From 30 December 2026, Regulation (EU) 2023/1115 (EUDR) prohibits placing seven commodities and the derived products listed in its Annex I on the EU market, or exporting them, unless they are deforestation-free, produced legally and covered by a due diligence statement. The application date has moved twice. Regulation (EU) 2024/3234 shifted it from December 2024 to December 2025, and Regulation (EU) 2025/2650 moved it to December 2026 while also changing who files what.

As of mid-October, there are roughly ten weeks left to prepare for EUDR compliance and reporting. Teams need plot-level geolocation from the first mile, legality evidence from the country of production, and tested submissions in the EUDR Information System before customs authorities begin checking reference numbers at the border.

The EUDR repeals Regulation (EU) No 995/2010 on timber (EUTR), which keeps applying until the EUDR applies. The Commission's impact assessment estimated that without regulatory intervention, EU consumption and production of six commodities alone would drive approximately 248,000 hectares of deforestation annually by 2030.

Who counts as an operator under the amended EUDR

An operator is the party who, in the course of a commercial activity, first places a relevant product from EUDR Annex I on the EU market or exports it from the EU. Article 2 defines the operator; Article 4 requires it to exercise due diligence and submit a DDS to the Information System before placing the product on the market. On submission it receives a reference number, which it must pass to downstream operators and traders.

Regulation (EU) 2025/2650 narrowed where this obligation sits. Only the operator who first places the product on the EU market files the DDS. Downstream operators and traders no longer file their own statements. Where their direct supplier is an operator, they collect and keep its reference number, and in practice only the first downstream operator in the chain does this. Under Articles 4 and 5, operators, downstream operators and traders all keep a residual duty to act on substantiated concerns. Non-SME downstream operators and traders must still register in the Information System, and make sure that due diligence has been exercised and no more than negligible risk has been found prior to making relevant products available on the EU market. 

In practice, a mid-market EU manufacturer importing cocoa butter is the operator on the hook. A packaged-goods brand buying that cocoa butter inside the EU collects and keeps the reference number.

The seven in-scope commodities are cattle, cocoa, coffee, oil palm, rubber, soya and wood. The original EUDR extended coverage to derived products listed in Annex I, and Delegated Act 2026/2102 adjusted that list. The Delegated Act removes cattle hides, skins and leather, re-treaded tyres, soybeans for sowing, articles of vulcanised rubber, conveyor and transmission belts, and aircraft and motor vehicle seats from scope. It adds soluble coffee, certain palm oil derivatives and frozen cattle tongues. Newly added products are due to become subject to the Regulation from 30 December 2027. Mapping product lines against the current Annex I is now a prerequisite step, because a BOM that was in scope in 2024 may no longer be, and a product that was out of scope may now be in.

Timing differs by company size. On 30 December 2026, the EUDR enters into application for large and medium enterprises and for operators of wood products that are currently regulated under the EUTR. For other micro and small operators, the deadline is 30 June 2027. The 30 December 2026 also applied to  ‘Micro and small primary operators’, defined under Article 2(15a), in countries benchmarked as low risk have a further concession: a one-off simplified declaration under the new Annex III, rather than a DDS per consignment.

{{product-tour-injectable}}

The three-part test every shipment must pass

Every consignment must satisfy three cumulative conditions before it can be placed on the EU market or exported. Article 3 requires that each relevant product is deforestation-free (and forest degradation-free, in the case of wood), produced in accordance with the relevant legislation of the country of production, and covered by a due diligence statement submitted through the EUDR Information System. Failure on any one of the three blocks the shipment.

Under Article 2(13), deforestation-free is anchored to a date. Relevant products, whether imported or produced in the EU, must come from land not deforested after 31 December 2020, and wood must also have been harvested without inducing forest degradation after that date.

Legality means compliance with the law of the country where the commodity was produced, as defined in Article 2(40). Operators need evidence of that compliance in the file, not an assurance from a supplier. The Commission has published an updated FAQ document in May 2026 that operators can refer to for interpretation.

The due diligence statement itself transfers legal responsibility. Article 4 is explicit stating that the operator must have carried out due diligence before submission. Filing a DDS with incomplete or incorrect data is a breach of the Regulation in itself. For a practical walkthrough of how direct suppliers, intermediaries and primary producers connect, see Coolset's note on mapping EUDR supplier tiers beyond Tier 1.

Why geolocation is the hardest input to get right

Geolocation is the input most likely to break an EUDR file, because it has to travel from a farmer, cooperative or forestry concession all the way to the EU importer's submission without losing precision. Under Articles 2(28) and 9(1)(d), geolocation is required for all plots, with an extra requirement to provide geolocation with polygons for plots over four hectares, for commodities other than cattle. 

Cattle supply chains are particularly exposed because animals move between locations. A single animal may pass through a cow-calf operation, a backgrounder and a finishing feedlot before slaughter. Under the latest Delegated Act, leather has been taken out of scope, leaving the cattle requirement focused on beef and live animals. Coolset's guide to EUDR cattle traceability walks through what that means for beef supply chains in practice.

Operators need plot-level traceability through processing, blending and bulk shipping, rather than batch-level data that hides where part of the material came from. Cooperatives, aggregated commodities and multi-origin blends are a common failure mode. Coolset's analysis of EUDR mixing and circumvention risk covers how to handle these supply chains without creating a circumvention exposure.

