EUDR Regulation Explained: What Changes and When

1. What Is EU Regulation 2023/1115?

EU Regulation 2023/1115, known as the EUDR, is the EU’s primary legal instrument to prevent products linked to deforestation and forest degradation from being placed on the EU market or exported from it. Under Article 3 of the regulation, every in-scope product must satisfy three conditions before it can enter the market:

• It must be deforestation-free, meaning it was not produced on land that was subject to deforestation or forest degradation after 31 December 2020
• It must have been produced in compliance with the relevant laws of the country of production
• It must be covered by a valid Due Diligence Statement

“Deforestation-free” under the EUDR covers both illegal and legal deforestation. If land was lawfully cleared in the country of origin but deforestation occurred after 31 December 2020, the product does not satisfy the EUDR standard. This is the most significant departure from the EUTR, which asked only whether timber had been legally harvested.

The regulation was amended by Regulation (EU) 2025/2650, formally adopted in December 2025, which pushed back application deadlines, simplified obligations for downstream operators and removed certain printed paper products from scope. The amended regulation entered into force on 26 December 2025.

2. How EUDR Differs from the Old EUTR

The table below sets out the key differences between the two frameworks:

Three of these differences warrant particular attention for compliance teams.

• The deforestation-free standard: Under the EUTR, legality was the test. Under the EUDR, legal deforestation does not satisfy the standard. Businesses that rely on legality certification alone, including FLEGT certificates, cannot meet EUDR requirements without additionally proving no deforestation occurred on the production area after 31 December 2020.

• The DDS submission requirement: The EUTR required businesses to maintain an internal due diligence system. The EUDR requires first-in-line operators to submit a Due Diligence Statement to the EU’s TRACES-based information system before products can be placed on the market or exported. Goods without a valid DDS are not released from customs.

• Plot-level geolocation: The EUTR had no GPS coordinate requirement. The EUDR requires geolocation data for every production area: polygon data for plots above four hectares, a GPS point for plots below four hectares. Document-based risk assessment no longer satisfies the traceability obligation.

3. The Risk Classification System: Negligible, Standard and Low Risk

The EUDR introduces a risk-based framework under which operators must assess whether the risk of deforestation or non-compliance in their supply chain is negligible. Only products assessed as carrying negligible risk can proceed to DDS submission and market entry.

The regulation also provides for a country-level benchmarking system, under which the Commission classifies countries as low, standard or high risk. Low-risk classifications allow for simplified due diligence: operators must still collect geolocation and legality data, but the formal risk assessment and mitigation steps under Articles 10 and 11 can be streamlined. Standard and high-risk origins require the full three-step process.

The Commission published its first benchmarking list in May 2025. However, the EU Parliament voted to reject this list, citing flawed methodology, lack of transparency, and political imbalance. The benchmarking system is currently unsettled.

The practical implication is that until a revised, formally adopted benchmarking list is in place, businesses cannot rely on the low-risk designation to apply simplified procedures. The correct position is to treat all supply chains as requiring full standard due diligence regardless of origin.

4. Key Deadlines and Enforcement Dates

The following dates reflect the current position under Regulation (EU) 2025/2650, confirmed by the EU Parliament and Council of the EU:

• 30 December 2026: Application deadline for large and medium operators and traders, with medium defined as fewer than 250 employees and a €50 million annual turnover
• 30 June 2027: Application deadline for micro and small operators, small defined as under 50 employees and annual turnover of less than €10 million, and micro defined by less than 10 employees and €2 million annual turnover

These are the dates by which businesses must be submitting compliant DDS submissions. The geolocation data collection and supply chain mapping required to reach that position takes considerably longer than most businesses anticipate.

5. What Due Diligence Statements Must Include

A Due Diligence Statement is the legal declaration that due diligence has been conducted and that the product meets EUDR requirements. It must be submitted through the EU’s TRACES-based information system before market entry. The submission generates a unique reference number that accompanies customs declarations.

