The EUDR guide 2026: everything you need to know about the EU Deforestation Regulation

In brief

The EU Deforestation Regulation applies from 30 December 2026 to large and medium-sized enterprises and to all downstream actors, regardless of size. Micro and small enterprises that are operators have until 30 June 2027, except for timber listed in the annex of the old Timber Regulation. There will be no third postponement; the simplification package of May 2026 is complete, and its legal acts have been in force since July and September.

Seven commodities are covered, wood, coffee, cocoa, rubber, oil palm, cattle and soya, and with them hundreds of derived products. Whether a product is in scope is decided by its customs code against Annex I, which has applied in a new version since 18 September 2026.

The role is determined per product, not per company. Operators and small primary producers submit statements; downstream operators and traders do not, they collect information. Since the amending regulation of December 2025 that applies to every size class; non-SMEs additionally register and verify where there is reasoned concern.

Germany transposes one-to-one through the EntwaldungsMG, the Federal Office for Agriculture and Food becomes the central enforcement authority, and penalties reach up to four percent of annual turnover. An administrative regulation is to let German forest owners and farmers use an address instead of geodata.

Anyone starting now has a good three months. That is enough if suppliers are contacted in the coming weeks, and it is not enough if that only happens in December.

What the regulation is and what makes it different

Regulation (EU) 2023/1115 entered into force on 29 June 2023 and replaces the EU Timber Regulation. Its core obligation is in Article 3 and has not moved through any of the amendments: relevant commodities and products may only be placed on the market, made available on the market or exported if they are deforestation-free, have been produced in accordance with the relevant legislation of the country of production, and are covered by a due diligence statement.

Deforestation-free means: no deforestation or forest degradation on the plot of production after 31 December 2020. Legal means: in accordance with the law of the country of production, expressly including land use rights, environmental and forest law, labour rights, human rights and the principle of free, prior and informed consent of indigenous peoples. The due diligence statement is submitted electronically in the EU information system, which is built on TRACES.

Three things set the regulation apart from almost all other product law. It applies to exports as much as to imports; a sawmill delivering to Switzerland is an operator just like a coffee importer. It attaches to the land, not to the product; the geolocation of the plots of production is the heart of the information requirement. And with the due diligence statement it transfers a personal responsibility: by submitting, the operator assumes responsibility under Article 4(3) for the product complying with Article 3.

Where things stand in September 2026: a timeline

Anyone following the regulation since 2023 has seen two postponements, a simplification package and a summer with four legal acts. This is the position you work with now.

19 December 2025, Regulation (EU) 2025/2650. The amending regulation postpones the date of application by a further year, introduces two new roles, the downstream operator and the micro or small primary producer, relieves downstream actors of the due diligence statement, and removes printed products of Chapter 49, that is books and newspapers, from the scope.

4 May 2026, the simplification package. The Commission presents its simplification review. The regulation's text stays unchanged; implementation is eased through the fifth FAQ edition, new guidelines and two legal acts. Key clarifications concern downstream actors, online sales and geolocation.

End of June 2026. The EU information system is available again, with registration and submission; further functions follow step by step.

13 July 2026. The Commission adopts the delegated act on Annex I. Implementing Regulation (EU) 2026/1565 on the information system enters into force on 14 July: aggregated due diligence statements, contingency arrangements for system outages, one account with several roles, the simplified declaration for small primary producers and updated interface specifications.

20 July 2026. The Commission guidelines appear as OJ C/2026/3896, third edition, for the first time in an official German version.

12 August 2026. The German cabinet adopts the Deforestation and Forest Degradation Minimisation Act, the EntwaldungsMG. The general administrative regulation has been available as a ministry draft since 7 August.

17 September 2026. Delegated Regulation (EU) 2026/2102 on Annex I is published in the Official Journal and enters into force on 18 September. The product scope is settled.

What remains open is the parliamentary passage of the German act in the autumn. We keep the running status in EUDR current status.

