The EU Deforestation Regulation (EUDR) is a law designed to ensure that certain commodities placed on or exported from the EU market are deforestation-free. This means that companies must ensure their products are not linked to deforestation or forest degradation after December 31, 2020, and that they comply with local laws in their countries of origin.

EUDR applies to cattle, wood, cocoa, coffee, palm oil, soy, and rubber, including many derived products. To comply, companies must trace their supply chains, assess risks, mitigate issues, and submit official due diligence statements. If the European Commission proposal from October 21st is accepted, for most companies the law will likely apply from 30 December 2025, while micro and small operators have until 30 December 2026. Enforcement for large and medium companies begins after a six-month transition phase in early 2026.

This article provides a comprehensive seven-step guide for business users to comply with EUDR, dividing the process into data collection, risk assessment, risk mitigation, traceability, due diligence, and ongoing monitoring.

{{custom-cta}}

Step 1: Confirm your role (operator, trader) in the EUDR process

The obligations of companies under EUDR are based on their role in the value chain and their size. Determining your role is the first step in compliance

Are you an operator or a trader?

Your first task is to determine whether your company is considered an operator or a trader, as obligations differ

Operator

Places in-scope products on the EU market for the first time in the product’s value chain, or exports them. The term operator covers multiple business cases – here are examples:

• Producers in the EU: a forestry company in Finland harvesting pine wood and selling it to a sawmill in Germany
• Importers placing goods for the first time on the EU market: a Dutch coffee importer bringing in green beans from Colombia and selling them to EU roasters
• Exporters: a Portuguese leather goods manufacturer sourcing EU cattle leather to produce handbags exported to the US
• Manufacturers using already available inputs: a Spanish chocolate maker buying cocoa mass from a French importer and selling chocolate bars within the EU

Trader

Buys and resells in-scope products already on the EU market without transforming them – for example, a German wholesaler buying bulk unroasted coffee beans from a Dutch importer and selling the same beans to roasters and cafés

Some businesses may act as both operator and trader depending on the transaction

New categories under the 2025 proposal

To simplify implementation, the Commission introduced two new sub-categories:

• Downstream operators: entities that process or sell already EUDR-compliant products. They no longer have to submit Due Diligence Statements (DDS) but must ensure traceability and keep supplier DDS references
  
• Micro and small primary operators: small producers in low-risk countries who only need to submit a one-time simplified declaration with basic geolocation data instead of full due diligence

Are you an SME?

Your company is an SME if it meets at least two of the following:

• Fewer than 250 employees
• Annual turnover below €50 million
• Annual balance sheet total below €25 million

SME operators benefit from simplified due diligence. Non-SME traders must fulfill full due diligence obligations like operators, while SME traders only need to retain and pass on information.

To determine your specific obligations based on your sector and company size, consult our detailed EUDR guide.

Step 2: Map your products and supply chains included in the EUDR

Not all products are subject to the EUDR. Only certain commodities and their derived products are covered. The next step is to identify which of your company’s products fall under the EUDR and map both the products and their origins throughout the supply chain

Identifying your in-scope products

EUDR requires you to exercise due diligence on the products you intend to sell in the EU market or export. To do so, you must understand which raw materials you use to produce these products – unless you are the producer yourself. Here is a simple list of what to check:

• List in-scope commodities in the raw materials used in your products. A supermarket chain would identify multiple commodities like coffee, palm oil, cocoa, soy, and cattle
• Match products that include the in-scope commodities to HS codes. You can check the full list of in-scope HS codes in Annex I of the Regulation
• Map raw materials to final products. This internal traceability mapping will later help ensure you can separate compliant vs. non-compliant sources
• Confirm whether the products or components were produced by suppliers classified as downstream operators or micro and small primary operators, as this affects the level of due diligence required under the new proposal
• For products sourced from low-risk countries (as benchmarked under Article 29), operators may apply a simplified due diligence process with reduced risk-assessment requirements. 
• The option to file a one-time simplified declaration applies only to micro and small primary operators established in low-risk countries who place or export their own products. All other operators must still perform due diligence but can rely on the simplified assessment framework.
  
