EUDR explained: what the EU Deforestation Regulation requires and who it affects

This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for advice specific to your situation.

What the regulation does

The EU Deforestation Regulation (Regulation (EU) 2023/1115, commonly referred to as EUDR) prohibits placing certain commodities and derived products on the EU market, or exporting them from it, if they are associated with deforestation or forest degradation that occurred after 31 December 2020.

The logic is straightforward: the EU is one of the largest consumers of commodities whose production drives deforestation globally. By conditioning market access on proof that production did not contribute to deforestation, the regulation makes EU demand a lever for forest protection rather than a driver of forest loss.

The practical consequence for businesses is significant. An EU company that wants to import cocoa, coffee, palm oil, soya, cattle products, wood, or rubber, or any product derived from those commodities, must be able to demonstrate, before placing the product on the market, that it was produced on land that was not subject to deforestation after 31 December 2020. If it cannot demonstrate this, the product cannot legally enter EU commerce.

Which commodities and products are in scope

The EUDR covers seven commodity groups: cattle, cocoa, coffee, palm oil, soya, wood, and rubber.

The regulation does not apply only to the raw commodities themselves. It also covers a wide range of derived products where those commodities are a significant input. The full list is set out in Annex I to the regulation, but the main categories include:

Cattle: Meat, leather, and leather goods. Live cattle exported from the EU are also covered.

Cocoa: Chocolate, cocoa butter, cocoa powder, and preparations containing cocoa.

Coffee: Roasted coffee and coffee extracts and preparations.

Palm oil: Refined palm oil, palm kernel oil, palm-based fats, and oleochemicals derived from palm. Many cosmetic, food, and cleaning products contain palm oil derivatives.

Soya: Soya flour, soya oil, soya-based animal feed, and tofu. Soya is widely used as an ingredient in processed foods and as livestock feed, which means it enters the supply chain of many products not immediately associated with deforestation risk.

Wood: Sawn timber, veneer sheets, plywood, paper, cardboard, and printed products including books. Furniture is covered. Wood used in construction materials is covered. The breadth of derived products makes this one of the more complex commodity groups to track.

Rubber: Natural rubber, rubber tyres, rubber gloves, and many other manufactured rubber goods.

The coverage of derived products means that businesses in sectors not obviously connected to forest commodities, including food manufacturing, cosmetics, furniture retail, publishing, and automotive, may find that at least some of their product lines are in scope.

Who is directly regulated

The EUDR distinguishes between two categories of regulated party: operators and traders.

Operators are companies or individuals who place relevant commodities or products on the EU market for the first time, or who export them from the EU. The export arm of the definition exists to prevent EU companies from trading in deforestation-linked commodities on third markets while remaining compliant at home. An importer bringing cocoa into the EU for the first time is an operator. A company processing domestically produced cattle products and selling them into EU commerce is also an operator. Operators bear the heaviest obligations under the regulation: they must carry out full due diligence before placing or exporting each product.

Traders are companies that make relevant products available on the EU market in the course of a commercial activity, but who are not the first to place them on the market. A retailer selling chocolate that was imported by a separate operator is a trader. Traders may rely on the due diligence already carried out by the operator, but they must verify that the relevant due diligence statements have been submitted and keep records of their supply chain.

SME traders benefit from a lighter-touch regime: they can rely on the operator’s due diligence statement and are not required to conduct their own full due diligence, provided they have no reason to believe the statement is inaccurate. Large traders do not have the same simplified option and must conduct their own due diligence.

What due diligence requires

Due diligence under the EUDR has three components: information collection, risk assessment, and risk mitigation.

Information collection

Before placing a product on the market, an operator must collect and keep the following information:

Description of the product: Including the commodity, quantity, and country of production.

Geolocation data: The precise geographic coordinates of all plots of land where the relevant commodity was produced. For cattle products, this means the coordinates of all establishments where the animals were kept. This is the requirement that creates the most practical difficulty for complex supply chains: it means tracing the commodity back to the specific land parcel, not just to the country or region of origin.

Verification of production date: Evidence or a substantiated statement that the commodity was produced on land that has not been subject to deforestation since 31 December 2020. Where satellite monitoring data is available, this is typically the basis for this determination.

Relevant legislation compliance: A statement that the commodity was produced in compliance with the relevant legislation of the country of production, covering land use rights, environmental protection, and applicable labour laws.

Name and contact details of supply chain actors: Sufficient to trace the product from the operator back to the relevant production land.

Risk assessment

Once the information is collected, the operator must carry out a risk assessment to determine whether there is a non-negligible risk that the products are not compliant. The assessment must consider:

The country or region of origin and its deforestation risk classification under the EUDR benchmarking system (explained below). The presence of forests in the area of production. The complexity and length of the supply chain. The reliability of the documentation provided by suppliers. Any concerns raised by third parties, NGOs, or public bodies about the area or the supply chain.

Risk mitigation

Where the risk assessment identifies a non-negligible risk, the operator must take mitigation measures before proceeding. These may include requesting additional documentation, conducting independent audits of production sites, or working with suppliers to implement monitoring systems. If the risk cannot be mitigated, the product cannot be placed on the EU market.

