error handling is a mandatory test in its own right, while amendment and retraction are separate capabilities. The 72-hour window therefore has to be reflected in the integration design, not treated only as a policy requirement.

Conformance testing happens on the ACCEPTANCE environment. Registration there does not register you in production, and submissions there carry no legal value.

Grouping: what changed in July 2026

Guidance written before mid-2026 may not cover one of the provisions most relevant to high-volume filing.

Implementing Regulation (EU) 2026/1565 of 13 July 2026 amends 2024/3084 as regards the submission of due diligence statements, simplified declarations for micro or small primary operators, contingency arrangements, and other measures simplifying use of the Information System. Its new Article 8a introduces grouping.

Users may group individual Due Diligence Statements or Simplified Declarations by submitting a new statement that references previously submitted ones via their reference numbers or declaration identifiers. The Information System then assigns a specific status to the individual statements marking them as grouped and replaced. The grouped statement represents them for compliance purposes, and for Articles 4(7) and 26(4) EUDR you communicate the grouped reference number rather than the individual ones.

Recital 7 explains that grouping was introduced to address technical limitations on statement file sizes and to avoid disruptions to customs procedures.

Grouping can make large submissions more manageable, but it also creates another lifecycle to track. An individual reference number changes status when it is absorbed into a group, Article 5(2) affects whether it can later be amended, and the grouped reference number must reach customs. Teams therefore need a reliable record of both the individual statements and the group that replaced them.

Two system states users cannot fully control

Your risk status is hidden. Under the amended rules, each submitted statement is subjected to automated electronic risk profiling and assigned a risk status which is not disclosed to the Information System user. Competent authorities may review a statement at any stage after submission, including after grouping, and assign a new status that takes precedence.

Because users cannot see the assigned risk status, the part they can control is the quality and defensibility of the submission. That makes an internal evidence record important rather than relying on the portal as the sole record.

A rejection reclassifies your product immediately. Where a DDS or Simplified Declaration is rejected, the relevant product is deemed not covered by a statement as required by Article 3(c) EUDR from the moment of rejection, and the rejection is reflected by a specific status in the system.

Questions people actually ask

Is there an EUDR API, and where is the documentation?

Yes. The Commission publishes API reference documentation for economic operators on CIRCABC, linked from its due diligence registry page. It is a SOAP web service with WSDL and XSD files per service, and access to production requires passing conformance tests on the acceptance environment first.

How often do I have to submit a DDS?

A statement is required before placing relevant products on the market or exporting them, so frequency follows your consignment pattern rather than a calendar. Since July 2026, Article 8a grouping lets you replace multiple individual statements with one grouped statement, and Article 4a provides for simplified declarations by micro or small primary operators. Neither removes the underlying obligation.

Can I fix a mistake after submitting?

For 72 hours, yes, unless the product has already been placed on the market, the reference number has already gone to customs, you have been notified of a check, or the statement has been referenced in a grouped statement. After that, only a competent authority can extend the window, by at most 8 calendar days, on a reasoned request.

Do I need a separate DDS for each export destination?

No. Per FAQ v5, section 7.20, the destination country is not entered when submitting for export, so multiple destinations do not require separate statements.

Does the reference number have to appear on my shipping documents?

On the customs declaration, yes. FAQ v5, section 7.21, cites Article 26(4) EUDR: the reference number or declaration identifier must be made available to customs authorities, except for export by a downstream operator. For other shipment documents, including intra-EU transport, the Commission states there is no specific EUDR provision requiring it.

Do I need separate accounts for different roles?

No. Per FAQ v5, section 7.29, a single economic operator account can carry multiple roles: operator, non-SME downstream operator, non-SME trader, and authorised representative.

Can I check whether a reference number is valid?

Yes. FAQ v5, section 7.25, describes a dedicated feature that checks DDS reference numbers, simplified declaration identifiers, and related verification numbers, and which also accepts CSV files for bulk checking.

Should I keep my own records if the system stores everything?

Yes. FAQ v5, section 7.14, notes that storage in the Information System is time-limited by the implementing regulation, and that users have the option to export a DDS to PDF and extract geolocation coordinates to a separate file for their own record-keeping. The system is a submission channel, not your archive.

Where manual work actually breaks

Manual filing usually breaks down gradually, through a series of operational problems.

First, the correction loop exceeds the window. Errors surface at review rather than at entry. By then the 72 hours have run, or the reference number has reached customs, and the only remaining path is a reasoned request to a competent authority.

Second, duplicate-and-edit drift compounds. Because the system holds no master data, every statement inherits from the last one someone copied. Errors propagate rather than repeat.

