EUDR guide: what the EU Deforestation Regulation requires, and how to comply (2026)

The EU Deforestation Regulation (EUDR), Regulation (EU) 2023/1115, is the EU law that keeps products linked to deforestation off the EU market. This guide is written from the official texts: the consolidated Regulation on EUR-Lex, the two amending regulations of December 2024 and December 2025, the Commission’s delegated and implementing acts of July 2026, and the Commission’s guidance, FAQ and Information System documentation. It reflects the legal position as of September 2026. Article numbers refer to the Regulation as amended.

What is the EUDR?

The EUDR prohibits placing on the EU market, making available on it or exporting from it any relevant commodity or product unless three conditions are all met (Article 3):

1. it is deforestation-free;
2. it has been produced in accordance with the relevant legislation of the country of production;
3. it is covered by a due diligence statement or, for micro or small primary operators, a simplified declaration.

The Regulation entered into force on 29 June 2023 and replaces the EU Timber Regulation (Regulation (EU) No 995/2010), which is repealed from 30 December 2026, with a transition for timber produced before 29 June 2023.

It has been amended twice:

The Commission published its simplification review on 4 May 2026, together with an updated guidance document and FAQ. The delegated and implementing acts adopted on 13 July 2026 completed that package.

Which commodities and products are covered?

Seven relevant commodities: cattle, cocoa, coffee, oil palm, rubber, soya and wood (Article 2(1)). The Regulation applies to the relevant products listed by customs code in Annex I that contain, have been fed with or have been made using those commodities. Examples include cocoa beans, paste, butter, powder and chocolate; green and roasted coffee; palm oil, palm kernels and many derivatives; natural rubber and tyres; soya beans, meal and oil; wood, pulp, paper and furniture; live cattle and beef.

Delegated Regulation (EU) 2026/2102, adopted on 13 July 2026, changed Annex I:

• Removed: cattle hides, skins and leather, retreaded tyres, soybeans for sowing, certain articles of vulcanised rubber, conveyor and transmission belts, and aircraft and motor vehicle seats.
• Added: soluble coffee (extracts, essences and concentrates of coffee), certain palm oil derivatives used in oleochemicals, and frozen cattle tongues. These additions apply from 30 December 2027.
• Clarified or exempted: samples and products used for analysis or testing, waste, used and second-hand products, packing material, and products used to manufacture medicinal products.

Printed books, newspapers and pictures had already been removed from Annex I by Regulation (EU) 2025/2650.

Check your products by customs code against the current Annex I on EUR-Lex. The commodity list itself has not changed.

Who has obligations under the EUDR?

The amended Regulation distinguishes four roles. Your role depends on what you do with each product, not on your company’s size or sector.

Key points:

• The first placing on the market carries the due diligence. An importer bringing cocoa beans into the EU is an operator. A chocolate maker that buys those beans from the importer and sells chocolate is a downstream operator.
• Operators established outside the EU. Where a company established outside the EU places products on the market, the first person established in the EU that makes them available is deemed the operator (Article 7).
• Downstream operators and traders must be in possession of the names, addresses and email addresses of their suppliers and customers. Where their supplier is an operator, they must also hold the DDS reference numbers or declaration identifiers. They keep this for five years (Article 5).
• Non-SME downstream operators and non-SME traders must register in the Information System. If they learn of a substantiated concern before placing a product, they must verify that due diligence was exercised and hold back the product unless the risk is negligible.
• Operators that are natural persons or micro-enterprises may mandate the next company down the chain to submit the DDS or simplified declaration on their behalf (Article 6(3)). They remain responsible for compliance.

The EUDR sits alongside broader value-chain rules such as the CSDDD. Article 12(3) allows operators also subject to other EU due diligence reporting to include their EUDR reporting there.

When does the EUDR apply?

As of September 2026, according to Article 38 as replaced by Regulation (EU) 2025/2650:

The 30 June 2027 date applies to operators. Micro and small downstream operators and traders follow the general date. Other provisions, such as country benchmarking and the Information System, already apply.

Background: the original text set 30 December 2024 and 30 June 2025. Regulation (EU) 2024/3234 moved these to 30 December 2025 and 30 June 2026. Regulation (EU) 2025/2650 moved them again by 12 months to the dates above.

What is the cut-off date?

The cut-off date is 31 December 2020 (Article 2(13)). Commodities must come from land that has not been deforested after that date. For wood, the harvest must also not have caused forest degradation after that date.

This means the question is always “what happened on this plot since 31 December 2020?”. A plot converted from forest in 2015 can be compliant. A plot cleared in 2021 cannot, whoever cleared it and whatever was planted afterwards. Article 9(1)(d) is explicit: any deforestation or forest degradation on a plot automatically disqualifies all commodities from that plot.

