EUDR Due Diligence: What It Is and What Companies Must Do

EUDR due diligence is the check a company must run before it puts coffee, cocoa, palm oil, soy, rubber, cattle or wood products on the EU market: prove where the commodity was grown, that the land wasn't deforested after 31 December 2020, and that it was produced legally. Large and medium companies must do it from 30 December 2026, and most micro and small companies from 30 June 2027.

The EU Deforestation Regulation, Regulation (EU) 2023/1115, has been delayed twice and rewritten once since it entered into force in June 2023. A lot of the advice still online describes the 2023 version, where every company in the chain filed its own statement. That's no longer how it works. Since the December 2025 amendment, only the company that first places a product on the EU market (or exports it) does the full due diligence. Everyone after it keeps records.

This guide covers what due diligence means under the EUDR, which products and companies it reaches after the 2026 scope changes, what goes into a due diligence statement, and what online sellers shipping into the EU need to change before the end of the year.

What is EUDR due diligence?#

EUDR due diligence is the process an operator follows before placing relevant products on the EU market or exporting them: collect information on where and when the commodity was produced, assess the risk that it is linked to deforestation or illegal production, and reduce that risk to negligible. It ends with a due diligence statement filed in the EU's information system.

The EUDR's core rule sits in Article 3. A relevant product may only be placed on the EU market, made available on it or exported if it is:

• deforestation-free, meaning the commodity was produced on land that was not deforested after the cut-off date of 31 December 2020 (and, for wood, harvested without causing forest degradation after that date);

• produced legally, under the laws of the country of production, which cover land use rights, environmental protection, labour rights, human rights, tax, anti-corruption and trade rules;

• covered by a due diligence statement, or by a simplified declaration for the smallest primary producers.

Due diligence is how a company shows the first two conditions are met. The Commission's guidance, published in the Official Journal on 20 July 2026, describes three linked steps: gather the information Article 9 requires, assess risk under Article 10, and take mitigation measures under Article 11 until the risk is negligible. Only then can the product go on the market.

When does the EUDR apply?#

The EUDR applies from 30 December 2026 for large and medium companies, and from 30 June 2027 for micro and small companies established as such by 31 December 2024. Micro and small companies selling timber products that were covered by the old EU Timber Regulation (EUTR) get no extra time: they also start on 30 December 2026.

The dates come from Regulation (EU) 2025/2650, published in the Official Journal on 23 December 2025, which replaced Article 38 of the EUDR. It followed an earlier one-year delay in Regulation (EU) 2024/3234. The amending law also asked the Commission for a simplification review by 30 April 2026. The review, published on 4 May 2026, says the Commission "does not consider it appropriate to propose further amendments to the basic legal text." A third delay is not on the table.

Company size follows the EU Accounting Directive's limits for micro and small undertakings. The later date only covers companies that were already established as micro or small undertakings by 31 December 2024, so a business set up in 2025 or later starts on 30 December 2026.

Which products does the EUDR cover?#

The EUDR covers seven commodities (cattle, cocoa, coffee, oil palm, rubber, soya and wood) and the products listed in its Annex I by Combined Nomenclature (CN) code. A product is in scope only if its code is on that list and it contains, was fed with or was made using one of the seven commodities.

That makes classification the first step of any EUDR check (our guide to HS codes explains how it works). Chocolate is in scope because heading 1806 is listed, and so is coffee under heading 0901. A wooden chair is in scope; a plastic chair is not. A product made of bamboo or rattan is out, because the 2026 changes say the regulation doesn't apply to bamboo, rattan and other woody materials.

The product list changed on 18 September 2026, when Delegated Regulation (EU) 2026/2102 entered into force the day after its publication. These are the changes most relevant to companies selling consumer goods.

Three exclusions matter for almost every online seller:

• Shipping packaging. Single-use packing material and containers used only to support, protect or carry another product are out of scope, so your cardboard shipping boxes don't need a due diligence statement. Paper bags or gift boxes sold as products in their own right still do.

