The EU Deforestation Regulation (EUDR) is a law designed to ensure that certain commodities placed on or exported from the EU market are deforestation-free. This means that companies must ensure their products are not linked to deforestation or forest degradation. While the current legal enforcement date remains 30 December 2025, the European Parliament has now voted in favour of a 12‑month delay. If adopted in the final legal text, the new application dates would be:

• 30 December 2026 for large and medium operators
• 30 June 2027 for small and micro operators (for non‑timber products)

These changes are not yet legally in force and will only take effect after trilogue negotiations conclude and the amended regulation is published in the Official Journal of the EU.

EUDR applies to cattle, wood, cocoa, coffee, palm oil, soy, and rubber, including derived products. To comply, companies must trace their supply chains, assess risks, mitigate issues, and submit official due diligence statements. This article provides a comprehensive seven-step guide for business users to comply with EUDR, dividing the process into data collection, risk assessment, risk mitigation, traceability, due diligence, and ongoing monitoring.

{{custom-cta}}

Step 1: Confirm your role (operator, trader) in the EUDR process

The obligations of companies under EUDR are based on their role in the value chain and their size. Determining your role is the first step in compliance

Are you an operator or a trader?

Your first task is to determine whether your company is considered an operator or a trader, as obligations differ

Operator

Places in-scope products on the EU market for the first time in the product’s value chain, or exports them. The term operator covers multiple business cases - here are examples:

• Producers in the EU: a forestry company in Finland harvesting pine wood and selling it to a sawmill in Germany
• Importers placing goods for the first time on the EU market: a Dutch coffee importer bringing in green beans from Colombia and selling them to EU roasters
• Exporters: a Portuguese leather goods manufacturer sourcing EU cattle leather to produce handbags exported to the US
• Manufacturers using already available inputs: a Spanish chocolate maker buying cocoa mass from a French importer and selling chocolate bars within the EU

Trader

Buys and resells in-scope products already on the EU market without transforming them – for example, a German wholesaler buying bulk unroasted coffee beans from a Dutch importer and selling the same beans to roasters and cafés

Some businesses may act as both operator and trader depending on the transaction

Updated EUDR roles and responsibilities following Parliament vote

To simplify implementation, the Parliament approved (26 November) the introduction of two new categories:

Downstream operators: entities that process or sell already EUDR-compliant products.

They now:

• Do not have to submit a new Due Diligence Statement (DDS)
• Must retain and pass on DDS references and traceability information
• Are exempt from showing a DDS at customs clearance if they export products
• Only the first downstream operator must record traceability
• Are excluded from EUDR if they buy from other downstream actors
  

Micro and small primary operators: are a natural person or micro/small enterprise established in a country classified as low‑risk under Article 29 that places relevant products on the EU market or exports them, provided they produced these products themselves.

They must:

• Submit a one-time simplified declaration with basic geolocation data
• Only update this declaration in the case of major operational changes

Are you an SME?

Your company is an SME if it meets at least two of the following:

• Fewer than 250 employees
• Annual turnover below €50 million
• Annual balance sheet total below €25 million

SME traders are only required to retain and pass on due diligence and traceability information. Non-SME traders are no longer required to submit their own due diligence statements but must ensure traceability is maintained.

To determine your specific obligations based on your sector and company size, consult our detailed EUDR guide.

Additional updates

• Simplification review: The Commission will conduct another review of simplification options by 30 April 2026
• Quantity reporting update for DDS: Operators must include a one-off estimate of the annual quantity of relevant products intended for placement on the EU market or export

Step 2: Map your products and supply chains included in the EUDR

Not all products are subject to the EUDR. Only certain commodities and their derived products are covered. The next step is to identify which of your company’s products fall under the EUDR and map both the products and their origins throughout the supply chain.

Identifying your in-scope products

EUDR requires you to exercise due diligence on the products you intend to sell in the EU market or export. To do so, you must understand which raw materials you use to produce these products – unless you are the producer yourself. Here is a simple list of what to check:

• List in-scope commodities in the raw materials used in your products. A supermarket chain would identify multiple commodities like coffee, palm oil, cocoa, soy, and cattle
• Match products that include the in-scope commodities to HS codes. You can check the full list of in-scope HS codes in Annex I of the Regulation
• Map raw materials to final products. This internal traceability mapping will later help ensure you can separate compliant vs. non-compliant sources
• Confirm whether the products or components were produced by suppliers classified as downstream operators or micro and small primary operators, as this affects the level of due diligence required under the new proposal
• For each in-scope product, operators must also estimate the total annual quantity intended to be placed on the market or exported, and include this figure in their DDS submission.
• For products sourced from low-risk countries (as benchmarked under Article 29), operators may apply a simplified due diligence process with reduced risk-assessment requirements. 
• The option to file a one-time simplified declaration applies only to micro and small primary operators established in low-risk countries who place or export their own products. All other operators must still perform due diligence but can rely on the simplified assessment framework.
  

