Custom EUDR software development for origin tracing
The deforestation regulation asks for something almost no purchasing organisation has: the geolocation of the plot where your raw material comes from. Not the country, not the supplier, but the piece of land. That data sits two or three links further up the chain, and the obligation lies with you.
What exactly is required of you
The EUDR prohibits placing certain commodities and products made from them on the market when they come from deforested land. You must demonstrate this with a system of due diligence requirements, known in trade as a due diligence system: collecting data on origin, assessing the risk, and mitigating that risk where necessary. You then submit a due diligence statement. In the Netherlands, the NVWA supervises compliance.
At the core of that data collection is geolocation. You record the exact place where the commodity was produced, and for plots above a certain size this means a polygon rather than a single coordinate. That is a different kind of data from what your purchasing administration holds, and it rarely comes from your direct supplier but from their supplier or from the grower themselves.
The date has been pushed back twice and now stands at 30 December 2026, with 30 June 2027 for SMEs and sole traders. Watch for the exception most often missed: the postponement does not apply to businesses trading in timber. There is also a proposal to limit the due diligence statement obligation to the first party placing the product on the EU market, which would make a real difference for downstream links. Check what applies to you before you build anything. The NVWA sets out what is expected of you at nvwa.nl.
Proving origin is not the only product data requirement on the way. For the digital product passport under the Ecodesign Regulation you gather largely the same supply chain data; see ESPR software. If you supply a very large undertaking, due diligence enquiries follow as well: supply chain due diligence.
Two record-keeping systems connect to this: the chain of custody under FSC and PEFC, which supports the EUDR but does not in itself meet it, and recording supplier visits for the due diligence side.
How we build this
Whether you can obtain the origin data determines whether this project succeeds. That is why we start with the supply chain rather than with the statement.
For each product and each raw material: who supplies you, who supplies them, and where your visibility ends. For most importers that visibility stops at the first link, and that is precisely the problem this needs to solve.
For some flows geolocation is already available because certification is in place; for others it has to be built from scratch. That distinction decides where you start.
Each sprint ends with something you can verify yourself, and we begin by recording plots and lots. Risk assessment and the statement mean nothing without them.
We take one incoming lot and try to trace it back to the plot. Where that stalls, you know which supplier the conversation needs to be with.
What the software actually does
The geolocated origin register is the core. Risk assessment and the statement are derivatives that mean nothing without that register.
Plots with geolocation
Coordinates or polygons per production site, linked to the supplier and the party it came from. Above a certain plot size a single point is not enough, and the system should enforce that difference rather than allow it.
Lot traceable to plot
From an incoming consignment back to the plots it was built from, including where material was mixed along the way. Without that chain, a statement is an assumption.
Risk assessment per origin
Country, region, supplier and the quality of the data supplied combine into a judgement, with the reasoning recorded. High-risk cases trigger mitigation measures, and those belong as tasks in the system rather than in a note.
Submission by suppliers
Your supplier has to submit plots and documents, often from outside the EU and without experience of this regulation. A simple, multilingual entry point works better than an exchange of emails and spreadsheets.
Block when origin is missing
A lot without complete origin must not flow quietly onto the market. Whether you block or merely warn is a choice you configure; either way the system makes visible what is missing before the consignment arrives.
A file kept for each statement
Which data, which assessment and which measures sat beneath a statement, and when. In an NVWA inspection that is what counts, not your current position.
Who we build for
Your place in the chain determines whether you can obtain the data or have to enforce it. Four situations.
Importers
You place the product on the EU market first and therefore carry the heaviest burden. Your supplier is located outside the EU and often does not know the regulation; building the supplier-side data flow falls entirely to you. If you also import goods subject to a carbon levy, a separate declaration runs alongside it; see CBAM declaration software.
Processors of agricultural commodities
Cocoa, coffee, soy, palm oil and cattle come together in products where blending takes place. The difficulty is not the origin of a single batch but maintaining that origin throughout your process; this touches on origin traceability, which concerns organic certification. If you work with batches and blending, that touches on MES.
Wood and wood products
The exemption for smaller businesses does not apply to you: the postponement does not hold if you trade in wood. That makes your timeline shorter than that of your colleagues dealing in other commodities, and it is often overlooked.
