What the EUDR is and why it matters
Regulation (EU) 2023/1115 of the European Parliament and of the Council on the making available on the Union market and the export from the Union of certain commodities and products associated with deforestation and forest degradation was published in the Official Journal on 9 June 2023. It entered into force on 29 June 2023.
The regulation addresses forest loss linked to agricultural expansion. Its core mechanism is a requirement that specific commodities and derived products placed on the EU market, or exported from the EU, were produced on land that was not subject to deforestation or forest degradation after 31 December 2020. That cut-off date is fixed in the regulation and applies regardless of when you are reading this.
The EUDR replaces the EU Timber Regulation (Regulation (EU) No 995/2010) and extends an analogous logic to six additional commodity groups beyond timber.
Who is covered: operators and traders
The regulation distinguishes between operators and traders. An operator is a natural or legal person who, in the course of a commercial activity, places relevant products on the EU market or exports them. For importers, this means any company that imports EUDR-covered goods from outside the EU and places them on the EU market. The obligation falls on the operator at the point of first placing on the market.
A trader is a person in the supply chain who makes relevant products available on the market, downstream of the operator. Traders who are not SMEs must carry out the same due diligence as operators. SME traders benefit from a simplified obligation: they do not carry out full due diligence themselves but must collect and transmit the reference numbers of the Due Diligence Statements submitted by the operators upstream.
The distinction matters because it determines which obligation applies to your company depending on your position in the supply chain.
Products in scope
The EUDR covers seven commodity groups and products derived from them. The specific CN codes in scope are listed in Annex I of the regulation. The commodity groups are:
| Commodity | Examples of derived products |
|---|---|
| Cattle | Beef, leather, hides, gelatine |
| Cocoa | Cocoa paste, cocoa butter, chocolate |
| Coffee | Roasted coffee, coffee extracts, instant coffee |
| Palm oil | Palm oil fractions, palm kernel oil, oleochemicals |
| Soya | Soya beans, soya bean meal, soya oil |
| Wood | Timber, wood pulp, paper, printed products, furniture, charcoal |
| Rubber | Natural rubber, tyres, rubber gloves, rubber tubes |
The scope of derived products is broad, particularly for wood and cattle. A furniture importer, a leather goods importer, or a chocolate manufacturer placing goods on the EU market all fall within scope if the underlying material traces back to one of the seven commodity groups. The first step for any importer is to map their product portfolio against Annex I by CN code.
The due diligence system
The due diligence system has three sequential components. All three must be completed before a Due Diligence Statement can be submitted.
Step 1: Information collection
The operator must collect specific information for each product placed on the market. This includes a description of the product (including CN code and quantity), the country of production, geolocation coordinates of all plots of land where the relevant commodity was produced, confirmation that the land was not subject to deforestation or forest degradation after 31 December 2020, and any other information the operator considers relevant to the risk assessment.
The geolocation requirement is the most demanding element for most supply chains. For agricultural commodities, the regulation requires coordinates for each individual plot of land. For wood products, coordinates for the areas where the timber was harvested. Suppliers in producing countries must be able to provide this data. If they cannot, the operator cannot complete the information collection step.
Step 2: Risk assessment
Based on the collected information, the operator must assess whether there is a non-negligible risk that the products are non-compliant. The risk assessment takes into account: the country and region of production and its deforestation risk profile (based on the Commission's country benchmarking), the product type and supply chain complexity, the prevalence of illegal activity in the country of production, and the operator's own track record with the specific supplier.
Operators sourcing from countries classified as low risk by the Commission's benchmarking system face simplified due diligence: they still must submit a DDS, but the information requirements and risk assessment are proportionally reduced. For the benchmarking system, see our article on EUDR country risk classifications.
Step 3: Risk mitigation
If the risk assessment indicates a non-negligible risk, the operator must take mitigation measures before placing the product on the market. Mitigation measures include requesting additional information, documentation, or independent verification from the supplier. If mitigation cannot reduce the risk to negligible, the operator must not place the product on the market. A DDS can only be submitted when the operator concludes that the risk is negligible.
The regulation does not define a precise threshold for negligible risk. The regulation clarifies that negligible risk does not mean zero risk, but that the operator has taken all reasonable steps to verify compliance and that the remaining uncertainty is marginal. The adequacy of the operator's due diligence is what authorities will assess, not whether deforestation was actually proven absent.
The Due Diligence Statement
A Due Diligence Statement is submitted via the EUDR Information System operated by the European Commission. The DDS is submitted before placing the product on the market or exporting it. It contains the information gathered in Step 1 plus the operator's conclusion that the risk is negligible. A reference number is generated for each DDS. This reference number must be included in customs declarations and must be passed to downstream traders.
The DDS is not a declaration of conformity. It is the operator's documented conclusion based on completed due diligence. Authorities can audit the underlying due diligence file at any time, and the operator must retain all supporting documentation for five years. For the mechanics of submitting a DDS, see our article on how to submit an EUDR Due Diligence Statement.
Country benchmarking and risk tiers
The Commission classifies all countries (and sub-national regions where relevant) into three risk tiers based on their deforestation and forest degradation risk profile: low risk, standard risk, and high risk. The classification is published and updated periodically.
Operators sourcing from low-risk countries benefit from simplified due diligence: a reduced information requirement and no mandatory risk assessment. Operators sourcing from high-risk countries face enhanced scrutiny. The benchmarking system is the principal tool the regulation uses to focus compliance burden on the highest-risk supply chains. Authorities conduct more frequent checks on operators placing products from high-risk countries on the market.
Penalties for non-compliance
Article 25 of the regulation requires member states to set penalties that are effective, proportionate, and dissuasive. The minimum penalty levels are set in the regulation itself. A fine of at least 4% of the operator's total annual turnover in the EU in the year preceding the infringement applies for the most serious violations. Other penalties include confiscation of the non-compliant products and any revenue derived from them, temporary exclusion from public procurement procedures, and prohibition on placing the relevant commodities on the EU market.
For a detailed breakdown of penalty levels and how they are calculated, see our article on EUDR penalties and what non-compliance actually costs.
Supply chain implications for importers
The EUDR creates a documentary obligation that runs upstream through the entire supply chain. An importer cannot comply by simply reviewing a supplier certificate. The geolocation requirement means working directly with producers or having a supply chain management system that captures plot-level data. For complex, multi-tier supply chains involving traders, aggregators, and processors in producing countries, building the data architecture for EUDR compliance is a substantial project.
Importers who trade in multiple EUDR-covered commodity groups need to build the due diligence system once and apply it across all relevant supply chains. A single system covering information collection, risk assessment, risk mitigation documentation, and DDS submission is more sustainable than commodity-by-commodity processes. For traceability data requirements in detail, see our article on EUDR traceability requirements.