Download one of our supply chain, EUDR, CSRD/VSME & whistleblower compliance guides now Learn more →
Test now Personal demo
EUDR 17. March 2026 · 25 Min read

EU Deforestation Regulation (EUDR) at a glance

In the middle of a dense forest of rules and regulations under EU law: the EUDR. With the EU Deforestation Regulation (Regulation 2023/1115), companies will in future have to prove that their supply chains, from wood to cocoa to palm oil, are deforestation-free and legally compliant. Find out what this means in concrete terms and how you can prepare yourself here.

Larissa Ragg

Larissa Ragg

Marketing Managerin · lawcode GmbH

Share:
EU Deforestation Regulation (EUDR) at a glance
Table of Contents

Important facts

What is the EUDR Regulation?
The EU Deforestation Regulation (Regulation 2023/1115), also known as the EU DR, requires companies to ensure that certain products are deforestation-free and comply with the law.
When does the regulation apply?
Large and medium-sized companies must meet the requirements from December 30, 2026, while an extended deadline of June 30, 2027 applies to small and micro-enterprises.
Which products are affected?
The regulation covers seven raw materials and products made from them: Wood, beef, coffee, cocoa, soy, palm oil and rubber.
What does deforestation-free mean?
Products are considered deforestation-free if they do not originate from areas that have been deforested or degraded since December 31, 2020.
Who is affected by the EUDR?
All companies that place, supply or export relevant products in the EU.
What are the main obligations?
Companies must geolocate cultivation areas, analyze and mitigate risks and submit a due diligence declaration.
What happens in the event of violations?
Violations could result in penalties of up to 4% of annual turnover, a trade ban on the products concerned and public censure by the EU.

Summary - EUDR at a glance

The EU Deforestation Regulation (EUDR/Regulation 2023/1115) replaces the previous EU Timber Regulation (EUTR) and goes significantly further: It requires companies to fulfill comprehensive due diligence obligations before placing seven raw materials on the market. Specifically affected are timber, cocoa, coffee, soy, palm oil, beef, and rubber, as well as all products derived from them. Large companies must fully implement the regulations starting in December 2026, while small and medium-sized enterprises do not have to comply until July 2027. The three-step process involves information gathering, risk assessment, and risk mitigation, with transparency and traceability all the way back to the farm level being crucial.

For the purposes of this regulation, deforestation is defined as the conversion of forests into agricultural land, regardless of whether it is caused by human activity or not. The cut-off date is December 31, 2020: Products must not originate from areas that have been deforested or damaged since then. The regulation establishes clear responsibilities, not only with regard to deforestation, but also concerning fair working conditions, human rights, and, in particular, the rights of indigenous peoples.

Companies need to analyze their supply chains, clarify responsibilities, record geodata correctly and keep a constant eye on legal developments. Although the regulation entails additional effort, it also offers real opportunities: those who act early can build sustainable supply chains, strengthen long-term partnerships and position themselves better in a competitive environment.

Never miss an update on the EUDR again.

New specialist articles, regulatory updates and practical tips, straight to your inbox. Once a week, no spam.

No spam Unsubscribe at any time GDPR-compliant

Update from 04.05.2026: FAQ version 5 of the EU Commission

In April 2026, the European Commission published the fifth version of its FAQ document on implementation. While not yet legally binding, it serves as an important interpretive guide for practical application.

New category "Micro or Small Primary Operator" (MSPO)

Micro and small enterprises, as well as individuals who produce their own goods (e.g., farmers or foresters) and place their products directly on the EU market, benefit from simplified requirements—provided they are based in a low-risk country. Instead of a Declaration of Due Diligence (DDS), a one-time simplified declaration (SD) is sufficient; a risk assessment is generally not required. Under certain circumstances, the mailing address may be used in place of geolocation. If a Member State provides the necessary data from national databases, the SD is not required at all.

Clear rules for online trading and B2C business

The EUDR applies to all deliveries “in the course of a business,” regardless of whether they are B2B or B2C. The party responsible is always the entity that actually delivers the product to the customer—whether it be the manufacturer, an online retailer, or a fulfillment service provider. EU consumers, on the other hand, are never considered operators, not even when placing direct orders from abroad. Pure online marketplaces without a delivery function have no obligations.

Re-import of previously exported goods

Anyone who re-imports products that were previously exported from the EU after undergoing due diligence may be considered a downstream operator, even if the products were processed in a third country. Instead of a separate DDS, a conventional reference number (format: 99EU9999999999) in the customs declaration is sufficient, provided that the earlier placing on the market can be clearly documented.

Specification of "substantiated concerns" (Substantiated Concern)

A report must be objective, verifiable, and specific to a particular company or supply chain; general references to problems in the country of origin are not sufficient. Upon becoming aware of such information, the following applies:

  • Immediate notification to the competent authority and downstream stakeholders
  • Non-SMEs: Sales suspended pending due diligence
  • Member States shall ensure the protection of whistleblowers' identities

The following adjustments to the scope are also planned:

  • New: frozen bovine tongues (HS ex 0206 21 00), soluble coffee (HS 2101 11 00), additional palm oil oleochemical derivatives (e.g. ex 1516 20, ex 2905 16, ex 3401 11 00)
  • Deleted: Hides, skins and leather of bovine animals (ex 4101, ex 4104, ex 4107)
  • Restricted: retreaded tires, obligations only for the new rubber tread (ex 4012 90 30)
EUDR News FAQ Version 5
Changes to the EUDR - status May 2026

All updates: EUDR current status

New Deadlines: The implementation has been postponed further:

  • Medium & large companies: from December 30, 2026
  • Micro & small enterprises: from June 30, 2027
  • Special case: Micro & small enterprises that were already covered by the EUTR will start from December 30, 2026

Relief for downstream players

In the future, only the first distributor to place a product on the market will submit the due diligence statement (DDS) in the EU system. Downstream market participants and dealers will instead work with reference and identification numbers, which they must record, store, and provide upon request. This reduces duplicate data entry. But be careful: a reduction in administrative burden does not mean the all-clear. Proper traceability and effective internal controls remain mandatory; otherwise, problems will quickly arise in the event of an audit.