• Inserts and marketing material. Letters, leaflets and marketing or information material that only accompany another product, or that are handed out free, are excluded from Chapter 48.

• Used goods. Second-hand wooden furniture, frames, kitchenware and used rubber articles are excluded, which takes vintage and resale stores out of most of the regulation.

Samples of negligible value used only to solicit orders, and products sent for testing that are used up or returned, are also excluded.

If you're unsure which CN code your product falls under, classify it first, then check the code against Annex I.

Who has to do EUDR due diligence?#

Only operators do full EUDR due diligence. An operator is the company that places a relevant product on the EU market for the first time, or exports it, in the course of a commercial activity. Downstream operators and traders further along the chain don't repeat the due diligence: they collect, keep and pass on information about who supplied them.

The 2025 amendment drew three roles more sharply:

• Operator. For goods produced outside the EU, this is generally the importer named on the customs declaration for release for free circulation. For goods made in the EU, it is usually whoever first distributes them. Operators carry out due diligence and file the statement.

• Downstream operator. A company that places products on the market that were made using relevant products already covered by a due diligence statement. A furniture maker in Poland that buys EU-imported timber is one.

• Trader. Anyone else in the chain who makes relevant products available on the market, such as a retailer or wholesaler selling goods it didn't import.

One company can hold different roles for different products. A retailer that imports its own-brand coffee is the operator for the coffee, and a trader for the chocolate it buys from an EU distributor.

What do downstream operators and traders have to do?#

Under the new Article 5, downstream operators and traders must collect and keep for at least five years:

• the name, postal address, email address and, if they have one, web address of each supplier;

• the reference numbers of the due diligence statements (or simplified declaration identifiers), but only when the supplier is an operator;

• the same contact details for each business they sell the products on to.

They don't need anything from consumers. The Commission's simplification review describes their role as "passive collection and retention" of information.

Downstream operators and traders that are not SMEs also have to register in the EUDR information system before trading, and if they learn of a substantiated concern about a product, they must check that due diligence was done and found negligible risk before selling it. SME downstream operators and traders only have to inform the authorities.

What are the EUDR due diligence requirements?#

The EUDR due diligence requirements are three steps in order: collect the information listed in Article 9, assess the risk of non-compliance under Article 10, and mitigate any risk found under Article 11. Operators must also keep a written due diligence system, review it at least once a year, and file a due diligence statement for each product before it is placed on the market.

What information does Article 9 require?#

Article 9 lists the information an operator must hold for each product. It applies to every operator, including those buying from low-risk countries.

Geolocation is the requirement that catches most supply chains out. A plot of land of more than four hectares used for commodities other than cattle has to be described as a polygon, not a single point. A shipment of chocolate can mean collecting coordinates for hundreds of small cocoa farms through several cooperatives and traders. Micro and small primary operators in low-risk countries may give a postal address instead.

What does the risk assessment look at?#

Article 10 lists the criteria an operator must weigh. The country's risk level comes first, followed by the presence of forests and indigenous peoples in the area of production, how complex the supply chain is, how likely it is that the product was mixed with products of unknown origin, and any substantiated concerns raised about the supplier or country.

Country risk comes from Implementing Regulation (EU) 2025/1093, still the latest list as of the July 2026 guidance. It names four high-risk countries (Belarus, North Korea, Myanmar and Russia) and around 140 low-risk ones, including every EU member state, the United States, China, India, Canada and Japan. Every country not listed is standard risk, which includes Brazil, Indonesia and Vietnam, three of the largest sources of EUDR commodities.

Sourcing only from low-risk countries allows simplified due diligence under Article 13. You still collect the full Article 9 information, but you don't have to carry out the Article 10 risk assessment or Article 11 mitigation unless you learn something that suggests a product is at risk.

