Identity Preserved
From a single certified mill, kept separate throughout.
RSPO Module ASoftware · responsible sourcing, cited
Responsible sourcing software: certification, traceability and the law
Responsible sourcing software records where a material came from, which scheme certifies it and what due diligence the business has done, so a sourcing policy can be shown to work.
For timber placed on the Great Britain market that due diligence is already law; for palm oil, soy and the other forest-risk commodities it is law in Northern Ireland and the EU from 30 December 2026, and only proposed for Great Britain.
What the software does
What does responsible sourcing software do? Policy, scheme, origin, proof
Responsible sourcing software follows the material rather than the supplier: each delivery of timber, palm oil, soy or cocoa carries its origin, its certificate and its risk assessment.
That is the difference from supply chain sustainability software, which runs questionnaires, ratings and audits about the supplier as a business.
A sourcing policy sets the rules, a certification scheme vouches for the material, and the law, where it applies, asks the business to do its own due diligence on top.
The software’s job is to keep those three apart, because a certificate is evidence for due diligence, not a substitute for it.
- 1
Policy
Which commodities, which schemes, which origins the business accepts.
- 2
Scheme
The FSC, RSPO or other certificate behind each delivery, and its validity.
- 3
Origin
Country, region or plot of production, held at batch level.
- 4
Due diligence
Information, risk assessment and mitigation where the law requires it.
- 5
Proof
Records kept for the regulator, the customer and any public claim.
Timber in Great Britain
What does the law already ask for timber? Due diligence, and five years of records
An operator is the business that first places timber or timber products on the Great Britain market, and under the UK Timber Regulations it must not place illegally harvested timber there and must exercise due diligence first.
The due diligence has three stages — information, risk assessment and mitigation to negligible — and OPSS’s guide says the records must be kept for at least five years and given to it on request.
A trader, which buys and sells timber already on the GB market, must keep records of who it bought from and who it sold to.
Failing to exercise due diligence is an offence under regulation 4 of SI 2013/233, so a timber sourcing record is a legal record, not a sustainability nicety.
UK Timber RegulationsExplore
UK Timber Regulations
Gather
Species, quantity, supplier, country of harvest, legality evidence.
UK Timber Regulations
Assess
The risk the timber was illegally harvested, against set criteria.
UK Timber Regulations
Mitigate
Reduce any risk to negligible before placing on the market.
UK Timber Regulations
Offence
Failing to exercise due diligence is a criminal offence.
Certification schemes
What do FSC and RSPO certify? The chain, and how mixed it may be
FSC chain of custody requires an unbroken chain of organisations certified by FSC-accredited bodies at every change of ownership, from the certified forest to the point of sale with the claim, under FSC-STD-40-004.
RSPO allows four supply chain models, and its 2020 standard lets a site move only to the same or a less strict model than its supplier, in the order Identity Preserved, Segregated, Mass Balance.
Mass Balance allows certified and ordinary palm oil to be mixed provided overall site quantities are controlled, so the software must reconcile volumes bought and sold site by site.
A system that stores only “certified: yes” cannot tell these apart, and the difference matters the moment a customer asks for origin.
One delivery
of palm oil
of palm oil
Segregated
From several certified sources, kept separate from ordinary oil.
RSPO Module BMass Balance
Certified and ordinary oil mixed; volumes reconciled at each site.
RSPO Module CRSPO Credits
Book and Claim: credits bought from certified producers.
No physical chainWhat a customer may ask
What can a customer require of you? Check a request in three answers
Sourcing questions often arrive from customers rather than regulators, and the tool beside this sorts what a request can require.
The CSRD caps what an EU reporter may require of a smaller supplier for its sustainability statement, under the value-chain cap in the Accounting Directive as amended.
The cap does not reach requests made for other reasons, such as EUDR due diligence, where the EU customer must gather origin data itself.
No UK law requires a particular audit or certification of a supplier; the Home Office guidance treats audits as one tool and says they should not be relied on alone.
What can a supplier request require?
Two questions; the answer cites the instrument.
Nothing is stored or sent.
Forest-risk commodities
Which deforestation rules reach a UK business? Two regimes, two dates, one proposal
EUDR in Great Britain
Does not applyApplies in Northern IrelandEUDR start, large operators
30 Dec 2026EUDR Art 38GB regime
ProposedSchedule 17, no regulations yetUKTR records
5 yearsOPSS guidanceThe EU Deforestation Regulation applies in Northern Ireland from 30 December 2026 and not in Great Britain, according to government guidance, which names a GB timber merchant selling to an NI consumer as an operator.
Micro and small operators established by 31 December 2024 start on 30 June 2027 for most products, but on 30 December 2026 for timber products the old EU Timber Regulation covered, under Article 38(3) of the EUDR.