Country benchmarking

Countries are officially divided into risk categories (low / standard / high). This has a direct impact on the depth of checks and effort required and should be taken into account in the procurement strategy and supplier management. The core remains unchanged: cut-off date 31.12.2020, legal production in the country of origin and the three-stage due diligence process (collect information, assess risk, mitigate risk).

The EU Deforestation Regulation(EUDR): Definition, objectives & importance

What is the EUDR and why was it introduced?

The EU Deforestation Regulation (EUDR/Regulation 2023/1115) addresses an issue that affects us all: Deforestation is closely linked to global supply chains—and thus also to the products we buy and use every day in Europe. The regulation requires companies to demonstrate two things regarding certain raw materials and products: they must not contribute to deforestation, and they must have been produced legally in the country of origin. The definition of “forest” under the EU regulation specifies exactly what counts as a forest.

The Regulation is based on Article 3

A product may only be placed on the EU market or exported from the EU if three conditions are met simultaneously:

Deforestation-free: Since December 31, 2020, the raw materials must not be associated with deforestation or forest degradation.

Legally produced: Production must have taken place in the country of production in accordance with the laws applicable there (e.g. land use rights, relevant permits, labor and social regulations).

✅ Duty of care verifiable: A valid duty of care must be in place, including a declaration of due diligence (DDS) (depending on the role) and verifiable documentation.

EUDR-infos-article-3
The EU Deforestation Regulation is based on Article 3, which contains the following:

The focus is on seven raw materials that are particularly relevant for deforestation risks according to EU logic: Cattle, cocoa, coffee, palm oil, soy, wood and rubber. This also includes products made from these raw materials (e.g. furniture, leather, chocolate, depending on the customs/product categories specified in the regulation).

The Deforestation Ordinance is based on a clear triad of due diligence obligations:

  • Collect information (including supply chain, suppliers, product data and, above all, geolocation data on the cultivation/production area),
  • Assess risk,
  • Reduce risk (if the risk is not negligible).

Background and development of the regulation

The Deforestation Regulation is not a hasty measure, but rather the result of a political process spanning several years: Following the Commission’s draft in November 2021 and the political agreement between the European Parliament and the Council in December 2022, the regulation formally entered into force on June 29, 2023. For companies, it is crucial to distinguish between entry into force and application. The latter was amended in December 2024 and again in December 2025 to make implementation more feasible without compromising the underlying logic.

The current schedule (as of May 2026) is as follows:

  • Large & medium-sized enterprises: Application from December 30, 2026
  • Micro & small enterprises: Application from June 30, 2027
  • Special case: micro/small enterprises that were already covered under the previous EU Timber Trade Logic (EUTR): December 30, 2026

At the same time, the EU has introduced targeted simplifications to avoid unnecessary duplication of effort in the supply chain. One example is the due diligence statement: In principle, only the company that first places the goods on the EU market is required to submit it. According to the amendment to the Delegated Act of May 2026, the timeline will no longer be adjusted.

The Importance of the EUDR for Environmental and Climate Protection

The EU Deforestation Regulation is more than just another compliance project: it directly links environmental and climate protection to market rules. Forests are not only a source of raw materials, but also carbon sinks, sanctuaries for biodiversity, and the basis of livelihoods for many communities. Deforestation destroys ecosystems and exacerbates climate change in equal measure.

The Deforestation Regulation is intended to ensure that only products not linked to deforestation since December 31, 2020, are traded within the EU. In addition, the products must have been produced legally in the country of origin, in compliance with the environmental and human rights standards in effect there.

The bottom line is that the regulation establishes a new minimum standard. Anyone wishing to trade within the EU must not only be aware of deforestation risks, but also demonstrate, manage, and document them.

EUDR-reasons-deforestation
Global causes of forest decline

Objectives of the EUDR

Reducing global deforestation through responsible sourcing

The goal of the EUDR is to ensure that deforestation is no longer profitable. To this end, market access is granted only to deforestation-free products. This reduces pressure to deforest, identifies high-risk supply chains through reliable data, and strengthens accountability throughout the supply chain, as risks should be actively managed rather than simply passed along.

Promotion of sustainable agricultural practices

In addition to protecting forests, the EUDR is also transforming agricultural supply chains. The EU market is redefining which products are still permitted for sale. Those who produce in a traceable manner, maintain accurate records, and avoid risks will continue to have access to the European market.

This means that sustainability will be easier to measure in the future, good supplier relationships will become more important, and making quick purchasing decisions without thorough vetting will become more difficult. What was once a voluntary commitment is now standard practice—for example, in procurement, quality management, and collaboration with suppliers.

Contribution to achieving the EU climate targets

Forests are important climate stabilizers: Less deforestation means more carbon storage, fewer emissions, and greater biodiversity. For companies, the climate impact is evident in two key areas: deforestation becomes a supply chain risk because it jeopardizes availability, prices, and reputation, and verification becomes crucial because the EUDR makes climate targets verifiable across the supply chain. The regulation is thus more than just a rule for forest protection. It is a building block of effective climate policy along global supply chains.

Sustainable development as a cross-cutting objective

The EUDR makes it clear: Sustainability is more than just being “green.” It’s not just about protecting forests, but also about legally sound supply chains and social standards, because deforestation is often linked to land conflicts, unresolved land rights, and poor working conditions. The regulation thus aims to achieve three things: responsible sourcing as the standard rather than an add-on, more secure supply chains through clear requirements, and greater credibility with the market, stakeholders, and regulators.

Obligations for companies

Introduction of due diligence obligations and risk assessments

In everyday life, this means above all that companies must set up their purchasing in such a way that deforestation and legal risks are identified early on and reduced where necessary. This requires a due diligence system that really works, not just as a document, but in the purchasing, quality, compliance and IT processes.

Essentially, the duty of care consists of four components:

  1. Collection of information
  2. Risk assessment
  3. Risk reduction if necessary
  4. Due diligence declaration (DDS)

What this means in practice

Due diligence begins with the collection of all relevant origin information related to the shipment. In practice, this process often fails due to issues with data quality, data formats, and a lack of a systematic approach. Geolocation data, in particular, must be recorded in a structured manner so that it can be further processed later in the EU system. The following information should be available for each goods flow or batch and remain accessible for 5 years:

  1. Proof of No Deforestation
  2. Indication of origin: Country of production as well as geolocation of the cultivation or production areas and the production period.
  3. Quantity information: Quantity of goods (e.g. kg, volume, number of items).
  4. Supplier Information: Name, address, and email address of all suppliers
  5. Product description: Trade name, product type, raw materials contained and intended use.
  6. Compliance of Production with the Law: Proof that raw materials were produced in accordance with the relevant laws and regulations of the country of origin.
  7. Customer information: Name, address and e-mail of the companies or retailers supplied.

