Compliance audit · eudr-a2a

Art. 3. Prohibition on placement

Relevant commodities and relevant products shall not be placed on the market [..] unless [..] (a) [..] deforestation-free; (b) [..] in accordance with the relevant legislation of the country of production; (c) [a DDS] has been made available [..].

This avoids the false-attestation trap: a signed document with the verbatim "no or only a negligible risk was found" wording over a non-negligible verdict would be a literal false statement.

Found 2026-10-11. legally_produced aggregated the legality findings as all(status != Failed), so an unresolved check counted as a clear one — and the tenure-and-permits check is unresolved on every statement by construction, because no satellite reads a land registry. Every statement the engine had ever issued therefore said the goods were legally produced, beside a land_tenure_and_permits: unknown of its own. The aggregate now requires every applicable finding to be Verified, which is what the field's own doc comment had always said.

Test: composite_risk tests cover every tier × fail-fraction combination including the high-risk floor.

Art. 4(1). Operator must not place product

The runner emits PipelineEvent::Blocked on non-negligible verdicts. The CLI and server present this state and refuse to mark a task paid on the assessment-only schema.

Art. 4(2). DDS reference with the customs declaration

The scenario carries an optional production.customs_declaration_ref (MRN or local reference). The report's Customs & Shipping (3b) section surfaces this field; the engine does not pre-validate the MRN format (operators in different member states use different formats).

Art. 4(3). Five-year retention

Operators shall keep [..] the due diligence statements they have submitted [..] for a period of five years from the date of submission.

Art. 8. Three steps of due diligence

Art. 9(1). What the operator collects

Coverage matrix is surfaced in the report as the "Article 9(1) · information collected" panel.

Art. 9(1). Five-year retention

Same five-year horizon as Art. 4(3). The receipt CID stays as the audit anchor even after operator-side erasure (Art. 17(3)(b) GDPR).

Art. 10. Risk assessment

Reported in the report's "Article 10 · risk assessment" panel. Criteria (a)–(k) listed with what the engine assessed and what it did not. The composite-risk function is exposed and tested:

composite = clamp(fail_fraction × 0.85 × tier_mult, 0, 1)

• Tier multipliers: Low ×0.5, Standard ×1.0, High ×1.2
• High-tier floor: composite >= 0.15 regardless of fail_fraction

Test: 8 cases in composite_risk tests.

Art. 10(2)(j). Risk of mixing / substitution

Operator-declared third-party certifications (RSPO, FSC, RA, Fairtrade, ISCC_EU, PEFC, …) are recorded in scenario.certifications and rendered in the report. They are surfaced in the Art. 10 row as mitigation evidence, not a substitute for due diligence.

Art. 11. Risk mitigation

The report's Article 11 panel is verdict-aware:

• Verdict negligible → "No mitigation required."
• Verdict non_negligible → "Mitigation required" with the four

Art. 11 measures listed, plus a note that the report must NOT be submitted as a negligible-risk attestation.

Art. 12. DD system + Art. 4(2) submission

The report's Article 12 panel records the engine identity (eudr-a2a, vortx-ai/eudr), notes annual reporting under Art. 12(3), and flags submission status:

• Pre-submission with engine-issued reference (eudr-a2a:engine:…)
• After TRACES SOAP submission, the official reference replaces it

TRACES SOAP submission is on the roadmap; the engine output is otherwise submission-ready.

Art. 13. Simplified due diligence

simplified_dd_applied is set true only when the production country is on the Implementing Reg. 2025/1093 low-risk list. The flag is recorded in conclusion.simplified_dd_applied and surfaced as a tag on the report.

Art. 29. Country benchmarking

The country tier table is data/country_benchmarks_2025_1093.json, loaded at startup. High-risk (4): BY, MM, KP, RU. Conservative low-risk list (~140). Anything unlisted resolves to STANDARD.

Art. 38 (replaced by 2025/2650). Application dates

Surfaced in the agent card's /spec page on the public console.

Signed proof

Tamper detection test: tamper_detected.

TRACES NT submission output

Three formats, one CLI:

eudr compile samples/scenarios/civ-cocoa.json --out civ.json

# Engine-annotated XML (verbose; namespace urn:vortx-ai:eudr-a2a)
eudr export-traces civ.json --format engine --out civ.engine.xml

# EU Commission TRACES NT v2 shape. The wire format the Information System accepts
eudr export-traces civ.json --format official --activity IMPORT --out civ.official.xml

# Full SOAP envelope with WS-Security UsernameToken-Digest, ready to POST
EUDR_TRACES_USERNAME=service@deployer.eu EUDR_TRACES_PASSWORD=… \
eudr export-traces civ.json --format soap --activity IMPORT --out civ.soap.xml

civ.official.xml namespace: http://ec.europa.eu/tracesnt/certificate/eudr/submission/v2. Root element: <eudr:SubmitStatementRequest>. Field names match the EU Commission's v2 API spec (operatorType, statement.activityType, statement.countryOfActivity, statement.commodities[].hsHeading, statement.commodities[].producers[].geometryGeojson base64-encoded, operator.operatorAddress.fullAddress, …).

civ.soap.xml adds a SOAP 1.1 envelope with the WS-Security header: UsernameToken with PasswordDigest = base64(SHA1(nonce ‖ created ‖ password)), fresh 16-byte CSPRNG nonce, RFC-3339 UTC Created timestamp. TRACES NT's EUDRSubmissionServiceV2 endpoint accepts this verbatim.

civ.engine.xml is what we already emitted. Useful for archival and internal audit because every <EngineConclusion> and source-cited element is namespaced separately from the official submission shape.

