Introduction

The EU Deforestation Regulation (EUDR) is a new European law designed to ensure that certain commodities are deforestation-free and legally produced. In short, it aims to stop products linked to recent forest loss from entering the EU market. Applying to seven core commodities and derived products, the EUDR aims to cut to the heart of deforestation drivers.

Why SMEs are still in scope - and why they need to act

Businesses of all sizes are in scope. The EUDR applies to any company that places relevant products on the EU market or exports them - regardless of size. While small and micro companies may benefit from adjusted obligations or extended timelines, they are not exempt.

Under Regulation (EU) 2025/2650, all operators and traders must comply by 30 December 2026. SMEs (small and micro enterprises) have until 30 June 2027.

What changed in December 2025:

On 23 December 2025, Regulation (EU) 2025/2650 was published in the Official Journal and entered into force on 26 December 2025. This targeted revision introduced several key changes for SMEs:

• All EUDR compliance deadlines were pushed back by 12 months - large and medium operators must now comply by 30 December 2026, small and micro enterprises by 30 June 2027
• A new category of small and micro primary operators (defined as small producers established in low-risk countries who place or export their own products) now only need to submit a one-time simplified declaration instead of full due diligence
• Small and micro primary operators only need to update the declaration if major changes occur. Instead of precise GPS coordinates, they may use a verifiable postal address when reporting plots or establishments, lowering the technical barrier for compliance
• SME simplifications apply regardless of legal form, ensuring that cooperatives and similar small structures are not excluded
• Any SME that imports in-scope products or places them on the EU market for the first time is still considered an operator under EUDR and must perform full due diligence, since the product has not yet entered the EU supply chain

The European Commission is also required to deliver an additional simplification package by 30 April 2026, which may include further changes to the product scope and information system requirements.

What you'll find in this guide

In this article we'll walk you through the EUDR, and how it specifically applies to SMEs. We'll give you a comprehensive understanding of the (conditional) lightened requirements for SME operators and traders, and outline how the compliance timelines differ for medium and small / micro firms.

EUDR explained in 60 seconds (for SME readers)

What the regulation aims to do

The EUDR is part of the EU's Green Deal agenda to combat global deforestation (see EUDR pillar page for more details). It ensures EU consumption of certain products no longer drives deforestation or forest degradation. In practice, the law prohibits placing specific high-risk commodities on the EU market (or exporting them) unless they are verified \"deforestation-free\" and produced in accordance with local laws. Depending on your role and size, this could include submitting a full due diligence statement, completing a simplified declaration, or keeping records that prove compliance and origin. You must be able to show that your products meet EUDR standards and that supporting information is available if requested by authorities.

What businesses it applies to

Any company that operates in the supply chains of the covered commodities \u2013 defined as either an 'operator' or a 'trader' under the law \u2013 must follow the EUDR. In essence, if you place and/or make available these commodities or products on the EU market, or export them, you must prove they're not sourced from recently deforested land.

The regulation refers to these seven commodities:

• Cattle (and derived products like beef and leather)
• Cocoa
• Coffee
• palm oil
• Soy
• Rubber
• Wood

Alongside these products, the regulation covers many of their derivatives, such as chocolate, furniture, tires, paper, and palm oil-based ingredients.

For a detailed breakdown of all covered commodities and their derivatives, check our sector-by-sector overview.

Do you count as an SME? - Roles and definitions

SME definition under the EUDR

The term SME covers a range of company sizes. The EU defines a medium, small or micro-sized enterprise based on employee count and financial thresholds.

• Medium enterprise: Fewer than 250 employees and \u2264 \u20ac50 million turnover (or \u2264 \u20ac25 million balance sheet)

• Small enterprise*: Fewer than 50 employees and \u2264 \u20ac10 million turnover (or \u2264 \u20ac5 million balance sheet)

• Micro enterprise: Fewer than 10 employees and \u2264 \u20ac900,000 annual turnover (or \u2264 \u20ac450,000 balance sheet total)

*Net turnover: \u2264 EUR 10,000,000 (standard)\u2264 EUR 15,000,000 (maximum allowed by Member States)

*Balance sheet total: \u2264 EUR 5,000,000 (standard)\u2264 EUR 7,500,000 (maximum allowed by Member States)

Small vs. Medium - when do I need to comply?

If your business falls into any of these categories, it's considered an SME for regulatory purposes. Under EUDR, company size determines your compliance deadline.

