EUDR is live. Seven commodities, one trace, and penalties starting at 4% of EU turnover.

The EU Deforestation Regulation is now a fixed appointment, not a live obligation. After a second postponement agreed in December 2025, medium and large companies must comply from 30 December 2026, and micro and small enterprises from 30 June 2027. From those dates, every consignment of soy, palm oil, cocoa, coffee, cattle, rubber and wood, and the products derived from them, needs a due diligence statement, plot-level geolocation, and proof the land was not deforested after 31 December 2020.^1,2

Last updated 4 August 2026. Reflects the amending Regulation (EU) 2025/2650 of December 2025, the country benchmarking list in Implementing Regulation (EU) 2025/1093, and the Commission's simplification review report of May 2026.

Who must comply with EUDR, and from when?

The regulation sorts companies by role and size. Regulation (EU) 2023/1115 applies to "operators", those who first place an in-scope product on the EU market or export it, and "traders", those who make it available further down the chain. The December 2025 amendment added a lighter-touch category of downstream operators and confirmed the twice-delayed timetable.^1,2,3,10

Mind what did not move. The cut-off date is unchanged: any product produced on land deforested or degraded after 31 December 2020 is non-compliant, no matter when it is placed on the market. Companies that read the postponements as a softening of substance are misreading them; the December 2025 recital language is about preparedness, not ambition.^2,3

What changed in the December 2025 amendment, and what did not?

The amendment is targeted, not a rewrite. Three changes matter most in practice:^2,6

• Downstream operators no longer file their own DDS. A company processing products already covered by an upstream due diligence statement, the chocolate maker buying compliant cocoa mass, the furniture maker buying compliant timber, collects and retains supplier names, addresses and DDS reference numbers for five years instead of duplicating the filing. Non-SME downstream operators must still register that information in the Commission's central system.
• Printed products are out. Books, newspapers and similar printing-industry products (CN Chapter 49) were removed from Annex I entirely.
• The review clause has teeth. The Commission was required to deliver a simplification review by 30 April 2026, and it did, with a report and proposals published in early May 2026 (see below).

What did not change is the harder list. The 31 December 2020 cut-off, the seven commodities and their derived products, plot-level geolocation, the three-step due diligence architecture, the country benchmarking system and the penalty regime, including maximum fines of at least 4% of a company's EU-wide annual turnover, confiscation of products and revenues, and possible exclusion from public procurement, all stand.^1,3

What must a due diligence statement actually contain?

Due diligence is a three-step architecture, and the DDS is its output. Before placing an in-scope product on the EU market (or exporting it), an operator must work through information collection, risk assessment and, where needed, risk mitigation, then lodge a due diligence statement in the EU's central information system and get a reference number that travels with the product down the chain.¹

The EUDR due diligence sequence. Only where the risk assessment finds no or negligible risk may the product be placed on the market.

The information requirements are where most supply chains currently fall short:

• Product description, HS/CN code and quantity being placed on the market or exported.
• Country of production and geolocation of every plot of land where the commodity was produced, as coordinates to at least six decimal places, with polygons required for plots over four hectares. Not the mill, not the trader, the land itself.¹
• Supplier and customer details, name and address of every business supplied from and to, sufficient to reconstruct the chain to the initial producer.
• Adequately conclusive evidence the product is deforestation-free, in practice satellite-based verification of each plot against the 31 December 2020 baseline.
• Evidence of legal production under the laws of the country of production, spanning land-use rights, environmental and forest law, labour and human rights protected under international law, tax, anti-corruption and customs, and free, prior and informed consent where relevant.

Certification helps but does not substitute. Third-party schemes (FSC, RSPO, Rainforest Alliance and similar) can feed the risk assessment, but the regulation is explicit that responsibility stays with the operator; a certificate is an input, not a safe harbour.¹

Which products are in scope? The seven commodities and what is made from them

Scope is deliberately wide, and it follows the ingredient, not the invoice. Annex I lists the seven commodities and the derived products that carry the obligation with them, which is how packaging, furniture and confectionery businesses end up inside a "deforestation" regulation.¹

The practical test is Annex I's CN codes, not intuition. A cardboard shipping box, a leather car seat and a palm-derived surfactant can each be in scope today; screen your product master against the Annex I codes and re-screen it when the pending delegated act lands, because the boundary is about to move in both directions.^6,7

Country risk tiers: what the benchmarking list means in practice

The list is in force, and it surprised almost everyone. Implementing Regulation (EU) 2025/1093, adopted on 22 May 2025, classified just four countries as high risk, Belarus, Myanmar, North Korea and Russia, together around 0.07% of EUDR-covered imports, put major forest-risk origins such as Brazil, Indonesia, Malaysia and the Democratic Republic of the Congo at standard risk, and rated over 140 countries low risk, including all EU member states, the United States, China and Australia. The European Parliament criticised the methodology in a July 2025 resolution, but the list stands, with periodic updates expected.^4,5

The tier changes two things: your due diligence and your odds of inspection. Sourcing exclusively from low-risk countries unlocks simplified due diligence under Article 13, information collection without the full risk assessment and mitigation steps, unless risk indicators emerge. And competent authorities must check a minimum share of operators that scales with tier.^1,5

Do not confuse "low risk" with "no work". Simplified due diligence still requires the full Article 9 information set, geolocation included, and the DDS still has to be filed. What falls away is the risk assessment and mitigation burden, not the traceability one.¹

What is still moving: the May 2026 review and the pending delegated act

The Commission delivered its mandated review on 4 May 2026, confirming 30 December 2026 as a firm date and claiming the accumulated simplifications cut compliance costs by roughly 75% against the original design. Alongside the report sit proposals that would, if adopted, reshape the edges of the regime: adding instant coffee and further palm-oil derivatives to Annex I, removing leather and certain used and sample goods, introducing a one-time simplified declaration for micro and small primary operators in low-risk countries, and consolidating filing responsibility in a "first operator" model, with downstream businesses in a largely passive role.^7,8,9

Plan on the law as it stands, watch the proposals. Companies that paused their EUDR programmes on rumours of the regulation's demise have now lost two grace periods to that bet. The sensible reading of 2026 is the opposite: the date is confirmed, the IT system is live for voluntary early filings, and the remaining legislative movement is about who files, not whether the data must exist.^8,9

Readiness checklist: what should importers do before 30 December 2026?