Practical implementation: This information must be stored in such a way that it can be used quickly in the event of an audit.

Based on the information collected, market participants and non-SME traders check whether there is a risk of a breach. If a risk is identified, risk mitigation measures must be taken until only a negligible risk remains.

To-dos that are often underestimated in practice:

  • Document risk assessments
  • review or update regularly, at least annually
  • Make results available to authorities on request

Criteria that belong in the risk assessment

  1. Producer country & regions: Risk status, presence of forests or indigenous groups, consultation or cooperation, legitimate land use or ownership claims.
  2. Environmental risks: Extent of deforestation or forest degradation in the country of production, reliability and validity of the information collected.
  3. Political & social factors: Corruption, falsification of documents, lack of prosecution, human rights violations, conflicts or existing sanctions.
  4. Supply chain & processing: Complexity of the chain and processing stages, risk of bypassing or mixing with products of unknown origin.
  5. Additional information: Conclusions of expert groups, information from certification systems or other verified systems.

Result of the risk assessment:

  • No or only negligible risk: Products may be placed on the market or exported.
  • Non-negligible risk: Risk mitigation measures are required prior to marketing or export.

This logic is important because it forces EUDR compliance into an operational rhythm: without clear criteria, approvals and escalation paths, the assessment becomes a case-by-case discussion and this is precisely what does not scale in real supply chains.

If the risk is not negligible, a guideline is not enough. Specific, documented measures are then required. Typical steps are

  1. Request for additional information, data or documents
  2. Independent investigations or audits
  3. Further measures as part of the information requirements
  4. Supporting suppliers with compliance

An important rule of thumb: No product may be placed on the market or exported without documented risk mitigation for relevant risks. If measures are not implemented, the regulation will quickly become an obstacle to distribution and supply.

The due diligence declaration (DDS) is the formal step that makes EUDR compliance effective: It is submitted digitally in the EU information system. After submission, the system generates a reference number. This number is not just internal proof, it is the prerequisite for importing or exporting relevant products and is passed on along the supply chain.

This is how it works in practice:

  1. Access & Registration
    You must be registered or have access to the EU Information System. Without access, you cannot create or manage declarations.
  2. Create a DDS
    A new due diligence statement is created in the system. Depending on the situation, you can use an existing statement as a template.
  3. Enter details and geodata
    The required company and product data is then entered, including the geocoordinates of the original areas. Depending on the constellation, geodata can be entered manually or uploaded via GeoJSON.
  4. Submit
    Once all the information is complete, the DDS is submitted to the system. From this moment on, it is part of the officially verifiable documentation.
  5. Receive, save and forward reference number
    After submission, the system generates a reference number. This reference number must be saved internally and is passed on to downstream parties. For import or export, it is practically the key without which no further action can be taken.

Special case: Reference to an upstream due diligence declaration

In many supply chains, not all companies submit their own DDS. Instead, they refer to an upstream due diligence statement. In such cases, the reference number of the upstream DDS is entered into the system, along with the verification number. Both numbers are accessible in the system and serve to establish a unique link.

Practical rule: Even if you are only referencing, you are still obliged to keep the information in such a way that it is traceable during audits. It is crucial that reference numbers, batches and internal approvals fit together neatly.

EUDR-duty-of-care
The due diligence obligations of the Deforestation Ordinance at a glance.

Since the amendment at the end of 2025, it has been clearly defined who plays which role in the supply chain: The company that first places the goods on the market in the EU submits the due diligence statement (DDS). Downstream actors use this information via DDS reference numbers or identifiers from the simplified declaration (SD).

However, they cannot simply sit back and relax: Disclosure requirements remain in effect in cases of justified concerns, and non-SMEs must also fulfill verification requirements to ensure product compliance.

It is fundamentally important that all steps in the supply chain are traceable. This is the EUDR basic requirement - complete traceability.

Requirements for the traceability of products

Traceability is the backbone of the Deforestation Ordinance. It is understood in much more concrete terms than traditional batch or supplier verification. It is crucial that a product can be traced back to the area on which the raw material was produced. To achieve this, companies must record the relevant information in such a way that it can be processed in the European Union's information system as part of the due diligence declaration.

What is particularly important in practice:

  • Geolocation at plot level: The due diligence declaration shall indicate the geographical coordinates of the plots of land on which the raw materials were produced, with at least six decimal places for longitude and latitude. Responsibility for the accuracy of the data lies with the operator, even if it was provided by the supplier.
  • Point or polygon, depending on the area: Polygons are mandatory for areas over 4 hectares, one point is sufficient for smaller areas. For cattle, one geo-point per holding is sufficient, but all holding locations must be recorded over the entire lifespan. Micro and small producers (MSPOs) from low-risk countries may be allowed to enter the postal address instead of the geo-coordinates.
  • Technical format & upload capability: Geodata must be provided exclusively in GeoJSON format (WGS-84 / EPSG-4326). Manual input is hardly realistic for many areas, which is why the system supports file uploads.
  • Time-Related Aspects of Production: In addition to “where,” “when” is also relevant. For most raw materials, this refers to the harvest date or production period; for cattle, it refers to the entire lifespan from birth to slaughter. Animals born before June 29, 2023, are generally not subject to the regulation.

In short: traceability is not just about knowing our suppliers, but a combination of area reference, data structure (geo-data) and system-compatible documentation. Geodata in the EUDR - that is what is required.

EUDR-traceability
Traceability requirements

Checking supply chains for deforestation risks

The regulation does not require a “zero-risk” guarantee, but rather an assessment and control process to ensure that, ultimately, only goods whose risk is negligible or has been sufficiently reduced are traded. “Negligible” means that, after a thorough review of all information, there is no cause for concern regarding deforestation or legality.

