The EUDR Deadline Is Approaching: A Practical Compliance Guide for Businesses

What is the EUDR? 

The EU Deforestation Regulation – Regulation (EU) 2023/1115 – aims to ensure that certain commodities and products placed on the EU market or exported from it do not contribute to deforestation or forest degradation. 

To comply, relevant products must meet three core conditions. They must be: 

• deforestation-free; 

• produced in accordance with the relevant legislation of the country of production; and 

• covered by a Due Diligence Statement or, where the amended regulation allows it, a simplified declaration. 

The deforestation cut-off date is 31 December 2020. This means relevant commodities must not come from land that was deforested after that date. For wood products, the regulation also addresses forest degradation. 

Which commodities and products are covered? 

EUDR covers seven key commodities: 

• cattle; 

• cocoa; 

• coffee; 

• oil palm; 

• rubber; 

• soya; and 

• wood. 

It also covers many products derived from these commodities, including selected meat and leather products, chocolate, tyres, furniture, paper and other wood-based goods. 

However, the regulation does not apply to every product containing one of these materials. Scope is determined by the Combined Nomenclature and HS codes listed in Annex I of the regulation. Companies should therefore classify products using the applicable customs code rather than relying only on a product description or material name. 

Following the 2025 amendments, certain printed products – such as books, newspapers and printed pictures – were removed from the regulation’s scope. Businesses should work from the latest consolidated legal text and product list. 

Upcoming changes to EUDR product scope

On 13 July 2026, the European Commission adopted a Delegated Act proposing targeted amendments to Annex I of the EUDR. The changes include removing certain cattle, rubber, soya and seat-related products from scope and adding soluble coffee, certain palm-oil derivatives and frozen cattle tongues. The Delegated Act is currently subject to scrutiny by the European Parliament and the Council and has not yet entered into force. Newly added products are intended to become subject to EUDR from 30 December 2027.

Who has obligations under EUDR? 

A company’s obligations under EUDR depend on its role, size and position in the supply chain. The same company may have different roles for different products or transactions, so its role should be assessed for each relevant product flow. 

An upstream operator places a relevant product on the EU market or exports it from the EU and is responsible for carrying out the applicable due diligence. This includes collecting the required information, assessing and, where necessary, mitigating risk, and submitting a Due Diligence Statement (DDS) before the product is placed on the market or exported. 

A special simplified regime applies to qualifying micro or small primary operators (MSPOs). These are micro or small operators that place on the market or export relevant products that they themselves have grown, harvested, obtained or, in the case of cattle, raised under the conditions set out in the Regulation. Instead of submitting a standard DDS, they submit a one-time simplified declaration and receive a declaration identifier. 

A downstream operator places on the market or exports a relevant product made using relevant products that have already been covered by a DDS or simplified declaration. A trader makes a relevant product available on the EU market without acting as an operator or downstream operator for that transaction. 

The December 2025 amendments significantly simplified the obligations of downstream operators and traders. They do not carry out a new due-diligence process or submit an additional DDS for products already covered upstream. Instead, their obligations focus mainly on traceability, record keeping, notification and, for certain non-SME actors, registration in the EUDR Information System. 

The precise requirements also depend on where the company is positioned in the downstream supply chain: 

• First downstream non-SME operators and traders must register in the EUDR Information System and collect and retain the relevant upstream DDS reference number or simplified declaration identifier. Where there is a substantiated concern regarding possible non-compliance, they must also verify that due diligence has been properly exercised.  

• First downstream SME operators and traders are not required to register in the Information System, but must collect and retain the relevant traceability information, including the applicable DDS reference number or declaration identifier.  

• Subsequent downstream non-SME operators and traders must register in the Information System and maintain the required supplier and customer traceability information, but they are generally not required to collect or communicate the original DDS reference number further down the supply chain.  

• Subsequent downstream SME operators and traders are mainly subject to traceability, record-keeping and notification requirements.  

All downstream operators and traders must take action where they obtain information indicating that a relevant product may not comply with EUDR. However, the additional verification obligation in the case of a substantiated concern applies specifically to non-SME downstream operators and traders. 

The table below summarises how these obligations vary according to the company’s role, position in the supply chain and size. 

Because one company can have different roles for different products or transactions, roles should be mapped by product flow—not assigned only once at company level. 

When does EUDR apply? 

The official application dates are: 

• 30 December 2026: large and medium operators; 

• 30 December 2026: micro and small operators whose relevant products were already covered by the EU Timber Regulation; 

• 30 June 2027: qualifying micro and small operators (that were established as such by 31 December 2024, for other relevant products)

It is therefore more accurate to say that EUDR applies from 30 December 2026 for large and medium operators than to describe 1 January 2027 as the legal deadline. Nevertheless, “EUDR from 2027” is a useful practical description: affected businesses must enter 2027 with their systems operational.

