EUDR supplier contract clauses warranties indemnities liability

EUDR Contract Clauses: A Clause-by-Clause Drafting Guide for Buyers and Suppliers

Last updated · August 6, 2026

A note before you read: This post explains regulatory mechanics and common commercial practice. It is general information only - not legal advice. Contract language has legal consequences that vary by jurisdiction, governing law, and the specific facts of your supply chain. Have any clause reviewed by qualified legal counsel before you sign or send it.

Here is the problem in one sentence: the EUDR places full legal responsibility for the accuracy of a due diligence statement on the operator who places goods on the EU market - even when a supplier provided the underlying data. The regulation gives you no automatic contractual remedy when that data turns out to be wrong. You have to write one.

Under the EUDR, the operator or trader takes full legal responsibility for the accuracy of the due diligence assessment and the products being placed on the market. That responsibility does not transfer to the supplier just because the supplier signed a declaration. The contract is the only mechanism that creates a private-law claim when things go wrong.

This guide works through the ten clauses that matter most, explains what good drafting covers, and names the failure mode each clause prevents. It then turns the table: if you are a supplier, here is what to push back on and what evidence you need before you sign.

Why the contract gap is a real problem

EUDR penalties under Article 25 require Member States to set maximum fines of at least 4% of an operator's total annual EU-wide turnover for breaches of the regulation, alongside confiscation of the products and revenues derived from them. For a mid-sized importer, that figure can dwarf the value of a single supply contract. Yet most existing supplier agreements were drafted before the EUDR existed and contain nothing about geolocation, the 31 December 2020 deforestation cut-off, or due diligence statements.

EU buyers are already converting regulatory pressure into contract terms: warranties, audit rights, data duties, notification obligations, remediation duties, termination triggers, and indemnity language. The risk runs in both directions. A supplier that signs those terms without the underlying traceable evidence has converted a documentation gap into direct financial exposure.

Isometric illustration of a procurement negotiation table with two sides facing each other across a table covered in documents, maps, and geolocation data printouts, with a large calendar on the wall showing December 2026

Clause 1: Scope and definitions

What it does: Establishes which products and commodities the EUDR obligations in the contract apply to.

What good drafting covers: Define "Relevant Commodity" and "Relevant Product" by reference to Annex I of Regulation (EU) 2023/1115 - not by a static list of HS codes you copy-paste today. The regulation's product scope is subject to delegated acts; a static list will go stale. Define "Plot of Land" consistently with the regulation's meaning: the specific parcel of land where the commodity was produced, identified by geolocation coordinates.

Failure mode prevented: A contract that lists specific product codes can silently fall out of scope when the Commission updates Annex I. Tying definitions to the regulation itself means the contract tracks the law automatically.

Clause 2: Data delivery warranty

What it does: Obliges the supplier to deliver geolocation data that meets the EUDR's technical requirements, on time, before each shipment.

What good drafting covers: The warranty should specify:

Format: GeoJSON, using the WGS84 (EPSG:4326) projection system. For plots larger than four hectares, geolocation must be provided as a polygon; for plots under four hectares, a single GPS coordinate point is acceptable, with coordinates expressed to at least six decimal places.
Completeness: All plots contributing to the shipment, not just tier-1 farms. Aggregators and cooperatives must be covered.
Timing: Data delivered no later than [X] business days before the scheduled shipment date - not after the vessel has sailed.
Accuracy: A representation that the coordinates correspond to the actual production plots and have not been fabricated or estimated.

Failure mode prevented: Incomplete geolocation coverage is the most common reason DDS submissions are rejected at EU customs. A late or malformed GeoJSON file blocks the shipment. The warranty creates a contractual claim for the resulting losses; without it, the operator bears the cost alone.

Clause 3: Legality warranty

What it does: Warrants that the commodity was "legally produced" within the meaning of the EUDR.

What good drafting covers: "Legally produced" is not a single standard - it refers to compliance with the laws of the country of production across several distinct areas. The EUDR's "relevant legislation of the country of production" covers: (a) land use rights; (b) environmental protection; (c) forest-related regulations; (d) third-party rights; (e) labor rights; (f) human rights protected under international law; (g) the principle of free, prior, and informed consent (FPIC) as set out in the UN Declaration on the Rights of Indigenous Peoples; and (h) tax, anti-corruption, trade, and customs legislation.

The warranty should require the supplier to warrant compliance across all applicable areas - and, critically, to provide evidence rather than mere assurance. A signed declaration that says "we comply with all applicable laws" is not evidence; a land title, harvest permit, or FPIC record is.