EU tools such as country benchmarking provide support in this regard but do not replace a company’s own risk assessment. Unlisted countries are automatically considered standard risk. And even when sourcing from low-risk countries, gathering information remains mandatory; only the comprehensive risk assessment and mitigation may be omitted, provided there are no risk warnings.

What the risk assessment typically boils down to:

  • Structured assessment of risk drivers: country/regional risk (benchmarking), complexity of the supply chain, known hotspots, governance/legal enforcement, and plausibility of supplier data and area data.
  • Think deforestation assessment in terms of area: In practice, much boils down to an area check, i.e. the question of whether and when forest loss/deforestation has taken place on the specified area. This is often supported by satellite/monitoring data and plausibility checks.
  • Risk mitigation as "tangible" measures: If risks are not negligible, concrete steps such as additional evidence, tighter supplier requirements, independent audits, monitoring, segmentation of goods flows or, if necessary, the realignment of sourcing decisions are required.

Once the adjustment takes effect at the end of 2025, the following will apply: The DDS is typically issued by the first distributor; downstream parties primarily work with reference numbers. This saves on duplicate work, but the checks performed beforehand must still be thorough, because if risk assessments are sloppy, the DDS quickly becomes a problem rather than a safeguard.

If there are justified concerns, non-SMEs must also actively verify whether the due diligence requirements have been properly met; until then, a sales ban applies to the affected product. Here you will find a guide to the step-by-step implementation of the EUDR.

EUDR in the customs process: What must be included in the declaration?

In practice, compliance is not only decided in the audit folder, but often very specifically at customs: certain information must be provided in the customs declaration for the import or export of EUDR-relevant goods, otherwise the goods will not be released. Important: The DDS (or, if applicable, the SD) must be submitted in the EU information system before the customs declaration is submitted and the reference number must have been received.

Mandatory information for import & export

The following information is always required in the customs declaration for relevant goods:

  • Customs tariff number (incl. TARIC): the 10-digit EU customs tariff number based on the HS/KN system and supplemented by TARIC.
  • Quantity: in kilograms net weight (the weight of the product without packaging), plus additional unit if applicable.
  • Document coding (TARIC document code): a code that indicates to customs that the requirement has been met. Typical example: C716 (“Declaration of due diligence has been submitted; the goods may be placed on the market, imported, or exported”).
  • Document number = due diligence declaration (DDS) reference number: The reference number from the EU information system must be entered as the document number. Several DDS reference numbers can also be combined in one customs declaration.
  • Y-codes (exemptions), if applicable: In certain cases, additional Y-codes are used to correctly reflect exemptions/reliefs in the notification (e.g. SME constellations, transitional periods, "ex" HS codes from Annex I or products made from recycled material).

Important: The goods will only be released if the coding is complete (incl. reference number). If something is missing, the import/export cannot be processed in case of doubt.

Special cases that are often overlooked in practice

  • Re-import: A conventional reference number (99EU999999999999) can be used instead of a separate DDS for products that were demonstrably previously placed on the EU market and exported.
  • Export by downstream operator: When exporting, it is generally not necessary to specify a separate DDS reference number; instead, a dedicated TARIC certificate code is sufficient.

Reporting and documentation obligations

EUDR compliance is impossible without proper documentation. Companies must be able to demonstrate how they reached their decisions. This requires evidence that will truly stand up to scrutiny during an audit, as well as a reliable process that continuously creates and updates these documents and makes them easy to find.

Three levels are central to this:

  • Due Diligence Documentation: Companies must be able to demonstrate what information was available, how risks were assessed, and what measures were implemented. The due diligence system must also be reviewed at least once a year and updated as needed.
  • Record-keeping and Documentation: All documents, due diligence statements, risk assessments, supplier data, and reference numbers must be available for at least five years from the date the products are placed on the market or exported. Downstream operators and traders are also subject to this requirement: It is sufficient if the data can be compiled within a reasonable time upon request by the authorities.
  • Annual public reporting (for non-SMEs): Non-SME operators must publicly report on their due diligence system annually. The first report is due after December 30, 2027 and covers the year 2027. Those already reporting under CSRD or CSDDD can integrate the EUDR-relevant information there to avoid duplication, which should be planned into governance and reporting structures at an early stage.
EUDR-reporting
Reporting and documentation obligations under the Deforestation Ordinance

In practice, it is helpful to treat documentation obligations not as a filing problem, but as a design issue:

  • What minimum proof must be provided for each product flow?
  • Where are they stored in the system?
  • How do you prevent different teams from working with different versions?
  • And how can it be shown at the touch of a button that a process has been released in compliance with EUDR?

For many companies, the EU information system becomes the linchpin here, because due diligence statements are created and managed there, including references that are used further down the chain.

Cooperation with suppliers to comply with the EUDR

No company can comply with the EUDR on its own—the critical information almost always originates upstream from suppliers. That is why collaboration with them is a key to success: not as a communication measure, but as a structured, contractually guaranteed exchange of data. In effect, this creates a clear dependency: without data, there is no trade.

Three-stage approach to cooperation with suppliers

  • Which data is mandatory (incl. geodata format, references, proofs)?
  • Which quality criteria apply (completeness, plausibility, up-to-dateness)?
  • What deadlines and escalation logic apply if data is missing?

Smaller suppliers in particular often fail not because of a lack of will, but because of technology and processes. If you support them with training, simple templates, suitable tools and clear contact persons, things will run much more smoothly and the purchasing department will not suddenly find itself without data shortly before the end.

  • EUDR clauses (data obligations, audit/inspection rights, obligations to cooperate)
  • Mechanisms for correction/remedy when risks occur
  • Consequences of repeated inability to deliver (up to and including sourcing decisions)

Since the simplifications, it is even more important that cooperation in the supply chain is properly organized. If the DDS lies with the first distributor and others work primarily with references, the supplier data really must be correct. This is the only way to ensure that reference numbers, batches and internal approvals match and nothing gets lost along the way. Attention should be paid to this with batches, deliveries and the DDS.

Many people underestimate the fact that the EUDR primarily affects data and systems, not just legal and procurement departments. The EU Information System is the central platform for due diligence statements and references. Establishing clear responsibilities early on and ensuring that data—such as proof of legality and GeoJSON uploads—is neatly structured will save a lot of effort down the road.