The deadlines and who has which

The regulation knows three dates, and the assignment is narrower than it is usually reported.

30 December 2026 for large and medium-sized operators, for all downstream operators and traders regardless of size, and for all products in the annex of the old EU Timber Regulation regardless of company size.

30 June 2027 for operators that were established as micro or small enterprises by 31 December 2024. The cut-off is 31 December 2024, not 31 December 2020 from the original version; older infographics still show the old date. The extension does not apply to EUTR-annex timber and not to medium-sized enterprises.

30 December 2027 for the products that the new Annex I adds for the first time: soluble coffee, certain palm oil derivatives, soaps containing oil palm and frozen cattle tongues.

A micro or small enterprise is one that does not exceed at least two of three criteria on its balance sheet date: 5 million euros balance sheet total, 10 million euros net turnover, 50 employees on average, under Article 3(2), first subparagraph, of Directive 2013/34/EU as amended by Delegated Directive (EU) 2023/2775. The group thresholds of the Accounting Directive are expressly not relevant for the EUDR; the individual company is tested. Who has which deadline and how to test size is covered in Operator or trader? The four EUDR roles, the SME thresholds and the two deadlines.

And regardless of all that: for commodities produced before 29 June 2023 the regulation never applies. What counts is the time of harvest, for cattle the date of birth.

Scope in four steps

Whether and to what extent a company is obliged can be settled in four questions. They are asked per product, not once per company.

Step 1: Is it a relevant product?

Annex I lists headings of the Combined Nomenclature for the seven commodities. What is not on it is not covered, however much wood or palm oil it contains. The check runs on the customs code, not the product name, and three things make it more demanding than it looks.

A leading "ex" means only the part of the heading named by the description in the annex is covered. For rubber, a single commodity pulls a whole series of codes in Chapter 40 with it, and the recast has removed some of them: conveyor belts and transmission belting under 4010 and other articles of soft rubber under 4016 have been out since 18 September, and retreaded tyres have been cut down to subheading 4012 90 30.

The recast also introduced five table notes that narrow the commodity concept. Cattle means only the genus Bos, no buffalo or bison. Oil palm means only Elaeis, no babassu oil. Rubber means only Hevea brasiliensis. Wood does not mean bamboo, rattan, reed, osier or cereal straw. And samples, specimens and products for testing and analysis are excluded.

Expressly outside scope since the recast are waste within the meaning of the Waste Framework Directive, used and second-hand products under the rubber, wood and furniture headings, and packing material used solely to support, protect or carry another product and presented with it, from the moment of use. A pallet is covered while traded empty and drops out as soon as it sits under goods.

For manufacturing industry, three commodities matter most, because they often sit unnoticed in inputs: wood in packaging, pallets and furniture, rubber in tyres, seals and hoses, oil palm in oleochemicals and, from the end of 2027, in soaps. Leather, by contrast, has been removed entirely since September. The full check logic with all 64 amendments of the recast and an Excel checker is in EUDR Annex I and CN codes.

Step 2: Is there a relevant activity?

The regulation has three triggers. Placing on the market is the first making available on the Union market, through production in the EU or through import; for imports it is the moment of release for free circulation. Making available is any supply for distribution, consumption or use in the course of a commercial activity, paid or free. Export is the export procedure under Article 269 of the Customs Code.

What hits none of the three triggers is not subject to the regulation: goods in a customs warehouse, under inward processing, in transit or in a free zone, the re-export of non-Union goods, products for private use, and products a company consumes itself without supplying them to third parties, such as wood chips for heating its own plant. How export, re-import and re-export are treated in detail is in The EUDR at export, re-import and re-export.

Step 3: Was due diligence already exercised upstream?

Three indications point that way: you source relevant products exclusively within the EU, your supplier has already placed them on the market, and a reference number exists for them. If all three apply, you are not an operator for that product but a downstream operator or trader, with considerably reduced obligations.