What counts as deforestation-free and legal?

Deforestation is the conversion of forest to agricultural use, whether human-induced or not (Article 2(3)). The definitions follow FAO’s:

• Forest: land of more than 0.5 hectares with trees higher than 5 metres and canopy cover of more than 10%, or trees able to reach those thresholds in situ, excluding land predominantly under agricultural or urban use.
• Agricultural plantation: tree stands in agricultural production systems, including agroforestry where crops grow under tree cover. Plantations of relevant commodities other than wood are excluded from “forest”. Cocoa agroforestry is therefore not forest in itself, but converting forest into cocoa agroforestry after the cut-off date is deforestation.
• Forest degradation (relevant for wood): conversion of primary or naturally regenerating forest into plantation forest or other wooded land, or of primary forest into planted forest.

Legality means compliance with the relevant legislation of the country of production (Article 2(40)) covering:

• land use rights;
• environmental protection;
• forest-related rules, where directly related to wood harvesting;
• third parties’ rights;
• labour rights;
• human rights protected under international law;
• free, prior and informed consent, including as set out in the UN Declaration on the Rights of Indigenous Peoples;
• tax, anti-corruption, trade and customs regulations.

Operators must hold “adequately conclusive and verifiable information” on both points (Article 9(1)(g) and (h)), including any arrangement conferring the right to use the area for production.

What geolocation is required?

Geolocation means latitude and longitude coordinates of a plot of land using at least six decimal digits (Article 2(28)).

Other rules to know:

• All plots. A product made from commodities from several plots must include the geolocation of every plot (Article 9(1)(d)).
• Date or time range of production must be collected alongside the geolocation.
• A plot of land is land within a single real-estate property, as recognised by the law of the country of production, with sufficiently homogeneous conditions to assess its deforestation risk as a whole (Article 2(27)).
• Format. The Information System accepts locations drawn on a map, entered as coordinates, or uploaded as GeoJSON files. The Commission publishes a GeoJSON file description, including fixes for the most common technical issues, in the help section of its acceptance (test) environment.
• The 4-hectare threshold is under review. Article 34(2)(d) requires the Commission’s first general review, due by 30 June 2030, to evaluate the polygon threshold.

Six decimal digits describe a location very precisely on paper. That does not make the reading accurate: accuracy depends on how and where the coordinates were captured.

What must a due diligence statement contain?

A due diligence statement is submitted in the Information System before the product is placed on the market or exported. Under Annex II, as amended by Regulation (EU) 2025/2650, it contains:

1. Operator’s name and address, and the EORI number for products entering or leaving the EU market.
2. Harmonised System code, free-text description including the trade name and, where applicable, the full scientific name (for wood), and the quantity, in kilograms of net mass and, where applicable, the supplementary unit, for products entering or leaving the market.
3. Country of production and geolocation of all plots of land (or of all establishments, for cattle).
4. The declaration: “By submitting this due diligence statement the operator confirms that due diligence in accordance with Regulation (EU) 2023/1115 was carried out and that no or only a negligible risk was found that the relevant products do not comply with Article 3, point (a) or (b), of that Regulation.”
5. Signature: signed for and on behalf of, date, name and function.

The former item on referring to upstream statements was deleted along with the provisions it served. Operators must now communicate the reference numbers of their statements to the downstream operators and traders they supply (Article 4(7)). For imports and exports, the reference number (or declaration identifier) must be made available to customs before release for free circulation or export (Article 26(4)).

By submitting the statement, the operator assumes responsibility for compliance and must keep a record of the statement for five years (Article 4(3)).

A simplified declaration for micro or small primary operators (Annex III) contains the operator’s identity and EORI where relevant, HS codes and a one-off estimated annual quantity, the country of production and the geolocation or postal address of all plots, and a commitment to exercise due diligence.

How do you submit a DDS in the EUDR Information System (EU TRACES)?

The EUDR Information System, run by the European Commission and widely known as EU TRACES, is where statements and simplified declarations are submitted, and where competent authorities and customs access them (Article 33). It launched on 4 December 2024 and reopened at the end of June 2026 after updates for the amended Regulation.