The three stages of standard EUDR due diligence

1. Collect the required information

Operators must collect sufficient information about the relevant product and its supply chain. Depending on the transaction, this includes: 

• product description and trade name; 

• quantity; 

• country of production; 

• supplier and customer information; 

• the commodity or material contained in the product; 

• the date or time range of production; and 

• geolocation of all plots of land where the relevant commodity was produced. 

For plots larger than four hectares, geolocation generally requires polygons showing the plot boundaries. For smaller plots and cattle establishments, coordinates may be recorded according to the applicable EUDR rules. 

Geolocation is one of the most demanding requirements. A supplier’s postal address is generally not a substitute for plot-level geolocation, except for micro or small primary operators benefiting from the specific Article 4a regime.

2. Assess the risk

Operators must assess whether there is a risk that a product does not comply with EUDR. The assessment should consider factors such as: 

• the country risk classification; 

• the presence of forests and deforestation in the area; 

• the complexity of the supply chain; 

• the risk of mixing with materials of unknown origin; 

• the reliability and consistency of documents; 

• corruption, document falsification or weak law enforcement; 

• concerns relating to Indigenous Peoples; and 

• substantiated concerns or other relevant information. 

The European Commission’s country benchmarking system classifies countries as low, standard or high risk. This classification affects the level of due diligence and the percentage of operators subject to checks, but low risk does not mean that traceability can be ignored. 

3. Mitigate any non-negligible risk

A product may be placed on the market or exported only when the operator concludes that there is no risk or only a negligible risk of non-compliance. 

Where the assessment identifies a higher risk, the operator must take proportionate mitigation measures. These may include requesting additional documentation, conducting independent surveys or audits, verifying geolocation data, separating supply chains or working with suppliers to improve controls. 

If the risk cannot be reduced to a negligible level, the product must not be placed on the EU market or exported. 

Simplified due diligence for low-risk sourcing

Where all relevant commodities and products have been produced in countries classified as low risk, operators may benefit from simplified due diligence under Article 13. They must still collect the information required under Article 9 and assess the complexity of the supply chain and the risk of circumvention or mixing. However, the full risk assessment and risk-mitigation requirements under Articles 10 and 11 do not normally apply unless the operator obtains or becomes aware of information indicating a risk of non-compliance.

Due Diligence Statements and the EUDR Information System 

Before placing a relevant product on the EU market or exporting it, an operator must normally submit a Due Diligence Statement (DDS) through the EU’s EUDR Information System. A specific simplified regime applies to qualifying micro or small primary operators: instead of submitting a normal DDS, they submit a one-time simplified declaration and receive a declaration identifier. 

Where the required information is already available in an eligible EU or Member State database, the Member State may transmit the information to the EUDR Information System on behalf of the micro or small primary operator. 

The statement confirms that due diligence has been carried out and that the operator found no risk or only a negligible risk that the product is non-compliant. Once processed, the Information System assigns a reference number to the DDS and a separate verification number used as an additional security element. For simplified declarations, the system assigns a declaration identifier and an associated verification number. The DDS reference number or, where applicable, the declaration identifier is the key identifier communicated where required under the regulation. 

The system has two separate environments: 

• the Production server, where submissions have legal value and may be checked by competent authorities; 

• the Acceptance server, which is intended for training, testing and familiarisation only. 

An account created in one environment does not automatically create access to the other. Companies should register in the correct environment, assign user roles and test their internal submission process before the deadline. 

Businesses handling large transaction volumes may also consider the system’s API for machine-to-machine data exchange.

Does certification prove EUDR compliance? 

No. Certification under a voluntary scheme does not replace the operator’s EUDR due diligence or transfer legal responsibility to a certification body. 

Schemes such as FSC® (FSC A000551) or PEFC (PEFC/12-44-001) chain of custody can support supply-chain traceability, controlled procedures and access to relevant supplier information. Independent certification may therefore provide useful evidence within an EUDR system – but companies must still confirm product scope, collect the required geolocation and legality data, assess risk and fulfil the applicable Information System obligations. 

Certification data should be treated as one source of evidence, not an automatic conclusion that a product is EUDR-compliant. 

What should companies do before the end of 2026? 

Step 1: Confirm product scope 

List products placed on, made available on or exported from the EU market. Compare their CN or HS codes with the latest version of EUDR Annex I. 

Step 2: Map your role for each product flow 

Determine whether the company acts as an upstream operator, downstream operator or trader. Record whether SME status changes the applicable duties. 