Failure mode prevented: A supplier that warrants legality without holding the underlying documents has given you a warranty you cannot verify and they cannot defend. When an authority asks for the evidence file, neither party has it.

Clause 4: Change notification

What it does: Requires the supplier to notify the buyer before any change that could affect the EUDR status of a shipment.

What good drafting covers: The obligation should cover:

New plots being brought into production for the buyer's orders
New sub-suppliers or changes in the sub-supplier chain
Changes in origin (country, region, or specific farm)
Any information suggesting that previously supplied geolocation data may be inaccurate

The critical drafting point is timing: notification must be required before the affected shipment, not after. A clause that requires notification "promptly" or "as soon as practicable" is too vague to be useful.

Failure mode prevented: An operator who files a DDS based on last year's geolocation data, unaware that the supplier switched farms, has filed an inaccurate statement. The notification clause creates a contractual duty to prevent that scenario.

Clause 5: Audit and verification rights

What it does: Gives the buyer the right to verify the supplier's EUDR evidence through document review, site access, or third-party audit.

What good drafting covers: Specify four things clearly:

Scope: Document audit (records, geolocation files, legality evidence), site access (farm visits, processing facilities), and third-party verification by an accredited body.
Notice period: Reasonable notice for planned audits (e.g., 30 days); shorter or no notice for audits triggered by a specific concern.
Cost allocation: Who pays? A common approach is buyer-pays for routine audits; supplier-pays if an audit reveals a material breach.
Sub-supplier access: The right extends to the supplier's own supply chain, not just the direct relationship.

Supplier contracts should require full cooperation with audits and third-party verification, particularly for higher-risk origins. Without an explicit right of access, a buyer cannot verify the data it is legally responsible for.

Failure mode prevented: A supplier who refuses an audit cannot be compelled without a contractual right. By the time a competent authority asks for evidence, it is too late to negotiate access.

For buyers: Build the audit clause before you need it. Competent authorities can conduct risk-based audits and inspections at any time after the application date. Your ability to respond depends on having already verified your supplier's evidence.

For suppliers: Audit cooperation is not optional in practice — buyers who cannot audit will delist. Agree the scope, notice period, and cost allocation upfront rather than leaving it open-ended.

Clause 6: Step-in and remediation

What it does: Sets out what happens when geolocation data arrives late, fails validation, or is found to be inaccurate - without immediately triggering termination.

What good drafting covers: A well-drafted step-in clause should:

Define a cure period (e.g., 10 business days) during which the supplier can correct and resubmit data
Allow the buyer to suspend shipment during the cure period rather than cancel the order
Give the buyer the right to commission independent verification at the supplier's cost if the supplier cannot cure
Specify what happens to goods already in transit if the DDS cannot be validated

Failure mode prevented: Automatic termination on first data failure is commercially disruptive and often disproportionate. A step-in clause preserves the relationship while protecting the buyer's ability to stop a non-compliant shipment from entering the EU market. A rejected DDS means the product batch cannot be placed on the EU market until the data gaps are resolved and a compliant DDS is resubmitted. The cure period maps to that operational reality.

Clause 7: Termination triggers

What it does: Defines the circumstances in which the buyer can terminate the contract for cause on EUDR grounds.

What good drafting covers: Termination for cause (rather than convenience) should be available in at least three situations:

Repeated failure: The supplier has failed to deliver compliant data on more than [X] occasions within [Y] months, or has failed to cure within the agreed period
Post-2020 deforestation: Evidence emerges that any plot used for the buyer's orders was subject to deforestation after 31 December 2020 - the fixed cut-off date that was not affected by the application date delays
Refusal of audit: The supplier refuses or materially obstructs an audit or third-party verification

Failure mode prevented: Without defined triggers, a buyer who discovers post-2020 deforestation in their supply chain has no clean contractual exit. They may be forced to continue purchasing from a supplier whose goods they cannot legally place on the EU market.

Clause 8: Indemnity and liability caps

What it does: Allocates financial responsibility when a supplier's data failure causes the buyer to incur regulatory penalties, shipment costs, or market access losses.

The honest discussion: This is the clause where both sides need to be realistic. EUDR fines are calculated on the operator's annual EU-wide turnover - a figure that can be many times larger than the value of any individual supply contract. An uncapped indemnity from a supplier covering the buyer's full regulatory exposure is often commercially unsignable - and an unsignable clause creates its own risk: suppliers sign what they cannot support, which means the indemnity exists on paper but is worthless in practice.