The steps:

1. Register with EU Login and create an account in the production environment. Each user creates a single account with one unique identifier, and may define several roles under it (Implementing Regulation (EU) 2024/3084, as amended). The acceptance environment is a separate replica for testing. Registrations there have no legal value and do not carry over.
2. Choose the role: operator, authorised representative, micro or small primary operator, or (for registration purposes) non-SME downstream operator or trader.
3. Create the statement: activity, products (HS code, description, quantity), country of production, and geolocation, drawn on a map, typed as coordinates or uploaded as GeoJSON.
4. Submit, through the web interface or automatically through web services (API) using the Commission’s published technical specifications, which were updated in 2026.
5. Receive a reference number and a verification number. Each statement goes through automated risk profiling. The resulting risk status is visible only to authorities. Competent authorities may delay the reference number while they check a product, and may reject a statement flagged as high risk within the period set in Article 17(3). A rejected statement no longer counts as covering the product.
6. Share the reference number with your customers and with the customs declarant.

Features introduced by Implementing Regulation (EU) 2026/1565:

• Grouping. A new statement can reference earlier statements by the same user, with a single reference number then standing in for them, including at customs. A statement used in a grouping can no longer be amended or withdrawn.
• Simplified declarations can be submitted, updated (keeping the same identifier) and withdrawn. Where a Member State already holds the information in a national database, it can make it available and the operator receives the identifier without filing.
• Contingency arrangements. By 30 December 2026, the Commission must publish availability information and contingency measures, including contingency reference numbers, for unexpected outages of more than 60 minutes.
• Data retention. Personal data in statements is stored for no longer than five years from submission (or from grouping).

The Commission publishes a user guide, API reference documentation and release notes, and runs training sessions for operators and micro or small primary operators.

How does country benchmarking change the obligations?

Article 29 sets up a three-tier country benchmarking system: low, standard and high risk. The first list was adopted by Commission Implementing Regulation (EU) 2025/1093 of 22 May 2025. As of September 2026, EUR-Lex lists it as in force without amendment:

• High risk: Belarus, the Democratic People’s Republic of Korea, Myanmar and the Russian Federation.
• Low risk: the countries named in the Annex, including all EU Member States.
• Standard risk: every country not listed. Several major producing countries of cocoa, coffee, palm oil and rubber are in this tier.

What the tier changes:

Simplified due diligence is lost as soon as the operator learns of information pointing to a risk, including substantiated concerns. The Commission reviews the list when new evidence arises, so classification should be checked, not assumed.

What is a due diligence report and what should it contain?

The Regulation does not use the term “due diligence report”. In practice, a due diligence report is the documented evidence behind each statement. Operators must keep it for five years and make it available to competent authorities on request (Articles 9(2), 10(4), 11(3) and 12(5)). A useful report covers:

1. Product and supply chain: description, HS code, quantity, trade name, species for wood; suppliers and customers with names, postal and email addresses.
2. Origin: country (and region) of production, geolocation of every plot, date or time range of production.
3. Deforestation evidence: for each plot, how land cover since 31 December 2020 was assessed, which sources and methods were used, when, and with what result.
4. Legality evidence: land use rights, permits, labour and human rights checks, free, prior and informed consent where relevant, tax and trade documents.
5. Risk assessment: how each criterion in Article 10(2) was considered, from country risk to supply chain complexity, risk of mixing, Indigenous Peoples’ claims, corruption, and substantiated concerns. Article 10(4) requires operators to show how information was checked against the criteria and how the degree of risk was determined.
6. Risk mitigation: additional information requested, independent surveys or audits, supplier support, and the decision reached, documented and reviewed at least annually (Article 11).
7. Conclusion: negligible risk, or not, and the resulting decision to place, hold or exclude the product.

Non-SME operators must also report publicly each year on their due diligence system (Article 12(3)), have a compliance officer at management level and an independent audit function (Article 11(2)).

What are the penalties?

Member States set the penalties, which must be effective, proportionate and dissuasive (Article 25). They must include:

• fines proportionate to the environmental damage and the value of the products, with a maximum of at least 4% of the company’s total annual Union-wide turnover for legal persons, increased where necessary to exceed the economic benefit gained;
• confiscation of the products concerned;
• confiscation of revenues from transactions in those products;
• temporary exclusion for up to 12 months from public procurement and public funding;
• temporary prohibition from placing, making available or exporting relevant products, for serious or repeated infringements;
• prohibition from using simplified due diligence, for serious or repeated infringements.

Competent authorities can also require corrective action: rectifying formal non-compliance, preventing placing on the market, withdrawal or recall, or donation or disposal (Article 24). Final judgments against legal persons are published by the Commission.

What are the common reasons plots and declarations fail?

