EUDR Regulations: Requirements and How to Comply

The EU Deforestation Regulation (EUDR) bars seven commodities, and listed products made from them, from the EU market and from export unless they are deforestation-free, legally produced and covered by a due diligence statement. It entered into force on June 29, 2023. It applies from December 30, 2026, and from June 30, 2027 for individuals and micro and small companies established by December 31, 2024. The Commission’s May 2026 review proposed no changes to the regulation.

This guide covers the EUDR regulations in full: scope, roles, deadlines, due diligence, country risk, the steps to comply and penalties.

EUDR Regulations: Legal Framework

The EUDR is Regulation (EU) 2023/1115. It replaces the EU Timber Regulation (Regulation (EU) No 995/2010), which is repealed from December 30, 2026. The Timber Regulation still applies until December 31, 2029 to timber produced before June 29, 2023 and placed on the market from December 30, 2026.

A covered product may be placed on the EU market or exported only if it meets three conditions:

• Deforestation-free. The commodity was produced on land not deforested after December 31, 2020. For wood, the harvest must also not have caused forest degradation after that date.
• Legally produced. The commodity was produced under the laws of the country of production, including land use rights, environmental protection, labor rights, human rights and tax rules.
• Covered by a due diligence statement. The operator files the statement in the EU Information System before the product is placed on the market or exported. Micro and small primary operators file a one-time simplified declaration.

Commodities and Products in Scope

The EUDR covers seven commodities. Within each, it covers only the products listed by customs (HS) code in its Annex I.

• Cattle: live cattle, beef and veal, edible offal and prepared beef products. Hides, skins and leather were removed on September 18, 2026. Frozen cattle tongues are added from December 30, 2027.
• Cocoa: cocoa beans, shells, paste, butter, powder and chocolate.
• Coffee: green and roasted coffee, coffee husks and skins, and coffee substitutes containing coffee. Instant coffee and coffee extracts are added from December 30, 2027.
• Oil palm: palm nuts and kernels, palm oil and its fractions, palm kernel oil, palm kernel cake, and listed derivatives such as glycerol and certain fatty acids. More derivatives, including palm-based soaps, are added from December 30, 2027.
• Rubber: natural rubber, latex, new tires, inner tubes, rubber gloves and some other rubber goods. Retreaded tires, rubber belts and other articles of vulcanized rubber were removed on September 18, 2026.
• Soya: soybeans, soy flour and meal, soybean oil and soybean cake. Soybeans for sowing were removed on September 18, 2026.
• Wood: timber, fuel wood, charcoal, wood products, pulp, paper and wooden furniture. Printed books and newspapers were removed in December 2025. Aircraft and car seats were removed in September 2026.

A product is covered only if its HS code is on the Annex I list. A product that contains a covered commodity but is not listed is out of scope. Examples are leather handbags, compound animal feed, biodiesel and cosmetics. Samples and many used, second-hand and waste items are also excluded.

The chart below shows each commodity’s share of commodity-driven deforestation from 2001 to 2022.

Who Must Comply

The EUDR sets duties for four roles.

• Operators. Companies that place a covered product on the EU market for the first time or export it. Operators of any size carry out due diligence and file a due diligence statement before the product is placed or exported.
• Micro and small primary operators. Individuals and micro and small companies established in a low-risk country that place or export products they grew, harvested or raised themselves. They file a one-time simplified declaration and may give a postal address in place of geolocation coordinates.
• Downstream operators. Companies that place on the market or export products made from inputs that are all covered by a due diligence statement or simplified declaration. They do not carry out due diligence or file statements.
• Traders. Companies that buy and sell covered products already on the EU market. They do not carry out due diligence or file statements.

Downstream operators and traders keep the names, postal addresses and email addresses of their suppliers and customers for at least five years. The first company after the operator also keeps the statement reference numbers. Large (non-SME) downstream operators and traders register in the EU Information System. All of them must tell the authorities if they learn that a product may not comply.

EUDR Deadlines

Date	What applies
December 30, 2024	Original application date in Regulation (EU) 2023/1115 (June 30, 2025 for micro and small companies).
December 30, 2025	First 12-month delay, Regulation (EU) 2024/3234 (June 30, 2026 for micro and small companies).
December 30, 2026	Current application date for all companies not listed below, set by Regulation (EU) 2025/2650. The EU Timber Regulation is repealed on the same date.
June 30, 2027	Application date for individuals and micro and small companies established as such by December 31, 2024. Timber products already covered by the EU Timber Regulation stay on December 30, 2026.
December 30, 2027	Products added by Delegated Regulation (EU) 2026/2102 come into scope: frozen cattle tongues, instant coffee and more palm oil derivatives.
June 30, 2030	Deadline for the Commission’s next general review of the regulation.

Medium-sized companies are on the December 30, 2026 date.

Due Diligence Requirements

Operators complete due diligence before placing a covered product on the EU market or exporting it. It has three steps, followed by the due diligence statement.

Information Collection

For each product, the operator collects and keeps for five years:

• a description and trade name of the product, with the species name for wood
• the quantity
• the country of production
• the geolocation of every plot where the commodity was produced, and the date or time range of production
• the name, postal address and email address of the supplier
• the name, postal address and email address of the customer
• adequately conclusive and verifiable information that the product is deforestation-free
• adequately conclusive and verifiable information that it was legally produced

Geolocation Rules

Each plot is given as latitude and longitude with at least six decimal digits. A plot of up to 4 hectares needs one point. A plot of more than 4 hectares needs a polygon that traces its boundary. For cattle, the operator gives the location of every establishment where the animals were kept, and no polygon is required. Any deforestation on a plot after December 31, 2020 disqualifies all products from that plot. Micro and small primary operators may give a postal address.