Medium-sized enterprises are treated the same as large firms in the rollout of EUDR. This means that medium companies must comply with EUDR by 30 December 2026, alongside large companies.

The extended deadline is only applicable to small and micro businesses, who are given slightly longer to prepare for the new regulation. Small and micro businesses have a delayed compliance deadline of 30 June 2027, by which point they must be fully EUDR compliant.

Current status (Regulation 2025/2650):

Under the targeted revision adopted in December 2025, small and micro enterprises handling non-timber products now have until 30 June 2027 to comply. SMEs that qualify as primary producers in low-risk countries can submit a one-time simplified declaration instead of full due diligence. However, SMEs acting as importers or placing goods on the EU market for the first time are still treated as operators and must carry out full due diligence.

For an overview of the Parliament's amendments to roles and responsibilities, refer to this breakdown.

What SMEs need to do under EUDR

To comply with the EUDR, SMEs must follow certain simplified procedures in order to prove that no deforestation activities have taken place. The streamlining of EUDR compliance for SMEs include a deferred entry in application, fewer obligations for downstream SME operators, no annual reporting obligations and the opportunity to mandate an authorised representative.

Current status (Regulation 2025/2650):

In December 2025, the targeted revision of the EUDR was formally adopted as Regulation (EU) 2025/2650. The revision pushed the deadline for small and micro operators (for non-timber products) to 30 June 2027, confirmed that simplified declarations only need to be updated if major changes occur, allowed postal addresses to be used in place of GPS coordinates for small/micro primary operators, and removed redundant DDS pass-on duties for traders. These changes are now legally binding.

Fewer obligations for downstream SME operators

As an operator (placing a product on the market) under EUDR you are required to perform due diligence. This includes collecting data, assessing and mitigating risk, and submitting a due diligence statement for that product. The extensiveness of due diligence depends on the risk benchmark of the source country, with those sourcing from low-risk countries exempt from conducting risk mitigations and assessments. All operators, regardless of size, have a responsibility to ensure the commodity is deforestation-free and legal. For a full understanding of an operator's responsibilities under EUDR, check out our step-by-step guide.

However, a helpful allowance has been made for SMEs. If an SME's product has already undergone EUDR due diligence or is accompanied by a declaration identifier, SME operators can skip duplicating the due diligence work, and simply record the existing DDS reference number. For example, if a coffee roaster imports coffee directly from a farm in Guatemala, they file a DDS for that coffee. If they also buy cocoa from an EU supplier, and the cocoa supplier has already undergone EUDR due diligence, the coffee roaster wouldn't be required to redo it - just reference the cocoa supplier's DDS or declaration identifier.

Practically, this means that only SMEs who are the first to place a product on the EU market (or export it) are required to exercise due diligence and submit a DDS. SME operators that are first in the supply chain are required to perform the full due diligence process - there are no shortcuts. However, if DD has already been completed, SME operators can skip DD requirements, and pass on the reference number of a previous DDS.

Update (Regulation 2025/2650):

Under the targeted revision adopted in December 2025, small and micro primary operators in low-risk countries can now submit a one-time simplified declaration instead of full due diligence, even when placing products on the market for the first time. The declaration only needs to be updated if major changes occur. For a full explanation of what qualifies as a due diligence statement, see our dedicated guide.

Lighter mitigation measures for all SME operators

SME operators also benefit from lighter mitigation measures to ease compliance burdens under EUDR. These provisions are designed to support SMEs in adapting to the regulations, whilst maintaining the integrity of deforestation-free supply chains.

For example, SMEs are exempted from appointing a compliance officer and conducting independent audits. Unlike non-SMEs, who are required to have their internal policies and procedures independently audited, the EUDR regulation provides relief from this administrative and financial burden for SMEs. SME operators are also not subject to the annual reporting obligations of their due diligence system.

Note: The targeted revision (Regulation 2025/2650) confirmed further simplifications for small and micro operators. These are now legally binding. SMEs should prepare based on the updated regulation and the compliance deadlines of 30 December 2026 (medium) or 30 June 2027 (small/micro).

Authorised representatives

Operators that are microenterprises (<10 staff and < \u20ac2 million turnover and/or < \u20ac2 million turnover) or a natural person are allowed to mandate the next operator or trader down the supply chain as an authorised representative. The authorised representative is then able to submit a due diligence statement on behalf of the micro-operator, provided the authorised representative is not a natural person or micro enterprise themselves. Whilst this releases microenterprises and natural persons from being burdened with due diligence obligations, those mandating remain responsible for the overall compliance of the product with EUDR.