Example: A chocolate company should link cocoa and palm oil inputs to each final product to ensure traceability and compliance. If its cocoa suppliers are based in a low-risk country, the company can apply simplified due diligence rules but must still confirm traceability to origin plots

Understanding your supply chain and origins

After identifying the exact product codes and raw materials used (if any), you are ready to identify the suppliers involved and the countries where the materials come from

In order to trace your supply chain:

• Identify all suppliers, including any upstream producers and downstream intermediaries, and determine whether they fall under the new EUDR role definitions (operator, downstream operator, trader, or micro/small primary operator)
  
• The suppliers are key stakeholders you will need to collaborate with to collect the information required for EUDR compliance. The country of origin of your materials remains one of the core factors in assessing deforestation and legality risks. If you are the producer yourself, you can skip this step
  
• If sourcing from countries classified as low-risk, you may benefit from simplified due diligence but must still ensure that all products remain traceable back to origin plots
  
• Determine complexity and depth (e.g., number of intermediaries). This helps you understand where you might face information gaps or higher risks in the supply chain
  
• Document whether any parts of your supply chain include blended or processed materials handled by downstream operators, since these may no longer require their own DDS submissions but must still pass on supplier references

Key takeaway:

Under the European Parliament’s adopted position, mapping products and supply chains isn’t just about identifying what’s in scope, it’s about understanding which actors qualify for simplified obligations. This includes recognising when small and micro primary producers are eligible for one-time declarations, and when downstream operators are exempt from submitting a new DDS during customs clearance when exporting, as long as the original DDS reference is retained and passed along. While responsibilities differ by role, maintaining full traceability across the chain remains essential.

Read our full deep dive on the Parliament's vote here.

‍

{{product-tour-injectable}}

Step 3: Collect and organize key data required under EUDR

Once you know what and where you’re sourcing, the next step is to collect the specific data that the EUDR requires for compliance. Operators must gather a comprehensive set of information – as outlined in Article 9 – for each shipment of in-scope commodities they handle.

Required information

Geolocation data of areas of harvest:

The precise GPS coordinates or polygons of the plots of land where the commodity was produced – whether a farm, plantation, or forest harvesting site.

If your product contains multiple commodities, you need coordinates for each relevant ingredient’s origin.

This information is collected once and submitted as part of the simplified declaration. Micro and small primary operators may provide either the geolocation or the postal address of the production site, and must update the declaration only if major operational changes occur.

Production date:

The date or date range when the commodity was harvested or produced. This proves that production occurred after 31 December 2020, in line with the EUDR’s deforestation cut-off date.

Under the new guidance, production date can be declared as a range (e.g. harvest season) when exact dates are unavailable, provided it still demonstrates compliance.

Product details:

Description of the product (trade name, type, HS code), quantity, and shipment details.

Operators can now include multiple related shipments in a single “consolidated” due diligence record if they come from the same sources and share identical risk profiles.

Supply chain contacts:

Names, addresses, and contact details of suppliers and buyers along the chain.

Downstream operators, while no longer required to submit Due Diligence Statements, must still retain and pass on supplier DDS reference numbers to ensure traceability.

Evidence of legality:

You must prove that each product was produced legally according to the laws of the country of origin, meaning it must be independently checkable by authorities – not based solely on supplier statements.

Collect documents covering:

• Land ownership or tenure rights
• Harvesting or production permits
• Labor, environmental, and indigenous peoples’ rights compliance. 

Deforestation-free status:

Satellite imagery, land-use history, or geotagged photos showing that no deforestation or forest degradation occurred after 31 December 2020.

The updated Guidance confirms that operators may rely on EU or national monitoring systems, such as the EU Observatory on Deforestation, to complement supplier-provided evidence.

Practical tips for data collection

Collecting all required data can be challenging, especially when working with smallholders or multi-tier supply chains. To streamline the process:

• Use standardized templates and supplier questionnaires based on Article 9 requirements
• Digitize your process with a traceability or ESG compliance tool to gather and store GPS coordinates, legal documents, and supplier attestations
• Reuse existing data for repeat shipments from the same origin where no material changes occurred
• Ensure all data is stored securely and retained for at least five years, as required under Article 12

Key takeaway:

Under the European Parliament’s adopted position, these core data requirements remain, but there are two important updates:

• Operators must now include a one-off estimated annual quantity of products in their due diligence statements.
• For small and micro primary operators, a one-time simplified declaration replaces full due diligence, unless major changes occur.

