EUDR Information System API V3: What Changed in July 2026

The European Commission published Implementing Regulation (EU) 2026/1565 on 14 July 2026, dated 13 July 2026. It entered into force on 17 July 2026 and changed how the EUDR Information System handles due diligence statements, simplified declarations, risk profiling, grouping and contingency arrangements.

For software teams, the practical result is EUDR Information System API V3. It is not a cosmetic update to V2. The service contracts, actors and response lifecycle have changed, and the first successful response is no longer the final reference needed for a shipment.

The short answer

• V3 submission starts with a UUID, not an immediately available reference and verification number.
• The Information System carries out automated risk profiling before making the reference or declaration identifier and verification number available.
• A standard Due Diligence Statement, a Simplified Declaration and downstream declaration verification are three distinct services.
• Grouping covers eligible declarations previously submitted by the same Information System user, or for the same operator by its authorised representative. It is not a general way to copy supplier reference records into a new filing.
• The current country benchmark still comes from Implementing Regulation (EU) 2025/1093: countries listed as low or high risk use that classification, while other countries remain standard risk.
• A technically valid GeoJSON file, a low-risk country classification or satellite evidence does not by itself prove that a product is deforestation-free or compliant.

The new lifecycle: UUID first, reference later

Under the amended Information System rules, each submitted Due Diligence Statement or Simplified Declaration is subjected to automated electronic risk profiling. Only after that profiling concludes does the system assign and make available the reference number or declaration identifier and the associated verification number. A competent authority can delay making those values available while it carries out the checks permitted by the Regulation. The risk status itself is not disclosed to the Information System user.

That creates a two-stage integration pattern:

1. Submit the declaration to the appropriate V3 service.
2. Receive and store the declaration’s UUID.
3. Retrieve status using that UUID instead of treating submission as complete.
4. Wait for the Information System to finish risk profiling.
5. Record the reference number or declaration identifier and verification number when they become available.
6. Handle rejection, amendment or withdrawal as a separate lifecycle event rather than overwriting the original submission record.

The Commission’s Operator API V3 reference also recommends avoiding high-frequency polling after submission. An integration therefore needs durable status tracking and controlled retry intervals—not a browser request that waits for a reference number.

Three V3 services, not one filing endpoint

The public acceptance contracts separate three jobs. The service names below are plain text because they describe the workflow; the separate technical links open the Commission’s raw WSDL files in XML, intended for software developers rather than normal product users.

Service	Who it is for	What it does	Developer contract
Due Diligence Statement V3	Operators and authorised representatives	Submits and manages standard Due Diligence Statements.	Raw WSDL (XML)
Simplified Declaration V3	Eligible micro or small primary operators and their authorised representatives	Submits and updates the separate Simplified Declaration route.	Raw WSDL (XML)
Verify Declaration V3	Downstream operators, traders and other authorised users	Checks whether an upstream DDS or Simplified Declaration is authentic and in a usable status.	Raw WSDL (XML)

The Simplified Declaration is not a shorter DDS for any small company. It is a specific route for an eligible micro or small primary operator that meets the conditions in Article 4a. The Commission’s EUDR Information System page is the safest starting point for the current manuals and technical files.

The verification service is also not a substitute for an operator’s own due diligence. It supports downstream actors in checking an upstream declaration; it does not decide whether the underlying goods satisfy every EUDR obligation. The separate downstream operator and trader API reference describes that boundary.

Grouping and contingency are separate concepts

The amended rules allow an Information System user to group individual statements or declarations by submitting a new declaration that references eligible declarations previously submitted by that same user. An authorised representative may also group declarations submitted for the same operator or micro or small primary operator.

This is narrower than a supplier-reference library. A buyer can still need to collect and retain upstream reference information, but holding those references does not automatically make them eligible for same-user grouping.

Regulation 2026/1565 also establishes contingency arrangements for periods when Information System functions are unavailable. A contingency reference number or declaration identifier is an authority-managed fallback for an outage. It should not be confused with a normal V3 UUID, a later system-generated reference, or a locally invented placeholder.