Fewer obligations for SME traders

If you are a trader under the EUDR, your business only deals in products that have already been placed on the EU market by someone else. As an SME trader, you have significantly simplified responsibilities, and act to pass along information, rather than collect it. SME traders are not required to exercise due diligence or submit a due diligence statement. They are only obliged to collect relevant information regarding their suppliers (name; address; DDS reference etc), and hold the information for a minimum of 5 years. SME traders are also subject to lighter checks by the competent authorities - and they are excluded from mandatory quotas for checks that competent authorities must perform.

Note: Under Regulation (EU) 2025/2650, the requirement for SME traders to pass on DDS reference numbers has been removed. Only the first downstream operator retains that obligation. For more on how compliance and enforcement work in practice, see our detailed guide.

Step-by-step compliance roadmap for SME operators

Step 1: Confirm role as an operator

• An operator is a natural or legal person who places relevant products on the market (inc. via an import) or exports them in the course of commercial activity
• A single business can have some activities as an operator and others as a trader - consider each supply chain
• Check if you fall in the category of small and micro primary operator (Added October 2025)

Step 2: Identify in-scope commodities and map to CN codes

• List all products you deal in and determine which fall under EUDR
• Remember, it's not just raw materials - check processed materials (e.g., chocolate from cocoa), your ingredients and components
• Map each product to the relevant CN code

Step 3: Map your supply chain

• Map the supply chain for each in-scope product, identifying suppliers and the country of origin for each commodity
• The goal is to trace each ingredient back to its farm/ plantation

Step 4: Check if due diligence has been exercised, and there is an existing DDS

• As an SME operator, if a DDS has been submitted upstream, you are not required to exercise DD. But, you should provide competent authorities with the existing DDS reference number upon request
• For products / parts of the product where DD has not been exercised, follow step 5

Step 5: (If no DD exercised) Collect all required data (geolocation, data, information)

• This includes geolocation, production data, product details, evidence of deforestation-free status and legality. For practical tips on collecting data from suppliers, see our supplier engagement guide
• For a full list of requirements, see 'How to comply with the EUDR'

Step 6: (If no DD exercised) Risk assessment and risk mitigation

• If your product comes from a low-risk country, you can skip the risk assessment and mitigation (if no substantiated concern of a risk of deforestation)
• If your product comes from a standard- or high-risk country, you must conduct a risk assessment - evaluating the risk that the commodity is linked to deforestation
• If the risk of deforestation is non-negligible, you must also take mitigation measures (e.g. internal control, reporting) to reduce the risk of deforestation. See our risk assessment guide for a step-by-step approach

Step 7: Upload or reference a due diligence statement

• If an existing DDS statement exists upstream, you must pass on the original suppliers DDS when requested by competent authorities
• If you completed DD, upload your DDS to EU Traces - the EU's centralised information system

For details on how the new country-benchmarking risk levels affect your DDS obligations, see our article.

Step 8: Keep records for 5 years

• The EUDR requires operators to retain all information and documentation for a minimum of 5 years

Disclaimer:

This guide reflects current EUDR obligations under Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650, which entered into force on 26 December 2025. The European Commission is expected to publish additional guidance by 30 April 2026.

{{custom-cta}}

Example: how a small coffee roaster is preparing for EUDR

To illustrate, we will consider a hypothetical coffee roaster (GreenBeanz) based in the EU. GreenBeanz has 25 employees and sources their coffee beans from various origins. Under EUDR they are considered a 'small' enterprise, and have a compliance deadline of 30 June 2027. Here's how they are preparing:

• Mapping supply chains - by listing each coffee product they sell, and identifying whether they are an 'operator' or 'trader' and 'upstream' or 'downstream' for each product
• Collecting geolocation and farm data for products where they are 'downstream SME operators' - using accurate satellite imagery and an EUDR software solution to ensure compliance, keeping data out of spreadsheets
• Collecting due diligence statements - collecting existing DDS from upstream suppliers (and exercising DD where they don't exist)
• Record keeping - maintaining organised and documented records
• Training and process integration - training the team on new procedures
• Continuous monitoring - keeping up to date with EUDR regulations and changing risk benchmarks

In summary, GreenBeanz are taking a proactive approach to be ready for the EUDR compliance deadline: mapping supply chains, identifying responsibilities, and maintaining records. It's a significant effort for a small company, and many choose to rely on software or third-party support to confidently file due diligence statements.