For mid-market food, beverage, consumer goods and industrial importers, the postponement bought exactly one sourcing cycle. Spent well, it looks like this:

• Screen your product master against Annex I CN codes. Include packaging, components and own-brand manufacture; flag lines touched by the pending delegated act (instant coffee, palm derivatives, leather) in both directions.⁷
• Classify your own role per product line. Operator, downstream operator or trader, the December 2025 amendment makes these materially different obligations, and one company is often all three across its range.²
• Map suppliers to plots, not mills. Start with highest-volume and standard-risk origins; collect coordinates to six decimal places and polygons for plots over four hectares, and validate format before the deadline crush.¹
• Verify plots against the 2020 baseline now. Run collected geolocations through satellite screening (JRC forest cover layers, Global Forest Watch or commercial equivalents) early enough to re-source where plots fail.
• Build the legality file per origin. Land tenure, permits, labour and FPIC documentation requirements differ by country; a per-origin evidence template beats ad hoc collection.
• Exploit the low-risk simplification deliberately. Where sourcing can consolidate into low-risk origins, Article 13 cuts the ongoing burden substantially, a legitimate procurement lever, provided the information set stays complete.⁵
• Test the Information System before you need it. Register in the EU IS, run test DDS submissions, and design how reference numbers will flow to customers, your downstream buyers will ask for them from day one.
• Assign an owner and version the evidence. One accountable role for the EUDR ledger, with every DDS linked to its plots, satellite checks and legality documents, is what turns a competent-authority check into retrieval rather than reconstruction.

Done in that order, 30 December 2026 becomes a filing date rather than a cliff, and the micro/small deadline six months later inherits a working system.

Frequently asked questions

When does EUDR actually apply?

From 30 December 2026 for medium and large companies, and from 30 June 2027 for micro and small enterprises, following the second postponement enacted by Regulation (EU) 2025/2650 in December 2025. The Commission's May 2026 review confirmed the 2026 date as firm.

Has EUDR been delayed again in 2026?

No. The December 2025 amendment was the second and, on the current legislative position, final postponement. The Commission's May 2026 simplification review explicitly confirmed 30 December 2026 and proposed only targeted changes, such as scope adjustments and a "first operator" filing model, which remain proposals.

What is the EUDR cut-off date?

31 December 2020. Products made from commodities produced on land deforested or degraded after that date cannot lawfully be placed on the EU market or exported from it, regardless of when they were produced or purchased. The cut-off has never moved through either postponement.

What geolocation data does EUDR require?

Latitude and longitude of every plot of land where the relevant commodity was produced, to at least six decimal places, with polygon boundaries required for plots larger than four hectares. Geolocation of mills, warehouses or traders does not satisfy the requirement.

Do downstream companies still need to file a due diligence statement?

Since the December 2025 amendment, downstream operators processing products already covered by an upstream DDS no longer file their own statements. They must collect and retain supplier details and DDS reference numbers for five years, and non-SME downstream operators must register that information in the EU's central system.

Which countries are high risk under EUDR?

Only four: Belarus, Myanmar, North Korea and Russia, per the benchmarking list adopted in May 2025. Most major commodity origins, including Brazil, Indonesia and Malaysia, are standard risk, and over 140 countries, including all EU member states, the US, China and Australia, are low risk, which enables simplified due diligence.

What are the penalties for EUDR non-compliance?

Member states must provide for penalties including fines with a maximum of at least 4% of a company's EU-wide annual turnover, confiscation of the products and of revenues from them, and possible exclusion from public procurement and public funding. Non-compliant products can also be blocked at the border.

References

1. EUR-Lex, Regulation (EU) 2023/1115 on the making available on the Union market and the export from the Union of certain commodities and products associated with deforestation and forest degradation, accessed August 2026.
2. Stibbe, The amended EUDR: what has changed and what has remained? (Regulation (EU) 2025/2650), accessed August 2026.
3. Council of the EU, Deforestation: Council signs off targeted revision to simplify and postpone the regulation, 18 December 2025, accessed August 2026.
4. CMS, The EUDR benchmarking list is here, and comes as a surprise (Implementing Regulation (EU) 2025/1093), accessed August 2026.
5. Coolset, EUDR country risk benchmarking: the Parliament objection and what applies now, accessed August 2026.
6. Mayer Brown, EU Regulation on Deforestation-free products (EUDR): What Lies Ahead in 2026?, accessed August 2026.
7. Foods Connected, EUDR April 2026 simplification review: 7 key takeaways, accessed August 2026.
8. European Commission, Report from the Commission to the Council and Parliament on the EUDR, COM(2026) 191, 4 May 2026, accessed August 2026.
9. ESG Today, EU Commission Says Simplification of EUDR Deforestation Law will Cut Costs for Companies by 75%, accessed August 2026.
10. European Commission, Access2Markets, Delay until December 2026 and other developments in the implementation of the EUDR Regulation, accessed August 2026.

This guide is general information, not legal advice. Measures described as proposed, including the May 2026 review proposals and the pending delegated act, remain subject to the EU legislative process; check the primary sources above for the current position.