The converse matters: for components not yet covered by a due diligence statement, for example raw timber you import yourself or coffee you source directly from the country of production, you are an operator with full obligations, even if you are downstream for other components.

Step 4: Which role and which scope?

The regulation has four roles. An operator is anyone who, in the course of a commercial activity, places relevant products on the market or exports them, that is importers, EU producers and exporters. For imports it is whoever appears as importer in the customs declaration, regardless of transfer of ownership. A micro or small primary producer is anyone who, as a micro or small enterprise in a low-risk country, grows, harvests, obtains or raises their own products and places them directly on the market; larger companies count too where only their EUDR-relevant business segment is below the thresholds. A downstream operator is anyone who places on the market or exports products made from products already declared, typically under a new HS code, such as the chocolate maker buying EU cocoa. A trader is anyone who merely makes available without placing on the market.

A company can hold different roles for different products, and that is the normal case. Size then comes into play for the obligations: for operators regarding the deadline and the reporting duty, for downstream actors regarding registration and the verification duty.

The obligations per role

This is where the amending regulation of December 2025 moved the most. The distribution, as officially described since the guidelines of July 2026, looks like this.

Operators exercise full due diligence under Articles 8 to 11, submit the due diligence statement before placing on the market or export, register in the information system, pass the reference and verification number to the next downstream actor, keep records for five years and inform the authorities without delay of any indication of non-compliance. They bear responsibility for compliance. Added to this is a framework of procedures and measures, the due diligence system under Article 12, with annual review. Operators that are not SMEs also appoint a compliance officer at management level, set up an independent audit function and report publicly every year on their due diligence system, which can be done through the CSRD report.

Micro or small primary producers exercise due diligence under Article 8 but, because by definition they source only from low-risk countries, need not carry out risk assessment and mitigation as long as there is no indication of a non-negligible risk. Instead of the due diligence statement they submit a one-off simplified declaration under Annex III and receive an identification number. They may give a postal address instead of geolocation, provided it corresponds unambiguously to the location of the plots or the holding, and an annual estimated quantity instead of transaction-level quantities. Where the information already exists in an EU or national system, the Member State can supply it; the own declaration then falls away. Updates on material changes, retention for five years, the identification number goes to the downstream actors.

Downstream operators and traders submit no due diligence statement of their own and need not exercise due diligence themselves. Since the amending regulation this applies to every size class; the guidelines put it unambiguously: they do not have to submit due diligence statements and do not have to ascertain that due diligence was exercised upstream. What they do: under Article 5(3), collect the identity of their suppliers and their business customers, plus the reference or identification numbers where the supplier is an operator, and keep everything for five years. They may only make products available if they hold this information. On indications of non-compliance they inform the authorities and their customers without delay. The duty to pass on the number lies with the upstream operator; anyone who is downstream themselves does not have to pass it on further.

Downstream operators and traders that are not SMEs have two additional obligations: they register under Article 5(2) in the information system before placing, making available or exporting products, and under Article 5(6) they verify, where there is reasoned concern, whether due diligence was exercised and no or only negligible risk exists. If the verification does not show that, they may neither place the product on the market nor make it available nor export it.

A note on sources, because it causes confusion in practice: the German version of the Commission FAQ, version 1.4, still describes in places the rule before the amending regulation, under which downstream non-SMEs submitted their own statement referring to the upstream reference numbers. That obligation no longer exists. What governs is the guidelines in the version of 20 July 2026 and Implementing Regulation (EU) 2026/1565, which expressly confirms the exemption of downstream actors from the statement.

Due diligence in three steps

For operators, due diligence runs in three steps that Article 8 prescribes and that must be completed before placing on the market.

Collect information under Article 9. Description with trade name and, for wood, the full scientific name; quantity; country of production and, where relevant, subnational part; geolocation of all plots of production with the production period; suppliers and customers; adequately conclusive and verifiable evidence of deforestation-free and legal production. Geolocation can be a point; from four hectares polygons are mandatory.