Continuous monitoring (Art. 8(2))

# A2A SendMessage on the new skill (advertised in the agent card):
curl -X POST https://eudr.dev/a2a/rpc \
 -H 'content-type: application/json' \
 -d '{"jsonrpc":"2.0","id":"r","method":"SendMessage",
 "params":{"task_type":"eudr.monitor.subscribe",
 "input":{"dds_reference":"eudr-a2a:engine:CI:…","cadence":"monthly"}}}'

The agent re-runs the deforestation check on the cadence, when a new Hansen loss year appears post-cut-off for any sampled cell, the subscription emits a SignedReceipt-shaped event citing Art. 8(2). The first re-check after each annual Hansen update is free; later checks are priced per call.

civ.xml is a namespaced XML carrying every Annex II point that TRACES NT requires:

<DueDiligenceStatement
 xmlns="urn:vortx-ai:eudr-a2a:dds:v2025_2650"
 schema="eu.eudr.dds.v2025_2650"
 submission_status="pre_submission">
 <Header>..</Header>
 <Operator>..<EORI>..</EORI>..</Operator> <!-- point 1 -->
 <Product><HsCode>..</HsCode><Cn8>..</Cn8>..</Product> <!-- point 2 -->
 <Geolocation><Plot index="0">..</Plot>..</Geolocation> <!-- point 3 -->
 <!-- point 4 deleted by Reg. (EU) 2025/2650 -->
 <Declaration verbatim="true">..</Declaration> <!-- point 5 -->
 <Signature>
 <Name>..</Name><Place>..</Place><Date>..</Date>
 <Function>..</Function>
 <CryptographicProof>
 <Algorithm>ed25519</Algorithm>
 <SignatureBase64>..</SignatureBase64>
 <PublicKeyBase32>..</PublicKeyBase32>
 <SignerDid>..</SignerDid>
 </CryptographicProof>
 </Signature> <!-- point 6 -->
 <EngineConclusion>..</EngineConclusion>
</DueDiligenceStatement>

submission_status is pre_submission for filable, not_filable when the schema is .assessment, draft when the document is unsigned. A production TRACES adapter replaces the engine namespace with urn:eu:eudr:dds:v1, wraps the document in the official SOAP envelope, and POSTs to https://eudr.webcloud.ec.europa.eu/tracesnt/. The <EngineConclusion> block is dropped on submission (it is the engine's audit annex, not part of Annex II).

What the engine does NOT do

Documented openly so an auditor can see the boundary:

1. Art. 9(1)(b). Lawful production. emem.dev's own response carries

a legality_disclaimer saying production-law checks are structurally outside Earth-observation scope, and that is still true: nothing here reads a land registry, a harvest permit or a record of free, prior and informed consent. What changed on 2026-10-11 is who answers. The engine no longer guesses from a country tier; the operator records their own Art. 3(b) assessment against the supplier, naming the assessor, the documents read and how long it holds, and the statement carries that verbatim. Without one, the statement is indeterminate. A partner legality provider can still sit behind the LegalityProvider trait; it is no longer the only way to reach a filable statement. The report's Article 10 panel marks (c)–(e), (j) and (k) as "Not assessed by this engine."

1. TRACES NT submission. The engine produces a submission-ready

document. The SOAP envelope and CIRCABC credential flow are on the roadmap.

1. HSM-backed signing in production. The bundled dev key is

deterministic and useful only for development. The server refuses to boot with the dev key over HTTPS. Production deployments must set EUDR_AGENT_PRIVKEY_B64 to a real 32-byte secret (ideally sourced from an HSM via KMS).

1. Replacement for the operator's compliance programme. The

regulation places the obligation on the operator. The engine is a processor that runs steps required by Art. 8(2) and emits a signed record. The operator retains responsibility for verifying inputs and for the final submission decision.

Audit log

Test coverage

cargo test --workspace. 58 tests passing across the workspace.

Verbatim declaration. Byte-exact check

The Annex II point 5 declaration text is mandated wording. The string in ANNEX_II_VERBATIM_DECLARATION is 287 bytes long and round-trips through the JSON serialiser unchanged:

By submitting this due diligence statement the operator confirms that due
diligence in accordance with Regulation (EU) 2023/1115 was carried out and
that no or only a negligible risk was found that the relevant products do
not comply with Article 3, point (a) or (b), of that Regulation.

This is the consolidated text from CELEX:02023R1115-20241226 Annex II, unchanged by Reg. 2025/2650.

Re-running this audit

cargo test --workspace
cargo run --bin eudr -- compile samples/scenarios/civ-cocoa.json --out /tmp/civ.json
cargo run --bin eudr -- verify /tmp/civ.json
python3 -c "
import json; d=json.load(open('/tmp/civ.json'))['payload']
print('Annex II keys:', sorted(k for k in d if k[:1].isdigit()))
print('Point 4 absent:', '4_' not in str(list(d.keys())))
for g in d['3_geolocation']:
 ring = g['plot_geojson']['coordinates'][0]
 md = min(min(len(repr(c).split('.')[-1]) for c in pt) for pt in ring)
 print(f'plot {g[\"cell64\"]}: precision={md} digits. Art. 2(28):', 'PASS' if md >= 6 else 'FAIL')
print('Verdict:', d['conclusion']['verdict'], '· schema:', d['schema'])
"

AI Act and product-safety posture (verified 2026-06-04)

Because this engine serves other AI agents (A2A v1.0 + MCP), not only humans, its own AI-regulation posture is part of the compliance surface:

Human oversight invariant: a non-negligible or indeterminate verdict is never auto-filed; TRACES submission is the operator's regulatory act under their own EU Login identity.

This page last changed on 2026-10-11. It describes the Regulation as it stood then; where a date or a code matters to a decision, check it against the EUR-Lex text it cites.