  

Example: A chocolate company should link cocoa and palm oil inputs to each final product to ensure traceability and compliance. If its cocoa suppliers are based in a low-risk country, the company can apply simplified due diligence rules but must still confirm traceability to origin plots

Understanding your supply chain and origins

After identifying the exact product codes and raw materials used (if any), you are ready to identify the suppliers involved and the countries where the materials come from

In order to trace your supply chain:

• Identify all suppliers, including any upstream producers and downstream intermediaries, and determine whether they fall under the new EUDR role definitions (operator, downstream operator, trader, or micro/small primary operator)
  
• The suppliers are key stakeholders you will need to collaborate with to collect the information required for EUDR compliance. The country of origin of your materials remains one of the core factors in assessing deforestation and legality risks. If you are the producer yourself, you can skip this step
  
• If sourcing from countries classified as low-risk, you may benefit from simplified due diligence but must still ensure that all products remain traceable back to origin plots
  
• Determine complexity and depth (e.g., number of intermediaries). This helps you understand where you might face information gaps or higher risks in the supply chain
  
• Document whether any parts of your supply chain include blended or processed materials handled by downstream operators, since these may no longer require their own DDS submissions but must still pass on supplier references

Key takeaway:

Under the 2025 proposal, mapping products and supply chains is not only about identifying what’s in scope – it’s about understanding which actors fall under new simplified categories and where simplified due diligence or one-time declarations for micro/small producers apply, while keeping end-to-end traceability intact.

Step 3: Collect and organize key data required under EUDR

Once you know what and where you’re sourcing, the next step is to collect the specific data that the EUDR requires for compliance. Operators must gather a comprehensive set of information – as outlined in Article 9 – for each shipment of in-scope commodities they handle.

Under the 2025 proposal, operators are still responsible for collecting the same core data points, but new flexibilities have been introduced to reduce administrative burden and allow data reuse across shipments where conditions remain unchanged.

Required information

Geolocation data of areas of harvest:

The precise GPS coordinates or polygons of the plots of land where the commodity was produced – whether a farm, plantation, or forest harvesting site.

If your product contains multiple commodities, you need coordinates for each relevant ingredient’s origin.

For micro and small primary operators filing a one-time simplified declaration, this geolocation information is collected once and linked to their declaration ID rather than per shipment.

Production date:

The date or date range when the commodity was harvested or produced. This proves that production occurred after 31 December 2020, in line with the EUDR’s deforestation cut-off date.

Under the new guidance, production date can be declared as a range (e.g. harvest season) when exact dates are unavailable, provided it still demonstrates compliance.

Product details:

Description of the product (trade name, type, HS code), quantity, and shipment details.

Operators can now include multiple related shipments in a single “consolidated” due diligence record if they come from the same sources and share identical risk profiles.

Supply chain contacts:

Names, addresses, and contact details of suppliers and buyers along the chain.

Downstream operators, while no longer required to submit Due Diligence Statements, must still retain and pass on supplier DDS reference numbers to ensure traceability.

Evidence of legality:

You must prove that each product was produced legally according to the laws of the country of origin, meaning it must be independently checkable by authorities – not based solely on supplier statements.

Collect documents covering:

• Land ownership or tenure rights
• Harvesting or production permits
• Labor, environmental, and indigenous peoples’ rights compliance. 

Deforestation-free status:

Satellite imagery, land-use history, or geotagged photos showing that no deforestation or forest degradation occurred after 31 December 2020.

The updated Guidance confirms that operators may rely on EU or national monitoring systems, such as the EU Observatory on Deforestation, to complement supplier-provided evidence.

Practical tips for data collection

Collecting all required data can be challenging, especially when working with smallholders or multi-tier supply chains. To streamline the process:

• Use standardized templates and supplier questionnaires based on Article 9 requirements
• Digitize your process with a traceability or ESG compliance tool to gather and store GPS coordinates, legal documents, and supplier attestations
• Reuse existing data for repeat shipments from the same origin where no material changes occurred
• Ensure all data is stored securely and retained for at least five years, as required under Article 12

Key takeaway:

The core data requirements under Article 9 remain the backbone of EUDR compliance. The 2025 amendments don’t reduce the scope of data to collect – but they make it easier to manage, consolidate, and reuse across shipments, particularly for small operators and downstream actors maintaining traceability without duplicating effort

Step 4: Conduct a robust EUDR risk assessment

Once your data is complete, based on Article 10, you need to assess whether there is more than negligible risk of deforestation or illegality before placing products on the EU market or exporting them.

Risk dimensions to evaluate:

• Country-level risk:
  Forest presence trends, deforestation and degradation trends, environmental protection levels law enforcement, corruption levels, land use and third party issues
• Supply chain-level risk:
  Number of intermediaries, processing complexity, risk of mixing, non compliant partners
• Plot/supplier-level risk:
  Legal permits and titles, indigenous rights, endangered species, labour and human rights violations, deforestation history, post harvest management
• Documentation and conduct risk:
  Missing or unverifiable documents, supplier behavior, transparency issues, past EUDR misconduct

Assess each dimension. If any indicator suggests non-negligible risk, mitigation is required before proceeding. Remember: due diligence is not a check-box exercise, it must be tailored to your context and thorough.

