EUDR: What Companies Need to Do Before the Deadline

The EU Deforestation Regulation has experienced an uncertain journey. Since it was first adopted in 2023, the EUDR was then postponed twice, amended at the end of 2025, and refined again through a simplification package in May 2026. For many companies, the repeated changes made it tempting to wait and see.

But now the EUDR applies to large and medium-sized operators and traders from 30 December 2026, and the Commission has confirmed that the core text will not be reopened and there will be no third extension.

This guide sets out what the regulation requires in its final form, how obligations differ depending on a company’s role, and the practical steps to take in the weeks that remain.

What the EUDR aims to do

The EUDR prohibits placing products on the EU market or exporting them from the EU unless they are:

• deforestation-free, meaning they were not produced on land deforested or degraded after 31 December 2020;
• legally produced, in line with the relevant laws of the country of production; and
• covered by a due diligence statement, where one is required.

The regulation covers seven commodities: cattle, cocoa, coffee, oil palm, rubber, soya and wood and many products made from them, such as beef, chocolate, furniture, tyres and paper. The list of covered products is set out in Annex I of the regulation.

What has changed since 2023

The rules companies must now follow differ in important ways from the original text. The main changes came from the targeted revision adopted in December 2025, Regulation (EU) 2025/2650, and from the May 2026 simplification package.

New application dates

• Large and medium-sized companies: from 30 December 2026.
• Micro and small operators: from 30 June 2027, except in the timber sector, where micro and small operators already covered by the previous EU Timber Regulation must comply from 30 December 2026.
• Timber products already on the market: certain timber products produced before 29 June 2023 and placed on the market before 30 December 2026 remain under the EU Timber Regulation until 31 December 2029.

Lighter obligations further down the supply chain

The most significant change concerns companies that do not place a product on the EU market for the first time. The revision introduced a new role, the downstream operator, and simplified the obligations of traders.

A due diligence statement is now required only when a product is first placed on the EU market or exported. Companies further down the chain no longer submit their own statements. Instead, they must collect and keep the reference numbers of the statements their suppliers have filed and act if they have substantiated concerns.

A simplified route for the smallest primary producers

Micro and small primary operators in low-risk countries — which include all EU Member States — can submit a one-time simplified declaration instead of repeated due diligence statements. They may also provide a postal address for their plots of land instead of geolocation coordinates. This is particularly relevant for small farmers and forest owners across Europe.

Adjusted product scope

A delegated act adopted this year, Delegated Regulation (EU) 2026/2102, refined the list of covered products. Retreaded and used tyres, cattle hides and certain seats are no longer in scope, while soluble coffee and some palm oil derivatives will be added from 30 December 2027. Printed products such as books and newspapers were removed from scope in the 2025 revision.

What each role must do

Obligations now depend on where a company sits in the supply chain. In summary:

Operators — companies that place a relevant product on the EU market for the first time, or export it — carry the main responsibility. They must:

• run a due diligence system covering information collection, risk assessment and risk mitigation, reviewed at least once a year;
• Submit a due diligence statement through the EU Information System before placing products on the market
• keep records for five years; and
• If they are not an SME, appoint a compliance officer and report publicly each year on their due diligence system.

Downstream operators and traders — companies that buy, process, or sell products already on the EU market — must:

• Collect information on their suppliers and customers, including the due diligence statement reference numbers they receive;
• Keep that information for at least five years
• register in the Information System if they are not an SME; and
• inform authorities and customers promptly if they become aware of a substantiated concern.

One point is easy to overlook: if the first operator is established outside the EU, the first EU-based company that makes the product available on the market is also treated as an operator. Importers and distributors buying from non-EU suppliers should assess their position carefully.

How risk levels affect due diligence

Countries are classified as low, standard or high risk under the Commission’s benchmarking system. The classification matters in two ways.

First, operators sourcing exclusively from low-risk countries can apply simplified due diligence. They still need to collect the required information, but they do not need to carry out a full risk assessment unless substantiated concerns arise.

Second, the classification affects how often authorities check compliance. Products sourced from high-risk countries face enhanced scrutiny. Companies should monitor the benchmarking list, as it can be updated.

Enforcement and penalties

The EUDR is enforced by national competent authorities in each member state. Penalties are significant. Member States must allow maximum fines of at least 4% of a company’s total annual EU-wide turnover, with higher fines for repeat infringements. Other penalties include confiscation of products and revenues, temporary exclusion from public procurement and funding, and temporary bans on placing products on the market. Authorities can also suspend products at the border for an initial period of three working days, or 72 hours for perishable goods.

Because the EUDR is a regulation, its requirements apply directly across all Member States. However, each Member State sets penalty levels, enforcement practices and designates the relevant authorities, so companies operating in several EU countries should check the arrangements in each.

How to prepare: seven steps before the end of 2026

With only weeks remaining, the priorities are practical:

1. Map your products against Annex I. Identify every product you handle that contains or is made from the seven commodities, using the customs codes listed in the regulation and the updated scope.
2. Confirm your role for each product. Decide whether you act as an operator, downstream operator or trader — the answer can differ by product and by supplier.
3. Set up or update your due diligence system. Write down your procedures for collecting information, assessing risk and mitigating it.
4. Register in the Information System. Operators, and downstream operators and traders that are not SMEs, need an account. Each legal entity needs its own.
5. Collect supplier data now. Request geolocation data for production plots, evidence of legal production, and, where relevant, reference numbers for due diligence statements. Mass balance supply chains are not permitted, so in-scope goods must be kept separate.
6. Update contracts. Build EUDR data and cooperation requirements into supplier and customer agreements.
7. Train the teams involved. Procurement, compliance, logistics and sustainability teams all have a role, and they need a shared understanding of the rules.

How the EUDR fits the wider picture

The EUDR is part of a broader shift in EU sustainability policy from disclosure to supply chain accountability. It connects with other frameworks companies already work with:

• CSRD and the simplified ESRS. Deforestation risk is relevant to biodiversity (E4) and value chain disclosures. Data collected for the EUDR can support these, as we explained in our guide to the simplified ESRS.
• Green claims under EmpCo. Claims such as “deforestation-free” or “sustainably sourced” made to consumers must be specific and verifiable, as covered in our article on EmpCo 2026.
• Supplier relationships. Smaller suppliers in high-risk regions may need support to provide the data required, which makes engagement and capacity building part of compliance.

Conclusion

The EUDR has changed considerably since 2023, and the final rules are lighter for many companies further down the supply chain. But the core obligation remains: companies that first place relevant products on the EU market must be able to show where those commodities came from and that they did not contribute to deforestation. That requires more than a compliance system. It requires people who understand supply chain due diligence, traceability and supplier engagement. EcoSkills’certified Sustainable Supply Chain Management course helps professionals build that knowledge so they can meet the EUDR’s requirements with confidence.