How do you keep compliance data current without a spreadsheet?

By treating each compliance item as a record tied to the source that owns it, rather than a copy. Certificates, permits, due diligence reference numbers and supplier declarations each have an owner: a certification registry, a permitting agency, a regulator's information system, or the supplier. Each has a status, a scope and validity dates that can change between checks. Current data means holding each item's identifier and source, taking the owner's change notifications where it offers them, and rechecking elsewhere. It also means linking each record to the suppliers, items and purchases it covers, and keeping old versions. That link is what tells you which wood a change affects.

What the usual answer says

Most advice is to buy compliance software with a central document store, expiry reminders, supplier upload portals, approvals and audit trails. Those help keep the copy tidy. But an expiry reminder only works if the expiry date is still true.

Where the truth lives

Certification makes the point directly. The chain-of-custody standard in force, effective since September 2021, asks organisations "to confirm any changes that might affect the availability and authenticity of the supplied products". To do that, they "shall regularly verify the validity and product groups scope of the certificates of their active FSC-certified suppliers through the FSC certificate database". A certificate can change in scope or validity well before its expiry date, and the standard puts the truth in the registry.

The same clause carries a note that answers the obvious objection. Platforms synchronised with the registry "may support the organization's conformity to this requirement by sending automatic notifications to the organization in the case of a change in the certificate scope of its suppliers". So for one scheme, a buyer can be told when a supplier's scope changes. A revision of the standard is due on 1 January 2027, so the wording may move.

What the notification can't do is say which of the buyer's own orders, stock and claims depend on that supplier. The standard's previous clause already asks for supplier information "including names, certification code (if applicable), and materials supplied". That list is the start of the link, and extending it to items and purchases finishes the job. Nor does the notification cover every scheme. The other main scheme's facts and figures page reports that "more than 29,800 companies and organisations hold PEFC Chain of Custody certification", "around one-third of all chain of custody certificates worldwide". A buyer with suppliers in both schemes has two registries to watch.

For businesses that opt into the scheme's voluntary regulatory module, effective 17 August 2026, there is a further set of records. It asks them to keep supplier details "for five (5) years" and, where an upstream supplier passes on due diligence statement reference numbers for one market's deforestation rules, to "keep that information". Those numbers belong to that market's information system.

What current looks like

Each certificate, permit, declaration and reference number becomes a record: identifier, issuing registry or body, holder, scope, valid-from and valid-to dates, status and evidence file. Where the registry sends notifications, the record takes them. Where it doesn't, a person or a job rechecks it on a schedule set by risk, and before a large purchase. Logging each check, with its date and result, gives an auditor something to test, even where the standard doesn't require a log.

Each record links to the suppliers, items and purchases it supports. When a certificate is suspended or its scope narrows, that link shows which open orders and which stock are affected, and which past sales carried a claim that relied on it. When a record changes, the old version stays. A claim made last year is judged against the certificate as it stood then.

Where AI helps

AI can read certificates, permits and declarations into structured records and match them to suppliers and items. It can compare records against registry results, and draft the follow-up to a supplier when evidence is missing. The decision to hold an order remains a person's.

When it doesn't apply

Businesses with a handful of suppliers and no certification or regulatory reporting can manage with a simple list and a calendar. Some obligations, such as legality in a supplier's own country, rest on documents with no registry at all.

Quarri for operations teams is built for the people running the crews, the lines and the yard.

Quarri is an AI-native data platform for the timber supply chain. It connects buying, production, sales and inventory for forest management, sawmill, wood products and pulp, paper and packaging operators.