The Complete Guide to EUDR: Everything Your Business Needs to Know

1. What Is the EUDR?

The EUDR, or EU Deforestation Regulation, is a European law that requires businesses to demonstrate that specific commodities and derived products are deforestation-free and legally produced before placing them on the EU market or exporting them from the EU.

Formally known as EU Regulation 2023/1115, EUDR entered into force in June 2023, replacing the EU Timber Regulation (EUTR). Where the EUTR focused on whether timber was legally harvested, the EUDR sets a higher standard, mandating that production must not have contributed to deforestation or forest degradation on or after 31 December 2020, regardless of whether it was legally permitted in the country of origin. Every covered product must satisfy three conditions: it must be deforestation-free, it must have been produced in compliance with the laws of the country of origin, and a Due Diligence Statement must cover it.

Application of the EUDR was pushed back by 12 months in December 2025, following a 405-242 vote by the EU Parliament, which formally adopted Regulation (EU) 2025/2650. The revised deadlines are 30 December 2026 for large and medium operators and traders, and 30 June 2027 for micro and small operators. The December 2025 amendments also removed printed paper products from the regulation’s scope.

The EUDR is already in effect as law; the revised dates are simply compliance deadlines. This means that businesses still waiting for final application dates before beginning supply chain work are, in practical terms, already behind.

For a breakdown of what the regulation requires and how the deadlines have evolved, read our guide, EUDR Regulation Explained: What Changes and When.

2. Which Products Does EUDR Apply To?

The EUDR applies to seven core commodities and a wide range of derived products. The in-scope commodities are:

• Cattle (including beef and leather)
• Cocoa (including chocolate and cocoa products)
• Coffee
• Palm oil (including palm kernel oil and derivatives)
• Rubber (including tyres and rubber products)
• Soy (including soy-based animal feed and oils)
• Wood (including timber, pulp and paper products; printed paper was removed from scope in the December 2025 amendments)

The scope also extends beyond raw materials. Common downstream products that are also in scope include furniture, leather, and chocolate. The full product list is detailed in Annex I of the regulation. If your business imports, processes, or trades any of these products and they pass through or onto the EU market, the EUDR is likely to apply to you. The regulation also captures exports from the EU, meaning European producers are not exempt.

3. Who Is Affected: Operators and Traders Explained

The EUDR distinguishes different categories of economic actor, and your obligations depend on which one you are.

First-in-line operators

An operator is any business that first places a relevant product on the EU market or exports it. This includes importers bringing in-scope commodities into the EU, EU-based producers harvesting or manufacturing in-scope goods, exporters, and manufacturers who create new derived products from in-scope materials already placed on the market.

First-in-line operators carry the most significant obligations. They must collect all required supply chain data, including geolocation, conduct a full risk assessment, mitigate any non-negligible risk, and submit a DDS before the product is placed on the market.

Downstream operators

The December 2025 amendments introduced a downstream operator category. A downstream operator is a business that buys and resells products already placed on the EU market by a first-in-line operator.

Downstream operators do not submit a DDS or conduct their own due diligence. Instead, their obligations include collecting and retaining DDS reference numbers or simplified declaration identifiers from upstream suppliers, maintaining traceability and transaction records for at least five years, registering in the EUDR Information System if they are not an SME, and notifying competent authorities if they encounter substantiated concerns about a product’s compliance.

Importantly, only the first downstream operator in the chain must collect and retain DDS reference numbers. Operators further down the chain do not need to pass them on.

Traders

A trader is any business that makes covered products available on the EU market without being the first to place them there. This includes wholesalers, distributors, and retailers. Traders have lighter obligations than first-in-line operators. Under the amended regulation, traders are required to retain DDS references only when their supplier is an operator, and the obligation to pass DDS numbers further down the chain has been removed.

SMEs and micro operators

Micro and small primary operators in low-risk countries can submit a one-time simplified declaration instead of a full DDS. However, the country risk benchmarking system is currently unsettled following the Parliament’s rejection of the Commission’s first list in July 2025. Until a revised list is formally adopted, the safe position is to treat all supply chains as requiring full due diligence regardless of origin.

4. What a Due Diligence Statement Must Contain

A Due Diligence Statement is a formal submission confirming that a product meets EUDR requirements. It must be submitted through the EU’s TRACES-based information system before the product is placed on the market. No DDS means no market access.

The Article 9 data requirements break down into the following practical categories:

• Product information: Description, HS/CN code, quantity, country of production, and date or time range of production/harvest
• Geolocation data: GPS coordinates or polygon data for all plots of land where the commodity was produced
• Deforestation-free evidence: Verifiable information confirming that no deforestation or forest degradation occurred on the production area on or after 31 December 2020
• Legal production evidence: Documentation demonstrating compliance with the laws of the country of production, including land use rights, environmental law, labour law, human rights, indigenous peoples’ rights (FPIC), taxation, and anti-corruption regulations
• Supplier information: Names, addresses, and contact details of all upstream suppliers and downstream business customers

The due diligence process itself follows three steps under Article 8 of the regulation: information collection, risk assessment, and risk mitigation, where needed. Only when risk has been assessed as negligible can the operator proceed to DDS submission. Certifications such as FSC or RSPO can support the risk assessment, but do not replace it. Operators remain legally accountable for the accuracy of every DDS they submit.