Geolocation: what the authorities want to see

Because the regulation hangs on the land, geolocation is the part of the information requirement on which projects fail or succeed. Required are the coordinates of all plots on which the relevant commodities were produced, for cattle all establishments where the animals were kept. Up to four hectares a point with latitude and longitude to at least six decimal places is enough; above that a polygon enclosing the plot is mandatory. Added to this is the production period, which has to be in the records even though it does not appear in the statement itself.

Three things matter in practice. First, the polygon must depict the plot of production, not the premises or the cadastral district; a 300-hectare forest from which 20 hectares were felled is declared with the 20 hectares. Second, authorities and software check the plot against satellite imagery for deforestation after the cut-off date; any deforestation on a declared plot excludes all products from it, which is why exactly the plots that supplied are to be declared and not more as a precaution. Third, geodata in the statement may be marked confidential so that downstream actors do not see them; the authorities see them in every case.

Assess risk under Article 10. Against the criteria of paragraph 2: country risk under the Commission's benchmarking, presence of forests and indigenous peoples in the area of production, prevalence of deforestation, corruption, supply chain complexity, risk of circumvention and mixing, certification as a supporting tool. The assessment is documented and reviewed at least annually.

Mitigate risk under Article 11. Only if the assessment reveals a non-negligible risk: additional evidence, independent surveys, audits, support for suppliers. Only once no or only negligible risk remains may the statement be submitted and the product placed on the market. If the risk persists, placing on the market is not permitted.

The Commission's country benchmarking sorts countries of production into three categories. For low-risk countries, which include all EU Member States, simplified due diligence under Article 13 applies: information is collected, risk assessment and mitigation are dispensed with, and what is checked is supply chain complexity and the risk of circumvention and mixing. The authorities' control rate is one percent of operators. For standard-risk countries full due diligence applies at a three percent control rate, for high-risk countries, currently Russia, Belarus, Myanmar and North Korea, at nine percent.

The due diligence statement

There is no template; the statement is entered in the information system, and Annex II sets out exhaustively what goes in: operator with EORI number for import and export, HS code with description and quantity in kilograms of net mass, country of production and geolocation of all plots, reference numbers where applicable, the prescribed declaration wording and the signature with name and function.

After submission the system creates a risk profile the user does not see and assigns a reference number and a verification number. Until the reference number is available the authority can reject the statement; after that it cannot. So do not submit on the day of customs clearance.

Three reliefs are worth knowing. A statement does not have to be submitted per shipment; it can cover several shipments until the declared quantity is used up, for at most one year from submission. Since July 2026 individual statements can be bundled into an aggregated statement that takes their place for customs and customers, after which the individual statements can no longer be amended. And anyone exporting or re-importing goods from the transitional period uses the universal number 99EU9999999999 in the customs declaration.

A warning belongs here: anyone declaring more plots as a precaution than actually supplied assumes responsibility for all of them. If one fails, the whole statement is non-compliant. Everything else, from the wording of Annex II to amendment and withdrawal, is in The EUDR due diligence statement; the reference number, its sharing and the customs codes are explained in EUDR reference number.

Customs and the external border

On import and export the reference number goes into the customs declaration with document code C716; Y codes mark the exemptions, for example Y129 for ex headings not covered. On import ten-digit TARIC codes are declared, on export eight-digit CN codes. Customs checks the status of the statement through the interface to the information system and suspends release if a check is ordered. Release is not proof of compliance; the authorities can still check afterwards.

Downstream actors that export state the reference numbers received from their suppliers; for them the Commission has announced a dedicated certificate code that is still outstanding. Anyone re-importing goods previously exported from the EU must be able to demonstrate the earlier placing on the market, otherwise the goods count as a first import. Details in The EUDR at export, re-import and re-export.