The due diligence statement

Before placing a product on the market or exporting it, an operator must submit a due diligence statement via the EU’s TRACES NT system (the same system used for sanitary and phytosanitary controls). The statement confirms that the operator has collected the required information, carried out a risk assessment, and taken mitigation measures where necessary.

The statement generates a reference number that must accompany the product through the supply chain. Downstream traders use this reference number to verify that due diligence has been conducted and to fulfil their own record-keeping obligations.

Operators must keep the underlying documentation, including the geolocation data, supplier declarations, risk assessments, and mitigation records, for five years. Competent authorities have the power to request this documentation during inspections.

The benchmarking system

The EUDR introduces a benchmarking system that classifies countries (and potentially regions within countries) into three risk categories: low, standard, and high.

For products originating from low-risk countries, operators benefit from simplified due diligence. They still need to collect basic information and submit a due diligence statement, but the risk assessment requirements are less intensive.

For products from standard-risk countries, full due diligence applies as described above.

For products from high-risk countries, enhanced scrutiny applies. The Commission and member state competent authorities pay closer attention to products from these origins, and operators may face additional verification requirements.

The benchmarking classifications are determined by the Commission based on objective criteria including deforestation rates, forest governance, national regulation, and trade and production trends. Classifications are reviewed regularly and can change. A country classified as standard risk today could be reclassified as high risk if its deforestation indicators worsen.

The practical consequence for supply chain decisions is that origin country matters not just for cost and logistics but for compliance burden. Sourcing from a country that later receives a high-risk classification means existing due diligence procedures may no longer be sufficient.

What non-EU suppliers need to provide

Non-EU producers and exporters are not directly regulated by the EUDR. The regulation applies to EU operators and traders. But EU buyers can only comply with their EUDR obligations if their non-EU suppliers provide the right information.

The specific requirements depend on the commodity and the structure of the supply chain, but the core data that non-EU suppliers are typically asked to provide includes:

Plot-level geolocation data: GPS coordinates for every land parcel where the commodity was produced. For large plantations this may involve a relatively small number of parcels. For commodities sourced from smallholders, it may involve hundreds or thousands of individual plots. Aggregated data at farm or village level is not sufficient — the regulation requires parcel-level coordinates.

Production date evidence: Documentation showing that the land was not subject to deforestation after 31 December 2020. Satellite imagery is the most common basis for this, and several third-party service providers offer EUDR-specific land monitoring. National deforestation monitoring systems may also be used where they meet the required standard.

Legal compliance declarations: Statements confirming that production complied with relevant national laws on land use, environmental protection, and labour rights.

Supply chain documentation: Records sufficient to trace the commodity from the production parcel to the point of export.

Suppliers who cannot provide this documentation will find EU buyers unable to legally import their products. In practice this means that inability or unwillingness to engage with EUDR data requirements translates directly into loss of EU market access, regardless of the quality or price of the product.

Enforcement and penalties

Enforcement is the responsibility of member state competent authorities. Each member state must designate the authority or authorities responsible for EUDR enforcement and give them adequate resources and powers.

Competent authorities have the power to conduct checks on operators and traders, including physical inspection of products and premises, review of due diligence documentation, and access to geolocation and supply chain data. They can also require operators to withdraw products from the market, seize non-compliant goods, and issue prohibitions on further placing or trading.

Penalties for non-compliance must be effective, proportionate, and dissuasive. The regulation requires member states to provide for penalties including fines proportional to the environmental damage caused and to the value of the relevant products (with a minimum threshold of at least four percent of annual EU turnover), temporary exclusion from procurement procedures, and confiscation of products and revenues.

The key deadlines

The EUDR was published in the Official Journal in June 2023. After an initial delay to the original timeline:

Large operators and traders: Obligations apply from 30 December 2025.

SME operators and traders: Obligations apply from 30 June 2026.

Micro-enterprises: May benefit from further transitional provisions depending on the specific nature of their activities.

The benchmarking system classifying countries by deforestation risk is expected to be operational before the application dates. The classification of origin countries will determine what level of due diligence is required from that point forward.

Where EUDR sits in the broader sustainability regulation landscape

The EUDR is one of several EU sustainability regulations that create obligations for non-EU businesses through supply chain mechanisms. It sits alongside CSDDD, which requires human rights and environmental due diligence across the supply chain more broadly, and CSRD, which requires EU companies to report on value chain impacts including from non-EU suppliers.

For suppliers of EUDR-covered commodities, the practical effect is that EU buyers are building data collection and verification systems that will generate ongoing requests for supply chain information, not just for initial EUDR compliance, but also to meet their CSRD reporting obligations and CSDDD due diligence requirements across the same supply chain. The data infrastructure required to respond to these requests has significant overlap across the three frameworks.

An overview of the full EU sustainability regulation landscape, including the interaction between these frameworks, is available here: EU sustainability regulation in 2026: an overview of what is now in force.