A more workable approach:

Cap the indemnity at a multiple of the annual contract value (e.g., 2-3×), with carve-outs for fraud, wilful misconduct, and deliberate misrepresentation of geolocation data
Require the supplier to maintain insurance covering EUDR-related liabilities (supply chain liability or trade credit insurance products are emerging in this space)
Distinguish between data failure and fraud: A supplier who makes an honest error in geolocation collection is in a different position from one who fabricates coordinates. Drafting should reflect that distinction

Failure mode prevented: A clause that is too aggressive will be signed by suppliers who cannot honour it, giving the buyer false comfort. A proportionate, insurable indemnity is more likely to be backed by real financial capacity.

Clause 9: Record retention and survival

What it does: Requires the supplier to retain EUDR-related records for the regulatory minimum period, and ensures the obligation survives contract termination.

What good drafting covers: EUDR traceability requirements mandate that all due diligence records, DDS documents, geolocation data, and risk assessments be retained for a minimum of five years and be accessible for inspection by competent authorities on demand. The contract should:

Mirror that five-year minimum
Specify that records must be retrievable in a usable format (not just archived)
Explicitly state that the retention obligation survives termination of the contract - a buyer who is audited three years after a supplier relationship ends still needs access to the underlying evidence

Failure mode prevented: Without a survival clause, a supplier who terminates the relationship has no contractual obligation to maintain records the buyer may need for a regulatory audit.

Clause 10: Downstream pass-through

What it does: Ensures that DDS reference numbers travel with the goods through the supply chain and that the linkage between reference number, batch, and quantity remains intelligible to the recipient.

What good drafting covers: Each DDS receives a unique reference number that must travel with the product through the supply chain, and downstream traders need this number to meet their own obligations. The contract should require:

The supplier (or operator) to provide the DDS reference number with each shipment documentation set
The reference number to be linked to a specific batch, quantity, and HS code - not just provided as a standalone number
The buyer to pass the reference number to their own downstream customers in a format that maintains the batch-to-reference linkage

Failure mode prevented: A DDS reference number that arrives without the batch and quantity mapping is useless for downstream compliance. The pass-through clause keeps the chain of evidence intact from first placement to final sale.

For suppliers: what to push back on, and what to build

If you are a supplier receiving a contract with EUDR clauses, the most important question is not whether to sign - it is whether you can perform what you are signing.

Push back on:

Uncapped indemnities that exceed your insurance coverage and financial capacity
Audit rights with no notice period, no defined scope, and no cost allocation
Termination triggers that fire on a single data error with no cure period
Warranties that cover areas of law where no legal framework exists in your country of production (the EUDR itself acknowledges this gap)

Build before you sign:

A complete geolocation file for every plot you supply from, in GeoJSON format, validated against satellite data
A legality evidence file covering each of the eight areas of law applicable to your origin country - not a declaration, but actual documents (land titles, permits, FPIC records where relevant)
A change-management process so that new plots or sub-suppliers are captured before they enter a shipment
A record-keeping system that can produce the full evidence file on demand, for five years

The commercial reality is this: a supplier with strong, traceable evidence is in a better negotiating position on every clause above. The evidence is not just a compliance requirement - it is the foundation that makes the contract safe to sign.

Practical sequencing: which contracts to reopen first

Not every supplier contract needs to be renegotiated before 30 December 2026. Prioritise in this order:

For contracts that will still be running on 30 December 2026 and have not been renegotiated, consider a side letter or contract addendum rather than a full renegotiation. A well-drafted addendum can add the ten clauses above as a schedule without reopening commercial terms. It is faster, cheaper, and less likely to trigger a broader renegotiation.

For new contracts signed after today, build the EUDR schedule in from the start. It is far easier to negotiate EUDR terms before a commercial relationship is established than to retrofit them into an existing one.

The application date is firm. The European Commission has confirmed there will be no further postponement. Large and medium operators must comply from 30 December 2026; micro and small operators from 30 June 2027. Contracts that are silent on EUDR on those dates leave the operator exposed with no private-law remedy against the supplier.

Where to go from here

The EUDR Navigator obligations checker can tell you your exact role and deadline based on your company size and where you source from. The supplier data templates give you a starting point for the data delivery requirements that underpin clauses 2 and 3 above.

For the contract itself: use this guide to frame the conversation with your legal team and your suppliers. The clauses are not boilerplate - they need to be calibrated to your specific supply chain, governing law, and the commercial relationship on each side of the table.