EU Deforestation Regulation
Contents
EU Deforestation Regulation at a glance
This regulation will be applicable to the first group of companies from 30 December 2026.
The EU Deforestation Regulation (EUDR) prohibits companies from placing, selling, or exporting seven commodities (cattle, cocoa, coffee, palm oil, soy, rubber, and wood) and related products (such as cocoa beans, chocolate, furniture and tires) on and from the EU market, unless these are deforestation-free, made in accordance with relevant legislation of the production country, and covered by a Due Diligence Statement.
Which companies fall under the EUDR?
The EUDR applies to any business that:
- places regulated commodities or products on the EU market (by either importing them or harvesting within the EU);
- processes them into another EUDR-regulated product;
- sells and trades any of these products on the EU market;
- or exports them from the EU.
The full list of EUDR-regulated ("relevant") commodities and products is available in Annex I of the Regulation (list about to be updated with leather no longer on it).
While the EUDR has a global impact along supply chains, many of the companies that directly fall under its obligations will be EU-registered. The timeline for EUDR application varies depending on company size:
- Large businesses and medium SMEs must comply by 30 December 2026.
- Micro and small SMEs must comply by 30 June 2027.
What are micro, small and medium-sized enterprises (SMEs)?
SMEs are small (including micro) and medium-sized enterprises and mainly determined by their number of employees, along with their annual turnover or balance sheet total:
- micro company: fewer than 10 employees and turnover or balance sheet total of up to €2 million
- small company: fewer than 50 employees and turnover of up to €10 million or balance sheet total of up to €10 million
- medium-sized company: fewer than 250 employees and turnover of up to €50 million or balance sheet total of up to €25 million
A company above at least two of these thresholds in two consecutive years is a large enterprise under the EUDR.
A small or medium-sized company that is part of a larger group may need to include staff headcount/turnover/balance sheet data from that group too.
What are companies expected to do?
All companies that place EUDR-regulated ("relevant") commodities and products on the EU market, make them available on the EU market, or export them from the EU must ensure these items are:
- not linked to any deforestation or forest degradation after 31 December 2020;
- produced in accordance with the relevant (e.g. labour, land use) laws of the country of production;
- covered by a due diligence statement (or simplified declaration).
To this end, companies have supply chain due diligence obligations especially when placing a relevant commodity or product on the EU market. In this case they are called 'operators' under the Regulation. Procedural obligations are most comprehensive if the product is imported into (rather than harvested within) the EU. A Due Diligence Statement digitally submitted by the operator for each shipment/batch has to certify that due diligence resulted in no or only a negligible risk of deforestation or violations of local legislation for this product.
Companies can act as operators or in other roles ('downstream operators', 'traders') under the EUDR and have lighter obligations, depending on their size, position in the supply chain, and where they source from.
Simplified procedures do not mean zero responsibility or consequences. The EUDR establishes an obligation of result: deforestation-free and legally produced goods. If any shipment or batch of a relevant product is found to be in violation of the Regulation, whether imported from abroad or harvested in the EU, it becomes illegal for all companies to trade with it, and to sell or export any other EUDR-regulated products made of it. Primary operators and large downstream operators and traders in particular face penalties.
Full due diligence under the EUDR
1. Collecting information, data and documents (Article 9)
Companies must compile comprehensive information and evidence demonstrating that their products are traceable, legally produced, and deforestation-free. This includes collecting the exact geographical coordinates (geolocation) of the production land, the production timeline, and proof of compliance with relevant local legislation concerning:
- land use;
- environment;
- third-party (e.g. communities’) rights;
- labour rights;
- free, prior and informed consent (FPIC);
- human rights (where applicable and enforceable within the national judicial framework);
- tax, trade, customs and anti-corruption.
2. Assessing risks (Article 10)
Companies are required to conduct a structured risk assessment – which must be reviewed at least once every year – to evaluate whether there is a risk that their commodity or product does not comply with the regulation. Companies may only place a product on the EU market if the risk assessment reveals no risk, or only a negligible risk, of non-compliance.
The risk assessment must take into account, among other criteria:
- the presence of Indigenous Peoples in the country of production, the degree of consultation and cooperation in good faith with them, and the existence of “duly reasoned” land use or ownership claims by these groups;
- the prevalence of deforestation or forest degradation in the production country or area, and the official risk category (low, standard, high) assigned to it by the European Commission;
- corruption levels, prevalence of document falsification, lack of law enforcement, human rights violations, the presence of armed conflicts or international sanctions in the country of origin or certain areas;
- any complaints (“substantiated concerns”) officially submitted to authorities under the EUDR by third-parties like NGOs;
- any additional information that would point to a risk (including, potentially, NGO and media reports, or complaints through a company’s own grievance mechanism).
3. Mitigating identified risks (Article 11)
- If the company identifies a risk that is more than negligible, it must take adequate and proportionate risk mitigation measures before placing the product on the EU market or exporting it.
- This includes requiring additional information, conducting independent audits (which, based on civil society experiences, may not suffice to truly address an issue), or supporting local suppliers through capacity building and investments, e.g. to improve local labour conditions. If a risk cannot be mitigated to a negligible level, the product cannot be brought into the EU (obligation of result, not mere process).
Once these three steps are completed and the risk is confirmed to be negligible, operators must summarise their findings and digitally submit a formal Due Diligence Statement (DDS) to obtain an electronic reference number for their batch/shipment that other companies (e.g. exporters) can refer to.
When are companies allowed to follow simplified procedures?
