EU Deforestation Regulation: preparing for compliance

What you need to know

• The EU Deforestation Regulation (EUDR) enters into application on 30 December 2026 for large and medium-sized operators and traders, and on 30 June 2027 for micro and small operators.
• Transitional rules apply to timber and timber products previously covered by the EU Timber Regulation, which continues to apply to certain timber until 31 December 2029.
• The EUDR imposes due diligence, traceability and deforestation-free requirements on seven commodity groups: cattle, cocoa, coffee, oil palm, rubber, soya and wood, and on derived products.
• Member States must set maximum fines of at least 4% of total annual EU-wide turnover for entities in breach of the requirements.

What you need to do

• Determine your role in the supply chain (operator, downstream operator or trader) and map your product portfolio against Annex I.
• Engage suppliers to secure the necessary data and documentation, and ensure that in-scope commodities are physically segregated from those of unknown origin, as mass balance chains of custody, which allow for mixing of deforestation-free commodities with those of unknown origin or that are not deforestation-free, are not permitted.
• Establish or update your due diligence system, including information collection, risk assessment and risk mitigation procedures.
• If you are an operator, or a non-SME downstream operator or trader, register in the EUDR Information System.

Overview

Regulation (EU) 2023/1115, the EU Deforestation Regulation (EUDR), entered into force on 29 June 2023. Following two postponements of its application date and targeted amendments made by Regulations (EU) 2024/3234 and (EU) 2025/2650, the EUDR will apply to large and medium-sized operators and traders from 30 December 2026, and from 30 June 2027 to micro and small operators established as such by 31 December 2024.

Transitional rules apply to timber and timber products covered by the EU Illegal Timber Regulation 2010 ((EU) 995/2010) (EUTR): the EUTR continues to apply until 31 December 2029 to timber and timber products produced before 29 June 2023 and placed on the market from 30 December 2026. From 31 December 2029, all such products must comply with the EUDR.

The EUDR aims to minimise the EU's contribution to global deforestation and forest degradation by ensuring that commodities and products placed on, made available on, or exported from the EU market are deforestation-free and have been produced legally. The EUDR targets seven commodity groups whose production is a major driver of global deforestation, together with a wide range of derived products.

On 4 May 2026, the European Commission published a Simplification Package confirming that the core EUDR legal text will not be reopened. The package included a draft delegated act proposing targeted amendments to the product scope in Annex I, together with improvements to the EUDR Information System. The delegated act has since been adopted and published in the Official Journal of the EU as Delegated Regulation (EU) 2026/2102. In addition, Implementing Regulation (EU) 2026/1565, which sets out the functioning of the Information System for submitting due diligence statements and simplified declarations, entered into force on 17 July 2026. The European Commission has also updated its main guidance and FAQs on the EUDR to reflect these changes. With the legal framework and supporting tools now largely finalised, the focus now shifts to implementation.

Commodities and products in scope

The EUDR applies to seven commodity groups (cattle, cocoa, coffee, oil palm, rubber, soya, and wood) and to a wide range of derived products listed in Annex I. Products not listed in Annex I fall outside the scope of the EUDR, even if they contain in-scope commodities. Owing to the changes made by the Delegated Regulation, to determine which products are in scope it is important to check Annex I and any application dates specified.

Following the adoption of the Delegated Regulation, retreaded and used tyres, skins and leather, cattle hides, soya beans for sowing, conveyor and transmission belts, and aircraft and motor vehicle seats are no longer relevant products.

The Delegated Regulation also excludes:

• samples and products used for examination, analysis or testing;
• single-use packing materials, and reusable packing materials from their first use, used to carry another product;
• waste, used and second-hand products from certain listed entries; and
• accompanying marketing materials and items of correspondence.

It also exempts certain palm oil derivatives to the extent that they are used to manufacture medicinal products. Soluble coffee, frozen cattle tongues and a range of palm oil derivatives (including oleochemicals and soaps) are added to Annex I with effect from 30 December 2027.

Fully recycled and end-of-life waste materials are generally exempt, but manufacturing by-products and certain waste items listed in Annex I remain in scope. Packaging is regulated only where it is placed on the market as a product in its own right; packaging material used exclusively to support, protect or carry another product is not a relevant product. Importantly, there is no de minimis threshold: the EUDR applies regardless of the volume or value of the relevant commodity.

Key obligations

The EUDR establishes a prohibition: relevant commodities and products must not be placed on, made available on, or exported from the EU market unless three cumulative conditions are met:

• They are deforestation-free (produced on land not subject to deforestation after 31 December 2020 and, for wood, harvested without inducing forest degradation after that date);
• They have been produced in accordance with the relevant legislation of the country of production; and
• They are covered by a due diligence statement (DDS) or simplified declaration submitted via the EUDR Information System.