Country benchmarking

With country benchmarking, the EU has created a key tool for classifying the risk of deforestation by country of origin. Since May 22, 2025, an official classification into three categories has been in place: low risk, standard risk, and high risk. This classification determines the level of due diligence required and where simplified requirements apply.

The EU publishes explicit lists of low-risk and high-risk countries; all countries not included on these lists are automatically considered standard-risk. You can find more details on country benchmarking here.

Risk categories at a glance

Low risk: Countries in this category are considered to be at comparatively low risk of deforestation-related violations. Companies in this category benefit from simplified due diligence obligations: Information collection remains mandatory, a comprehensive risk assessment and risk mitigation is generally not required. Typical examples (excerpt) include

  • Many EU member states (classified as low risk) and the USA
  • as well as individual countries that often seem surprising but are explicitly listed as low risk (e.g. Laos or the Dominican Republic)

Standard risk: This category is the "default" classification: It applies to all countries that are not explicitly listed as low or high. For imports from standard risk countries, the full due diligence obligations of the EUDR Regulation continue to apply, including risk assessment and, if necessary, risk mitigation measures.

High risk: Countries in this category are subject to particularly strict expectations, not only because of the full due diligence requirements, but also because they are accompanied by a higher level of regulatory scrutiny. In the first official classification, only four countries were listed as high risk:

  • Belarus
  • Myanmar
  • North Korea
  • Russia
EUDR-risk-categories
Country benchmarking: the three risk categories

EUDR-relevant products and raw materials

List of raw materials concerned (e.g. wood, soy, palm oil)

For the EUDR (Regulation EU 2023/1115), the most important thing is how the raw material is legally classified. The decisive factor is whether it belongs to the relevant raw materials and whether the specific product is listed in Annex I. The goods concerned are defined there via CN/customs tariff codes, in some cases only for certain subgroups ("ex" codes). This applies to HS codes and TARIC codes under the Deforestation Regulation.

The Deforestation Ordinance is linked to seven raw materials:

  • Wood
  • Soy
  • Palm oil
  • Beef
  • Cocoa
  • Coffee
  • Rubber (natural rubber)

Important in practice: As soon as a product contains one of these raw materials, was fed with it or was manufactured from it, it is worth taking a look at Annex I. Only if the product category is explicitly listed there does it fall within the scope. Composite products are also affected - this applies to composite products.

EUDR-raw-materials
Relevant raw materials covered by the directive

Product groups and their specific requirements

The regulation does not use industry categories but rather customs tariff codes for product groups. While this may seem cumbersome, it ensures clarity: Depending on its classification, the same material may be either in or out of scope. Correct tariff classification (CN code) is therefore a key step in every EUDR analysis. Two points are particularly important here:

  • "ex" codes: If "ex" appears before a code in Annex I, only an excerpt of the product group is covered. For example, "ex 9401" only covers wooden seats, but not seats made of other materials.
  • No quantity or value threshold: Even the smallest quantities of relevant products are subject to the obligations.

Typical product groups that fall under Annex I (depending on the CN code) are e.g:

Wood & wood products: roundwood, sawn timber, panel materials, furniture, certain paper and cardboard products
Soy: beans, soy meal, soy oil
Palm oil: palm oil and certain palm oil-based products
Beef: Cattle farming and beef products, including certain leather and hide product groups (hides, skins, and leather are to be excluded from the scope as of May 2026, according to the draft)
Cocoa & Coffee: Raw materials and selected processed product forms (e.g., certain cocoa products, coffee products). According to the May 2026 draft, instant coffee is also to be included.
Rubber: Natural rubber and selected products made from it (e.g., certain tires and rubber goods). This applies to both natural and synthetic rubber.

What has changed recently: In the course of the targeted revision, Annex I was technically adapted, among other things by removing certain printed products from the scope (Annex I adjustment "ex 49").

Exceptions and special regulations

In addition to the principle of Annex I decisions, there are a number of special cases in the EU Deforestation Regulation and the accompanying Guidance/FAQ that are regularly overlooked in projects.

Important exceptions and delimitations include:

  • Purely recycled products (100% recycled): Products made entirely of recycled material are generally not subject to the regulation. However, as soon as virgin material is added (e.g., new wood to repair a pallet or virgin pulp in paper), the regulation applies to those components.
  • Waste, used, or secondhand products: Products that have reached the end of their life cycle and would otherwise be disposed of as waste are excluded. This also applies, for example, to the casings of retreaded tires; only the new rubber tread is subject to this requirement.
  • Packaging that merely “tags along”: Packaging materials or containers used exclusively for transportation or protection are out of scope, including reusable packaging such as pallet pools or returnable containers. The situation is different when packaging is traded as a standalone product.
  • Printed matter (HS 49): Since the revision at the end of 2025, many printed products have been excluded from the scope of application. This also includes marketing and informational materials (e.g., user manuals, flyers, catalogs) that are included with another product or provided free of charge. However, if such materials are sold separately, the regulation continues to apply.
  • Samples or specimens for testing or analysis purposes: Product samples of negligible value and in negligible quantities that are used exclusively to establish new supplier relationships or for testing or analysis purposes are exempt.

In practice, these special cases often lead to misclassifications. Here are the most important distinctions.

Some special features apply to wood and wood products under the EU Deforestation Regulation.

Special features of wood & wood products

When it comes to implementing wood, companies frequently encounter three recurring bottlenecks:

  • Traceability: The more trading and processing steps there are, the more often consistent data is missing all the way back to the field of origin.
  • Mixing / mass balancing: Raw materials from different sources are mixed in sawmills, pellet mills or paper mills. It is then often no longer possible to clearly assign them to individual areas. For mixed products, however, all components must be EUDR-compliant.
  • Area origin: Forest areas often consist of many parcels, small owners or communal management. Determining the exact origin of individual wood lots is therefore challenging, especially outside the EU.

A frequent stumbling block: The transitional regulation between the EUTR and EUDR plays a major role for wood. For timber and timber products that were produced before June 29, 2023 and are placed on the market from December 30, 2025, the EUTR continues to apply up to and including December 31, 2028. Only after this date does the Deforestation Regulation apply exclusively. The date of production and time of placing on the market are therefore decisive.

