The European Union Deforestation Regulation (EUDR), Regulation (EU) 2023/1115, entered into force on 29 June 2023. Its obligations start to apply on 30 December 2026. There are two exceptions:

• 30 June 2027 for micro and small operators that were established by 31 December 2024.

• 30 December 2027 for products newly added to the scope in 2026, which are covered below.

The EUDR was introduced to tackle deforestation and forest degradation linked to the production and consumption of specific commodities in the EU. Its application has been postponed twice. Regulation (EU) 2024/3234 delayed it first. Regulation (EU) 2025/2650 delayed it again and also simplified several obligations. Many organisations are now in the final stage of their preparations. This article explains what the EUDR is, who must comply, what is required of each type of company and how the regulation is enforced.

What is the EUDR?

The EUDR aims to stop the EU market from contributing to deforestation and forest degradation, both within the EU and globally. It does this by setting rules for specific commodities and the products made from them that are sold in or exported from the EU. The main driver of deforestation is the expansion of agricultural land used to produce these commodities.

The EUDR covers seven commodities: cattle, cocoa, coffee, oil palm, rubber, soya and wood. It also covers derived products listed in Annex I of the regulation, such as chocolate, furniture and new tyres.

Relevant products may only be placed on the EU market or exported if they meet three conditions:

1. Deforestation-free. They were not produced on land deforested after 31 December 2020.

2. Legally produced. They were produced in line with the relevant laws of the country of production.

3. Covered by a due diligence statement (DDS) or, where allowed, a simplified declaration.

Recent changes to the product scope

Delegated Regulation (EU) 2026/2102 entered into force on 18 September 2026 and adjusted which products are in scope.

Added (applies from 30 December 2027):

• Soluble coffee

• Palm oil oleochemical derivatives

• Frozen cattle tongues

Removed:

• Cattle hides, skins and leather

• Conveyor belts and other vulcanised rubber articles

• Soya for sowing

• Aircraft and vehicle seats

Printed products had already been removed by Regulation (EU) 2025/2650. Several things are explicitly out of scope:

• Samples and test products

• Waste and used or second-hand products

• Packaging used only to support, protect or carry another product

Please note: for some products the scope was narrowed rather than removed. For example, retreaded and used tyres are now only in scope as new tyre treads.

Who must comply with the EUDR?

The EUDR distinguishes between products that are placed on the market and products that are made available on the market:

• Placed on the market means a product is supplied on the EU market for the first time.

• Made available on the market means any later supply of a product already on the EU market, for distribution, consumption or use, in the course of a commercial activity.

Based on this, the regulation defines three roles:

• Operator: a company that places relevant products on the EU market for the first time or exports them, such as an importer or an EU producer.

• Downstream operator: a company that places on the market or exports products made from relevant products already covered by a DDS. An example is a processor turning imported cocoa into chocolate.

• Trader: a company that makes relevant products already on the EU market available, such as a wholesaler or retailer.

Obligations per role

Operators carry out due diligence, including collecting geolocation data for the plots of land where the commodities were produced. Before placing products on the market or exporting them, they submit a DDS in TRACES. They keep each DDS for five years and pass the DDS reference numbers on to their customers. If all products come from low-risk countries, operators can apply simplified due diligence.

Micro and small primary operators can submit a one-time simplified declaration instead of a DDS. This applies when they place their own produce on the market and that produce comes from a low-risk country. They receive a declaration identifier and may provide a postal address instead of geolocation data.

Downstream operators and traders have the same obligations, regardless of company size:

• Keep the name, address, email address and website of their suppliers and customers for at least five years.

• Provide this information to authorities on request.

• Do not place products on the market without this information.

• Report any concerns about non-compliance to the authorities and to their customers.

The first downstream operator or trader, meaning the company that buys directly from an operator, must also collect and keep the DDS reference numbers or declaration identifiers for the products it buys. This applies to SMEs too. Companies further down the chain do not need to collect these numbers.

Non-SME downstream operators and traders must also register in TRACES. When they receive substantiated concerns, they must verify that due diligence was carried out.

What is TRACES?

TRACES is the European Commission's online information system for the EUDR, which went live on 4 December 2024.

• Operators submit their DDS in TRACES and receive a reference number for each statement.

• Companies further down the supply chain use that reference number to prove that the products they buy are covered.

• Competent authorities use the information in TRACES to plan and carry out their checks.

What does due diligence involve?

Due diligence is an obligation for operators. It has three steps.

1. Information gathering. Operators collect information on the product, quantity, suppliers, customers and country of production, plus evidence that production was legal and deforestation-free. This includes geolocation coordinates for every plot of land where the commodity was produced.

2. Risk assessment. Operators use this information to assess the risk that a product is non-compliant. The criteria include:

• The risk level of the country of production

• The presence of forests

• The presence of Indigenous peoples and whether they were consulted

• Concerns about corruption

• The prevalence of deforestation

The risk assessment must be documented, and the due diligence system must be reviewed at least once a year. Records must be available to competent authorities on request.

3. Risk mitigation. If the risk is more than negligible, operators must take mitigation measures before placing the product on the market. Operators sourcing only from low-risk countries can apply simplified due diligence. They don't need to carry out risk assessment and mitigation unless they receive relevant information that points to a risk of non-compliance.

How is the EUDR enforced?

The European Commission classifies countries as low, standard or high risk. Belarus, Myanmar, North Korea and Russia are currently classified as high risk. Competent authorities in each Member State must meet minimum annual check rates that depend on this classification:

• High risk: at least 9% of relevant companies and 9% of the quantity of products

• Standard risk: at least 3%

• Low risk: at least 1%

Penalties are set by each Member State, but they must be effective and dissuasive. The maximum fine for companies must be at least 4% of their total annual EU-wide turnover. Other possible penalties include:

• Confiscation of products and revenues

• Exclusion from public procurement and public funding for up to 12 months

• A temporary ban on placing products on the market

• Loss of the right to use simplified due diligence

Is the EUDR connected to other sustainability legislation?

Operators that are also covered by other EU laws regulating value chain due diligence can meet their EUDR reporting obligation by including the required information when they report under those laws.

The Corporate Sustainability Due Diligence Directive (CSDDD) sets a broader due diligence framework covering both social and environmental impacts. Companies subject to both the CSDDD and the EUDR will see overlap between the two, and aligning their processes makes both easier to manage.

How Simvia supports first downstream operators

If you buy relevant products directly from an operator, you are a First Downstream Operator. You don't submit due diligence statements yourself. You do need to collect the DDS reference numbers from your suppliers, link them to the right products and keep them for at least five years. You also need to show them to authorities and customers on request. When your ERP system can't handle this reliably, it turns into manual admin and creates a risk of errors.

Simvia gives First Downstream Operators one place to receive, link and store DDS reference numbers:

• Tag the products and suppliers that fall under the EUDR.

• Map the supply chain of each product.

• Request DDS information from suppliers based on rules you set.

• Receive DDS documents and reference numbers in a simple way from suppliers. Simvia extracts the key details from shared documents using AI.

• Keep audit-ready records for five years or more, with an Excel export so you can respond quickly to authorities and retailers.

Want to know how Simvia can help you manage your DDS reference numbers? Contact us to learn more.