Controls and enforcement practice

The competent authorities check on a risk basis under Article 16, with the annual minimum rates from the country benchmarking: one percent of operators for low-risk countries, three percent for standard risk, nine percent for high risk, in each case of the operators sourcing from those countries. The information system creates a risk profile for every statement and assigns a status that the authorities see and the user does not.

In a check the authority examines the due diligence system, the risk assessment and mitigation, the Article 9 records and the geodata, where necessary with field inspections and laboratory analysis to determine the origin of wood. If it finds non-compliance it orders remedial action, can have the goods withdrawn from the market and imposes penalties. For products at the external border it can have release suspended, and a customs clearance expressly does not count as proof of compliance.

Two rules in the guidelines take the edge off the first months: the authorities are to support implementation and to ask operators to correct shortcomings first, and the measures taken by operators and traders to pass on information are taken into account in the authorities' risk analysis. Anyone who documents what they have done stands differently in a check than anyone who merely did it.

Authorised representatives and companies outside the Union

Operators and traders may under Article 6 mandate an authorised representative to submit the due diligence statement; responsibility for compliance stays with the principal, and the representative must produce the mandate on request. Operators established outside the Union that place relevant products on the market can submit statements through the information system; under Article 7 the first person established in the Union to make the product available is additionally deemed an operator, so that there is always a responsible actor in the EU. In online sales the operator is whoever actually supplies the product commercially, such as the retailer or the fulfilment service provider; the consumer who appears as importer in the customs declaration never is.

Penalties: the EU framework

Article 25 sets the framework the German act fills in. Fines must be proportionate to the environmental damage and the value of the products and, for legal persons, reach a maximum of at least four percent of Union-wide annual turnover; for repeated infringements the maximum is to be raised. Added to this are confiscation of the products and of the revenues gained, temporary exclusion from public procurement and public funding for up to twelve months, a temporary ban on placing relevant products on the market or exporting them, and, for serious or repeated infringements, a ban on using simplified due diligence. Member States publish judgments on infringements with company names. What the regulation does not have is a grace year: from the date of application checks and penalties are possible, even if under the guidelines the authorities are to start with support and correction.

Germany: act, authority, penalties, reliefs

Germany transposes the regulation through the EntwaldungsMG, which the cabinet adopted on 12 August 2026. It is to transpose one-to-one, without obligations beyond EU law, and to enter into force in essence on 30 December 2026; the Bundesrat and Bundestag deliberate in the autumn.

The Federal Office for Agriculture and Food becomes the central enforcement authority for import, export, processing and trade and works with customs. The Länder authorities supervise domestic primary production, that is wood, cattle and soya from German production. The penalty framework reaches up to four percent of annual turnover, provides criminal offences for intent, and allows sales bans and blocking of access to the information system for up to one year. For wood produced before 29 June 2023 the old EUTR regime continues to apply until the end of 2029.

The general administrative regulation, available as a ministry draft since 7 August, brings three reliefs for German primary production: an address instead of geodata for micro and small primary producers producing in Germany, collective declarations through forestry associations for their members' timber, and an opening also for medium and large companies where only a small part of the business concerns EUDR commodities, such as municipalities with their own forest. Enforcement is to be risk-based, using existing administrative data with on-site checks only on suspicion. All of that applies only to German production; import supply chains still need geodata. Until the Bundesrat and promulgation it is a draft, not a binding rule.

The information system and IT

The EU information system has been running again since the end of June 2026 and has been considerably expanded since Implementing Regulation (EU) 2026/1565. All roles can be held under one account, defined contingency arrangements apply during outages so that the flow of goods does not stop, and since the end of July the Commission has offered free trainings with recordings, suitable for a test run in your own team.

For companies with volume, three functions are decisive. The aggregated due diligence statement bundles many reference or identification numbers into one new statement, one number for customs and customers. The web services allow submitting and managing statements through an interface under common technical specifications, built for high volumes. And one statement can cover several batches of the same product over up to twelve months.

