For years, the EU Deforestation Regulation (EUDR) felt like a moving target. Brussels postponed it twice, trimmed the scope and simplified the paperwork, and many companies decided to wait and see. That window has closed. From 30 December 2026, large and medium-sized companies placing cocoa, coffee, wood, soy, cattle, rubber or palm oil products on the EU market must prove those products are deforestation-free and covered by a due diligence statement. Micro and small enterprises follow on 30 June 2027.
As the Dutch trade association evofenedex puts it, the question is no longer whether the EUDR is coming, but whether your organization is ready. And for most companies, the hardest part isn’t inside their own walls. It sits several tiers down the supply chain, with suppliers in Asia, Africa and Latin America.
Why does the EU need a deforestation regulation?
The EUDR exists to cut the EU’s contribution to global forest loss. The world still loses about 10.9 million hectares of forest to deforestation every year, much of it cleared to grow commodities that end up in EU supply chains.
According to the FAO Global Forest Resources Assessment 2025, deforestation has slowed from 17.6 million hectares a year in the 1990s, but the current rate is still described as too high. Forests cover 4.14 billion hectares, or 32% of the planet’s land area.
The Regulation (EU) 2023/1115 entered into force on 29 June 2023 and replaces the older EU Timber Regulation (EUTR). The European Commission’s EUDR page hosts the official guidance, FAQs and an explainer video.
What does the EUDR require?
To sell covered products in or export them from the EU, companies must prove they are deforestation-free, legally produced and backed by a due diligence statement. The rules apply to seven commodities and many everyday products made from them, from furniture and paper to leather, tyres and chocolate.
Despite the delays and simplifications, the core of the law hasn’t changed. Every relevant product placed on or exported from the EU market must meet three conditions: it is deforestation-free, it was produced in line with the laws of the country of production, and it is covered by a due diligence statement (DDS). “Deforestation-free” means the raw material was not grown or raised on land deforested after 31 December 2020.
The regulation covers seven commodities and many products made from them:
| Commodity | Examples of covered products |
| Cocoa | Cocoa beans, cocoa butter, chocolate |
| Coffee | Green and roasted coffee, coffee husks |
| Wood | Timber, plywood, furniture, pulp, paper, packaging |
| Soy | Soybeans, soy meal, soy oil |
| Cattle | Live cattle, beef, leather and hides |
| Rubber | Natural rubber, tyres, gloves, rubber articles |
| Oil palm | Palm oil, palm kernel oil, derivatives |
Key EUDR dates: what changed and what is now fixed
The EUDR applies from 30 December 2026 for large and medium-sized companies, and from 30 June 2027 for micro and small enterprises. After two postponements, both dates are now fixed in law.
The EUDR was adopted in 2023 and originally due to apply from 30 December 2024. It has since been postponed twice, most recently through Regulation (EU) 2025/2650, published in December 2025. The current application dates are 30 December 2026 for large and medium-sized companies and 30 June 2027 for micro and small enterprises.
| Date | Milestone |
| 30 June 2027 | EUDR applies to micro and small enterprises (except those already covered by the EU Timber Regulation) |
| 30 December 2026 | EUDR applies to large and medium-sized companies, and to micro and small timber operators |
| 4 May 2026 | Commission publishes its simplification review, with clarifications, a revised product scope and IT system upgrades |
| 23 December 2025 | Regulation (EU) 2025/2650 published: second postponement, new “downstream operator” role, simplified declaration for micro and small primary operators |
| December 2024 | First postponement, from 30 December 2024 to 30 December 2025 |
| June 2023 | EUDR enters into force |
The simplifications have reduced the paperwork, especially further down the chain. They have not changed what has to be proven.
Who is responsible for EUDR compliance?
The importer, or whichever company first places the product on the EU market, carries the main responsibility for EUDR compliance. Downstream operators and traders have lighter duties, and non-EU suppliers are affected indirectly through the data their buyers need.
The heaviest responsibility sits with the operator who first places the product on the EU market, which for imported goods is usually the importer. This company must carry out due diligence, submit the DDS to the EU Information System, and be able to show authorities that the product complies. The 2025 amendment made this even clearer by shifting due diligence responsibility to that first operator.
| Role | Who this is | Main obligations |
| Operator (first placer) | Importer, EU producer or exporter | Full due diligence, submit DDS, keep records for 5 years |
| Downstream operator | EU company processing an already-covered product (e.g. a chocolate maker using imported cocoa) | No DDS of its own; collect and keep the DDS reference number and register if not an SME |
| Trader | Company selling on products already on the EU market | Simplified obligations, keep supplier and customer records |
| Micro or small primary operator | Small EU-based producer (e.g. a small farm) | One-off simplified declaration instead of a DDS |
Non-EU suppliers are not directly regulated, but they are not off the hook. Without geolocation data, origin records and legality documents from the manufacturer or exporter, the EU importer cannot complete due diligence. In practice, suppliers who can’t provide verifiable EUDR data risk losing EU buyers.
What information does a due diligence statement need?
A due diligence statement must identify the product, its quantity and country of production, and the geolocation of every plot where the commodity was produced, backed by evidence that it is deforestation-free and legal.
