Why the deforestation rules affect more businesses than many think
Regulation (EU) 2023/1115 on deforestation-free products applies to large and medium operators and traders from 30 December 2026, roughly four and a half months from now. The date is set by Regulation (EU) 2025/2650, adopted on 19 December 2025 and in force since 26 December 2025, which delayed the regime for the second time and simplified parts of it.
Two misconceptions follow from that history. The first is that a third delay will arrive before December. Nothing in the legislative pipeline suggests one, and the European Commission confirmed in July 2026 that the regulation will begin to apply at the end of December. The second, and the more costly in Sweden, is that small businesses have until 30 June 2027. Micro and small enterprises that were already covered by the old EU Timber Regulation do not get that extension, which means Swedish forest owners face the December date whatever their size.
What does the regulation actually require?
Three things must be true before a covered product may be placed on the Union market, made available on it or exported. The product must be deforestation-free, meaning it does not derive from land deforested after 31 December 2020. It must have been produced in accordance with the relevant legislation of the country of production. And it must be covered by a due diligence statement.
Due diligence has three stages under Articles 9 to 11. You collect information, including the geolocation of every plot of land where the commodity was produced and the date or time range of production. You assess the risk that the product is non-compliant. You mitigate that risk until it is negligible. Only then may the product move.
Which commodities and products are caught?
Seven commodities: cattle, cocoa, coffee, oil palm, rubber, soya and wood. The regulation then reaches a long list of derived products identified by customs code in Annex I, covering beef, chocolate, roasted coffee, palm oil, tyres, soy meal, and on the wood side timber, pulp, paper, paperboard and wooden furniture. Printed products such as books and newspapers were removed by Regulation (EU) 2025/2650.
The Commission adopted a further delegated act on 13 July 2026 adjusting the product list, removing leather, retreaded tyres and several rubber articles and adding soluble coffee and certain palm oil derivatives. That act is still in the scrutiny period before the Parliament and the Council, and any newly added product would only be caught from 30 December 2027.
How much geolocation detail is required?
Every plot must be identified by coordinates. Plots below four hectares may be given as a single point, and plots of four hectares or more require polygons. For Swedish forestry this is less alarming than it sounds, because harvest notifications, Skogens karta and the Skogliga grunddata datasets already hold most of what is needed. The work is in connecting that data to the consignment rather than in generating it.
Who has to do what?
The regulation distinguishes operators from traders. An operator places a covered product on the Union market for the first time or exports it, which in Sweden captures importers, a forest owner who harvests and sells timber, and the buyer of a standing timber sale. A trader makes available a product that is already on the market.
Regulation (EU) 2025/2650 changed the mechanics substantially. Only the first operator in the chain now submits a due diligence statement in the Commission information system. Everyone downstream receives and retains the reference number and passes it on where required, rather than filing again. Micro and small primary operators submit a one-off simplified declaration instead of a statement for each consignment. Records must be kept for five years.
Does Sweden’s low risk status help?
It helps a great deal, and it is easy to overstate. Commission Implementing Regulation (EU) 2025/1093 classified all EU member states, including Sweden, as low risk. Under Article 13 that means simplified due diligence: you must still collect the Article 9 information and submit a due diligence statement, but you are not obliged to carry out the risk assessment and risk mitigation stages unless something in the information you hold points to a risk. Authorities must check one per cent of operators annually in low risk countries, against nine per cent for high risk.
So low risk removes two of the three stages. It does not remove geolocation, and it does not remove the statement.
A practical example
A Swedish family forestry business with four employees sells standing timber to a sawmill and also runs a small planing operation that buys sawn timber and sells finished cladding to builders’ merchants.
On the harvesting side it is a primary operator. Because timber was already regulated under the EU Timber Regulation, its micro enterprise status buys it nothing, and 30 December 2026 applies. As a micro operator it files a simplified declaration rather than a statement per consignment, but it still needs geolocation for every harvest site and a declaration identifier to pass to the sawmill.
On the planing side it is a downstream operator, because it converts a product already on the market into another covered product. Its obligation there is lighter: receive and retain the reference numbers or declaration identifiers from its suppliers, keep buyer and seller records for five years, and pass the numbers on. Two roles, two sets of duties, one company. Most Swedish forestry businesses of this size will find they sit in exactly this position and have not mapped it.
Common mistakes
The most expensive error is assuming a third postponement. The regulation has been delayed twice, which has trained the market to wait, but the Commission spent 2026 building tools rather than drafting another delay.
A second is the size assumption already described. Any business that was within the scope of the EU Timber Regulation faces December 2026 regardless of headcount, because that regulation is repealed on the same date and there would otherwise be a gap.
A third is treating low risk as an exemption. Simplified due diligence is a reduction in obligations, not an absence of them, and the due diligence statement remains mandatory.
A fourth is waiting for Swedish legislation before starting. The regulation is directly applicable and does not need a Swedish act to bite. The Swedish complementary statute proposed in SOU 2025:17, which would add criminal liability and administrative charges, has not yet been adopted, but that affects the sanctions available domestically rather than the underlying duty.
Recommended actions
Begin by establishing which role or roles your company occupies for each product line, because operator, downstream operator and trader carry quite different duties and many businesses hold more than one. Confirm your size classification per legal entity rather than across the group, and check specifically whether the entity was within the EU Timber Regulation, since that single question decides whether your deadline is December 2026 or June 2027. Then work backwards through your supply chain and establish, supplier by supplier, who will give you geolocation data and reference numbers, and get that commitment into your purchase terms rather than leaving it to goodwill. Register in the Commission information system and test a submission in the training environment well before December, because the first live filing should not be the first filing. Set up a five year retention arrangement for statements, reference numbers and counterparty records. Finally, watch the delegated act on product scope and the expected revision of the country benchmarking list, both of which could change what you are handling before the deadline arrives.
Frequently asked questions
Does this apply if we only sell within Sweden?
Yes. The regulation covers placing a product on the Union market and making it available on it, so purely domestic Swedish sales of covered products are included. Sweden’s low risk classification reduces the due diligence burden but does not remove the obligation.
We buy finished furniture from an EU supplier. Are we caught?
Probably as a downstream trader rather than an operator. Your supplier or the first importer files the due diligence statement, and your duty is to receive and retain the reference numbers and keep records of who you bought from and sold to for five years.
What are the penalties?
Article 25 requires member states to provide fines with a maximum of at least four per cent of annual Union turnover, confiscation of the products and the revenues gained, and exclusion from public procurement and funding for up to twelve months. Sweden’s complementary sanctions legislation is still at proposal stage.
Conclusion
The EU deforestation regulation has a reputation for slipping, and that reputation is now the main risk it poses to Swedish businesses. The obligations are administrative rather than conceptually hard, but they depend on data that has to be collected from other people, and four and a half months is not long to build a supply chain process from nothing. At Lawgent, we help companies determine their role under Regulation (EU) 2023/1115, map the data and reference number flows their supply chain will need, and put the necessary terms into supplier contracts before the deadline. Get in touch and we will work through what the December date means for your operations.
