Introduction

The EU Deforestation Regulation (EUDR) is a new European law designed to ensure that certain commodities are deforestation-free and legally produced. In short, it aims to stop products linked to recent forest loss from entering the EU market. Applying to seven core commodities and derived products, the EUDR aims to cut to the heart of deforestation drivers.

Why SMEs are still in scope - and why they need to act

Businesses of all sizes are in scope. The EUDR applies to any company that places relevant products on the EU market or exports them - regardless of size. While small and medium enterprises may have reduced obligations in certain circumstances, they are not excluded from the regulation.

Under Regulation (EU) 2025/2650, the compliance deadline for medium-sized businesses (under 250 employees, under €50M turnover, under €43M balance sheet) is the same as for large companies: 30 December 2026. Small and micro enterprises have until 30 June 2027.

The December 2025 revision also introduced simplifications for small and micro primary operators, including a one-time simplified declaration option. For details, see the EUDR compliance scope guide.

{{custom-cta}}

What products are in scope?

The EUDR covers seven commodities - cattle, cocoa, coffee, oil palm, rubber, soy, and wood - and a wide range of derived products (e.g., leather, chocolate, biofuels, rubber products, wooden furniture). For a full list with CN codes, see which products are covered under the EUDR.

If your company processes, imports, or sells any of these products, you need to determine your role in the supply chain.

SME operator vs SME trader: what’s the difference?

Under the EUDR, companies fall into one of two main compliance roles:

• Operators place relevant products on the EU market for the first time or export them. SME operators must carry out due diligence - collecting supply chain data, assessing risk, and submitting a Due Diligence Statement (DDS) for each shipment.
• Traders buy and sell products that have already been placed on the EU market. SME traders do not submit a DDS themselves, but must retain and pass on DDS reference numbers from the operator who first placed the products on the market.

Update: Under Regulation 2025/2650, downstream SME traders now benefit from reduced DDS obligations - only the first downstream operator must retain and pass on DDS reference numbers.

Obligations for SME operators: what you need to do

If your SME is an operator - importing or first placing in-scope products on the EU market - you must:

1. Collect supply chain data, including geolocation of production areas, harvest dates, commodity type and quantity, supplier and buyer details, and proof of legality
2. Assess deforestation and legality risk for each product and sourcing country
3. Mitigate any non-negligible risk identified (e.g., request additional documentation, seek third-party verification)
4. Submit a Due Diligence Statement (DDS) to the EUDR Information System before placing the product on the market or exporting it
5. Keep all records for at least five years

For a step-by-step walkthrough of this process, see the EUDR compliance guide.

Obligations for SME traders: what you need to do

If your SME is a trader - buying and reselling products already on the EU market - your obligations are lighter:

• Retain information about your direct suppliers and buyers (name, address, contact details)
• If your direct supplier is an operator, collect and retain the DDS reference number for the relevant products
• Do not place products on the market if you know or have reason to believe they are non-compliant
• Report substantiated concerns about non-compliance to the relevant authority

Note: Under Regulation (EU) 2025/2650, if you purchase from another downstream operator or trader (rather than directly from an upstream operator), you are not required to collect DDS reference numbers. Your obligation is limited to basic business partner information.

Country risk and simplified due diligence for SMEs

The EUDR’s risk benchmarking system classifies countries as low, standard, or high risk for deforestation. SMEs sourcing entirely from low-risk countries are entitled to simplified due diligence - meaning they are not required to carry out the risk assessment or risk mitigation steps, only the information collection step under Article 9.

SMEs sourcing from standard- or high-risk countries must follow the full due diligence process, including risk assessment and mitigation.

How software can help

Coolset’s EUDR solution helps companies collect the right data, check for deforestation risk, and file Due Diligence Statements without chasing suppliers or working in complex spreadsheets. With Coolset, companies can import product and order data from your ERP, request documents from suppliers, and track everything in one place. The system flags missing or at-risk shipments and generates audit-ready DDS files that follow the mandatory EU TRACES format. Reach out to our team to see our EUDR module in action. You can also compare EUDR compliance tools to find the right fit for your business.

{{product-tour-injectable}}

June 2026 update: What the simplification package means for SMEs

The Commission’s simplification review (COM(2026) 191 final, 4 May 2026) and updated Guidance Document (3rd edition) contain several developments that directly affect how SMEs approach EUDR compliance.

Simplified due diligence for low-risk sourcing is now confirmed. Commission Implementing Regulation (EU) 2025/1093 (22 May 2025) formally adopted the country risk classification. Under the adopted list, 51% of importing operators — including many SME importers — now qualify for simplified due diligence under Article 13. This means no risk assessment or risk mitigation steps are required under Articles 10 and 11, as long as an initial examination does not indicate non-compliance. The Guidance Document (3rd edition) further clarifies that for negligible-risk low-risk supply chains, operators are not required to systematically collect comprehensive legal documentation for each individual plot, obtain specific document types such as individual land titles, or compile an exhaustive list of all potentially applicable laws.

Passive obligations for downstream SME traders are now confirmed. Under Regulation (EU) 2025/2650, the obligation of the first downstream operator or trader to collect reference numbers is passive. SME traders are not required to investigate or proactively ask suppliers for reference numbers. Acting in good faith, they may presume their supplier is not an upstream operator if no reference numbers are received. This removes any expectation of active supply chain investigation for SME traders further down the chain.

No further delays planned. The Commission confirmed in COM(2026) 191 final that no further amendments to the core EUDR legal text are proposed. SMEs should treat 30 June 2027 as a firm deadline.

FAQ - EUDR for SMEs

1. Does the EUDR apply to small and medium-sized enterprises (SMEs)?

Yes. All SMEs are in scope. Under Regulation (EU) 2025/2650, medium-sized businesses follow the same rules and deadlines as large companies (30 December 2026). Small and micro enterprises have until 30 June 2027. The revision also introduced simplifications for small and micro primary operators, including a one-time simplified declaration option.

2. What is the difference between an SME operator and an SME trader?

SME operators place or export in-scope products for the first time. SME traders buy and sell goods already placed on the market. Operators must conduct due diligence; traders only need to store and pass on traceability data.

Update: Under Regulation 2025/2650, downstream SME traders now benefit from reduced DDS obligations - only the first downstream operator must retain and pass on DDS reference numbers.

3. What if the product has already undergone due diligence upstream?

If your supplier already submitted a valid DDS, you don’t need to duplicate it. Instead, you must reference that DDS and maintain traceability records.

Note: Under Regulation 2025/2650, this is reinforced - operators and traders can reuse existing DDS without new submissions. Only the first downstream operator must store and pass on reference details.

4. What data do SME operators need to collect for EUDR compliance?

SME operators must collect geolocation data, production dates, product and shipment info, supplier and buyer contacts, and legality and deforestation-free evidence.

Update (Regulation 2025/2650): Small and micro primary operators in low-risk countries can now submit a one-time simplified declaration instead, with lighter data requirements (e.g. postal address allowed instead of precise geolocation).

5. What are the penalties for non-compliance?

Penalties for EUDR non-compliance can include:

• Blocking of non-compliant products from entering the EU market
• Fines up to 4% of annual EU turnover
• Confiscation of goods and profits
• Temporary bans from public contracts or from placing goods on the market

Even small firms are subject to checks and audits. SMEs are advised to act early to avoid supply disruptions or regulatory action once enforcement begins.