It is important to note that these wood transitional rules run independently of the general EUDR deadlines according to company size; wood is a special case here.

FLEGT also causes misunderstandings in practice. The FLEGT regulations remain in force and are intended to ensure that only legally harvested timber from partner countries enters the EU. A FLEGT license therefore confirms legality - but it does not replace the EUDR requirements for freedom from deforestation and due diligence (incl. DDS).

Note: FLEGT can help with "legal", the Deforestation Ordinance also requires "deforestation-free" and "DDS/verifiable due diligence".

Affected companies & timetable

Scope of application according to company size and activity

Whether a company is subject to the EU Deforestation Regulation depends less on the industry and more on its role in the flow of goods. The regulation makes a rough distinction between "operators" and "traders". Since the amendment at the end of 2025, an additional distinction has been made between initial distributors, traders and downstream market participants:

  • First Placer on the Market / Exporter (Operator): Anyone who first places a relevant article or product on the EU market or exports it from the EU falls under the “operator” role—for example, an importer of cocoa beans or a cattle farmer in the EU. Operators bear full due diligence responsibility and must submit a DDS.
  • Trader: Anyone who resells a relevant product after it has already been placed in the EU is considered a trader. No own DDS obligation, but information and retention obligations to suppliers and customers.
  • Downstream Operator: Companies that place relevant products on the market or export them, provided those products are already covered by a DDS or simplified declaration—for example, following processing that results in a change in HS code. Example: a chocolate manufacturer that produces chocolate from imported cocoa beans. Core obligations are similar to those of traders: no requirement to submit a DDS, but information and record-keeping obligations (registration required in the EU Information System for non-SMEs).

Whether own import, own consumption or intermediate trader - our article Own consumption, own import, intermediate solution - When does the EUDR apply and when does it not?

These are the due diligence obligations for market participants and traders in detail.

Two special cases that often occur in practice:

  • Non-EU operator (Art. 7 EUDR): If a company based outside the EU places relevant products on the EU market, the first company based in the EU that passes on the goods is also deemed to be an operator. There are therefore two operators with full obligations.
  • Dual-role operator + downstream operator: A legal entity can have both roles at the same time, e.g. if it imports raw timber (operator) and processes it into sawn timber itself and sells it (downstream operator). In this case, DDS reference numbers do not have to be passed on within the same legal entity.

A separate sub-category of operators is the Micro or Small Primary Operator (MSPO), micro and small producers from low-risk countries with significantly simplified obligations. Details can be found in the update section above.

Transition periods and timetable for implementation

One point is crucial regarding the timeline: Although the regulation has been in effect since 2023, it will not become mandatory until the effective dates. Following the changes in December 2024 and December 2025 and the EUDR postponement, the current applicable timeline is as follows:

  • Large and medium-sized companies (large/medium operators): from December 30, 2026
  • Micro and small enterprises (micro/small operators): from June 30, 2027
  • Special rule for “EUTR products”: For market participants who were established as such as of December 31, 2024, the later start date of June 30, 2027 generally applies. This does not apply to products covered by the Annex to Regulation (EU) No. 995/2010 (EUTR). In this case, the regulation takes effect as early as December 30, 2026.

EUDR and the cut-off date: Find out how to deal with goods in stock and later placing on the market here.

What these deadlines mean in practice: The additional time is not a break, but rather an opportunity to set the groundwork properly, since clarifying roles, data flows, and internal approvals usually take longer than the legal review itself. In addition, the amending regulation provides for the continued application of the EUTR until December 31, 2029, for “existing products” (wood produced before June 29, 2023, and placed on the market on or after December 30, 2026).

EUDR-timeline
Implementation schedule

Differences between large companies and SMEs

The regulation deliberately differentiates between company size and role. Large and medium-sized companies usually have to fulfill more formal obligations. SMEs are relieved in some cases. This applies in particular where the rules are intended to prevent the same work being done more than once in the supply chain. These thresholds apply in detail to corporations and SMEs.

This is typically more significant for large and medium-sized companies:

  • More formal governance and more transparency: For non-SMEs, this includes annual public reporting on the due diligence system, with the first report due after December 30, 2027. In addition, the system must be reviewed at least once a year. Non-SME downstream operators and traders are also required to register in the EU information system.
  • Greater expectation of systematics and scalability: Large organizations must set up due diligence in such a way that it functions consistently across product groups, countries and business units, including audit capability.

Where SMEs are typically relieved:

  • Extended transition period: For micro and small enterprises, the EUDR will only apply from June 30, 2027, half a year later than for non-SMEs.
  • Less reporting burden: SMEs do not always have the same public reporting obligations as non-SMEs.
  • Simplifications throughout the supply chain: The obligation to submit DDS data generally rests with the first entity to place the product on the market. Of particular note: Only the first downstream entity is required to record the reference numbers, and it must do so passively—that is, only when the information is provided by the operator, without any obligation to actively request it.
  • Special category MSPO: Micro and small producers from low-risk countries who produce their own products and place them directly on the EU market benefit from particularly far-reaching facilitations, details in the update section above.

Where SMEs still come under pressure

Fewer obligations do not mean less work, because small businesses in particular quickly reach their limits: Geolocation data from suppliers in third countries is difficult to obtain, the resources for risk analyses are often lacking, and most do not have their own compliance department. On top of that, even small businesses are coming under increasing pressure because larger customers are demanding EUDR-compliant documentation from them, regardless of what the regulation formally requires.

What SMEs can do now

  • Review the supply chain: Which of the seven raw materials are included in our product lineup, either directly or as ingredients in processed products?
  • Approach suppliers: Clarify at an early stage which geodata and certificates of origin suppliers can provide.
  • Clarify my role in the chain: Am I the first distributor or a downstream player? The specific obligations that apply depend on this.

A point that is often overlooked in practice: Despite simplifications, SMEs also need clean processes. If information is missing or not properly documented internally, things quickly become difficult, for example with customer requirements, inspections or in supply chains with many intermediate stages.

Monitoring compliance with the EUDR

Competent authorities and monitoring mechanisms

The EU delegates enforcement of the EUDR to the member states: Each state designates its own authorities to conduct on-site inspections, which are closely integrated with customs and market surveillance.