What goes into a due diligence statement?#

A due diligence statement is the operator's filing in the EUDR information system confirming it carried out due diligence and found no or only negligible risk. It carries the operator's details, the product's HS code, description and quantity, the country of production and the geolocation of the plots, and returns a reference number for that statement.

By filing it, the operator takes legal responsibility for the product's compliance. Statements must be kept for five years from submission. An operator can mandate an authorised representative established in the EU to file for it, but keeps the legal responsibility. The Commission's simplification review adds that its updated guidance and FAQs clarify that one statement can cover multiple shipments.

The information system runs on the Commission's TRACES platform. The Commission's simplification review planned its reopening in stages from June 2026, after an update that adds the simplified declaration for micro and small primary operators, voluntary grouping of reference numbers and the registration of downstream operators and traders.

How does EUDR due diligence work at customs?#

Customs authorities need the due diligence statement's reference number before they release relevant products for free circulation or allow them to be exported. The person lodging the customs declaration must give it to customs, so your customs broker or carrier needs the number with the shipment's other data.

That rule, in Article 26(4) of the amended EUDR, turns due diligence into a release condition. If the information system flags the product for a check, customs suspends its release. The Commission has until 1 December 2029 to connect the information system to national customs systems through the EU Single Window, so until then the reference number travels with the declaration.

Only release for free circulation counts as placing on the market. Goods in a customs warehouse, under inward processing or temporary admission aren't in scope until they're released.

How does the EUDR apply to ecommerce and non-EU sellers?#

The EUDR applies to online and distance sales in the same way as to any other sale. When a product is shipped from outside the EU directly to a consumer, the consumer is never the operator, even if named as importer on the customs declaration. The operator is whoever actually supplies the product: the manufacturer, seller, online retailer or fulfilment provider.

The Commission's guidance states that point directly, and it closes the gap many direct-to-consumer brands hoped to rely on. A US or UK brand shipping wooden homewares to EU customers is the operator for those goods, wherever it is based.

Article 7 adds a second layer. When the importer isn't established in the EU, the first company established in the EU to make the products available on the market also takes on the obligations of an operator. The guidance says this "comes on top of" the non-EU operator's own obligations, so there is always one responsible company inside the EU. For a brand that ships pallets to an EU distributor, both the brand and the distributor carry operator duties.

For marketplaces, the position depends on what the platform does. Reed Smith's summary of the Commission's 2026 materials says a platform that only connects buyers and sellers has no EUDR obligations, while fulfilment providers are typically regarded as supplying the product. A seller using a marketplace's fulfilment service should confirm in writing which company files the due diligence statement.

The EUDR has no low-value threshold. A single €40 wooden chopping board (heading 4419) shipped to a customer in Germany is in scope in the same way as a container of timber. Customs duty works differently: the EU is removing its €150 duty-free threshold in stages, and you can see the current de minimis and VAT rules in border.bot's European Union import rules.

A worked example: a dining table shipped to Germany#

Take a medium-sized US homeware brand that sells a solid acacia wood dining table for €640 to a consumer in Germany. The table is made in Vietnam from Vietnamese acacia, shipped from the brand's US warehouse and cleared in Germany on a DDP basis with the brand paying duty and import VAT.

Here's how the EUDR applies after 30 December 2026:

1. Scope. Wooden dining tables fall under subheading 940360, wooden furniture of other kinds, which is listed in Annex I. The product is in scope.

2. Role. The consumer is not the operator. The brand, as the company supplying the table, is.

3. Start date. The brand is a medium-sized company, so the rules apply from 30 December 2026. Had it been small, the June 2027 date still wouldn't apply, because wooden furniture was covered by the EUTR.

4. Information. The brand needs the geolocation of the forest plots or plantations the acacia came from, the harvest dates, its Vietnamese factory's details and evidence of legal harvest and of no deforestation after 31 December 2020.

5. Risk. Vietnam isn't on the low-risk list, so it is standard risk. The brand can't use simplified due diligence and must carry out the full risk assessment, then mitigate any risk it finds.