Note:

This example reflects the current EUDR obligations under Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650. The steps described - such as mapping supply chains, collecting geolocation data, and submitting or referencing due diligence statements - remain fully applicable. Small and micro primary operators in low-risk countries may benefit from the simplified declaration route instead of full due diligence.

For a detailed breakdown of what changed under the December 2025 revision, read this deep dive

Common mistakes SMEs make

Even with the best intentions, it's easy for SMEs to get caught out by misconceptions or oversights regarding EUDR. Here are some common mistakes to avoid:

Note: The following examples reflect the EUDR as amended by Regulation (EU) 2025/2650, which entered into force in December 2025. This includes reduced DDS pass-on requirements and simplified declaration options for small and micro primary operators.

• Assuming 'small' means you're exempt: there are no size obligations for the core obligations, SMEs must still comply, with some simplified processes\u200d
• Overlooking 'derived' products in your offerings: EUDR applies to more than just the seven listed commodities. Be sure to check whether you trade in derived products too\u200d
• Skipping the collection of geolocation data when exercising due diligence: SMEs may be tempted to ignore this, or assume the address of the farm is enough. It's a mistake - geolocation is mandatory if you are the first in line to exercise due diligence\u200d
• Not tracking and referencing DDS (for traders): whilst SME traders don't have any heavy due diligence, they are still required to collect and store the evidence of their supplier's due diligence

By being aware of these common mistakes, SMEs can take proactive steps to avoid them. EUDR compliance is absolutely achievable for small and medium businesses - it just requires early planning, attention to detail, and a clear understanding of your role. Use checklists to ensure you're covering all bases, and don't hesitate to seek out authoritative resources or expert advice for any areas of uncertainty.

How software can help

Coolset's EUDR solution helps companies collect the right data, check for deforestation risk, and file Due Diligence Statements without chasing suppliers or working in complex spreadsheets. With Coolset, companies can import product and order data from your ERP, request documents from suppliers, and track everything in one place. The system flags missing or at-risk shipments and generates audit-ready DDS files that follow the mandatory EU TRACES format.

Reach out to our team to see our EUDR module in action. You can also compare EUDR compliance tools to find the right fit for your business.

{{product-tour-injectable}}

FAQ - EUDR for SMEs

1. Does the EUDR apply to small and medium-sized enterprises (SMEs)?

Yes. All SMEs are in scope. Under Regulation (EU) 2025/2650, medium-sized businesses follow the same rules and deadlines as large companies (30 December 2026). Small and micro enterprises have until 30 June 2027. The revision also introduced simplifications for small and micro primary operators, including a one-time simplified declaration option.

2. What is the difference between an SME operator and an SME trader?

SME operators place or export in-scope products for the first time. SME traders buy and sell goods already placed on the market. Operators must conduct due diligence; traders only need to store and pass on traceability data. Update: Under Regulation 2025/2650, downstream SME traders now benefit from reduced DDS obligations - only the first downstream operator must retain and pass on DDS reference numbers.

3. What if the product has already undergone due diligence upstream?

If your supplier already submitted a valid DDS, you don't need to duplicate it. Instead, you must reference that DDS and maintain traceability records. Note: Under Regulation 2025/2650, this is reinforced - operators and traders can reuse existing DDS without new submissions. Only the first downstream operator must store and pass on reference details.

4. What data do SME operators need to collect for EUDR compliance?

SME operators must collect geolocation data, production dates, product and shipment info, supplier and buyer contacts, and legality and deforestation-free evidence. Update (Regulation 2025/2650): Small and micro primary operators in low-risk countries can now submit a one-time simplified declaration instead, with lighter data requirements (e.g. postal address allowed instead of precise geolocation).

5. What are the penalties for non-compliance?

Penalties for EUDR non-compliance can include:

• Blocking of non-compliant products from entering the EU market
• Fines up to 4% of annual EU turnover
• Confiscation of goods and profits
• Temporary bans from public contracts or from placing goods on the market

Even small firms are subject to checks and audits. SMEs are advised to act early to avoid supply disruptions or regulatory action once enforcement begins.