Learn more about how the EUDR risk benchmarks change your due diligence responsibilities here.

Step 5: Take risk mitigation actions if needed

If your risk assessment finds anything other than negligible risk for a product, the EUDR in Article 11, requires you to take risk mitigation measures before proceeding. In practical terms, this means you must actively reduce the risk to a negligible level, or else you cannot place the product on the market. 

Here’s how businesses can approach risk mitigation:

• Requesting more evidence: Often, the initial data might be insufficient to conclude negligible risk. Reach back out to your supplier for more evidence like extra land documents, or certifications
• Third-party verification: Another mitigation step is to get independent third-party checks. These could be NGO reports or certification audits (e.g. FSC, RSPO)
• On-site audits: If paper evidence isn’t convincing, consider an on-the-ground audit. This could mean sending your own team or hiring local auditors to visit farms or facilities
• Supplier engagement: Work to improve traceability or exclude non-compliant plots. For example, if a supplier’s product currently isn’t compliant, you might give them a chance to remedy it, e.g. agree to source only from certain plots that you verify, or help them implement better tracking
• Supplier switching: If risks remain, sourcing must shift to compliant sources. This is a tough business decision, but the regulation leaves no choice if compliance can’t be achieved

After mitigation, you should re-evaluate the risk. If negligible, you can move forward to the next step. If not, further mitigation or exclusion is needed. By the time you’re done with this step, any product you intend to sell should have a negligible deforestation risk profile and full compliance documentation.

Note: Due diligence requirements currently apply to all sourcing countries, as no approved benchmarking system is in place. Companies should proceed with risk mitigation assuming full compliance is required.

Step 6: Submit your EUDR due diligence statement

Once you have completed the due diligence process (information collection, risk assessment, and needed mitigation), the EUDR requires a final formal step: submitting a due diligence statement (DDS). This is basically an official declaration that you have fulfilled your obligations and that the product meets EUDR requirements. Think of it as signing off that “we did our homework, and to the best of our knowledge, this product is deforestation-free and legal.”

For a step-by-step breakdown of the EUDR due diligence process, read the latest requirements in our article.

Key details:

• Who submits the DDS: The company placing the product on the market
• How to submit: Through an EU’s information system called EU Traces. You can already familiarise with their test environment
• What’s included: Annex II provides a template on a typical due diligence statement. This includes product information and quantities, risk assessment outcome, compliance attestation
• How frequently to submit: Every shipment needs a due diligence statement. Recent updates allow the submission of DDS on a periodic or aggregated basis if specific criteria apply‍
• Special cases: Downstream operators are no longer required to submit their own DDS but must retain and pass on supplier DDS reference numbers
• Micro and small primary operators in low-risk countries can submit a one-time simplified declaration instead of individual DDS submissions
• Each DDS has a unique reference number for tracking – ensure every shipment and internal record links back to it

Each DDS has a unique reference and verification number. Track each DDS by its unique reference number and ensure it is linked to each shipment.

Step 7: Monitor and update over time

EUDR compliance isn’t a one-time task. Companies must continuously ensure that supply chains remain deforestation-free and legally compliant.

• Ensure every new batch of in-scope products is traceable to origin before it’s placed on the market. Make this a routine part of procurement
• Monitor changes in country risk or sourcing conditions
• Store all due diligence data, risk assessments, and statements for at least five years. Make sure your team can retrieve them quickly in case of an audit
• Prepare for audits by EU authorities. Have a clear process for responding to document requests and demonstrating compliance

Check out our EUDR procurement integration guide to ensure supplier vetting includes compliance with the latest regulations.

Annual reporting

Non-SME operators must publish annual summaries of due diligence activities. First reports are due by the end of 2026.

EUDR compliance checklist

To wrap up the step-by-step guide, here’s an EUDR compliance checklist distilling the key actions. Use this as a quick-reference to ensure you’ve covered all bases:

By following this EUDR checklist, businesses can systematically work through compliance and ensure nothing is overlooked. Early preparation is key – each of these steps can take time, especially for complex supply chains.

Leveraging technology to simplify compliance

Managing EUDR compliance manually can quickly become overwhelming especially as supply chains grow. Digital tools make a difference by:

• Centralizing data collection: Storing and organizing supplier data, GPS coordinates, and compliance documents in one place with no scattered spreadsheets
• Automating risk screening: Instantly flagging high-risk suppliers or regions using built-in risk assessments
• Live deforestation screening: Use of remote sensing with the use of satellites to track deforestation trends
• Supply chain mapping: Visualization of origin-to-market product flows and maintenance of traceability across inputs and outputs
• Due diligence statement management: Preparing and tracking submissions through integrations with the EU portal
• Ongoing monitoring: Providing alerts for missing documents, expiring certifications, or changes in sourcing risk

In short, investing in a digital due diligence system turns a complex compliance burden into a more automated, trackable process. It also helps with other sustainability reporting synergies – for example, the data collected for EUDR (like supply chain traceability) can feed into broader ESG reporting or upcoming regulations like CSDDD. 