Due diligence for operators

Upstream operators, those who first place relevant products on the EU market or export them, must establish and maintain a due diligence system comprising the three steps explained below. They must also review it at least once a year and update it whenever they become aware of new developments that could influence it.

• Information collection (Article 9 EUDR): operators must gather comprehensive data including the product description, Harmonized System code, quantity, country of production, supplier and client details, and the precise geolocation coordinates of all plots of land where the relevant commodities were produced. Operators must also collect evidence that the commodities comply with the relevant legislation of the country of production. If the required information cannot be obtained, the products must not be placed on the market or exported.
• Risk assessment (Article 10 EUDR): operators must evaluate the collected information against fourteen mandatory criteria, including the country risk classification, supply chain complexity, corruption levels, prevalence of deforestation, and substantiated concerns.
• Risk mitigation (Article 11 EUDR): where the risk is assessed as more than negligible, operators must take adequate and proportionate mitigation measures, including additional information requests, audits, and controls, before placing the product on the market or exporting it. Non-SME operators must also appoint a compliance officer.

To reduce the administrative burden, a single DDS may cover multiple batches or shipments, provided that due diligence has been carried out for all relevant products intended to be placed on the market or exported and all geolocations have been declared; once the quantity covered has been reached, a new DDS must be submitted. Operators must also ensure full traceability back to the plot of land: mass balance chains of custody are not permitted, so in-scope commodities must be kept physically segregated from commodities of unknown origin or commodities that are not deforestation-free at every stage of the supply chain. Operators must keep the information collected and their DDS records for five years, and non-SME operators must publish an annual report on their due diligence system. Reports prepared under other EU value-chain due diligence frameworks can be used to meet this requirement.

Following the amendments made by Regulation (EU) 2025/2650 in December 2025, downstream operators and traders are not required to exercise due diligence themselves or to submit a DDS. Their core obligation is to collect information about their direct business partners (suppliers and commercial clients), including DDS reference numbers or declaration identifiers where their supplier is an upstream operator, and to retain this information for at least five years.

Non-SME downstream operators and traders must also register in the Information System. All downstream operators and traders, including SMEs, must immediately inform the competent authorities and their customers if they become aware of information, including a substantiated concern, indicating that a product is at risk of non-compliance. A substantiated concern is a duly reasoned claim based on objective and verifiable information regarding non-compliance which could require intervention by competent authorities. In the event of a substantiated concern, non-SME downstream operators and traders must also verify that due diligence was exercised upstream, and must not continue to place the product on the market or make it available unless that verification concludes that there is no, or only a negligible, risk.

Products placed on the EU market before 30 December 2026 are not subject to the EUDR. Where such stock is used or resold after that date, downstream operators and traders need only gather conclusive and verifiable evidence (such as customs declarations or invoices) that it was placed on the market before the application date.

Simplified due diligence

Operators sourcing entirely from countries classified as low risk benefit from simplified due diligence. They must still collect the information required under Article 9 of the EUDR and assess the complexity of the supply chain and the risk of circumvention or of mixing with products of unknown origin. However, they are not required to carry out a full risk assessment and risk mitigation unless they become aware of relevant information, including substantiated concerns, indicating non-compliance.

Micro or small primary operators (MSPOs), meaning natural persons or micro or small undertakings established in low-risk countries that place on the market or export relevant products they have produced themselves, benefit from further simplifications. MSPOs submit a one-off simplified declaration instead of a DDS and may use postal addresses instead of geolocation coordinates, provided that the address clearly corresponds to the geographic location of the plots of land concerned. Where a Member State has made the required information available in the Information System, no declaration needs to be submitted.

Who is affected

The EUDR applies to all economic actors along supply chains that place, make available or export relevant products listed in Annex I. There are three categories of regulated actors.

• Operators are those who first place relevant products on the EU market or export them, typically importers, EU-based primary producers, and manufacturers using inputs not already covered by a DDS.
• Downstream operators place on the market or export products made using relevant products already covered by a DDS or simplified declaration. Importantly, a company that imports a derived product from outside the EU is an upstream operator, not a downstream operator, because the product is not yet covered by a DDS. A single company may also have a dual role, for example as the upstream operator when importing raw rubber or green coffee and as the first downstream operator when placing the tyres or roasted coffee it manufactures from them on the market.
• Traders make relevant products available on the market without transforming them.

Where a non-EU operator places relevant products on the EU market, the first EU-established person to make those products available is deemed to be an operator under Article 7 of the EUDR, ensuring there is always an accountable entity within the EU. The EU-established operator is not treated as a downstream operator under Article 5, so it cannot rely on the non-EU operator's DDS reference number. It must exercise its own due diligence and submit its own DDS, although it may draw on information supplied by the non-EU operator and remains responsible for its accuracy.