These changes are not yet final and will only apply once formally adopted into law. For a full breakdown of what each operator type must prepare, see our latest article.

Step 4: Conduct a robust EUDR risk assessment

Once your data is complete, based on Article 10, you need to assess whether there is more than negligible risk of deforestation or illegality before placing products on the EU market or exporting them.

Risk dimensions to evaluate:

• Country-level risk:
  Forest presence trends, deforestation and degradation trends, environmental protection levels law enforcement, corruption levels, land use and third party issues
• Supply chain-level risk:
  Number of intermediaries, processing complexity, risk of mixing, non compliant partners
• Plot/supplier-level risk:
  Legal permits and titles, indigenous rights, endangered species, labour and human rights violations, deforestation history, post harvest management
• Documentation and conduct risk:
  Missing or unverifiable documents, supplier behavior, transparency issues, past EUDR misconduct

Assess each dimension. If any indicator suggests non-negligible risk, mitigation is required before proceeding. Remember: due diligence is not a check-box exercise, it must be tailored to your context and thorough.

Learn more about how the EUDR risk benchmarks change your due diligence responsibilities here.

Step 5: Take risk mitigation actions if needed

If your risk assessment finds anything other than negligible risk for a product, the EUDR in Article 11, requires you to take risk mitigation measures before proceeding. In practical terms, this means you must actively reduce the risk to a negligible level, or else you cannot place the product on the market. 

Here’s how businesses can approach risk mitigation:

• Requesting more evidence: Often, the initial data might be insufficient to conclude negligible risk. Reach back out to your supplier for more evidence like extra land documents, or certifications
• Third-party verification: Another mitigation step is to get independent third-party checks. These could be NGO reports or certification audits (e.g. FSC, RSPO)
• On-site audits: If paper evidence isn’t convincing, consider an on-the-ground audit. This could mean sending your own team or hiring local auditors to visit farms or facilities
• Supplier engagement: Work to improve traceability or exclude non-compliant plots. For example, if a supplier’s product currently isn’t compliant, you might give them a chance to remedy it, e.g. agree to source only from certain plots that you verify, or help them implement better tracking
• Supplier switching: If risks remain, sourcing must shift to compliant sources. This is a tough business decision, but the regulation leaves no choice if compliance can’t be achieved

After mitigation, you should re-evaluate the risk. If negligible, you can move forward to the next step. If not, further mitigation or exclusion is needed. By the time you’re done with this step, any product you intend to sell should have a negligible deforestation risk profile and full compliance documentation.

Step 6: Submit your EUDR due diligence statement

Once you have completed the due diligence process (information collection, risk assessment, and needed mitigation), the EUDR requires a final formal step: submitting a due diligence statement (DDS). This is basically an official declaration that you have fulfilled your obligations and that the product meets EUDR requirements. Think of it as signing off that “we did our homework, and to the best of our knowledge, this product is deforestation-free and legal.”

For a step-by-step breakdown of the EUDR due diligence process, read the latest requirements in our article.

Key details:

• Who submits the DDS: The company placing the product on the market
• How to submit: Through an EU’s information system called EU Traces. You can already familiarise with their test environment
• What’s included: Annex II provides a template on a typical due diligence statement. This includes product information and quantities, risk assessment outcome, compliance attestation
• How frequently to submit: Every shipment needs a due diligence statement. Recent updates allow the submission of DDS on a periodic or aggregated basis if specific criteria apply‍
• Special cases: Downstream operators are no longer required to submit their own DDS but must retain and pass on supplier DDS reference numbers
• Micro and small primary operators in low-risk countries can submit a one-time simplified declaration instead of individual DDS submissions
• Each DDS has a unique reference number for tracking – ensure every shipment and internal record links back to it

Each DDS has a unique reference and verification number. Track each DDS by its unique reference number and ensure it is linked to each shipment.

Step 7: Monitor and update over time

EUDR compliance isn’t a one-time task. Companies must continuously ensure that supply chains remain deforestation-free and legally compliant.

• Ensure every new batch of in-scope products is traceable to origin before it’s placed on the market. Make this a routine part of procurement
• Monitor changes in country risk or sourcing conditions
• Store all due diligence data, risk assessments, and statements for at least five years. Make sure your team can retrieve them quickly in case of an audit
• Prepare for audits by EU authorities. Have a clear process for responding to document requests and demonstrating compliance

Check out our EUDR procurement integration guide to ensure supplier vetting includes compliance with the latest regulations.