Great Britain’s own regime is enabled by Schedule 17 of the Environment Act 2021 but has no regulations, and the government’s June 2026 approach is a proposal for businesses over £1 million GB turnover using seven commodities.
Software bought now should hold plot-level origin, because both the EU rule in force and the GB proposal ask for geolocation, which is covered in depth on EUDR software.
Forest-risk rulesExplore
Forest-risk rules
EUDR in NI
Applies in Northern Ireland from 30 December 2026, in phases.
Forest-risk rules
GB first placers
A GB business first placing on the NI or EU market is an operator.
Forest-risk rules
Micro and small
30 June 2027 for most products; 30 December 2026 for old EUTR timber.
Forest-risk rules
GB proposal
Over £1m turnover, seven commodities; legislation expected 2027.
Platforms, in their own words
Which platforms describe sourcing and traceability? Five, alphabetically
Several carbon and ESG platforms now describe traceability, commodity and EUDR features, and the five beside this say so in their own words.
Each brings a different starting point, from commodity emissions accounting to supplier sustainability and compliance workflows, which is a useful spread to compare against your own sourcing policy.
The full registry, with each vendor’s claims on every UK and EU regime, is on carbon reporting software.
Specialist certification and traceability tools that are not in the registry are not listed here, which says nothing about them.
Public claims
What can you say on the pack? Only what the records prove
A sourcing claim on a product or website is a green claim, and the Competition and Markets Authority’s guidance on claims across the supply chain says responsibility for them runs along the chain.
Scheme claims carry their own rules: RSPO claims must follow RSPO’s rules on market communications and claims, and an FSC claim needs the certified chain.
The safest system holds the evidence for each public claim beside the sourcing data, so marketing cannot outrun the records.
| Claim | What the record must show |
|---|---|
| “FSC-certified” | An unbroken certified chain and the business’s own valid certificate or licence |
| “Contains certified sustainable palm oil” | The RSPO model used, and the volumes for Mass Balance |
| “Responsibly sourced” | The policy, what it covers and the evidence for each line |
| “Deforestation-free” | Due diligence and origin data for each batch, where the EUDR applies |
A sourcing claimExplore
A sourcing claim
“FSC-certified”
An unbroken certified chain and the seller’s own certificate or licence.
A sourcing claim
Certified palm oil
The RSPO model named, and reconciled volumes for Mass Balance.
A sourcing claim
“Responsibly sourced”
The policy, what it covers, and evidence for each line.
A sourcing claim
“Deforestation-free”
Due diligence and origin data per batch, where the EUDR applies.
The tests before you sign
How do you test a sourcing product? Eight questions, each tied to a rule
Each question beside this names the regulation or scheme rule behind it and what a passing answer looks like.
Run them with your own commodities and suppliers, because a demonstration rarely includes a downgrade from Segregated to Mass Balance or a GB-to-NI shipment.
This site has tested no products
Nothing on this page is a rating, ranking or recommendation of any product.
Responsible sourcing demo questions · tick the ones you need
The pass tests are our reading of the cited provisions.
Nothing you tick is stored or sent.
Responsible sourcing software, in one sentence
A certificate vouches for the material, but the due diligence the law asks for stays with the business that places it on the market.
Takeaways
What to take from this page
| The fact | What to do |
|---|---|
| Timber due diligence is law in Great Britain now | Keep the information, risk assessment and mitigation for each product, for five years |
| The EUDR applies in Northern Ireland from 30 December 2026 | Hold plot-level origin for any product first placed on the NI or EU market |
| RSPO and FSC certify chains, not legality | Store the scheme, model and certificate per delivery, and use them as evidence only |
| The GB forest-risk regime is still a proposal | Choose software that can take the seven commodities if regulations follow |
Start with the request checker on any customer questionnaire, then take the demo questions to vendors.
Frequently asked
Responsible sourcing software, answered
What is responsible sourcing software?
Software that records where a material or commodity came from, the certification scheme that vouches for it, and the due diligence a business has done on it.
For timber, palm oil, soy, cocoa, coffee, cattle and rubber it holds supplier, origin and certificate data at batch level, so a business can show its sourcing policy is being followed and meet the legal due diligence that applies to it.
Is responsible sourcing a legal requirement in the UK?
Parts of it are.
A business that first places timber or timber products on the Great Britain market must exercise due diligence under the UK Timber Regulations, and failing to do so is an offence.
The wider GB forest-risk-commodity regime in Schedule 17 of the Environment Act 2021 has no regulations yet; the government’s June 2026 plan expects legislation in 2027.
Most other sourcing standards are voluntary or contractual.
Does the EUDR apply to UK businesses?
It applies in Northern Ireland from 30 December 2026, not in Great Britain.
A GB business that is the first to place an in-scope product on the Northern Ireland or EU market is an operator under the EUDR for that product.