Operators submit the DDS through the EU Information System (TRACES) before the goods are placed on the market or exported. The Dutch regulator NVWA explains this step for importers. Supporting records must be kept for five years.
| Information required | What it means in practice |
| Operator details | Company name, address and EORI number |
| Product description | Trade name, HS code and, for wood, the tree species |
| Quantity | Net mass, volume or number of units |
| Country of production | Where the commodity was grown, raised or harvested |
| Geolocation | GPS point for each plot, or a polygon for plots over 4 hectares |
| Production date | Date or time range of harvest or production |
| Supply chain contacts | Names and addresses of suppliers and business customers |
| Deforestation-free evidence | Verifiable proof the land was not deforested after 31 December 2020 |
| Legality evidence | Proof of compliance with land use, labour, environmental and tax laws in the country of production |
How does country risk benchmarking affect due diligence?
The European Commission rates every producing country as low, standard or high risk, and that rating sets how much due diligence you must do and how often authorities will check you.
The Commission’s first benchmarking list, published in May 2025, placed most countries in the low or standard categories and only four in high risk: Belarus, North Korea, Myanmar and Russia. As European Rubber Journal reported, sourcing from a low-risk country means operators still collect information but do not need to assess and mitigate risk.
| Country risk | Due diligence required | Minimum share checked by authorities |
| Low | Simplified: collect information, no formal risk assessment or mitigation | 1% |
| Standard | Full: information, risk assessment and mitigation | 3% |
| High | Full, with enhanced scrutiny | 9% |
Low risk does not mean no risk. If you have reason to suspect mixing with products of unknown origin, or circumvention through a low-risk country, you must still act on it.
The real challenge: proving your data is reliable
Collecting documents is not enough: importers must show that supplier data is reliable and that risks were properly assessed. A geolocation on its own does not prove a product is compliant.
Most companies now understand what the EUDR says. The open question is how to apply it in practice. According to evofenedex’s EUDR implementation working group, the challenge has shifted from collecting documents to assessing risk and backing up that assessment. The importer has to judge whether supplier information is complete, reliable and verifiable, not just whether it exists.
This is where a common misconception appears. A geolocation on its own does not prove a product is EUDR-compliant. Companies must also show that the data they received is trustworthy and that the risks have been properly assessed. That responsibility stays with them, even when they use external auditors, certification bodies or software platforms.
In international supply chains, the information often isn’t missing. What’s missing is the ability to check it independently. Several questions remain open for many businesses:
- When is the evidence sufficient?
- How far should you go when checking suppliers?
- What will an inspector expect from the reasoning behind your choices?
Enforcement is getting closer. In the Netherlands, for example, the food and product safety authority (NVWA) is already running trial inspections to prepare for checks once the regulation applies.
What are the penalties for EUDR non-compliance?
Under Article 25 of the regulation, fines must reach at least 4% of a company’s total annual EU turnover, alongside confiscation of goods and revenues and temporary exclusion from public contracts.
Each EU member state sets its own penalties, but the regulation requires them to be effective, proportionate and dissuasive. National authorities can also order corrective action, such as withdrawing products from the market.
| Penalty | What it means |
| Fines | Maximum of at least 4% of total annual EU turnover |
| Confiscation | Seizure of the non-compliant products and the revenues earned from them |
| Public procurement ban | Temporary exclusion from public tenders and public funding, up to 12 months |
| Market ban | Temporary prohibition from placing or exporting relevant products |
| Simplified due diligence ban | Loss of the right to use the simplified low-risk procedure |
How to prepare before 30 December 2026
Start now: map your products, define your role, gather and verify supplier data, and document every risk decision. Collecting data from several tiers upstream takes longer than most companies expect.
The message from industry is simple: don’t wait any longer. With about ten weeks to go, these are the steps importers and their suppliers should be working through now:
- Map your products. Check which of your products fall under Annex I by HS code, and which commodities they contain.
- Define your role. Confirm whether you are an operator, downstream operator or trader for each product flow.
- List the data you need. Geolocation of production plots, date of production, quantities, supplier details and proof of legal production.
- Go deep into the chain. Engage suppliers several tiers upstream, not just your direct vendor, and agree on how and when data will be shared.
- Verify, don’t just collect. Cross-check documents, assess country and supplier risk, and use audits or on-site checks where the risk is not negligible.
- Document your reasoning. Record how you reached each risk conclusion, so you can explain it to an inspector.
- Involve the whole business. EUDR is not a one-department project. Bring in purchasing, IT and management, not only compliance and customs.
How HQTS can help
HQTS helps importers and suppliers verify EUDR data at the source, through supplier audits, environmental and social audits, supply chain mapping and training.
The EUDR asks importers to do something that is hard to do from a desk in Europe: verify what is happening at the source. HQTS gives EU buyers independent, on-the-ground verification in the countries where their products are made. With local teams across China, Vietnam and Southeast Asia, and global coverage beyond, HQTS works with more than 50,000 brands worldwide.
Our support for EUDR readiness includes:
- Supplier audits to check traceability systems, sourcing records and document quality at the factory level
- Environmental and social audits that support the legality and risk assessment parts of due diligence
- Supply chain mapping support to trace covered materials such as wood, rubber and leather back through sub-suppliers
- Consulting and training for suppliers who need to understand what data their EU customers will ask for
Whether you are an EU importer building your due diligence system or a manufacturer supplying the EU market, contact HQTS to discuss your EUDR preparations before the deadline.
