EUDR explained: what the EU Deforestation Regulation requires and who it affects

This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for advice specific to your situation.

What the regulation does

The EU Deforestation Regulation (Regulation (EU) 2023/1115, commonly referred to as EUDR) prohibits placing certain commodities and derived products on the EU market, or exporting them from it, if they are associated with deforestation or forest degradation that occurred after 31 December 2020.

The logic is straightforward: the EU is one of the largest consumers of commodities whose production drives deforestation globally. By conditioning market access on proof that production did not contribute to deforestation, the regulation makes EU demand a lever for forest protection rather than a driver of forest loss.

The practical consequence for businesses is significant. An EU company that wants to import cocoa, coffee, palm oil, soya, cattle products, wood, or rubber, or any product derived from those commodities, must be able to demonstrate, before placing the product on the market, that it was produced on land that was not subject to deforestation after 31 December 2020. If it cannot demonstrate this, the product cannot legally enter EU commerce.

Which commodities and products are in scope

The EUDR covers seven commodity groups: cattle, cocoa, coffee, palm oil, soya, wood, and rubber.

The regulation does not apply only to the raw commodities themselves. It also covers a wide range of derived products where those commodities are a significant input. The full list is set out in Annex I to the regulation, but the main categories include:

Cattle: Meat, leather, and leather goods. Live cattle exported from the EU are also covered.

Cocoa: Chocolate, cocoa butter, cocoa powder, and preparations containing cocoa.

Coffee: Roasted coffee and coffee extracts and preparations.

Palm oil: Refined palm oil, palm kernel oil, palm-based fats, and oleochemicals derived from palm. Many cosmetic, food, and cleaning products contain palm oil derivatives.

Soya: Soya flour, soya oil, soya-based animal feed, and tofu. Soya is widely used as an ingredient in processed foods and as livestock feed, which means it enters the supply chain of many products not immediately associated with deforestation risk.

Wood: Sawn timber, veneer sheets, plywood, paper, and cardboard. Furniture is covered. Wood used in construction materials is covered. Printed products such as books and newspapers were removed from scope by the December 2025 amending regulation. The breadth of remaining derived products still makes this one of the more complex commodity groups to track.

Rubber: Natural rubber, rubber tyres, rubber gloves, and many other manufactured rubber goods.

The coverage of derived products means that businesses in sectors not obviously connected to forest commodities, including food manufacturing, cosmetics, furniture retail, publishing, and automotive, may find that at least some of their product lines are in scope.

Who is directly regulated

Following the December 2025 amending regulation (Regulation (EU) 2025/2650), the EUDR distinguishes between operators, downstream operators, and traders, with a further subcategory of operator called the micro or small primary operator.

Operators are companies or individuals who, in the course of a commercial activity, place relevant products on the market or export them. An importer bringing cocoa into the EU for the first time is an operator. A company processing domestically produced cattle products and selling them into EU commerce for the first time is also an operator. Operators bear the full due diligence obligation: they must carry out the complete due diligence process and submit a due diligence statement before placing or exporting each product.

Micro or small primary operators are a subcategory of operator introduced by the 2025 amendment: natural persons or micro and small enterprises established in a country classified as low risk, who place on the market or export relevant products that they themselves produced. Rather than submitting a full due diligence statement, they may submit a one-time simplified declaration in the EU information system, which is assigned a declaration identifier that accompanies the product through the supply chain. Where the required information is already available through an existing Member State database, such as the cattle traceability systems most Member States already operate, they may be exempted from even that one-time declaration.

Downstream operators are a new category introduced by the 2025 amendment: companies that place on the market or export products made by processing other relevant products that have already been covered by a due diligence statement or simplified declaration further up the chain. Their obligations are identical to those of traders.

Traders are companies that make relevant products available on the EU market without processing them, and without being the first to place them there, such as a retailer selling chocolate that was imported by a separate operator.

Neither downstream operators nor traders are required to ascertain that due diligence was exercised or to submit a due diligence statement of their own. Non-SME downstream operators and non-SME traders must register in the EU information system. Only the first downstream operator or trader in a given supply chain is required to collect and retain the reference number of the upstream due diligence statement or declaration identifier; downstream operators and traders further down the same chain are not required to repeat that step.

What due diligence requires

Due diligence under the EUDR has three components: information collection, risk assessment, and risk mitigation.

Information collection

Before placing a product on the market, an operator must collect and keep the following information:

Description of the product: Including the commodity, quantity, and country of production.

Geolocation data: The precise geographic coordinates of all plots of land where the relevant commodity was produced. For cattle products, this means the coordinates of all establishments where the animals were kept. This is the requirement that creates the most practical difficulty for complex supply chains: it means tracing the commodity back to the specific land parcel, not just to the country or region of origin.

Verification of production date: Evidence or a substantiated statement that the commodity was produced on land that has not been subject to deforestation since 31 December 2020. Where satellite monitoring data is available, this is typically the basis for this determination.

Relevant legislation compliance: A statement that the commodity was produced in compliance with the relevant legislation of the country of production, covering land use rights, environmental protection, and applicable labour laws.

Name and contact details of supply chain actors: Sufficient to trace the product from the operator back to the relevant production land.

Risk assessment

Once the information is collected, the operator must carry out a risk assessment to determine whether there is a non-negligible risk that the products are not compliant. The assessment must consider:

The country or region of origin and its deforestation risk classification under the EUDR benchmarking system (explained below). The presence of forests in the area of production. The complexity and length of the supply chain. The reliability of the documentation provided by suppliers. Any concerns raised by third parties, NGOs, or public bodies about the area or the supply chain.