Step 3: Map suppliers and production origins 

Identify every supplier, intermediary, processor and country of production. Determine how each shipment can be linked back to the relevant plots of land. 

Step 4: Collect and test geolocation data 

Request coordinates or polygons in a consistent format, such as GeoJSON. Test whether files are complete, valid and correctly linked to the relevant product and shipment. 

Step 5: Build a legality evidence framework 

Identify the relevant laws in each country of production and define which permits, land-use rights, contracts, tax records or other evidence suppliers must provide. 

Step 6: Establish a documented risk-assessment method 

Create clear criteria, responsibilities and decision records. Country benchmarking should be one factor, not the entire assessment. 

Step 7: Define risk-mitigation actions 

Decide in advance when additional documents, satellite checks, supplier audits, sampling or supply-chain separation will be required. 

Step 8: Update contracts and supplier communication 

Include EUDR data requirements, deadlines, change notifications and rights to verify information in supplier agreements. 

Step 9: Prepare the Information System workflow 

Register the relevant users, test the Acceptance environment, decide who approves submissions and establish controls for DDS reference and verification numbers. 

Step 10: Run a pilot before the deadline 

Select several representative products and complete the entire process – from supplier data collection to a test submission. A pilot is the best way to reveal missing data and unclear responsibilities. 

Common EUDR preparation mistakes 

• Assuming that certification alone proves compliance. 

• Checking only the commodity name and not the product’s CN or HS code. 

• Collecting supplier addresses instead of plot-level geolocation. 

• Treating a low-risk country classification as an exemption from traceability. 

• Waiting for suppliers to develop their own approach without setting clear data requirements. 

• Focusing on the DDS submission while neglecting the evidence behind it. 

• Using the Acceptance environment as if it were the legally valid Production system. 

• Assigning EUDR responsibility to the sustainability team without involving procurement, logistics, customs, IT and legal functions. 

How BM Certification can support your preparation? 

EUDR is a legal compliance obligation, and no certification body can issue one certificate that replaces the required due-diligence process. 

BM Certification offers both FSC Chain of Custody certification and PEFC Chain of Custody certification for organisations handling wood, paper and other forest-based products. These certification schemes can help companies establish and independently assess procedures for material identification, supplier control, record keeping, segregation and supply-chain traceability.

For companies affected by EUDR, FSC and PEFC certification can provide a valuable foundation for stronger supply-chain controls and more structured information management. Certification records may also form part of the evidence used in an EUDR due-diligence system. 

However, neither FSC nor PEFC certification automatically proves EUDR compliance. The responsible operator must still confirm whether the product is in scope, collect the required geolocation and legality information, assess and mitigate risk, and fulfil the applicable Due Diligence Statement and Information System requirements. 

BM Certification is an independent certification and verification body with more than 20 years of experience supporting companies across international supply chains. Our team can help businesses understand how certification, verification and training can strengthen their traceability systems and support preparation for changing market requirements. 

Learn more about FSC Chain of Custody certification and PEFC Chain of Custody certification, or contact BM Certification to discuss which service is relevant to your supply chain and EUDR preparation.

Editorial note 

This article provides a general overview and does not constitute legal advice. EUDR obligations depend on the product code, company size, role and transaction. Businesses should use the latest consolidated regulation, European Commission guidance and information from their national competent authority. 

Official sources 

• European Commission, Regulation on Deforestation-free Products: https://environment.ec.europa.eu/topics/forests/deforestation/regulation-deforestation-free-products_en 

• EUR-Lex, Regulation (EU) 2023/1115: https://eur-lex.europa.eu/eli/reg/2023/1115/oj/eng 

• European Commission, FAQ on EUDR Implementation, updated 21 August 2026: https://environment.ec.europa.eu/publications/faq-eudr-implementation_en 

• European Commission Green Forum, EUDR roles and responsibilities: https://green-forum.ec.europa.eu/nature-and-biodiversity/deforestation-regulation-implementation/roles-and-responsibilities_en 

• European Commission Green Forum, EUDR Information System: https://green-forum.ec.europa.eu/nature-and-biodiversity/deforestation-regulation-implementation/information-system-deforestation-regulation_en 

• EUDR Information System—Production environment: https://eudr.webcloud.ec.europa.eu/ 

• EUDR Information System—Acceptance environment: https://acceptance.eudr.webcloud.ec.europa.eu/ 

• EU Observatory on Deforestation and Forest Degradation: https://forest-observatory.ec.europa.eu/ 

• Council of the EU, targeted EUDR revision and postponement: https://www.consilium.europa.eu/en/press/press-releases/2025/12/18/deforestation-council-signs-off-targeted-revision-to-simplify-and-postpone-the-regulation/