Companies are allowed to follow different simplified procedures and combinations of those under specific conditions, for example when:
- they source from a so-called “low-risk” country;
- (due diligence limited to step one, the collection of full information)
- they are smallholder farmers and foresters in "low-risk" (e.g. EU) countries and directly place their product on the EU market;
- (one-off simplified declaration per production site instead of repeated Due Diligence Statements for every batch)
- they transform (as 'downstream operator') a relevant product that has already been legally placed on the EU market into another relevant product for domestic sale or export; or they sell any of these as 'traders';
- (no full process but a mere reference to the Due Diligence Statement ID created when the relevant batch was first placed on the EU market; with further simplifications for SMEs)
If large (non-SME) downstream operators and traders obtain verifiable evidence of non-compliance (such as public NGO reports, supplier alerts, or official authority notices), they lose their simplified status for this product batch. They must immediately pause sales to scrutinise and potentially rectify their suppliers' (especially the operator's) due diligence.
What can I do if a company does not meet the obligations?
If you believe that a company is not complying with the EUDR or that a regulated commodity or product (or regulated product made from that initial product) is linked to deforestation and illegal production, you can raise your concerns:
- with the company directly and try to engage with it, for example through its grievance mechansim (which is no formally requirement mechanism under the EUDR but under other laws and the international UN and OECD standards);
- By submitting a “substantiated concern” under Article 31 of the EUDR to a competent authority in an EU Member State.
A substantiated concern is information supported by objective and verifiable evidence that the company may not have complied with the EUDR. The rest of this section focuses on this pathway.
Jump to...
1. Finding the competent authority
Competent authorities (one or several per country) are national authorities designated by EU member states to enforce the EUDR. They are responsible for checking whether companies comply with the Regulation and for taking action in cases of non-compliance.
You can find the competent authority for each EU Member State here. Substantiated concerns are normally filed with the competent authority of the Member State where the (EU) company in question is registered, or if this is unknown, where the suspected product was most likely placed on the market, traded, or exported from. Complaints will be forwarded to the right authority if need be.
2. Submitting substantiated concerns
Before submitting
Before submitting, you should try to collect as much information as possible that shows why you believe the company did not meet its obligations under the EUDR. This could include:
- the name of the company/companies concerned;
- the product concerned and any details such as the specific lot, batch or port of arrival;
- where the product was produced and information about deforestation in the area;
- the national law that you believe may have been violated, if relevant;
- any other supporting evidence, such as photographs, maps, documents, reports, satellite information or witness statements.
You do not need to have all of this information before raising a concern, but providing as much information as you can will be helpful to show that it is substantiated.
If you are concerned that a company or product possibly covered by the EUDR is connected to (local) risks and harms but you need to find out more about the supply chain, which may be very challenging, you can refer to basic guidance and helpful resources here.
Large companies making forest products available on the EU market are required to publish an annual report on their due diligence under the EUDR. This will in many cases be part of their overall sustainability reporting under the Corporate Sustainability Reporting Directive (CSRD). Companies are not required to disclose the exact coordinates or names of suppliers producing relevant commodities and products. However, company reporting on production countries, risk assessment results and local consultations undertaken may still be relevant for stakeholders concerned about deforestation risks and illegal production.
You can submit your concern to the relevant authority. How to submit might differ depending on the authority, but it should usually be possible via the authority’s website, or an email address. Authorities are not obliged to provide an anonymous channel, but they have to treat your complaint confidentially.
The concern should include as much of the above information as possible and explain, to the very least:
- what product and/or company is involved;
- what happened where and when;
- and include evidence to support your claim.
3. Assessment of your concern
- The authority will assess the information you provide and determine whether it should carry out an investigation.
The authority can also identify possible non-compliance through its own inspections, information from other authorities, or information available through the EUDR-related electronic information system (TRACE) where all due diligence statements are held.
4. Investigations and enforcement under the EUDR
If the authority decides to investigate because of substantiated concerns or other information proactively assessed, it might investigate, for instance:
- the company's due diligence system, including the information and documents collected by the company;
- the company's risk assessment and risk mitigation measures;
- the relevant products and their supply chains;
- information about where the products were produced.
Interim measures, corrective action and penalties
If the authority suspects a violation, it can take immediate interim measures before a final decision is reached, such as temporarily suspending the placement of a product on the EU market or its export, or seizing the product.
If the authority formally finds the product does not comply with the EUDR, for example because it is linked to deforestation or illegal production, it can require the company (or multiple companies involved in the supply chain) to take corrective action, and impose penalties.
Corrective action
Corrective action can include requiring the company to:
- correct shortcomings in its due diligence statement or system;
- prevent a product from being placed or made available on the EU market or exported from there;
- withdraw or recall a non-compliant product;
- take other measures necessary to bring the company or product into compliance.
In severe cases, authorities might even refer cases to the criminal prosecutor’s office.
Penalties
Member States must establish penalties for EUDR violations. These can include fines and other sanctions, such as confiscation of products, exclusion from public procurement or public funding, and publication of information about the infringement, depending on the applicable national rules.
Fines must be effective and proportionate. For legal persons like companies, the maximum fine must be at least 4% of the company's annual EU-wide turnover in the preceding financial year.
If a competent authority flags a product shipment or batch due to local compliance flaws (e.g. missing land titles and labour contracts), a product ban can be lifted for future shipments once the company successfully ensures there is no risk or only negligible risk. This could be a lever for improvements in situations of human rights and environmental abuse, if these are covered under the national laws of the production country.
For instance, importers may take mitigation action that supports their suppliers’ local compliance through capacity building and investments, as stipulated in the Regulation. If properly implemented and consulted with stakeholders, this can benefit local workers and communities. Remedy in the sense of compensation, restitution etc. is not mentioned in the Regulation.
The core criterion of products being deforestation-free since 31 December 2020 is permanent. If a plot of land was deforested after this cut-off date, it is permanently and irreversibly banned from the EU market. No amount of local mitigation or replanting can lift this ban for that specific area.