Penalties, customs checks and enforcement exposure

Article 25 requires Member States to lay down effective, proportionate and dissuasive penalties for infringements. This includes fines with a maximum of at least 4% of the operator’s or trader’s total annual EU turnover, the confiscation of relevant products, temporary exclusion from public procurement processes, and temporary market access restriction, among others. For a sustainability manager, this translates into a straightforward operating risk: a product you cannot defend is a product you cannot sell in the EU.

Customs authorities check the DDS reference number at entry under Article 26, and a missing or invalid reference stops the shipment. That sits alongside, not instead of, later checks by competent authorities, so a weak file can cost you twice: stockouts and demurrage at the border, and penalties after the fact.

Country-of-production risk shapes exposure. Article 16 describes a three-tier checking scheme, under which national authorities must ensure annual checks to be carried out for at least 9%, 3% and 1% of operators and traders dealing with products that originate from high-, standard- and low-risk countries, respectively. Coolset's note on EUDR audit pitfalls details where files most often fall apart under scrutiny.

Building a due diligence system before December 2026

A due diligence system has three steps and all three need to be running in production before December 2026. Under Articles 8 to 11, the EUDR due diligence system consists of information collection down to plot coordinates and production dates, risk assessment against the criteria in the Regulation, and risk mitigation that brings risk to a negligible level before any statement is submitted. The DDS is the output of this system, not a substitute for it. Article 12 stipulates that the system must be reviewed annually. 

Information collection runs across the full upstream chain, which usually means rewriting supplier contracts. Clauses need to require geolocation data in the correct format, legality evidence, and audit rights that extend to the first-mile producer. Retrofitting these clauses across hundreds of farms, cooperatives or forestry concessions takes longer than most compliance teams assume, especially where intermediaries have historically shielded origin data.

Risk assessment under Article 10 is where the file is built. The assessor weighs country-of-production risk under the Commission benchmarking, the complexity of the supply chain, the reliability of upstream data, and any concerns raised by third parties. The output is a documented conclusion. A spreadsheet of certifications is not a risk assessment on its own.

Article 29 sets up the three-tier country benchmarking system, applied through Implementing Regulation (EU) 2025/1093. Where all relevant commodities come from low-risk countries, Article 13 allows simplified due diligence: operators still collect the Article 9 information and submit a DDS, but do not have to carry out the Article 10 risk assessment or Article 11 mitigation, unless they become aware of information pointing to a risk of non-compliance or circumvention. Low risk lowers the workload and the inspection rate. It does not remove the statement.

Risk mitigation under Article 11 closes the gap. Where risk is not negligible, operators are expected to put in place measures such as additional information requests, independent surveys, support for supplier capacity building, or sourcing changes. The mitigation evidence has to live in the file alongside the risk assessment.

The May 2026 simplification review pays particular attention to micro and small operators such as farmers and foresters. Operators building a due diligence system should read it alongside the primary text.

Testing the Information System submission flow with real supplier data in the remaining weeks is one of the most useful de-risking activities. Implementing Act 2026/1565 finalised the technical specification of that system, so the shape of what has to be submitted is now legally fixed, though the Commission continues to refine the system and its documentation. Dry runs surface polygon errors, country-of-production mismatches and HS code gaps while there is still time to go back to the source. Coolset's note on what EUDR dry runs reveal covers the specific failures that have emerged during pilot submissions.

{{custom-cta}}

Where to focus the remaining lead time

With roughly ten weeks to go, work in this order. First, map each product line against the current Annex I, including whether it falls under the December 2026 or December 2027 date. Second, confirm for each line whether you file the DDS or collect a reference number. Third, close the gaps in supplier contracts and geolocation data. Fourth, run test submissions in the Information System with real data, leaving time to go back to suppliers for corrections.

Frequently asked questions

Is the EUDR regulation delayed to 2026?

Yes. The one-year postponement moved application for large and medium enterprises to 30 December 2026 and for most micro and small enterprises to 30 June 2027, under Regulation (EU) 2025/2650. December 2027 is the application date for all products that have been added under the most recent Delegated Act. The Commission confirmed that no further postponement is to be expected.

Does the EU deforestation regulation apply to the UK?

The EUDR is an EU regulation and applies in the 27 EU Member States and Northern Ireland from the end of 2026. UK companies are not directly subject to it. Any UK business that exports in-scope commodities or derived products to the EU becomes part of an EU operator's supply chain. That operator will ask for geolocation data, legality evidence and the information needed to support its DDS.

What are the latest updates on the EU Deforestation Regulation (EUDR)?

The most recent change is the 13 July 2026 Delegated and Implementing Acts. The Delegated Regulation (EU) 2026/2102 removes cattle hides, skins and leather, re-treaded tyres, soybeans for sowing, articles of vulcanised rubber, conveyor and transmission belts, and motor vehicle and aircraft seats from Annex I, and adds soluble coffee, certain palm oil derivatives and frozen cattle tongues. Implementing Regulation (EU)  2026/1565 finalises the EUDR Information System.

Who files the due diligence statement after the 2025 amendment?

Only the operator who first places the product on the EU market, or exports it, files the due diligence statement. Downstream operators and traders no longer file their own. The first downstream operator collects and keeps the reference number. Micro and small primary operators in low-risk countries submit a one-off simplified declaration instead.

‍