EUDR compliance roadmap: phased implementation plan for 2026

Key takeaways

• EUDR applies from 30 December 2026 for large and medium operators and from 30 June 2027 for micro and small enterprises, with no further delay planned.
• Split 2026 into three phases: Q3 data foundation, Q4 DDS dress rehearsal, and post-30 December operational compliance under enforcement.
• Only the actor first placing a product on the EU market files the due diligence statement; downstream operators reference it.
• See how Coolset supports EUDR compliance across geolocation, DDS, and supplier onboarding.

Regulation (EU) 2025/2650 sets the EU Deforestation Regulation (EUDR) application date at 30 December 2026 for large and medium operators and traders. Micro and small enterprises follow on 30 June 2027. That six-month gap, plus a single hard cutover on 30 December 2026 for most importers, is why 2026 is not a year for a big-bang project.

Companies subject to EUDR should sequence their 2026 work in three phases: a Q3 readiness lock-down, a Q4 pre-launch dress rehearsal, and post-30 December operational compliance. Geolocation collection, due diligence statement (DDS) submission, supplier onboarding, and customs integration all have to be live at the same moment. None of them can be finished in the final quarter alone.

What the 2026 phasing actually establishes

The 2026 roadmap is anchored to two dates: 30 December 2026 for large and medium operators and an extra six-month cushion for micro and small operators until 30 June 2027. Most importers of cattle, cocoa, coffee, oil palm, rubber, soya and wood have twelve months to build, test, and run the full compliance chain. No additional grace period is available inside that window.

Regulation (EU) 2025/2650 introduces a new 'downstream operator' category. Its purpose is to clarify obligations in downstream supply chains and cut reporting on the Article 33 information system. In practice, the first company that places a relevant product on the EU market carries the DDS obligation for the shipment, and downstream actors align to traders. Working out where each of your entities sits in that chain is the precondition for every other 2026 decision. Coolset covers this reclassification in more depth in the guide to the EUDR downstream operator category.

The commodity list has moved slightly and will move again. The amending regulation deletes point 4 in Annex II of the initial EUDR, and the Commission's May 2026 simplification package tabled a draft delegated act adding soluble coffee and certain palm oil derivatives while removing leather and retreaded tyres. If your SKU list still reflects the original Annex I, your Q3 scoping will be wrong before it starts.

Country risk is the other lever. The Commission's implementing regulation classifies producing countries as high, standard or low risk, and that classification decides whether simplified due diligence applies. It should drive supplier segmentation in the first phase, not the last.

{{product-tour-injectable}}

July to September 2026: lock the data foundation

Phase one closes the traceability gaps that would otherwise block DDS submission in Q4. Under Regulation (EU) 2023/1115, operators must trace commodities back to the plot of land where they were produced. The Commission's own impact assessment estimates that without intervention EU consumption of the seven covered commodities could cause almost 250,000 hectares of deforestation annually by 2030. Plot-level traceability is the single largest data lift for most importers, and it cannot be retrofitted during peak harvest.

The Q3 work therefore centers on four items:

• A complete SKU-to-origin map for every in-scope commodity and product, refreshed against the current Annex I and the pending delegated act on scope.
• Supplier contracts amended to require geolocation data, cut-off date attestations, and audit rights, so the obligation to provide plot data does not depend on goodwill.
• A tested connection to the EUDR information system. The Article 33 Information System was launched on 4 December 2024 and its functioning is governed by Commission Implementing Regulation (EU) 2024/3084 of 4 December 2024. Waiting to test the API in November leaves no time to fix authentication or schema errors.
• Internal ownership assigned across procurement, sustainability, legal, and customs. The DDS reference number needs to move from the information system to the customs declaration without a manual handover.

Suppliers in high-risk origins deserve early attention because substitution is realistic in July and impossible in December. If a plot cannot be geolocated or its production date cannot be confirmed against the deforestation cut-off, that flow needs to be redirected or dropped from the 2026 book long before Q4.

October to November 2026: run the DDS dress rehearsal

Phase two submits live due diligence statements against real shipments to surface system, data, and classification errors before enforcement begins. Parliament confirmed on 17 December 2025 that the additional time is intended to allow improvement of the IT system used to submit electronic due diligence statements. That framing tells teams to test the system under load, not to wait for policy clarity.

The dress rehearsal needs to cover the full chain, not just the DDS form. That means:

1. Running risk assessments on a representative sample of SKU-origin pairs and templating the output so the same reasoning can be reused across similar flows.
2. Verifying that HS code mappings in the customs system point to the right DDS reference numbers, so declarations from 30 December 2026 automatically link.
3. Testing the referencing chain end-to-end for downstream flows. The Access2Markets summary of Regulation (EU) 2025/2650 confirms the amendment adjusts due diligence obligations and creates two new categories that redistribute obligations along the chain. A broken reference in a downstream flow can still block a shipment.
4. Reviewing supplier data quality against satellite baselines rather than accepting self-reported coordinates at face value.