Leveraging technology ensures that the foundation remains strong and less labor-intensive over time. Scalable solutions like Coolset are designed to support mid-market companies in exactly this way – by providing an all-in-one platform to manage data, due diligence workflows, and reporting for regulations such as EUDR. The result is not only saved time and reduced risk of error, but also actionable insights that can improve your supply chain transparency beyond just compliance.

Next steps for businesses

Moving forward, evaluate how prepared your business is across the seven steps. Identify gaps in supplier data, internal processes, or reporting systems and decide whether additional support is needed. If managing this manually seems unsustainable, consider whether a platform like Coolset could help streamline your compliance, reduce risk, and scale with your operations.

Coolset’s EUDR solution helps companies collect the right data, check for deforestation risk, and file Due Diligence Statements without chasing suppliers or working in complex spreadsheets.With Coolset, companies can import product and order data from your ERP, request documents from suppliers, and track everything in one place. The system flags missing or at-risk shipments and generates audit-ready DDS files that follow the mandatory EU TRACES format.

FAQs – EUDR compliance and due diligence

1. What is the EU Deforestation Regulation (EUDR)?

‍
The EU Deforestation Regulation requires companies to ensure that specific commodities – coffee, cocoa, soy, palm oil, cattle, rubber, and wood – placed on or exported from the EU market are deforestation-free and legally produced.

The main compliance deadline is 30 December 2025 for large and medium companies.
Micro and small operators have until 30 December 2026, with a six-month transition period (January–June 2026) before enforcement begins for all.

Note: These extended timelines and simplified obligations are part of a European Commission proposal (October 2025) that is not yet officially adopted. They will only take effect once the proposal is approved by the European Parliament and Council.

2. Who needs to comply with EUDR?

‍All operators and traders handling in-scope commodities in the EU are subject to the Regulation, though responsibilities differ by company type:

• First-in-line operators (those placing products on the EU market for the first time or exporting them) must complete full due diligence and submit a Due Diligence Statement (DDS)
• Downstream operators (e.g. manufacturers, retailers) no longer submit DDS but must keep and pass on supplier DDS references to maintain traceability
• Micro and small primary operators in low-risk countries can file a one-time simplified declaration instead of full due diligence
• SME traders have simplified obligations, while non-SME traders must perform full due diligence like operators

3. What data is required for EUDR compliance?

Operators must collect and verify key data outlined in Article 9, including:

• Geolocation data (GPS coordinates or polygons) of plots where commodities were produced
• Production dates confirming harvest took place after 31 December 2020
• Evidence of legality (land titles, permits, labor and indigenous rights compliance)
• Deforestation-free proof (satellite imagery or land-use history)
• Supplier and buyer information (names, addresses, and contact details)
  This information must be adequately conclusive and verifiable and stored for at least five years

4. What does EUDR due diligence involve?

‍EUDR due diligence consists of seven key steps:

1. Confirm your role (operator, trader, or downstream operator)
2. Identify in-scope products and map supply chains
3. Collect required data (geolocation, legality, production date)
4. Conduct a risk assessment (Article 10)
5. Mitigate any non-negligible risks (Article 11)
6. Submit a DDS or, where applicable, a simplified declaration
7. Monitor, update, and retain records for five years

5. How are “low-risk countries” treated under the EUDR?

‍Products from low-risk countries benefit from simplified due diligence, meaning fewer risk assessment requirements, but not a full exemption.
Only micro and small primary operators established in those countries may submit a one-time simplified declaration.
All other operators must still perform due diligence and ensure traceability to origin plots.

6. Can technology help with EUDR compliance?‍

Yes. Platforms such as Coolset can simplify and automate the EUDR process by:

• Collecting and validating supplier data and geolocation information
• Mapping and visualizing supply chains
• Tracking risk and compliance in real time
• Managing DDS submissions through integration with the EU TRACES system
• Centralizing documentation for audits and annual reporting

7. What happens after compliance begins?

‍From 2026 onward, competent authorities will begin checks, using satellite monitoring and TRACES data to verify DDS accuracy.
Non-compliance can result in product removal, fines of up to 4% of annual turnover, or market exclusion.
Companies are encouraged to start preparation early to ensure smooth compliance before enforcement starts.