Third, reconciliation grows faster than volume. Once statements can be individually submitted, grouped, replaced, rejected, risk-profiled, or referenced at customs, the number of states exceeds what a spreadsheet column can express. Teams start spending more time locating status than moving submissions.

Fourth, integration becomes difficult to avoid. Above a certain volume, the API is likely to become the practical submission channel. It requires schema-valid payloads, credential management, conformance-tested error handling, and amendment and retraction paths. At that point, the organisation is effectively operating integration infrastructure, whether or not it was designed as such from the start.

What deterministic engineering changes

In EUDR work specifically, this means:

• structured intake with validation at entry, not at review, so errors surface inside the 72-hour window;
• your own master data for HS codes, scientific names, and production places, since the Information System holds none;
• deterministic geometry handling against the 25 MB and per-statement limits before submission, not after rejection;
• explicit lifecycle state per reference number, including grouped, replaced, and rejected;
• full request and response logging, because the system's risk assessment is invisible and your own evidence is what you will be asked for;
• exception queues with named owners, because the deadline for a correction is measured in hours.

The useful measure of automation here is whether it helps the team detect and correct errors within the available window.

Case study: engineering an EUDR submission system

We supported a French operator preparing for tens of thousands of monthly DDS submissions, with burst days exceeding ten thousand entries. Manual handling was not viable at that volume.

The engineered backend included:

• an internal JSON-based API wrapping the Commission's SOAP interface, so product teams never hand-build envelopes;
• deterministic schema and geo-data validation ahead of submission;
• automated SOAP envelope construction against the published WSDL and XSD files;
• an explicit error taxonomy mapped to the CF2 through CF7 conformance scenarios: submission, reference retrieval, error handling, amendment, retraction, and cross-operator retrieval;
• controlled retry logic for transient failures;
• immutable submission state tracking per reference number;
• amendment and retraction endpoints built against the 72-hour constraint;
• full request and response logging;
• multi-operator orchestration under a single economic operator account with multiple roles.

The operational result was less manual entry, faster diagnosis of failed submissions, and a clearer view of each reference number's lifecycle.

For the production write-up: EUDR Compliance Bridge: DDS Submission at Scale

When manual filing is still the right answer

Manual filing remains a reasonable choice when submission volume is low, consignment patterns are stable, and someone can reliably check a statement on the day it is filed. Many operators may never need more than the Commission's web interface.

The threshold is not a volume number. It is this question: can you detect and correct an error in a submitted statement within 72 hours, every time, including the week your specialist is on leave? If the answer is no, the exposure is already there.

Evaluating your readiness

• expected monthly submission volume and burst variability;
• time from submission to customs declaration, which is your real correction window;
• who validates a statement, and how quickly;
• whether master data lives anywhere other than previous statements;
• integration surface with ERP or internal systems;
• how a rejected submission is traced and corrected, and by whom;
• whether you hold exportable evidence independent of the Information System.

If those questions are difficult to answer, it is worth testing the workflow before a live deadline exposes the gaps.

Dates and where this sits

The current EUDR application dates are 30 December 2026 for large and medium operators, downstream operators and traders, and for micro and small operators handling products already covered by the EU Timber Regulation. Most other qualifying micro and small operators have until 30 June 2027. Regardless of date, production and acceptance require separate TRACES NT registration and roles.

At scale, this becomes a RegOps operating-model problem: ownership, exceptions, evidence, and state must remain coherent across the process. The native EUDR API integration handles the submission edge, while controlled compliance workflow automation defines the guardrails around it.

If EUDR is material to your operations and volume will not stay small, treat it as integration and state management now. You can also get in touch.

Sources

All operational claims above are drawn from the following. Regulations are linked by ELI, which is stable.

• Regulation (EU) 2023/1115: the EU Deforestation Regulation itself
• Commission Implementing Regulation (EU) 2024/3084: functioning of the Information System, including Article 5 on amendment and withdrawal
• Commission Implementing Regulation (EU) 2026/1565: 13 July 2026 amendment introducing Article 8a grouping, Article 4a simplified declarations, and contingency arrangements
• Regulation (EU) 2025/2650: current application dates
• EUDR implementation FAQ, 5th iteration: European Commission, sections 7.4, 7.12, 7.14, 7.16, 7.17, 7.20, 7.21, 7.25, 7.26, 7.29
• The Information System of the Deforestation Regulation: European Commission
• Deforestation due diligence registry: European Commission guidance on bulk API submission and CIRCABC documentation
• EUDR roles and responsibilities: European Commission

Reviewed against these sources on 16 August 2026. EUDR has been amended more than once; confirm the current position against the primary sources before acting. This is operational guidance, not legal advice.