Why the EUDR matters to more companies than you think
The EU Deforestation Regulation (EU) 2023/1115 bans the placing on the EU market – and the export from it – of seven commodities and the products made from them unless the company can show they are deforestation-free, legally produced, and covered by a due diligence statement.
After two postponements, the main obligations now apply from 30 December 2026 for large and medium-sized companies, and from 30 June 2027 for micro and small enterprises. The Commission has said it does not intend to postpone again. That leaves under six months to build a working due diligence process.
Which products are covered
Seven commodities are in scope: cattle, cocoa, coffee, oil palm, rubber, soya and wood. Crucially, the regulation also covers a long list of derived products – leather, chocolate, furniture, paper and printed matter, tyres, palm-oil derivatives used in cosmetics and food. A furniture retailer, a coffee roaster, a chocolate brand, a tyre importer and a packaging buyer are all potentially in scope, even though none of them thinks of itself as being in the forestry business.
What compliance actually requires
The cut-off date
Products must not come from land that was deforested or degraded after 31 December 2020. This is a hard line, not a target.
Geolocation data
Operators must collect the geographic coordinates of the plots of land where the commodity was produced. This is the single hardest part of the regulation in practice, because it forces traceability all the way back to the plot – not merely to the supplier.
Due diligence statements
Before placing goods on the market, operators submit a due diligence statement in the EU information system, confirming that risk assessment and, where needed, risk mitigation have been carried out. Following the 2025 simplification, micro and small primary operators submit a simplified one-off declaration rather than a statement per consignment.
Country benchmarking
The Commission classifies producing countries as low, standard or high risk. Sourcing from a low-risk country reduces the depth of the required risk assessment but does not remove the obligations to collect information and submit a statement.
Penalties
Member states must provide effective, proportionate and dissuasive penalties. Fines can reach at least 4 per cent of the company’s annual EU-wide turnover, alongside confiscation of the goods and of the revenues, and temporary exclusion from public procurement.
Practical example: a Swedish furniture importer
A mid-sized importer buys flat-pack furniture from a manufacturer in Asia. The manufacturer buys panels from a board mill; the mill buys timber from several forest owners. To comply, the importer must obtain the plot coordinates for the timber, evidence of legal harvesting under the producing country’s law, and enough documentation to run a risk assessment – then file a due diligence statement before the containers reach the EU. If the manufacturer cannot trace the panels back to the plots, the importer cannot lawfully place the furniture on the market. That is a commercial problem, not just a paperwork problem, and it takes months to fix.
Common mistakes companies make
The first is assuming that a supplier certificate (FSC, PEFC or similar) is enough. Certification is useful evidence in a risk assessment, but it does not replace the geolocation and due diligence statement obligations. The second is treating EUDR as a sustainability team project rather than a supply chain and IT project – the work is data collection, supplier contracting and system integration. The third is starting late: suppliers deep in the chain need lead time to gather coordinates, and they will be asked by all their customers at once.
Recommended actions before 30 December 2026
Map your product portfolio against the seven commodities and the derived-product list, including packaging and inputs. Determine your role: operator, trader, large or SME – it changes both your deadline and your duties. Write EUDR clauses into supplier contracts now, requiring plot geolocation and legality evidence. Test the EU information system with a pilot consignment well before December. And document the risk assessment methodology you will rely on, because that is what an inspection will ask to see.
Frequently asked questions
Does the EUDR apply to companies outside the EU?
Indirectly, yes. The obligations fall on the operator placing the product on the EU market, but that operator must obtain the data from its non-EU suppliers, so the requirements travel down the chain contractually.
We only buy from EU forests. Are we exempt?
No. The regulation applies to EU-produced commodities as well, including Swedish timber. The risk assessment will usually be lighter, but the information, geolocation and statement obligations remain.
What counts as a medium-sized company?
The regulation uses the EU accounting definitions of micro, small, medium and large undertakings. Anything above the small-enterprise thresholds is caught by the December 2026 date, so borderline companies should check their figures carefully.
Will there be another delay?
The Commission has stated that the December 2026 date stands. Planning on a further postponement is not a defensible strategy.
Conclusion
The EUDR turns supply chain transparency into a condition of market access. The companies that will cope are the ones that treat it as a data problem and start collecting now – because the coordinates you need in December 2026 have to be gathered by suppliers who are already busy.
Lawgent helps companies determine whether they are in scope, draft EUDR supplier clauses and build a defensible due diligence process. Contact us for a scoping review.