Article 9 and Annex II of the regulation specify the data requirements. Every DDS must include:

• Product data: Description, CN/HS code, quantity (net mass), country of production, and date or time range of production or harvest
• Geolocation: GPS coordinates for plots under four hectares; polygon data in GeoJSON format for plots over four hectares; data linked to specific suppliers and batches, not submitted as an aggregate
• Deforestation-free evidence: Verifiable information confirming no deforestation or forest degradation on the production area after 31 December 2020
• Legal production evidence: Documentation of compliance with laws of the country of production, including land use rights, environmental law, labour law, human rights, indigenous peoples’ rights (FPIC), taxation, and anti-corruption legislation
• Supplier and buyer information: Names, addresses, and contact details of all upstream suppliers and downstream business customers.

Before a DDS can be submitted, the operator must complete the three-step due diligence process under Articles 8 to 11, which includes information collection, risk assessment and risk mitigation where the risk is assessed as more than negligible. Certifications such as FSC or RSPO may support the risk assessment, but do not substitute for it. The European Commission does not recognise any certification scheme as a replacement for a DDS.

Under the December 2025 amendments, the DDS obligation falls on first-in-line operators only. Downstream operators, those buying products already placed on the EU market by a first-in-line operator, do not submit a DDS. Their obligations are to collect and retain DDS reference numbers from their supplier, maintain traceability records for five years and notify competent authorities of any substantiated compliance concerns.

Micro and small primary operators in low-risk countries may submit a one-time simplified declaration in place of a full DDS. However, given that the country benchmarking system remains unsettled, this route is not currently available in practice.

6. Penalties for Non-Compliance

The EUDR’s penalties are substantially more severe than those under the EUTR. Article 25 sets out the framework, and each EU Member State defines its own penalties within these minimum standards.

Key penalty provisions include:

• Fines of at least 4% of total annual EU turnover for serious violations, scaled by environmental harm and prior violations
• Confiscation of non-compliant products and confiscation of revenues derived from those products; under the EUTR, only the goods themselves could be confiscated
• Temporary exclusion from public procurement and public funding for up to 12 months
• Exclusion from the EU market for covered commodities in the event of serious violations
• Prohibition on applying simplified due diligence procedures for serious or repeated violations

Enforcement is risk-based. Competent authorities are required to inspect a minimum of 1% of operators sourcing from low-risk countries, 3% from standard-risk and 9% from high-risk. Customs authorities verify DDS reference numbers before releasing shipments. Third parties can file substantiated concerns, triggering investigations outside the regular inspection cycle. Authorities are required to publish the names of non-compliant companies and the penalties applied.

7. What Businesses Should Be Doing Now

For compliance and trade teams, the regulation is specific enough to allow a clear work programme. The following actions follow directly from the legal text:

• Map your products against Annex I: Confirm which of your products fall within the HS codes listed in Annex I of the regulation. Note that “ex” codes in the annex apply only to products made from the naturally occurring form of the commodity, not synthetic equivalents.
  
• Determine your role: Whether you are a first-in-line operator, downstream operator, or trader determines your obligations precisely. Only first-in-line operators must submit a DDS and complete the full three-step due diligence process.
• Build your Article 9 data collection system: The categories of data required under Article 9 are defined in the regulation. Geolocation collection is the most operationally demanding. Start supplier engagement on geolocation data before anything else.
• Apply full due diligence to all origins: The country benchmarking system remains unsettled. Do not apply simplified procedures based on the rejected Commission list.
• Structure documentation for five-year retention: All due diligence records must be retained for a minimum of five years and be available for inspection by competent authorities on request.

For a broader guide to what EUDR compliance involves across your business, visit our Complete guide to understanding the EUDR

If your supply chain includes solid biomass such as wood pellets or agricultural residues, read our article GGL Certification for Biomass Supply Chains: What It Is and Who Needs It.

Understanding the regulation is one thing. Building a supply chain that can satisfy it is another. DoubleHelix works with businesses to close the gap between the two, by mapping supply chains back to production level, collecting the geolocation data Article 9 requires, and preparing DDS submissions that hold up to scrutiny. 

If you are working through your EUDR obligations for the first time or assessing whether your current processes are sufficient, we can help you understand exactly where you stand. Speak to DoubleHelix about EUDR compliance.