The following problems come directly from the Regulation’s requirements and the Information System’s validation:

• A point where a polygon is required. Plots of more than four hectares recorded as a single coordinate.
• Invalid geometry. Polygons that cross themselves, are not closed, have too few vertices, or have coordinates in the wrong order (longitude and latitude swapped). The Commission’s GeoJSON file description lists the most frequent technical errors.
• Too little precision. Coordinates with fewer than six decimal digits.
• Overlapping plots. Two farmers’ plots, or two suppliers’ plots, claiming the same land, which may point to duplicated or borrowed plots.
• Area mismatch. A declared area that differs from the area of the polygon, or a volume that the declared area could not plausibly have produced.
• Deforestation signal after the cut-off. Forest loss detected on or next to the plot after 31 December 2020, which disqualifies the plot’s production unless the signal is shown to be wrong.
• Missing links in the chain. Products that cannot be traced back to the plots they came from, or mixed with products of unknown origin (Article 10(2)(i) and (j)).
• Missing legality evidence. No documented land use right or permit.
• File and data issues. Oversized files or duplicated submissions. The Commission may set technical limits on file size and interaction frequency.

Most of these failures are cheaper to prevent at the point of capture than to fix in a compliance team months later.

How do smallholder supply chains comply in practice?

Cocoa, coffee, rubber and palm oil are largely grown by smallholders, often on plots of a few hectares, sold through cooperatives, collectors and exporters. The Regulation acknowledges this: Article 11(1) lets operators support their suppliers, “in particular smallholders”, through capacity building and investment. Article 34(2)(b) requires the 2030 review to assess the Regulation’s impact on smallholders.

What works in practice:

1. Register farmers and map plots at the source. Field agents capture each plot’s point or polygon on a phone, offline, while walking the boundary with the farmer. They record the date of capture and the time range of production.
2. Validate on capture. Geometry, area and overlap checks should run before the agent leaves the field, so errors are corrected with the farmer present.
3. Obtain consent and document land rights. Farmers should know what data is collected and why. Land use documents, even informal ones, should be recorded with the plot.
4. Assess deforestation per plot, from the cut-off date to today. Use several public sources, and treat an assessment as dated evidence that needs refreshing, not a permanent certificate.
5. Keep first-mile traceability through aggregation. Link each purchase to the farmer and plot at the collection point, and keep that link through warehouses and processing, so each shipment’s statement lists the plots it actually came from.
6. Build the statement from plot-level data. When the data is right at the source, statements and due diligence reports become an export of existing records, not a scramble.

There are about 500 million smallholders worldwide. The Regulation works for them when compliance data is collected once, accurately, and stays useful to the farmer too.

EUDR compliance checklist

• Map each product to its HS code and check it against the current Annex I (including Delegated Regulation (EU) 2026/2102).
• Determine your role for each product flow: operator, micro or small primary operator, downstream operator or trader.
• Confirm your application date: 30 December 2026, or 30 June 2027 for eligible micro and small operators.
• Register in the EUDR Information System (operators; non-SME downstream operators and traders).
• Collect, for every plot: geolocation with at least six decimals, polygons above four hectares, date or time range of production.
• Validate geometry, precision, area and overlaps before submission.
• Assess deforestation since 31 December 2020 for every plot, and record sources, method and date.
• Collect legality evidence against the eight areas of Article 2(40).
• Check the country benchmark of every country of production and apply simplified due diligence only where allowed.
• Carry out and document the risk assessment and any mitigation.
• Submit the DDS before placing on the market or export; store the reference and verification numbers.
• Pass reference numbers to customers and to your customs declarant.
• Keep all records for five years; review the due diligence system at least once a year.
• Non-SMEs: appoint a compliance officer, set up independent audit, publish the annual report.

How does Farmer1st help with EUDR compliance?

Farmer1st is the first-mile infrastructure built around farmers: a farmer-controlled network where companies, governments and organisations collect, verify and share origin data — and build the services they need on top of it.

For the EUDR, that means:

• Due diligence reports and statements from plot-level data. We produce the DDR and the DDS from the farmer, plot and purchase records themselves, so each statement lists the plots its products actually came from. See EUDR compliance.
• Direct EU TRACES integration. Statements are submitted to the EUDR Information System through its web services, and reference numbers flow back into your records and to your customers.
• Geo and polygon validation. Our in-house geo service checks geometry, precision, area and overlaps, and runs a multi-source deforestation assessment up to today, not frozen at a past year. You can apply your own calculation method or reference methods such as Whisp (FAO). See Geo & polygons.
• Offline field collection. Field agents register farmers and map plots offline, with validation on capture, so errors are fixed while the farmer is present. See Field agent management.
• Your existing tools stay in place. We plug into the field tools, ERPs and compliance platforms you already use. See Data integration.

Farmer1st works offline-first in the field, with AI added to support farmers and the teams who use the tools. If you need something we have not described here, we prototype it with you in the Nursery.

This guide is general information based on the official texts as of September 2026. It is not legal advice. Check the consolidated Regulation on EUR-Lex and the Commission’s latest guidance before making compliance decisions.