An Overview of the EUDR
Up to 90 per cent of global deforestation is driven by land clearance for agriculture. Key drivers are commodities such as beef, soy (often used as animal feed), palm oil, cocoa and other export-oriented agricultural raw materials. The EU’s contribution to global deforestation – in particular through imported goods – is estimated at around 10 per cent. With the EU Deforestation Regulation (EUDR), the European Union aims to reduce this contribution. The EUDR provides that the agricultural commodities cattle, soy, palm oil, natural rubber, wood, cocoa and coffee, as well as certain derived products, may only be placed on the European market if they demonstrably originate from deforestation-free sources after the cut-off date of 31 December 2020 and have been produced in accordance with the relevant legislation of the country of production.
The Regulation applies to large and medium-sized companies from 30 December 2026 and to micro and small enterprises from 30 June 2027.
In early May 2026, the European Commission published a package of measures to facilitate practical implementation. The package includes updated FAQs, guidelines and new infographics with application-specific supply chain scenarios. Companies are advised to clarify their scope of application at an early stage, to engage with the requirements of the Regulation and to define appropriate processes and responsibilities.definieren.
Does the EUDR Apply to Your Company?
The EUDR applies to all companies established in the EU that place the commodities cattle, wood, soy, coffee, cocoa, natural rubber and palm oil, as well as certain derived products, on the EU market, make them available on the EU market or export them from the EU.
Which products are specifically covered depends on their individual customs tariff classification, the so-called HS code. The EUDR only applies where a product with the relevant HS code is listed in Annex I and a relevant action (placing on the market, making available, exporting) is taken in relation to that product.
What Do You Need to Do?
In order to be permitted to place relevant products on the EU market, you must fulfil three basic requirements. The products must be:
- deforestation-free
- produced in accordance with the relevant legislation of the country of production, and
- covered by a due diligence statement or simplified declaration
The due diligence statement or simplified declaration is a prerequisite for placing products on the market. In order to submit the statement, companies must first fulfil due diligence obligations. These obligations apply primarily to operators – that is, companies that place relevant products on the EU market for the first time or export them from the EU, provided that no due diligence obligation has yet been fulfilled for these products. Reduced obligations apply to downstream operators, traders and micro or small primary operators.
How Can Operators Implement Their Obligations?
Compliance with the EUDR is not demonstrated by a single piece of evidence but through a systematic due diligence process. Operators must collect relevant data and information, assess the risks of deforestation and non-compliance with applicable legislation based on that information, implement appropriate risk mitigation measures where necessary, and document the outcomes of the due diligence process. The following step-by-step overview illustrates how this process can be implemented in practice.
Step 1: Strategy and Governance
Step 2: Collection of Information
The information-gathering process focuses on the commodity underlying the product and the location where that commodity was produced. In particular, the following information must be gathered: product details (e.g. type and quantity), country of production, information on the suppliers involved, and the geolocation data of the plots of land where production takes place. In addition, evidence of deforestation-free production and legal production must be collected, for example in the form of certificates, official permits or other suitable documents.
The scope and level of detail of the information required depends on the level of risk exposure. In general, high-risk contexts require more comprehensive information and evidence than low-risk contexts. Since the EUDR does not prescribe the specific scope of information collection, companies retain a certain margin of discretion in this regard.
The information collected forms the basis for the subsequent risk assessment.
Step 3: Risk Assessment
Operators must assess whether, on the basis of the information collected, there is a risk that the product does not comply with the requirements of the EUDR. The key question is whether a reasonable person could conclude that there is no or only a negligible risk of deforestation or illegality. Various factors feed into this assessment, including the reliability of the information, the complexity of the supply chain, the risk of deforestation in the country of origin, or indications of possible violations. Only if the risk is classified as negligible can the process continue without further measures.
Where there are indications (including substantiated concerns) of non-compliance of products already placed on the market, operators must inform the competent authorities as well as downstream operators and traders.