Risk mitigation

Where the risk assessment identifies a non-negligible risk, the operator must take mitigation measures before proceeding. These may include requesting additional documentation, conducting independent audits of production sites, or working with suppliers to implement monitoring systems. If the risk cannot be mitigated, the product cannot be placed on the EU market.

The due diligence statement

The statement generates a reference number that must accompany the product through the supply chain. Under the amended regulation, neither downstream operators nor traders need to submit a separate due diligence statement of their own, but the first downstream operator or trader in the chain must collect and retain the upstream reference number, and be able to produce it and the supporting documentation on request.

Operators must keep the underlying documentation, including the geolocation data, supplier declarations, risk assessments, and mitigation records, for five years. Competent authorities have the power to request this documentation during inspections.

The benchmarking system

The EUDR introduces a benchmarking system that classifies countries (and potentially regions within countries) into three risk categories: low, standard, and high.

For products originating from low-risk countries, operators benefit from simplified due diligence. They still need to collect basic information and submit a due diligence statement, but the risk assessment requirements are less intensive.

For products from standard-risk countries, full due diligence applies as described above.

For products from high-risk countries, enhanced scrutiny applies. The Commission and member state competent authorities pay closer attention to products from these origins, and operators may face additional verification requirements.

The benchmarking classifications are determined by the Commission based on objective criteria including deforestation rates, forest governance, national regulation, and trade and production trends. Classifications are reviewed regularly and can change. A country classified as standard risk today could be reclassified as high risk if its deforestation indicators worsen.

The practical consequence for supply chain decisions is that origin country matters not just for cost and logistics but for compliance burden. Sourcing from a country that later receives a high-risk classification means existing due diligence procedures may no longer be sufficient.

What non-EU suppliers need to provide

Non-EU producers and exporters are not directly regulated by the EUDR. The regulation applies to EU operators and traders. But EU buyers can only comply with their EUDR obligations if their non-EU suppliers provide the right information.

The specific requirements depend on the commodity and the structure of the supply chain, but the core data that non-EU suppliers are typically asked to provide includes:

Plot-level geolocation data: GPS coordinates for every land parcel where the commodity was produced. For large plantations this may involve a relatively small number of parcels. For commodities sourced from smallholders, it may involve hundreds or thousands of individual plots. Aggregated data at farm or village level is not sufficient as the regulation requires parcel-level coordinates.

Production date evidence: Documentation showing that the land was not subject to deforestation after 31 December 2020. Satellite imagery is the most common basis for this, and several third-party service providers offer EUDR-specific land monitoring. National deforestation monitoring systems may also be used where they meet the required standard.

Legal compliance declarations: Statements confirming that production complied with relevant national laws on land use, environmental protection, and labour rights.

Supply chain documentation: Records sufficient to trace the commodity from the production parcel to the point of export.

Suppliers who cannot provide this documentation will find EU buyers unable to legally import their products. In practice this means that inability or unwillingness to engage with EUDR data requirements translates directly into loss of EU market access, regardless of the quality or price of the product.

Enforcement and penalties

Enforcement is the responsibility of member state competent authorities. Each member state must designate the authority or authorities responsible for EUDR enforcement and give them adequate resources and powers.

Competent authorities have the power to conduct checks on operators, downstream operators, and traders, including physical inspection of products and premises, review of due diligence documentation, and access to geolocation and supply chain data. They can also require operators or downstream operators to withdraw products from the market, seize non-compliant goods, and issue prohibitions on further placing or trading.

Penalties for non-compliance must be effective, proportionate, and dissuasive. The regulation requires member states to provide for penalties including fines proportional to the environmental damage caused and to the value of the relevant products (with a minimum threshold of at least four percent of annual EU turnover), temporary exclusion from procurement procedures, and confiscation of products and revenues.

The key deadlines

The EUDR was published in the Official Journal in June 2023. The application date has since been postponed twice: first from 30 December 2024 to 30 December 2025, and then, by Regulation (EU) 2025/2650, published in the Official Journal on 23 December 2025, to the dates below.

Operators, downstream operators, and traders generally: Obligations apply from 30 December 2026.

Operators who are natural persons or micro and small undertakings already established as such by 31 December 2024: Obligations apply from 30 June 2027.

Micro and small primary operators sourcing from low-risk countries benefit from a further simplification: a single, simplified declaration rather than a full due diligence statement per consignment.

Where EUDR sits in the broader sustainability regulation landscape

The EUDR is one of several EU sustainability regulations that create obligations for non-EU businesses through supply chain mechanisms. It sits alongside CSDDD, which requires human rights and environmental due diligence across the supply chain more broadly, and CSRD, which requires EU companies to report on value chain impacts including from non-EU suppliers.

For suppliers of EUDR-covered commodities, the practical effect is that EU buyers are building data collection and verification systems that will generate ongoing requests for supply chain information, not just for initial EUDR compliance, but also to meet their CSRD reporting obligations and CSDDD due diligence requirements across the same supply chain. The data infrastructure required to respond to these requests has significant overlap across the three frameworks.

An overview of the full EU sustainability regulation landscape, including the interaction between these frameworks, is available here: EU sustainability regulation in 2026: an overview of what is now in force.

Verdandi monitors the EU sustainability regulatory landscape continuously, covering EUDR, CSRD, CSDDD, CBAM and more, so you’re working from current requirements as deadlines and country risk classifications change. Start for free.