EUDR compliance checklist

To wrap up the step-by-step guide, here’s an EUDR compliance checklist distilling the key actions. Use this as a quick-reference to ensure you’ve covered all bases:

By following this EUDR checklist, businesses can systematically work through compliance and ensure nothing is overlooked. Early preparation is key – each of these steps can take time, especially for complex supply chains.

Leveraging technology to simplify compliance

Managing EUDR compliance manually can quickly become overwhelming especially as supply chains grow. Digital tools make a difference by:

• Centralizing data collection: Storing and organizing supplier data, GPS coordinates, and compliance documents in one place with no scattered spreadsheets
• Automating risk screening: Instantly flagging high-risk suppliers or regions using built-in risk assessments
• Live deforestation screening: Use of remote sensing with the use of satellites to track deforestation trends
• Supply chain mapping: Visualization of origin-to-market product flows and maintenance of traceability across inputs and outputs
• Due diligence statement management: Preparing and tracking submissions through integrations with the EU portal
• Ongoing monitoring: Providing alerts for missing documents, expiring certifications, or changes in sourcing risk

In short, investing in a digital due diligence system turns a complex compliance burden into a more automated, trackable process. It also helps with other sustainability reporting synergies – for example, the data collected for EUDR (like supply chain traceability) can feed into broader ESG reporting or upcoming regulations like CSDDD. 

Leveraging technology ensures that the foundation remains strong and less labor-intensive over time. Scalable solutions like Coolset are designed to support mid-market companies in exactly this way – by providing an all-in-one platform to manage data, due diligence workflows, and reporting for regulations such as EUDR. The result is not only saved time and reduced risk of error, but also actionable insights that can improve your supply chain transparency beyond just compliance.

Next steps for businesses

Moving forward, evaluate how prepared your business is across the seven steps. Identify gaps in supplier data, internal processes, or reporting systems and decide whether additional support is needed. If managing this manually seems unsustainable, consider whether a platform like Coolset could help streamline your compliance, reduce risk, and scale with your operations.

Coolset’s EUDR solution helps companies collect the right data, check for deforestation risk, and file Due Diligence Statements without chasing suppliers or working in complex spreadsheets.With Coolset, companies can import product and order data from your ERP, request documents from suppliers, and track everything in one place. The system flags missing or at-risk shipments and generates audit-ready DDS files that follow the mandatory EU TRACES format.

FAQs - EUDR compliance and due diligence

1. What is the EU Deforestation Regulation (EUDR)?

The EUDR requires companies to ensure that certain commodities (e.g. cocoa, soy, palm oil, wood) are deforestation-free and legal. Parliament voted to delay enforcement to 30 December 2026 for large and medium operators and 30 June 2027 for small and micro primary operators(non-timber), but this is not yet law and must be formally adopted.

2. Who needs to comply with EUDR?

All operators and traders handling in-scope products must comply. Operators submit a DDS. Small/micro primary operators file a simplified declaration. Downstream operators and non-SME traders no longer submit DDS but must maintain traceability and record-keeping.

3. What data is required for EUDR compliance?

Operators must collect and verify key data outlined in Article 9, including:

• Geolocation data (GPS coordinates or polygons) of plots where commodities were produced
• Production dates confirming harvest took place after 31 December 2020
• Evidence of legality (land titles, permits, labor and indigenous rights compliance)
• Deforestation-free proof (satellite imagery or land-use history)
• Supplier and buyer information (names, addresses, and contact details)
  This information must be adequately conclusive and verifiable and stored for at least five years

4. What does EUDR due diligence involve?

‍EUDR due diligence consists of seven key steps:

1. Confirm your role (operator, trader, or downstream operator)
2. Identify in-scope products and map supply chains
3. Collect required data (geolocation, legality, production date)
4. Conduct a risk assessment (Article 10)
5. Mitigate any non-negligible risks (Article 11)
6. Submit a DDS or, where applicable, a simplified declaration
7. Monitor, update, and retain records for five years

5. How are “low-risk countries” treated under the EUDR?

‍Products from low-risk countries benefit from simplified due diligence, meaning fewer risk assessment requirements, but not a full exemption.
Only micro and small primary operators established in those countries may submit a one-time simplified declaration.
All other operators must still perform due diligence and ensure traceability to origin plots.

6. Can technology help with EUDR compliance?‍

Yes. Platforms such as Coolset can simplify and automate the EUDR process by:

• Collecting and validating supplier data and geolocation information
• Mapping and visualizing supply chains
• Tracking risk and compliance in real time
• Managing DDS submissions through integration with the EU TRACES system
• Centralizing documentation for audits and annual reporting

7. What is the April 2026 EUDR review?

The Commission must review the EUDR by 30 April 2026, with a focus on small and micro operators. This may lead to further simplification, but any changes must go through the formal legislative process.