Step 4: Risk Mitigation
If the risk assessment reveals a non-negligible risk, operators must adopt appropriate risk mitigation measures. These aim to eliminate remaining uncertainties and reduce the risk to a negligible level. This may include, for example, requesting additional information or evidence from the supplier, commissioning independent audits or inspections, or conducting on-site research. Only once these measures have been successfully taken and the risk has been reduced accordingly can the process be completed.
Step 5: Submission of the Due Diligence Statement
Finally, operators must register in the EU information system and submit a due diligence statement. By means of this statement, they confirm to the competent authorities that they have fulfilled all the required due diligence obligations and have concluded that there is no or only a negligible risk of non-compliance. Submission of this statement is a mandatory prerequisite for a product to be placed on the EU market, made available on the market or exported.
Only through the combination of information collection, assessment and, where necessary, risk mitigation, together with the final due diligence statement, is it ensured that only compliant products enter the European market.
Step 6: Documentation and Reporting
Decisions on procedures and measures must be documented. Large operators (non-SMEs) are additionally required to designate a compliance officer at management level and an independent audit function, and to report publicly on an annual basis on their EUDR measures. Reporting under the CSRD or CSDDD may in certain cases fulfil this requirement.
Simplified Due Diligence
Where relevant products are sourced from a low-risk country, a simplified due diligence procedure applies. Simplified due diligence does not replace the standard due diligence obligations but modifies them. The obligation to collect information (Step 1) remains in place. Risk assessment and risk mitigation can, however, generally be dispensed with (Steps 3 and 4). The prerequisite for this is that the operator ensures that the relevant products were produced in countries or regions classified as low risk under the EU country benchmarking system. In doing so, operators must in particular consider three aspects:
- the complexity of the supply chain,
- the risk of circumvention of the Regulation, and
- the risk of mixing with products from countries in higher risk categories.
The operator must therefore rule out, through an assessment, that one or more of these risk-increasing factors are present. This means: if an operator finds, for example, that the supply chain is particularly complex and the risk of mixing is high, the operator is required to carry out a risk assessment and, where necessary, risk mitigation.
The conclusions regarding the simplified due diligence must be documented by companies and made available to the authorities upon request.
How Can Micro or Small Primary Operators Implement Their Obligations?
Micro or small primary operators are operators that are micro or small enterprises established in a low-risk country and that themselves grow, harvest or raise relevant products in that country. Under the EUDR, reduced obligations apply to them. While they are in principle subject to the same obligations as operators, the requirement to submit a comprehensive due diligence statement before each placing on the market does not apply. Instead, following registration in the EU information system, only a one-time simplified declaration is required. This declaration contains reduced information: instead of geolocation data, the postal address or business address of the site of production suffices, and the quantity of products can be provided as an annual estimate. Each declaration is assigned a declaration identifier, which is required for placing on the market or exporting and must be passed on to downstream operators. A declaration is exceptionally not required where the necessary information is already available in EU or national information systems and is transferred to the EU information system. In all other respects, the simplified declaration is limited to a confirmation that the due diligence obligations will be complied with prior to each placing on the market.
How Can Downstream Operators and Traders Implement Their Obligations?
Downstream operators and traders are actors who place or make available on the market relevant products whose components have already been subject to due diligence at an earlier stage in the supply chain. They are subject to significantly fewer obligations than upstream operators (first placers on the market). Since the due diligence obligations have already been fulfilled, their focus is on ensuring traceability. They are therefore generally not required to submit their own due diligence statement or to carry out an independent risk assessment. However, they are subject to information, record-keeping and notification obligations. In particular, information on suppliers and customers as well as – where applicable – the reference number of a due diligence statement already submitted must be recorded and retained for a period of five years. Where there are indications of possible non-compliance, the competent authority and downstream business partners must be informed without delay. Large downstream operators and traders are subject to additional obligations: they must register in the EU information system and, where substantiated concerns exist based on objective and verifiable indications, verify whether the upstream due diligence obligations were properly fulfilled and whether only a negligible risk exists. This case-specific verification may take the form of, for example, a plausibility check of the reference number of a due diligence statement, the obtaining of additional information from the supplier, or the review of available reports; however, verification of the reference number in the EU information system is not required.