The purpose of a dress rehearsal is to fail on purpose. A DDS rejected in November by an internal quality check is a saved fine in January. For a deeper look at the mechanics of documenting risk, plot data, and mitigation, Coolset's supply chain due diligence guide walks you through the process.

{{custom-cta}}

From 30 December 2026: operating compliance under enforcement

Once the application date passes, the roadmap shifts from build to run. Every batch placed on the EU market needs a DDS before market entry, and competent authorities designated under Regulation (EU) 2023/1115 begin executing their inspection duties across Member States. The information system, live again as of July 2026, becomes the source of truth for what a company said about a shipment and when.

Penalties are the reason this matters at the executive level. According to the EUR-Lex legal summary, penalties must be effective, proportionate and dissuasive, including fines of at least 4% of the operator's annual EU turnover and temporary exclusion from public procurement and public funding. That is not a rounding item on a compliance budget. Coolset breaks down the enforcement mechanics in the article on what EUDR non-compliance actually costs.

Two operational realities take over in this phase. First, monitoring is continuous. New plots, new suppliers, and new SKUs enter the system throughout the year, and each has to be tied to a valid DDS before its first shipment. Second, only the actor placing the product on the market for the first time submits the DDS, so downstream operators need a documented process to receive and retain reference numbers from their upstream operator. Parliament's 17 December 2025 press release confirms that only businesses first to place a relevant product on the EU market file the DDS. Micro and small primary operators need only submit a one-off simplified declaration.

For companies inside the second wave, the June 2027 date does not mean nine free months. It means their upstream partners are live under enforcement while they are still building. The realistic posture is a lighter but documented workflow ready by 30 December 2026, not an exemption held until the last day.

Where 2026 roadmaps typically break

The most common failure mode is waiting for another delay. The provisional political agreement of 4 December 2025 removed the Commission's proposed 'grace period' for large and medium companies. It replaced that grace period with a clean extension of the application date for all operators until 30 December 2026. Planning as if a further postponement will land is not a plan.

The second failure mode is treating the file as a procurement issue. Submitting a DDS through the Article 33 information system requires customs alignment, IT integration, legal review of supplier contracts, and sustainability data governance. The May 2026 simplification package (IP/26/941) is expected to cut annual compliance costs for companies subject to EUDR obligations by about 75% compared to the original EUDR. That saving only reaches companies that already have the underlying data ready to run through the simplified process. Simplification is not a substitute for the plot map.

The third failure mode is buying geolocation datasets without verification. A coordinate that does not match the physical boundary of a producing plot cannot support a defensible risk assessment. Satellite verification and cross-checks against local land records are what turn coordinates into evidence.

The fourth is scope drift. The Commission's draft delegated act under the May 2026 package proposes to add soluble coffee and certain palm oil derivatives while removing leather and retreaded tyres from scope. Portfolios need a quarterly review against the delegated act text, not an annual one. Coolset's summary of the April 30 EUDR simplification package tracks the moving pieces.

Setting the phase-one milestone

Start by mapping every in-scope SKU to its country of production and confirming which plots still lack geolocation data. That gap list is what turns a 2026 calendar into an executable plan, because every later phase depends on knowing what data you already have and what you still need to collect during the growing season. For the full compliance picture beyond the phasing, Coolset's EUDR compliance guide covers requirements, timelines, and solution options in one place.

Frequently asked questions

When does the EUDR actually apply?

Regulation (EU) 2025/2650 sets the application date at 30 December 2026 for large and medium operators and traders, and 30 June 2027 for micro and small enterprises. The dates were formally confirmed by the Council on 18 December 2025.

Which commodities are in scope?

Cattle, cocoa, coffee, oil palm, rubber, soya and wood, together with products derived from them and listed in Annex I of Regulation (EU) 2023/1115. A draft delegated act tabled in the May 2026 simplification package proposes to add soluble coffee and certain palm oil derivatives and to remove leather and retreaded tyres.

Who has to submit the due diligence statement?

Only businesses that are first to place a relevant product on the EU market submit the DDS, according to the European Parliament press release of 17 December 2025. Downstream operators and traders receive and reference the upstream DDS rather than filing their own.

What are the maximum penalties for non-compliance?

Penalties must be effective, proportionate and dissuasive, including fines of at least 4% of the operator's annual EU turnover and temporary exclusion from public procurement and public funding, as summarized by EUR-Lex.

Will the 30 December 2026 date be postponed again?

No further postponement is on the table. The 4 December 2025 provisional agreement deliberately removed the earlier grace-period proposal in favor of a clean, single application date. The May 2026 simplification package focuses on reducing burden inside the existing timeline, not on shifting it.

‍