5. EUDR Timelines and Key Deadlines

The following timeline sets out the key dates and milestones for EUDR compliance:

These deadlines are set in legislation and confirmed by both the EU Parliament and the Council of the EU. They are not subject to further automatic extension. The work needed to reach compliance, particularly supply chain mapping and geolocation data collection, takes months for businesses with complex supply chains.

For more on the timeline and how the deadlines have evolved, read our article EUDR Regulation Explained: What Changes and When

6. The Geolocation Requirement: What It Means in Practice

The EUDR’s geolocation requirement is unlike anything required under the previous EUTR. It mandates that businesses can identify, precisely, the plots of land where their commodities were produced, and confirm that those plots were not subject to deforestation after 31 December 2020. 

The technical requirements are as follows: 

• Production areas larger than four hectares require polygon data, which is multiple GPS coordinates mapping the boundary of the plot, submitted in GeoJSON format
• Production areas up to four hectares require at least one GPS coordinate point per plot
• Geolocation data must be linked to specific suppliers and product batches, not submitted as an aggregate

For supply chains involving many smallholder farmers, collecting plot-level coordinates at scale is a significant operational challenge. Operators cannot rely on warehouse addresses or regional approximations. Coordinates must map actual production areas and must be validated against satellite data confirming deforestation-free status since 31 December 2020.

Micro and small primary operators have a simplified option. Under the December 2025 amendments, they may use a postal address in place of precise coordinates in certain circumstances. All other operators must meet the full geolocation requirement.

Getting geolocation data right requires active supplier engagement and, in many supply chains, on-the-ground data collection. It is consistently identified as the most common compliance gap. Businesses that have not yet begun this work should treat it as an immediate priority.

7. How the EUDR Differs from EUTR

The EUTR and the EUDR address the same broad concern but differ substantially in scope, standard, and requirements. The table below summarises the key differences:

The most significant operational difference is the shift from document-based due diligence to plot-level geolocation. The other critical distinction is the standard itself. The EUTR asked whether timber was legally harvested, but the EUDR asks whether production caused deforestation, regardless of whether it was legally permitted. Legal deforestation in a producing country does not satisfy the EUDR standard. For businesses that previously relied on legality documentation as their primary assurance mechanism, this is a fundamental shift.

8. EUDR and the US Lacey Act: How They Compare

If your business operates across both US and EU markets, you may be subject to two major regulatory frameworks simultaneously. The US Lacey Act and the EUDR share a common purpose but differ in scope, standard and practical requirements.

Here are the key differences between the two regulations:

• Standard applied: The Lacey Act is legality-based: it prohibits trade in plants and plant products harvested in violation of US or foreign law. The EUDR goes further, requiring that no deforestation occurred regardless of whether it was legally permitted in the country of origin.
• Scope of commodities: The Lacey Act covers nearly all plants and plant products, including timber, rubber and derivatives. The EUDR is focused on seven specific commodity groups. Notably, the Lacey Act does not cover common food crops such as soy, cocoa, coffee or palm oil, while cattle is not a plant-based product, so neither falls within the Lacey Act scope.
• Traceability level: The EUDR requires plot-level geolocation data. The Lacey Act requires species and country of harvest information, but does not mandate GPS-level data.

Where the frameworks overlap most directly is wood and rubber. The data collected for EUDR geolocation compliance will typically satisfy or substantially support Lacey Act due care requirements.

For a full guide to Lacey Act compliance, visit our Lacey Act Compliance Centre. 

9. What Happens If You Cannot Comply?

The EUDR’s penalties are set out in Article 25 of the regulation. Each EU Member State defines its own penalties, but they must meet minimum EU standards. Non-compliance can result in:

• Fines of up to 4% of total annual EU turnover
• Confiscation of non-compliant products
• Confiscation of revenues derived from non-compliant products
• Temporary exclusion from markets and from public procurement processes
• Prohibition on placing further in-scope products on the EU market

Where violations are intentional, criminal sanctions can apply under Directive 2024/1203. Enforcement is the responsibility of national competent authorities, coordinated at the EU level. Inspections are risk-based, and customs authorities verify DDS submissions at the border. Third parties, including NGOs and civil society groups, can file substantiated concerns that trigger investigations outside the regular inspection cycle.

Authorities are also required to publish the names of non-compliant companies, violations, and penalties, meaning reputational risk is part of the consequence. Beyond regulatory enforcement, commercial consequences can arrive earlier: major EU buyers are already requiring EUDR-compliant documentation as a condition of purchase.