6. Statement. The brand files a due diligence statement before the table ships and passes the reference number to the courier that lodges the German import declaration. Without it, customs won't release the parcel.

As a standard-risk product, the table falls in the group where German authorities must check at least 3% of operators each year. The penalty ceiling is the larger risk. Germany must set a maximum fine of at least 4% of a company's EU-wide annual turnover, so for a brand with €12 million of EU sales the maximum fine must be at least €480,000, plus confiscation of the goods and the revenue earned from them.

The EUDR adds no duty of its own. The table still pays customs duty and import VAT in Germany, which you can work out for your own products with the landed cost calculator.

What are the penalties for non-compliance with the EUDR?#

EUDR penalties are set by each member state but must include fines whose maximum, for a company, is at least 4% of its total annual EU-wide turnover, confiscation of the products and confiscation of the revenue earned from them. Fines must strip out the economic benefit of the breach and rise for repeat offences.

Before any penalty, competent authorities must order corrective action. Under the amended Article 24, that means at least one of: fixing formal non-compliance, stopping the product from being placed on the market, withdrawing or recalling it, or donating or disposing of it. Authorities can also recover the full cost of their checks from companies found in breach.

How often companies are checked depends on where the commodities come from. The amended Article 16 sets a minimum share of operators, and of non-SME downstream operators and traders, that each member state must check every year.

For high-risk countries, member states must also check 9% of the quantity of each product. Products from Belarus, Myanmar, North Korea and Russia will see nine times the scrutiny of products from low-risk countries.

What should companies do before 30 December 2026?#

Companies should first list every product whose CN code appears in Annex I, decide whether they are the operator, a downstream operator or a trader for each, and start collecting geolocation data from suppliers now. Geolocation and legality evidence take months to gather through multi-tier supply chains, and customs will need reference numbers from the first day.

A practical order of work:

• Map your catalog against Annex I. Use the CN code of each product, not its name. Check the 2026 changes: leather goods, rubber articles under 4016, used goods and shipping packaging are now out; palm-based soaps and soluble coffee arrive at the end of 2027.

• Work out your role per product. If you import from outside the EU, or ship directly to EU consumers from abroad, you are almost certainly the operator. If you buy from an EU importer, you are a downstream operator or trader.

• Check your size and start date. The June 2027 date needs the company to have been micro or small by 31 December 2024, and never covers EUTR timber products.

• Write to suppliers now. Ask for plot geolocation, harvest dates, legality evidence and whether they or their own suppliers will file statements you can reference.

• Register in the EUDR information system. Operators and non-SME downstream operators and traders need accounts before they trade.

• Brief your customs broker and carriers. Agree how the reference number reaches the import declaration for every relevant shipment.

• Update contracts. Make it clear who files the statement when you use distributors, agents or fulfilment providers inside the EU.

The EUDR sits alongside, not inside, the customs checks most sellers already know. Getting the classification right comes first for both: the code decides the duty you pay and whether you need a due diligence statement at all.

Sources#

• Regulation (EU) 2023/1115 on deforestation-free products, EUR-Lex, 9 June 2023

• Regulation (EU) 2024/3234 amending the date of application, EUR-Lex, 23 December 2024

• Regulation (EU) 2025/2650 amending Regulation (EU) 2023/1115, EUR-Lex, 23 December 2025

• Commission Implementing Regulation (EU) 2025/1093 on country risk classification, EUR-Lex, May 2025

• Simplification review of the EUDR, COM(2026) 191, European Commission, 4 May 2026

• Guidance document for Regulation (EU) 2023/1115, C/2026/3896, Official Journal of the European Union, 20 July 2026

• Commission Delegated Regulation (EU) 2026/2102 amending Annex I, EUR-Lex, 17 September 2026

• Regulation on deforestation-free products, European Commission, accessed 21 October 2026

• EUDR simplification and clarification on scope for online sales, Reed Smith, 11 May 2026