Retailers and brand owners
You are furthest from the grower and have the least direct control. Your route runs through contractual requirements placed on suppliers and through whether they have their own supply chains in order.
Test your idea first: a working prototype in 1 day
With OneDayBuild, we turn your idea into something tangible in one day for €1,150, so you can see whether further development is worth the investment. Decide to go ahead with the full build? Then we credit the full cost.
Explore OneDayBuild →Technology and integrations
Geolocation is geographic data and requires proper polygon support, not just two text fields. In addition, the regulation is still evolving, so dates and thresholds should be configurable.
For collecting and verifying plot geolocations from suppliers, there is our supplier plot geolocation software.
Why Appfront
Geolocation is the whole obligation
Everything depends on whether you know the plot. We build the system around that, with genuine geographic storage rather than a coordinate in a text field.
The data comes from outside your business
You cannot demonstrate what your supplier does not provide. The supplier side is therefore the first thing that must work, and it must be usable for someone on the other side of the world.
Wood has not been granted a postponement
The date you read somewhere may not apply to you. We set the application date per product group in the system rather than assuming a single date.
Honest about what is still moving
The regulation has been postponed twice, and there is a proposal to limit the declaration obligation to the first party placing the product on the market. We build for configurability and make no claims about how the rules will ultimately read.
Security and privacy
This file contains data that is more commercially sensitive than it might appear. A complete overview of your plots and growers is a map of your sourcing chain, and that is exactly what a competitor would want. Confidentiality also applies towards your suppliers: a grower who can see in the portal which other growers you use is a problem. Each supplying party therefore receives its own separate, restricted access point.
On the evidence side, reproducibility matters. A due diligence statement rests on the data and risk assessment as they stood at the time; if a supplier later provides different coordinates, that must not silently alter the earlier statement. We store supplier data as it arrived and place a revised assessment alongside the previous one. In some countries, plot data can also be traceable to individual farmers, which makes it personal data; we handle it accordingly. How we ourselves approach security is set out in our information security policy; reports from outside come in via our vulnerability disclosure policy.
Frequently asked questions about the EUDR
The regulation applies from 30 December 2026, and for SMEs and sole traders from 30 June 2027. Application has been postponed twice, partly due to problems with the information system. Check the current date with the NVWA before basing your planning on it, as this file has been moving.
That depends on what you trade. The postponement for smaller companies does not apply to businesses trading in wood. This is the exception most often overlooked, and it is the difference between eighteen months and a few months of preparation time. So do not assume a single date for your entire range.
Because it is a piece of information your purchasing records don't hold, and it isn't with your direct supplier but with the grower. Above a certain plot size, a single coordinate is not enough and a polygon is required. That means genuine geographic storage and a portal through which someone at the other end of the chain can supply it.
Then you cannot substantiate the due diligence statement and you may not place the product on the market. That is a commercial problem, not an administrative one, which is why we build the flagging to catch gaps before the consignment arrives rather than after. You will know months earlier which flows are at risk.
There is a proposal to limit the obligation to submit a statement to the first party placing the product on the market in the Union, which would make a big difference for downstream links. Whether it will pass, and what exactly it would mean, is not yet certain. Have your position assessed by your lawyer; we build the system so that both variants fit.
Often as a starting point, because for some flows origin is already recorded. But a certificate is not a due diligence system: the regulation requires your own data collection, risk assessment and mitigation measures. We import existing certification data where possible and make clear which part is not yet covered.
Often, yes, and that's usually where the gain lies: the shipment is already there, the supplier is already there, only the origin data is missing. What can be integrated depends on your systems and on how your customs declarations are handled; we map that out before committing to anything. Connecting to procurement is done through integrations.
That depends on the number of raw materials, the length of your supply chain and whether the supplier portal is needed too. The origin register with the risk assessment is usually quick to put to use; the portal and integrations cost more. We give a reasoned estimate after the discovery phase.
Build EUDR software?
Take one incoming consignment and try to trace it back to the plot. Where you get stuck in the chain determines where this project begins. We build this as a standalone application and as part of a broader custom software project. If recording happens at receipt, we build that as an app.