How the EU Deforestation Regulation affects your business

The EU Deforestation Regulation (EUDR, the Regulation) aims to minimise global deforestation and forest degradation (see our earlier blog here). To this end, the EUDR bans relevant commodities and products linked to deforestation or forest degradation from the EU market and imposes binding due diligence obligations on companies that import, export, or trade certain products made from high-risk commodities. The EUDR’s due diligence obligations are far reaching and have caused significant pushback from both Member States and companies which has induced the Commission to delay its date of application from 30 December 2024 to 30 December 2025.

While the EUDR is still subject to political debate, this blogpost outlines the core provisions of the EUDR, including its scope, the due diligence requirements imposed on businesses and its enforcement, in order to assist companies in preparing for compliance.

Products and companies in scope 

The EUDR targets seven key commodities, namely:   

• cattle, 
• cocoa, 
• coffee, 
• oil palm, 
• rubber, 
• soya and 
• wood. 

It applies to certain products that contain or are made from these commodities and are listed by their Harmonised System code (HS code), i.e., the code relevant for classification under customs law, in Annex I to the Regulation. Relevant products include chocolate, coffee, certain industrial fatty alcohols, pneumatic tyres of natural rubber, packaging cases of wood and certain pulp and paper products.

The Regulation also provides for certain explicit exemptions. Packaging material, for example, is only subject to the Regulation when first delivered as a product in its own right (e.g., by the pallet dealer), but exempted when used exclusively as packing material to support, protect or carry another product (cf. FAQ 2.6). Products composed entirely of recycled materials also fall outside the scope. A draft Delegated Act, put forward by the Commission, proposes to clarify that accessory materials, such as user manuals, leaflets, catalogues and marketing materials, are excluded from the scope of the EUDR, as are product and test samples (cf. here).

Companies must fulfil the obligations under the EUDR when they place or make available relevant products on the EU market or export such products from the EU, regardless of the product’s volume or value (i.e., there is no explicit de minimis threshold). Unless products are imported or exported, this generally requires a transfer of ownership or another property right – renting or loaning products is  not subject to the Regulation (cf. FAQ 2.15). Generally, the EUDR applies to both products produced (or commodities harvested) inside the EU as well as products imported from third countries (cf. FAQ 2.4). 

Due diligence obligations

Companies are only allowed to place relevant commodities and products on the EU market if they are (i) deforestation-free; (ii) produced in accordance with the relevant legislation of the country of production; and (iii) covered by a due diligence statement (DDS).

While all companies in scope are subject to certain obligations, the extent of their duties varies according to the company’s role, its size and the country of production of the respective product or commodity. 

Relevant roles: operators and traders

The EUDR categorises companies by two key roles: operators and traders.

• An operator is a natural or legal person that exports a relevant product or makes it available on the EU market for the first time. This may involve importing a relevant product into the EU or producing a relevant product in the EU (upstream operator) or transforming a relevant product into another relevant product with a distinct HS code as listed in Annex I (downstream operator). In the case a non-EU operator places a relevant product on the EU market, the first natural or legal person established in the Union who makes the relevant product available on the EU market is also considered an upstream operator.
• A trader is a natural or legal person that resells or distributes a relevant product that has already been placed on the EU market without transforming it into another relevant product. 

Under the EUDR, upstream operators not qualifying as micro, small or medium-sized enterprises (non-SME), are subject to extensive due diligence obligations which include:

• gathering all necessary data, including the geolocation coordinates of the plots of land where the commodity was produced, 
• analysing the collected information to assess whether there is a risk of non-compliance, 
• adopting adequate measures of risk mitigation, where necessary,
• submitting a DDS to the Information System set up by the European Commission to prove compliance with the EUDR requirements, and
• communicating all relevant information concerning the due diligence of a product, including the DDS reference number, to operators or traders further down the supply chain.

To this end, upstream operators must set up an adequate due diligence system, which includes appointing a compliance officer at management level and an independent audit function, and review such due diligence system at least annually and on an ad hoc basis, where necessary.

Non-SME downstream operators and traders, on the other hand, must also submit a due diligence statement, but are not required to independently collect all relevant information themselves. Instead, they can refer to DDS submitted earlier in the supply chain for product components that have already been subject to due diligence after having ascertained that due diligence was exercised properly upstream. To this end, downstream operators and traders must collect the reference numbers and verification numbers of DDS submitted upstream and verify their validity (cf. FAQ 3.4). Moreover, downstream operators and traders do not have to appoint specific internal functions such as a compliance officer and an auditor.

Given that downstream operators and traders remain responsible for compliance with the EUDR, they may consider implementing additional voluntary due diligence measures, particularly in case of increased risks of non-compliance, such as for products from high-risk countries or due to past irregularities concerning a specific supplier.