The inspections are risk-based: Depending on the risk category of the country of origin, authorities inspect at least 1% (low risk), 3% (standard risk), or 9% (high risk) of cases. For companies, this means that the likelihood of an audit depends heavily on the origin of the raw materials. Data and supporting documentation should therefore be fully and transparently documented at all times.

Carrying out inspections and audits

Inspections are more than just paperwork. Regulatory agencies verify whether the information provided is accurate, whether internal assessments actually make sense, and whether the company’s processes comply with the rules in practice. This is done either in response to a specific incident—such as a tip—or on a regular basis as part of established minimum inspection quotas.

An audit typically proceeds as follows: Authorities cross-check documents, perform plausibility checks, and examine information regarding origin and geodata particularly closely. This is often supplemented by random sampling and, in some cases, on-site inspections. If there is an immediate risk, authorities can take immediate action, such as seizing goods or temporarily halting their sale or export.

Role of digital systems for monitoring

Without a digital infrastructure, the EUDR is virtually impossible to implement. That is precisely why the EU information system plays a central role. Due diligence statements are recorded there and reused throughout the supply chain: Downstream companies simply adopt the reference and verification numbers, either manually or via a CSV upload. An API is also available for handling large volumes of data.

For government agencies, the system serves as a central access point: It streamlines screening, supports risk-based selection, and establishes a uniform basis for traceable audits. User guides also assist with the day-to-day operation of the system.

Sanctions and penalties for breaches of the EUDR

The EUDR’s sanctions framework is intentionally strict because it uses market access as a lever. In addition to fines, the focus is primarily on measures that have a direct impact on the market: products can be removed from the market, and bans on distribution or supply may be imposed; in certain cases, seizure is also possible to immediately eliminate risks.

The financial implications are also significant: Fines can reach up to 4% of annual EU-wide revenue. What matters most here is not so much the exact percentage as the message it sends: Violations are meant to pose a genuine compliance risk, both financially and operationally.

Enforcement is carried out by the competent authorities of the Member States. They can not only impose penalties but also take immediate action, such as recalling products, removing them from the market, or taking provisional measures in the event of an acute risk.

Added to this is a factor that many underestimate: public visibility. Under the concept of “naming and shaming,” final court decisions can be made public. Sanctions thus affect companies not only financially but also in terms of their reputation.

Under the EUDR, reputational risk is no minor issue. If proceedings become public, pressure quickly mounts from regulatory authorities, customers, investors, NGOs, and the media—a violation is then often seen as a sign of a lack of control, even if only a single process did not go smoothly.

In addition to fines and sales bans, companies face the risk of strained business relationships, contractual penalties, or contract rescissions, as well as internal questions regarding accountability. EUDR violations are therefore rarely just legal matters—they quickly become a business risk for the entire value chain.

Conclusion

The implementation of the EUDR is an important step toward sustainability and environmental protection. At the same time, it presents companies with clear tasks: reviewing supply chains, ensuring transparency, and thoroughly documenting the origin of raw materials. As a result, ensuring that products are free from deforestation becomes an integral part of day-to-day business. Digital tools and high-quality data help identify risks early on and systematically meet regulatory requirements.

The extra time gained by the postponement is not a reason to delay, but a real opportunity. Those who consistently implement the EUDR are not only fulfilling their legal obligations; they are also demonstrating that they are reliable partners in sustainable, deforestation-free supply chains. This protects forests and, at the same time, provides a real competitive advantage.

Frequently asked questions

The EU Deforestation Regulation (EUDR) is intended to prevent products linked to deforestation from entering the EU market. It covers seven commodities—beef, cocoa, coffee, palm oil, soy, timber, and rubber—as well as products made from them, such as leather, chocolate, furniture, and paper.

The EUDR is a significant step toward sustainability and, at the same time, sets clear requirements for companies: to review supply chains, ensure transparency, and thoroughly document the origin of their products. This makes ensuring that products are free from deforestation an integral part of day-to-day business.

The EUDR replaces the EU Timber Regulation (EUTR, EU 995/2010). Effective in 2010, the EUTR prohibited the import of illegally harvested timber into the EU for the first time and required importers to provide proof of legal origin.

However, the EUTR remains in effect for another three years for wood products derived from trees that were harvested before the EUDR took effect and that enter the EU market during the transition period (Article 37, paragraph 2).

The transition period runs from the date the regulation is adopted on June 30, 2023, until it takes effect on December 30, 2026 (until June 30, 2027, for micro and small enterprises). This applies to raw materials listed in Annex 1 of the EUDR that are imported during this phase but will not be placed on the market in processed form until later.

Example: Cocoa is imported during the transition period without geolocation data, but the chocolate produced from it is not scheduled to be sold until December 30, 2026. In this case, the market participant need only demonstrate that the raw material was on the market before the regulation took effect. If, on the other hand, the goods are placed on the market or exported after December 30, 2026, the full EUDR requirements apply.

This applies to all “market participants”—that is, companies that sell, process, or export relevant products in the EU.

Large and medium-sized enterprises must comply with the full due diligence requirements (risk assessment, measures). SMEs are partially exempt but must still ensure deforestation-free production and retain reference numbers for 5 years. Small enterprises: total assets up to €4 million, revenue up to €8 million, and a maximum of 50 employees. Medium-sized enterprises: total assets up to €20 million, revenue up to €40 million, and a maximum of 250 employees.

Article 7 EUDR describes this case in more detail. In this respect, it should be noted that the first natural or legal person established in the Union to make these relevant products available on the market is considered to be an operator within the meaning of this Regulation. This means that the first company established in the EU that places the products on the market must comply with the due diligence obligations.

The EUDR covers seven raw materials: wood, coffee, soy, palm oil, cocoa, beef, and rubber, as well as all products derived from them, as listed in Annex I. The list is exhaustive; there are no thresholds, and the requirements apply regardless of the place of manufacture. The Commission may amend the list by delegated act; an initial review is scheduled to take place within two years of the regulation’s entry into force.

The full text of the regulation, including Annex I and the HS codes, is available as a PDF on EUR-Lex. Businesses are advised to use the consolidated version, as it already includes all amendments, including the deadline extension provided for in Regulation (EU) 2025/2650.