Operators may mandate an authorised representative established in the EU to submit DDS or simplified declarations on their behalf, and natural persons and microenterprises may mandate the next downstream operator or trader in their supply chain that is not itself a natural person or microenterprise to do so. However, responsibility for compliance always remains with the operator. Service providers such as shipping agents and customs representatives are generally not operators or traders, and have no obligations under the EUDR, provided that they do not themselves place products on the market or export them.

Commodities produced within the EU are subject to the same requirements as those produced outside the EU.

Online distributors, retailers and fulfilment service providers supplying relevant products to EU customers may be operators, downstream operators or traders depending on their role; online marketplaces acting purely as intermediaries have no obligations under the EUDR.

Penalties and enforcement

EU Member States are required to lay down national penalty frameworks that include, at a minimum, the penalties set out in Article 25(2) of the EUDR.

The maximum fine must be at least 4% of the entity's total annual EU-wide turnover in the financial year preceding the fining decision. Fines must increase for repeated infringements and must effectively deprive those responsible of the economic benefits derived from their infringements. Other penalties include confiscation of the relevant products and of revenues derived from them, temporary exclusion from public procurement processes and from access to public funding, and a temporary prohibition on placing, making available, or exporting relevant products.

Competent authorities may also impose interim measures, including suspending products deemed to present a high risk of non-compliance, initially for three working days (or 72 hours for perishable products).

Member States must notify the European Commission of final court judgments and penalties imposed so it can publish a list of those judgments on its website.

Competent authorities will carry out risk-based checks on operators, downstream operators, and traders, including documentary checks and, where necessary, field audits. The European Commission will support enforcement through the EU Observatory on Deforestation and Forest Degradation, which provides satellite imagery, land cover maps and other monitoring tools to help verify compliance.

Practical steps for compliance

With the application date now imminent, businesses should take the following steps to prepare for compliance:

• Map your product portfolio against Annex I to determine which products fall within scope.
• Classify your role in the supply chain for each relevant product: operator, downstream operator, or trader, as obligations differ depending on your position. Remember, you could occupy dual positions depending on precisely what you are doing.
• Establish or update your due diligence system with documented standard operating procedures for information collection, risk assessment, and risk mitigation, ensuring the system is embedded into day-to-day procurement and supplier onboarding processes.
• If you are an operator, or a non-SME downstream operator or non-SME trader, register in the EUDR Information System, the central platform for submitting due diligence statements and simplified declarations.
• Review physical segregation and chain of custody arrangements to ensure that in-scope commodities are not mixed with commodities of unknown origin, as mass balance chains of custody are not permitted.
• Engage your suppliers to secure the data and documentation necessary for compliance, including geolocation data, chain of custody records, and evidence of legal harvest.
• Review your contractual frameworks with suppliers and customers to incorporate EUDR compliance obligations, including obligations on operators to pass DDS reference numbers or declaration identifiers to their direct downstream customers and, where commercially agreed, to share geolocation data and verification numbers (which are not legal requirements).
• Monitor the country benchmarking system: the European Commission has classified countries, or parts thereof, as low, standard, or high risk (Implementing Regulation (EU) 2025/1093, as updated) based on deforestation and forest degradation rates, agricultural expansion, and other criteria. Operators sourcing from high-risk countries face enhanced checks by competent authorities.
• Be prepared to face some uncertainty over the EUDR Information System, since it will be fine-tuned over time.

To facilitate compliance, the European Commission is currently working to establish, ahead of the EUDR's entry into application, two repositories: one listing the relevant legislation of countries of production, and one listing certification schemes applicable to EUDR-relevant commodities. These repositories will be hosted on dedicated websites and will include information provided by third countries and by the owners of relevant certification schemes.

Businesses that delay preparation risk enforcement action from the date of application. Early engagement with the EUDR's requirements will be critical to ensuring a smooth transition to the new regime.

Want to know more?

• The European Commission proposes new amendments to the EUDR, 30 October 2025.
• Simplification of the regulation on deforestation-free products under the spotlight, 29 April 2025.
• The EU institutions agreed on postponing the application of the EUDR, the Regulation on Deforestation-Free Products, 18 December 2024.
• The EU Regulation on Deforestation-Free Products (EUDR) remains in limbo: update and prospects, 15 November 2024.

Authors: Claus Zimmermann, Partner, Global Co-Head of International Trade; Giovanna Ventura, Senior Regulatory Affairs Adviser; Julie Vaughan, Counsel; and Becky Clissmann, Global Sustainability Expertise Counsel.