All operators must keep a record of their due diligence documentation for five years and publicly report on the due diligence system annually. Yet, reporting on supply chain due diligence under other EU legislation (such as the EU Corporate Sustainability Due Diligence Directive, CSDDD) suffices to fulfil the EUDR reporting obligations.

Size: micro, small and medium-sized enterprises 

To reduce administrative burdens, the EUDR provides additional reliefs for micro, small and medium-sized enterprises (SME). Among other reliefs:

• All SME operators and traders are exempted from both the obligation to appoint specific internal functions such as a compliance officer and an audit function and from the annual public reporting requirement; and
• SME downstream operators and SME traders are also exempted from the obligation to exercise due diligence and to submit a DDS for products that have already undergone due diligence. They must only collect and store for five years certain information regarding the products they make available on the market, including the DDS reference numbers, and provide relevant DDS reference numbers to competent authorities upon request. In contrast to SME traders, SME downstream operators must also communicate all relevant information to operators or traders further down the supply chain.

All SME operators and traders are obliged to immediately inform the competent authorities if they obtain or become aware of new information indicating that a relevant product is at risk of non-compliance with the Regulation.

Country of production: the benchmarking system

Finally, the obligations of operators differ depending on how the Commission has classified the country of production of the respective product in its three-tier benchmarking system (see here).

Where the country of production is classified as low risk with respect to deforestation (e.g., all EU Member States, the United States and China), operators are subject to simplified due diligence obligations: If they collect all relevant information and determine that, considering the complexity of their supply chain, there is no more than a negligible risk of circumvention or mixing with products from other risk categories, they are not required to conduct further due diligence measures unless new information or substantiated concerns arise that indicate a risk of non-compliance. 

In the case of high-risk countries (Belarus, Democratic People's Republic of Korea, Myanmar, and the Russian Federation) or standard risk countries (e.g. Brazil, Mexico, Indonesia, Argentina), operators remain subject to the obligations outlined above.

Note that despite continuing pushes from several Member States, the EU has so far not introduced an additional ‘no risk category’ which would further simplify due diligence requirements, including by removing the obligation to collect detailed geolocation data for products from countries with a negligible deforestation risk. 

Enforcement and sanctions

Compliance with the EUDR will be enforced by competent national authorities which conduct risk-based inspections (ranging from a minimum number of 1 to 9 % of all operators) taking into account factors such as the complexity and length of supply chains, the operator’s or trader’s history of non-compliance, and the risk-level of the country of production. Additionally, customs authorities carry out risk-based controls with respect to the customs declarations for relevant products entering or leaving the EU market to ensure that a DDS is provided. This will be particularly significant in practice, given that customs controls are typically enforced in a rigorous manner.

In case of non-compliance, authorities may require the operator or trader to take corrective action including rectifying formal breaches, preventing non-compliant products from being placed on the EU market or exported, and immediately withdrawing or recalling affected products. In addition, the EUDR provides for penalties that include the imposition of fines up to a maximum of at least 4 % of the company’s EU-wide turnover from the previous financial year, confiscation of relevant products or revenues, as well as temporary exclusion from public procurement processes and/or access to public funding.

Key takeaways

To ensure compliance with the EUDR by 30 December 2025, companies should take the following into account:

• Stocktaking: Identify all product flows that may fall within the scope of the EUDR. This involves mapping the current purchasing and sales practices and conducting a detailed HS code analysis to identify relevant commodities or products that are in scope.
• Analysis: Determine the precise obligations of the respective entities involved in these product flows. This requires categorising each entity (e.g., within a group of companies) as either trader or operator, SME or non-SME, and taking into account the risk classification of the country of production. Given that several legal uncertainties remain unresolved despite the Commission’s efforts of providing Guidance and FAQs, companies will also have to make informed, risk-based decisions as to how to handle these uncertainties.
• Develop and implement a compliance strategy: Consider available options for EUDR implementation and leverage existing supply chain due diligence structures. For groups of companies, for example, the compliance system can either be set up at each individual entity level or group-wide, i.e. authorising one entity to submit DDS on behalf of all other entities. The EUDR compliance system can also be integrated in the supply chain due diligence systems already established, for example, under the German Supply Chain Duty of Care Act (see our recent blogpost here) or in preparation for compliance with the forthcoming CSDDD. 
• IT infrastructure: Consider establishing IT infrastructure enabling automation of supply chain tracking. Automated compliance analysis, including using AI functions, will be essential for a cost-efficient implementation of the administrative requirements under the EUDR (e.g., review of legal documents proving the legality of production) and for ensuring interoperability with the Information System established by the European Commission.