Risk Assessment

The operator checks the collected information against the criteria in the regulation. These include the country’s risk tier, the presence of forests and indigenous peoples, deforestation in the area, corruption and law enforcement, supply chain complexity, and the risk of mixing with products of unknown origin. A product may be placed on the market only if the risk is none or negligible. The operator documents the assessment and reviews it at least once a year.

Risk Mitigation

If the risk is more than negligible, the operator must reduce it to negligible before placing the product. Measures include asking for more information or documents, independent surveys or audits, and support for suppliers such as smallholders. Large (non-SME) operators must also appoint a compliance officer at management level and have an independent audit function.

Due Diligence Statement

The operator files the statement in the EU Information System before placing or exporting the product. By filing it, the operator takes responsibility for the product’s compliance. The system issues a reference number, which goes to customs with the import or export declaration. Commission guidance allows one statement to cover several shipments, including annual submission. Operators keep each statement for five years.

Country Risk Classification

The Commission classifies countries as low, standard or high risk. Its first list, Implementing Regulation (EU) 2025/1093 of May 22, 2025, is the only list in force.

• Low risk: 140 countries, including all EU member states, Ghana, Vietnam, China, India, the United States and the United Kingdom.
• Standard risk: every country not listed as low or high risk, including Brazil, Indonesia, Malaysia, Côte d’Ivoire and Colombia.
• High risk: Belarus, Myanmar, North Korea and Russia.

The tier changes two things.

• Check rates. Each year, authorities must check at least 1% of operators sourcing from low-risk countries, 3% from standard-risk countries and 9% from high-risk countries. The same rates apply to large downstream operators and traders. For high-risk origins, authorities must also check 9% of the quantity of each product.
• Simplified due diligence. If every input comes from low-risk countries and there is no risk of mixing with other origins, the operator still collects the information and skips risk assessment and risk mitigation. If it learns of any risk, full due diligence applies again.

Standard-risk and high-risk sourcing follow the same full due diligence process. The regulation adds no extra step for operators sourcing from high-risk countries.

How to Comply with the EUDR

1. Check scope. Match each product’s HS code against Annex I as amended in 2026.
2. Confirm your role and size. Each role has different duties, and size sets your application date.
3. Collect geolocation and trade data. Get the geolocation of every plot, or every establishment for cattle, the production dates, and supplier and customer details. A supply chain traceability map down to the plot is the starting point.
4. Collect evidence. Gather adequately conclusive and verifiable information that each plot was not deforested after December 31, 2020 and that production was legal. The regulation does not prescribe a method.
5. Assess risk. Check the information against the regulation’s criteria, starting with each origin’s country tier. Use simplified due diligence only if every input comes from low-risk countries with no mixing.
6. Mitigate risk. Reduce any non-negligible risk before placing the product. If the risk stays above negligible, do not place the product.
7. File the statement. Register in the EU Information System, file the statement before placing or export, and give the reference number to customs.
8. Keep records and review. Keep all due diligence records for five years and review your due diligence system at least once a year. Large (non-SME) operators also report publicly each year on their due diligence system.

Downstream operators and traders follow steps 1 and 2. They then keep supplier and customer details for five years, plus the statement reference numbers if their supplier is the operator. Large (non-SME) ones register in the EU Information System.

2025 and 2026 Amendments

Regulation (EU) 2025/2650, adopted December 19, 2025:

• Delayed application by 12 months, to December 30, 2026 and June 30, 2027.
• Created the downstream operator role and removed due diligence and statements for downstream operators and traders.
• Created the micro and small primary operator role, with a one-time simplified declaration and a postal address option.
• Removed printed products, such as books and newspapers, from Annex I, and moved the general review to June 30, 2030.

Delegated Regulation (EU) 2026/2102, adopted July 13, 2026 and in force since September 18, 2026, changed the Annex I product list. It removed leather, retreaded tires, rubber belts and some other products. It adds instant coffee, frozen cattle tongues and more palm oil derivatives from December 30, 2027. Leather is to be reconsidered in the 2030 general review.

COM(2026) 191, published May 4, 2026, is the Commission’s simplification review. It proposed no further changes to the regulation, so the current dates stand. Updated Commission guidance, adopted in all EU languages on July 13, 2026, allows one statement to cover several shipments. The Commission estimates that the changes cut annual compliance costs by about 75%.

Enforcement and Penalties

Each EU member state names competent authorities to enforce the EUDR and sets its own penalties. The penalties must include:

• Fines. For companies, the maximum fine must be at least 4% of total EU-wide annual turnover in the preceding financial year. Fines rise for repeated breaches.
• Confiscation. Authorities confiscate the products and the revenue earned from them.
• Public procurement exclusion. Exclusion from public contracts and public funding for up to 12 months.
• Trading ban. A temporary ban on placing, selling or exporting covered products, for serious or repeated breaches.
• Loss of simplified due diligence. For serious or repeated breaches, a company can lose the right to use simplified due diligence.

Checks are carried out without prior warning unless notice is needed for the check to work. Authorities can order a non-compliant product to be kept off the market, withdrawn or recalled. Anyone, including NGOs, can submit substantiated concerns to the authorities, who must assess them.

Frequently Asked Questions

Preparing for the EUDR Deadline

Start with scope and roles: check each product’s HS code against Annex I and confirm your role and application date. Then collect plot-level geolocation from suppliers well before December 30, 2026. Companies also in scope of the Corporate Sustainability Due Diligence Directive (CSDDD) can compare the two laws in our CSDDD vs EUDR guide.