EUDR and FSC Chain of Custody: What the Certificate Does Not Cover

A wood-products exporter in Izmir opens an email from a German buyer she has supplied for years. Before the next shipment, the buyer needs the geolocation coordinates of every forest plot her timber came from, evidence that the harvest was legal, and a due diligence reference number. She forwards it to her quality manager with one question: does our FSC certificate not already cover this? It is the right instinct and the wrong conclusion, and a great many suppliers are about to learn the difference the hard way.

The EU Deforestation Regulation, Regulation (EU) 2023/1115, rewrites the terms of trade for seven commodities and everything made from them. A chain-of-custody certificate is one of the most useful things a supplier can bring to it, yet the certificate and the regulation answer two different questions. This article sets out what the regulation actually demands, where your certification carries real weight, and where the legal responsibility stays firmly with you no matter how many certificates sit in the file.

What EUDR asks for, and where a certificate was never aimed

Strip the regulation back to what it does to a supplier and it comes down to a change of question. A chain-of-custody certificate was built to prove one thing well, that this wood came from a controlled, certified source and stayed separate from uncontrolled material along the way. EUDR takes that proof and asks for more on top, because for wood and the other commodities in scope it now wants to know the specific ground the material grew on, not only that the source was certified. That is the shift every certificate holder has to absorb, and it is why a document that felt sufficient last year is suddenly being read far more closely.

Held against your certificate, the regulation's demands fall into two piles. Some of what it wants, a working chain-of-custody system was practically built to supply: a controlled source, clean separation from uncontrolled material, an externally audited trail. Other demands sit outside what the certificate was ever scoped to prove, from origin pinned to the exact plot, to legality measured across the full body of the producing country's law, to a deforestation-free status tied to a hard calendar date. Working out which demand lands in which pile is the real exercise, and far more useful than reading the regulation through one more time.

Why the demand lands on you, not on the scheme

The regulation hands the legal duty to the operator, the party that first places the goods on the EU market, and it is blunt that no certificate transfers that duty away. For a supplier in Türkiye, the practical point is that your EU customer is usually the operator, so every piece of information they owe the authorities comes straight back up the chain to you: the coordinates, the legality evidence, the answers behind their risk assessment. An FSC certificate does not put you in the operator's seat, yet it does not excuse you from feeding their file either, and that is exactly the part suppliers miss when they assume the logo settles everything.

Timing is why this sits on your desk now rather than later. The rules phase in for larger businesses first and for smaller ones after, and buyers are not waiting for those dates to find out whether a supplier can hand over plot-level data. They are screening already, certificate in hand, to see where the gaps are before a shipment hangs on the answer. The productive move is not to re-explain EUDR to yourself but to set your certificate against what it asks and surface the open questions early, which is what the rest of this article works through.

Where your chain-of-custody certificate does the heavy lifting

This is where a credible chain-of-custody system earns its place. FSC certification and the equivalent forest-product schemes were built to answer a question very close to the one EUDR asks: can you show, link by link, where this material came from and that it was kept apart from uncontrolled sources along the way. A working chain-of-custody certification already gives you supplier verification, documented input-output reconciliation, control over how certified and non-certified material is mixed or separated, and an audit trail that an external body checks every year. That is most of the traceability backbone the regulation assumes you already have.

The scheme owners have not stood still either. FSC and other programmes have added regulatory modules, geolocation data tools and aligned claims, specifically so that a certificate holder can reuse existing data for an EUDR file instead of building a parallel system from scratch. If you already run chain of custody, you are not starting at zero. You are extending something that works.

Where certification stops and due diligence begins

Here is the line every supplier and importer needs to understand. The regulation places the due diligence duty on the operator and says plainly that a certificate cannot discharge it. Third-party certification can feed your risk assessment and strengthen it, but it does not replace it, and an enforcement authority will hold the operator responsible regardless of what scheme labels a product carries. Treating a logo as a free pass is the single most common misreading of the rules.

Three gaps tend to remain even with a strong certificate. The first is geolocation. Many chain-of-custody systems prove that material is certified without yet recording the exact plot of origin to the coordinate, which is precisely what EUDR demands, and closing that gap is the live project for most scheme members. The second is the mass-balance question. Certification often lets certified and uncertified inputs be mixed and reconciled by volume, yet the regulation wants the specific product on the market to be deforestation-free, which sits far more comfortably with segregated or fully certified material than with a percentage claim. The third is legality and the 2020 cut-off as the regulation defines them, which can reach wider than a given certificate scope. The honest reading is that chain of custody carries you a long way down the road and then hands the wheel back to you for the last stretch.

A practical way to get ready

The suppliers who cope best are treating this as a sourcing and data project, not a paperwork exercise the week before a shipment. A sensible order of work looks like this. Map which of your products actually fall in scope, because a single bill of materials can pull furniture, packaging and printed inserts all under the rules at once. Check what your certificate really claims, segregated, fully certified or mixed, since that determines how much extra evidence each line needs. Start collecting geolocation from your own suppliers early, as this is the slowest and most contested piece. Run the legality and deforestation-free risk assessment against the country of origin and its benchmark rating. Then connect the result to your customer's due diligence statement, with the records to back it if an authority asks.

None of that has to be built alone. The same management discipline behind an ISO 14001 environmental management system gives you the risk-assessment and supplier-control habits the regulation rewards, and a supplier sustainability rating such as EcoVadis helps you screen the upstream partners whose data you now depend on. Pairing those with a sound chain-of-custody programme turns EUDR from a threat to your EU sales into something your better-prepared competitors have not finished yet. If you want to map your current certification against what the regulation will ask of you, our certification team can walk through your product range and your sourcing data and show you where the real gaps sit.