Further Information from the European Commission
The European Commission also provides companies with a range of resources to help them comply with the EUDR requirements. Click here for the FAQs, guidelines, and website:
elan!: Step by Step Towards Deforestation-Free Supply Chains
Would you like to make your supply chains deforestation-free and put the EUDR due diligence requirements into practice? The free online platform elan! guides you through the process, from strategic planning to practical implementation.
Go to elan!
Frequently asked questions
What is my company’s role – operator, trader or downstream operator – and what obligations follow from this?
The relevant role must be determined separately for each relevant product and each individual transaction. An operator is a person who places a relevant product on the Union market for the first time or exports it from the Union. A downstream operator is a person who places or exports a relevant product made using relevant products, all of which have already been covered by an operator. Traders are economic actors who make a relevant product that has already been placed on the Union market available on the market. A legal person can therefore hold different roles under the EUDR depending on the product and the specific transaction.
How can I check whether my product is actually covered by the EUDR?
The check should follow three steps: first, binding customs tariff classification; second, comparison of the tariff heading with Annex I of the EUDR; and third, assessment of whether the product actually consists of or has been made using the relevant commodity assigned to it in Annex I. For packaging, the specific use must additionally be taken into account. For recycled goods, the waste status and the possible proportion of non-recycled material must be evidenced. For borderline cases, an application for a binding tariff information should be considered.
When must my company submit its own due diligence statement, and when is the reference number of an upstream supplier sufficient? How must reference numbers be passed on, retained, verified or requested?
In principle, the due diligence statement must be submitted by the operator that places a relevant product on the Union market for the first time or exports it from the Union. A simplified declaration applies to micro or small primary operators. Downstream operators and traders are generally not required to submit their own due diligence statement. However, the first downstream actor whose immediate supplier is an operator must record the reference number of the due diligence statement or the declaration identifier of the simplified declaration. This reference number must be actively passed on by the operator to the purchaser, for example on the invoice, by e-mail or in an accompanying document. The recipient must assign the reference number to the relevant goods receipt and retain it for at least five years. A systematic verification of the reference number is not prescribed, although the EU information system provides a technical facility for this purpose. However, where the recipient is aware that its supplier is acting as an operator, the recipient must actively request the reference number.
What should I do if a due diligence statement is missing, the reference number is not passed on, or there are doubts about whether the supplier has fulfilled its due diligence obligations?
Where a reference number of a due diligence statement is missing, the downstream actor may initially assume that its immediate supplier is not acting as an operator. However, if the downstream actor is aware that the supplier is an operator and is not providing the required reference number, the product in question may not be placed on the market, made available on the market or exported. Where downstream operators or traders obtain new information or where substantiated concerns exist regarding possible non-compliance, they must immediately inform the competent authority and the affected downstream purchasers. Non-SMEs are subject to additional verification obligations in such cases: they must verify whether the upstream due diligence obligation was properly fulfilled, and may not market or export the product until the verification is complete. If the risk cannot be reduced to a negligible level or if the required information is not available, placing on the market or exporting is not permissible.
What information and evidence must I collect, store, retain for five years and be able to provide upon request?
An operator should maintain a verifiable product file with four levels: master data and transaction data; geolocation data and production period; evidence of legality and deforestation-free production; and documented risk assessment including measures and the due diligence statement. Downstream actors, by contrast, should not as a rule request a complete upstream due diligence file without specific cause. Their statutory information obligations are limited in principle to immediate business partners and, where applicable, the reference number.
For the legality check, the EUDR refers to ‘relevant legislation of the country of production’. What does this mean?
The legality check under the EUDR relates exclusively to the country of production and, within that country, to the specific area where the commodity was grown, harvested or raised. Legislation of countries where only processing took place is not relevant for the legality check.
The following are considered ‘relevant’: legislation affecting the legal status of the area of production. Examples of relevant areas of law:
- Land use rights
- Environmental protection and biodiversity
- Forest laws and sustainable management
- Third parties’ rights (e.g. of indigenous peoples)
- Labour and human rights
- Tax, trade and customs regulations