What records does chain-of-custody certification need?

Under the FSC chain-of-custody standard, the records that show certified material in, what happened to it, and certified claims out, kept for at least five years. That includes material accounting for each input and output with its claim, conversion factors for each processing step, and due diligence records for controlled wood. Since 17 August 2026, organisations can opt into a regulatory module that adds more. What it adds depends on role. Upstream operators, the first to place wood on the regulated market, record species, harvest dates and plot locations for each supplier. Downstream organisations, which is most mills and converters buying already-placed material, record supplier and customer contact details and reference numbers. This piece covers the FSC standards; other schemes set their own record rules, which we haven't checked here.

The classic list

The chain-of-custody standard in force, approved in January 2021 and effective since 1 September 2021, requires records "retained for a minimum period of five (5) years". At a minimum, they cover "procedures, product group lists; training records; purchase and sales documents; material accounting records; annual volume summaries; trademark approvals; records of suppliers, complaints, and outsourcing; control of non-conforming products; verification program records for reclaimed material, and records related to a due diligence program for controlled material and FSC Controlled Wood".

Two clauses carry most of the data work. Organisations must identify processing steps that change volume or weight and "specify the conversion factor(s) for each processing step", kept up to date. And they must "maintain up-to-date material accounting records" of inputs and outputs. For inputs, that means the supplier's sales document number, date, quantity and material category, "including the percentage or credit claim". Guides for this search mostly stop here, and for most certified businesses that is still the answer.

What the regulatory module adds, and for whom

The regulatory module was approved on 24 July 2026 and took effect on 17 August 2026, with a transition end date of "12 months from date of publication". It describes itself as a "Voluntary add-on module" that certificate holders "can voluntarily choose" to take. Its stated aim includes to "gather and transmit precise information on the origin of products, including geolocation and time of production".

Its Table 1 decides what each organisation keeps. Upstream operators fall under Part 2. For each supplier, they "collect and keep for five (5) years" each species by "common and full scientific name", the quantity, the country of harvest, and "the date or time range of harvest". They also record the geolocation of all plots: a polygon for plots over "four (4) hectares", and for smaller ones a polygon or "a single latitude and longitude point with six decimal digits". A micro or small primary operator may substitute "the postal address of all plots".

Downstream operators and regulatory traders fall under Part 3, and Table 1 marks Part 2's information clause as not applicable to them. They collect and keep for five years each supplier's "name; b) registered trade name or registered trademark; c) postal address; d) email address; and e) if available, web address". They keep the same for customers. Where an upstream supplier passes on due diligence statement reference numbers, they keep those too.

What this means for record-keeping

For a downstream mill, the module is a supplier and customer master data task. The contact fields and reference numbers fit in records most businesses already hold, provided each reference number is stored against the purchase it came with.

For an upstream operator, the data must follow material. A plot reference and species on a purchase are useful only if the product groups and sales that used it can be traced back. That takes links from purchase lines to production batches, with the conversion factor applied, and from batches to sales.

A downstream mill may still be asked for that trail by a buyer. That is a commercial choice rather than a certification requirement, and the module doesn't test it for downstream organisations.

More change to come

The standards body is running a joint revision of its chain-of-custody standards, started in April 2022, with a planned end date of 1 January 2027. Records designed today should expect further change.

Where AI helps

AI can read supplier certificates, invoices and origin statements into structured records. It can check that each purchase carries the fields that apply to the organisation's role, and flag conversion factors that drift from the recorded method. It can't supply a link between a batch and its inputs that was never captured.

When it doesn't apply

Uncertified businesses keep none of this for certification, though buyers may ask for similar data. Certified organisations that don't take the module keep the classic list only.

Quarri for wood products is built around how a wood products plant runs, where the order book meets real capacity.

Quarri is an AI-native data platform for the timber supply chain. It connects buying, production, sales and inventory for forest management, sawmill, wood products and pulp, paper and packaging operators.