Moving goods from Northern Ireland to Great Britain carries no EUDR requirement.
What are the RSPO supply chain models?
Four: Identity Preserved (from a single certified mill, kept separate), Segregated (from several certified sources, kept separate), Mass Balance (certified and ordinary palm oil mixed, with volumes reconciled at each site) and Book and Claim, through RSPO Credits.
A site can only move to the same or a less strict model than its supplier.
What is FSC chain of custody?
The FSC system that lets a product carry an FSC claim.
Every organisation that takes legal ownership of the product between the certified forest and the point of sale with the claim must itself be certified by an FSC-accredited body; the core standard is FSC-STD-40-004.
Does FSC or RSPO certification satisfy the UK Timber Regulations or the EUDR?
Not by itself.
Certification is evidence an operator can use in its own due diligence, but the legal duty stays with the operator.
Mass Balance palm oil, in particular, is reconciled on paper rather than kept separate, so it does not on its own give the plot-level origin the EUDR asks for.
How long must timber due diligence records be kept?
At least five years, and they must be provided to the Office for Product Safety and Standards on request, according to OPSS’s guidance on the UK Timber Regulations.
Traders must keep records of who they bought from and sold to.
Is responsible sourcing software the same as supply chain sustainability software?
They overlap.
Supply chain sustainability software usually runs the supplier programme: questionnaires, ratings, audits and statements.
Responsible sourcing software follows the material itself: origin, certification and chain of custody.
Many platforms do both.
Can a responsible sourcing claim breach consumer law?
Yes, if it is misleading.
A claim such as “responsibly sourced” is a green claim, and the Competition and Markets Authority’s guidance says liability for green claims runs along the supply chain.
Hold the evidence for each claim in the same system as the sourcing data.
Do small businesses need responsible sourcing software?
Often not.
A business buying a few certified products can keep supplier certificates and invoices in a spreadsheet.
Software earns its place where a business places timber or forest-risk commodities on the market itself, handles certified material across many sites, or must answer EU customers’ due diligence requests.
Has this site tested any responsible sourcing software?
No. The page is built from the regulations, government guidance and scheme standards cited, and the vendor table quotes what each vendor says about itself, in alphabetical order. It is not a ranking.
Sources
Primary sources
Every duty and scheme rule on this page traces to the instrument, guidance or standard listed here.
Checked against 16 sources fromlegislation.gov.ukGOV.UK (Defra and OPSS)Office for Product Safety and StandardsDefraGOV.UK (Defra)EUR-Lex
- legislation.gov.ukThe Timber and Timber Products (Placing on the Market) Regulations 2013, SI 2013/233
Regulation 4: failing to exercise due diligence is an offence.
- GOV.UK (Defra and OPSS)Regulations: timber and FLEGT licences
UKTR applies in Great Britain; operators’ due diligence and traders’ records.
- Office for Product Safety and StandardsGuide to the UK Timber Regulations 2013 (PDF)
Due diligence records kept for at least 5 years; approved monitoring organisations.
- legislation.gov.ukEnvironment Act 2021, Schedule 17
The GB forest-risk-commodity framework; no regulations yet made.
- DefraThe UK’s approach to deforestation regulations (23 June 2026)
A proposal: over £1m GB turnover, seven commodities, legislation expected 2027.
- GOV.UK (Defra)Placing deforestation-free products on the market in Northern Ireland
The EUDR applies in NI from 30 December 2026; GB first placers can be operators.
- EUR-LexRegulation (EU) 2023/1115 (EUDR), consolidated 18 September 2026
Operator due diligence; Articles 37 and 38 dates.
- RSPOSupply Chain Certification Standard 2020 (PDF)
Four supply chain models; the IP → SG → MB downgrade order; mass balance rules.
- RSPOSupply chains
The four models and RSPO Credits, in RSPO’s own words.
- FSCFSC-STD-40-004 Chain of Custody Certification, V3-1
The core chain-of-custody standard, effective 1 September 2021.
- FSCFSC-STD-40-004 V4-0, draft D1-0 (PDF)
A draft: the unbroken chain of certified organisations, stated in its scope.
- legislation.gov.ukModern Slavery Act 2015, section 54
A statement duty; due diligence is a topic it “may” include.
- Home OfficeTransparency in supply chains: a practical guide
Audits are one tool and should not be relied on alone.
- Competition and Markets AuthorityMaking green claims: getting it right, across the supply chain
A sourcing claim is a green claim, and liability runs along the chain.
- EUR-LexDirective 2013/34/EU as amended, Arts 19a(3) and 29a(3)
The CSRD value-chain cap on what may be required of smaller suppliers.
- EUR-LexDirective (EU) 2024/1760 (CSDDD), consolidated
Due diligence for the largest groups, applying from 26 July 2029.
Continue reading