GeoJSON checks that still matter in V3

The V3 lifecycle does not relax the production-place data. The Commission’s current EUDR GeoJSON File Description v1.5 distinguishes two file contexts:

• Type I is used by the API and by producer-level import. Clearlane’s current source-resolved profile accepts Point, Polygon, MultiPolygon and GeometryCollection in this context; acceptance parity for GeometryCollection remains to be proven.
• Type II is used by the Information System’s commodity-level UI import. It permits Point, MultiPoint, Polygon and MultiPolygon and requires ProducerCountry for each feature.

Both use WGS84 coordinates in [longitude, latitude] order. Coordinates are processed to six decimal places, so a file should be checked again after simulating that precision change. Truncation can collapse two nearby positions into one, turn a ring into a line or reduce a polygon to zero area even when the original coordinates looked valid.

Other important checks include:

• a real ISO 3166-1 production-country code, not merely two capital letters;
• closed, non-self-intersecting polygon rings without unsupported holes;
• a polygon for a non-cattle plot larger than four hectares;
• the cattle-establishment exception to that four-hectare point rule; and
• the assembled declaration’s producer, commodity and final payload limits—not only the size of the original upload.

Clearlane’s EUDR geolocation requirements guide explains the point-versus-polygon rule in detail. The free EUDR GeoJSON validator and repair tool checks supported format rules in the browser and records meaning-preserving repairs.

Those are format and data-quality checks. They do not certify a declaration or prove legal compliance.

Country risk and satellite evidence: useful inputs, not verdicts

The Commission’s current country classification list presents the low- and high-risk countries adopted under Regulation 2025/1093. Article 1 of that act keeps a standard risk level for every country not listed in its Annex.

That classification affects the EUDR risk framework and some procedural obligations. It does not establish that an individual plot or shipment is compliant. A valid country code must therefore be resolved against the effective classification source; it should not be inferred from a methodology paper or from a supplier’s office address.

Satellite or other remote-sensing evidence can support an operator’s risk assessment—for example by identifying a change that needs review. It cannot prove on its own that the commodity was legally produced, that the supply-chain link is correct, or that every EUDR requirement has been met. The operator still owns the cited due-diligence conclusion. The Commission’s fifth EUDR implementation FAQ is useful non-binding guidance on how geolocation, traceability and due diligence fit together.

A practical V2-to-V3 migration checklist

1. Inventory every V2 assumption. Find code that expects a reference number in the initial submission response or uses a V2 namespace, role or activity value.
2. Separate the three services. Do not model DDS submission, Simplified Declaration and downstream verification as one generic call.
3. Persist the UUID and lifecycle. Make status retrieval, later reference issuance, rejection, amendment and withdrawal durable and auditable.
4. Keep grouping distinct from upstream references. Enforce the same-user or same-operator boundary before building a grouped declaration.
5. Revalidate assembled data. Apply current GeoJSON context, quantity, country, commodity, producer and final-byte limits to the final declaration—not only to individual source files.
6. Test in acceptance before production. Public WSDLs establish inspectable contract structure; they do not prove that credentials, business rules or a generated payload will be accepted.
7. Keep the risk status private. The amended rules say it is visible only to Information System actors. Do not infer or display a hidden status to the operator.

What Clearlane checks today

Clearlane currently provides cited EUDR scope and geolocation checks, deterministic GeoJSON repair, production-country validation and evidence-backed preparation. The public tool can establish that supported EUDR Information System format checks passed for a file.

Clearlane treats V3 as the current engineering contract candidate and preserves V2 as historical evidence. Its V3 live submission adapter remains disabled. Clearlane does not currently submit a legally effective DDS or Simplified Declaration, issue an official reference, expose the Information System’s hidden risk status, or certify that goods are deforestation-free. See how Clearlane’s preparation workflow works and the plain-language EUDR guide for the current product boundary.

This article is educational guidance, not legal advice, an Information System filing or a compliance verdict.