The most common mistake in EUDR's five-year storage obligation is that companies keep the reference number of their due diligence declaration, but not the documents on which that declaration is based. The number alone tells a supervisor little; what matters are the geolocation data, the supplier declarations, the risk assessment and the proof of origin documents that should be behind it. If those are missing, you have a declaration without substantiation.
This mistake usually does not arise from carelessness, but from the way dossiers grow in practice: by email, by colleague, by supplier, without a fixed location. Below is where it concretely goes wrong and what can be done about it.
Documents become scattered across systems and people
A buyer requests geolocation data from a supplier, saves the file in their own mailbox and forwards it to accounting for the declaration. Five years later, that buyer may no longer be employed, the mailbox has been cleaned out and the file is nowhere else to be found. The regulation does not ask for a process that depends on one person, but for documentation that remains traceable, even if people change positions. Those who record dossiers by product stream instead of by colleague avoid this problem to a large extent. the overview of storage obligations per commodity shows which documents are required for your product.
Only the latest version is kept
Geolocation data and supplier information change: a parcel is re-surveyed, a supplier switches sourcing region, a country's risk classification changes. Many companies overwrite old files with the new version, because that feels intuitive as an update. For the storage obligation, that is precisely a problem: if an inspection takes place regarding a delivery from two years ago, the documentation from that time must be available, not the current state of affairs. Overwriting versions instead of adding to them is thus one of the quieter mistakes, because no one notices that something is missing until it is needed.
The risk assessment itself is not kept
A second recurring mistake is that companies keep the source documents but do not record how they arrived at their risk assessment. The regulation asks for substantiation of the weighing, not only for the loose building blocks. Without that substantiation, it is no longer possible afterwards to reconstruct which information was considered and what conclusion followed from it. The risk assessment itself remains the responsibility of the economic operator; recording it is what the storage obligation means in practice.
Storing in a location that does not hold up
Files on a local hard drive, in a private cloud account of an employee, or in a system that was not carried along after a merger or migration: this also happens more often than expected. Five years is a long period in IT terms, and systems that seem obvious today do not automatically still exist in 2030. A fixed, personnel-independent storage location per product stream prevents documentation from moving with an account that will one day be terminated. How data is secured and remains accessible in the process is explained on the page about how we handle your data.
How to prevent this
The core of the solution is simple to state, even if implementation takes time: create one dossier per product stream, add new information instead of overwriting old, and ensure the dossier does not depend on one employee. This applies to geolocation data, supplier declarations, correspondence about origin and the substantiation of the risk assessment. Those who prefer not to set up this process entirely themselves, can read how a dossier is built and stored with us and thus see which part of the work is taken over and which part remains with the economic operator.
The exact requirements for the storage obligation remain part of the official regulation and the guidance of the competent supervisory authority; if you have doubts about your specific situation, a lawyer or the supervisory authority is the appropriate point of contact. If you first want to know which role and which obligations apply to you, then the free role check in a few questions provides an initial direction, after which you can read further on the knowledge base per topic.