According to Article 3 EUDR, the raw materials and products must fulfill the following conditions cumulatively:

  1. They must not be deforested and must comply with the deadline of December 31, 2020.
  2. In addition, the products must be produced in accordance with the applicable laws of the country of manufacture.
  3. Finally, a declaration of due diligence is required for the corresponding products.

Deforestation refers to the conversion of forest into agricultural land, whether caused by human activity or not. Important: The EUDR excludes not only illegal deforestation but all forms of deforestation. Products are considered deforestation-free if the cultivation areas have not been deforested or damaged since December 31, 2020.

According to the FAO definition, a forest is an area larger than 0.5 hectares with trees taller than 5 meters and more than 10% canopy cover, excluding areas used primarily for agricultural or urban purposes. Forest degradation occurs when the forest structure undergoes a fundamental change, such as the conversion of primary forests into plantations.

“Other forested areas” are areas larger than 0.5 hectares with 5–10 percent canopy cover or more than 10 percent coverage by shrubs, bushes, and trees. The European Commission regularly considers expanding the scope of protection to include these areas.

After 1 year: Review of these areas. After 2 years: Review of additional ecosystems (peatlands, wetlands) and raw materials (corn, biofuels). After 5 years: First comprehensive review, focusing on producer countries, small-scale producers, and indigenous peoples.

Market participants must fulfill the due diligence requirements set forth in Article 8 before placing products on the market or exporting them. This is mandatory. Non-SME traders have the same obligations as market participants in this regard.

SMEs are not required to conduct the due diligence review themselves if a due diligence statement already exists for the products. In that case, it is sufficient to provide the reference number. If no such statement yet exists for individual components, however, SMEs must also conduct the full review for those components.

The current version of the EUDR underwent a fundamental revision at the end of 2025: The revised version was published in the Official Journal of the European Union on December 23, 2025. It is now mandatory for large and medium-sized enterprises as of December 30, 2026, and for small and micro-enterprises as of June 30, 2027.

In terms of content, the revision introduces the “once-only” approach: Only the first distributor must submit a complete due diligence statement; downstream actors are relieved of this obligation. In addition, printed materials have been removed from the scope of the regulation. The European Commission will examine further simplifications by April 2026. Companies should use this additional time to establish practical systems for fulfilling due diligence obligations and collecting geodata.

The due diligence process consists of three steps. These steps must be completed before a product is placed on the market or exported.

  1. Gather information: Details regarding the product, quantity, supplier, country of origin, legality, and geographic coordinates of the cultivation areas. If this information is missing, the product may not be sold.
  2. Assess Risk: A comprehensive risk assessment is mandatory for standard- and high-risk countries. For low-risk countries, a simplified review is sufficient, though information must still be gathered. Ultimately, it must be determined that the risk of deforestation is negligible.
  3. Mitigating Risk: If the risk is not negligible, additional measures are required, such as more documentation, independent audits, or closer monitoring of suppliers. Only then may the due diligence statement be issued and the product sold.

All supporting documents must be retained for 5 years. The procedure must be reviewed at least once a year.

Country benchmarking (Article 29) classifies countries of origin into three categories based on deforestation risk: low, standard, and high. This classification is based on criteria such as the extent of deforestation, the expansion of agricultural land, and trends in production. National laws, the protection of indigenous peoples, and international sanctions may also play a role.

The classification determines how strictly the goods are inspected. For low-risk countries, a simplified inspection is sufficient. However, the origin of the goods must always be verified, and it must be demonstrated that there is no deforestation or illegal practices involved.

The authorities of the member states are responsible for verifying the due diligence statements. The frequency of verification depends on the risk level of the country of origin: 9% for high risk, 3% for standard risk, and 1% for low risk.

The due diligence statements, along with risk assessments and mitigation measures, will be reviewed. This will be supplemented by random spot checks and on-site inspections. Market participants and non-SME traders must cooperate in this process—for example, by granting access to their premises and providing all relevant documentation.

Traceability means that a product’s path from its origin to the market must be fully traceable. At its core is the geolocation of all cultivation areas using coordinates; for areas larger than four hectares, this is done using polygons.

There are no exceptions, not even for long supply chains, bulk commodities such as soy, or composite products such as wooden furniture. Mixing with raw materials of unknown origin is not permitted; if even one part is noncompliant and cannot be separated, the entire product is considered noncompliant.

Coordinates are recorded using a cell phone, GNSS device, or GIS application.

It should be emphasized that there are no exceptions. If a part of a relevant product does not comply with the regulations, it must be separated before being placed on the market or exported. If this cannot be done, the entire product is considered non-compliant. Proof of compliance with Article 3 is always crucial. The operator must record the geolocation of all properties involved, otherwise the product may not be placed on the market.

Article 9(1)(d) governs geolocation. Additionally required: harvest date or production period, in order to verify compliance with the deforestation-free requirement under Article 3(a) as of the cutoff date of December 31, 2020.

There is a special rule for cattle: Geolocation must cover all locations where they are kept, including pastures and slaughterhouses.

Article 31 grants natural and legal persons the right to report substantiated concerns to the competent authorities if they suspect a breach of the EUDR. The authorities are obliged to investigate such reports, listen to the market participants concerned and, if necessary, take action, including suspending trade in the products concerned. The whistleblowers will be informed of the measures taken within 30 days.

If a violation is suspected, authorities can take immediate action: seize the goods or halt their sale. If a violation is confirmed, the company must respond—recall the goods, dispose of them, or take precautions for the future.

Penalties: Fines, confiscation of goods and profits, and bans on trade. In the event of a repeat offense, fines of up to 4 percent of annual revenue may be imposed. In addition, the European Commission publishes the names of the companies involved.

Larissa Ragg

Larissa Ragg

LinkedIn

Marketing Managerin · lawcode GmbH

Larissa Ragg verantwortet die Content-Strategie bei lawcode und erstellt Fachbeiträge zu den Themen EUDR, ESG-Compliance, HinSchG, Supply Chain und CSRD. Ihre Beiträge auf dem lawcode Blog machen komplexe regulatorische Anforderungen verständlich und liefern Unternehmen praxisnahe Orientierung.

Previous Post

ESG reporting: Obligations, key figures & frameworks for companies at a glance

Next Post

Non-Financial Reporting Directive (NFRD): Obligations, affected parties & replacement by the CSRD

y

More articles on EUDR