The practical consequence: anyone who structures master data and geodata now will find bulk submissions routine from December. Anyone who gathers them in December will find them a struggle. How the system works in detail is in EUDR information system; which software helps is in EUDR software compared.

The roadmap to 30 December

Internally, in the next two weeks. Identify relevant products through the customs code, determine the role per product, check size. Name a person responsible for implementation, in SMEs too. Review contracts, purchasing policies and IT interfaces.

Externally, in October. Write to suppliers and request EUDR information, with geodata for import supply chains. This is the step that takes longest, because it depends on the response time of the slowest supplier; four to twelve weeks is realistic. Apply for access to the information system, allow time for activation by the BLE.

In November. Set up processes and documentation, record the due diligence system under Article 12 in writing, submit first statements as a test, brief the customs agent on codes and reference numbers.

In December. Submit statements for the first shipments of the new year with lead time, carry reference and verification numbers on the shipments, supply downstream customers with numbers.

Free help is available in chamber of commerce formats, in the Commission's trainings and e-learning on the information system and in the BLE's information material.

The most common misconceptions

"We are only traders, this does not concern us." Traders collect information and keep it for five years; non-SME traders register and verify on concern. Only the statement falls away.

"As an SME we have until June 2027." Only operators that were micro or small enterprises by the end of 2024, and only outside the EUTR annex. Medium-sized enterprises and downstream actors of any size are due on 30 December 2026.

"As a downstream non-SME we need our own statement with a reference." Not since the amending regulation. Registration and verification on reasoned concern, no statement.

"Our product contains wood, so we are affected." Only if the customs code is in Annex I. A wooden toy under Chapter 95 is not covered.

"Export is out of scope." The regulation applies to exports as to imports, and the reference number must be in place before the export declaration.

"We would rather declare all the plots that might be involved." Anyone declaring too much is liable for all of it. A hit on one superfluous plot makes the whole statement non-compliant.

"The regulation will be postponed again anyway." The simplification package is complete, the legal acts are in force, the deadlines stand.

How Polygon One helps

Polygon One is end-to-end software for the EUDR: capture of geodata and legal information through a supplier portal without mandatory accounts, satellite-based deforestation analysis and legal analysis per plot, and submission of due diligence statements through the connection to the information system, with reference and verification numbers returned to the order. The role is kept per product and supply relationship, because the regulation demands it, and from that follows per unit whether full due diligence, simplified due diligence or only the collection under Article 5(3) applies.

What the software does not do: determine your role in law, exercise due diligence on your behalf or sign the assurance in the statement. That stays with you, and the regulation intends it to. If you would like to see what your supply chain looks like in this structure, book a demo or read on at the EUDR module product page.

Download the EUDR Compass

Four pages for management, purchasing and compliance: the deadlines with their assignment, the four-step check, the obligations matrix per role in the version of the amending regulation, and the roadmap to 30 December 2026.

• Download: EUDR Compass 2026 (PDF)

Frequently asked questions

From when does the EUDR apply?

From 30 December 2026 for large and medium operators and all downstream operators and traders, regardless of size. From 30 June 2027 for micro and small enterprises that are operators, except for EUTR-annex timber. Newly added products from 30 December 2027.

Will the EUDR be postponed again?

No. The simplification package of May 2026 is complete, its legal acts are in force, and no third postponement is foreseen.

Which commodities are covered?

Wood, coffee, cocoa, rubber, oil palm, cattle and soya and the derived products listed in Annex I. The customs code is decisive.

What changed in the product scope?

Since 18 September 2026 leather, conveyor belts, other soft rubber articles and vehicle seats are removed. Soluble coffee, palm oil derivatives, soaps with oil palm and frozen cattle tongues are added from the end of 2027.

Who is an operator?

Anyone who first places relevant products on the EU market commercially or exports them. For imports that is the importer in the customs declaration.

Do traders have to submit a due diligence statement?

No. Traders and downstream operators collect the identity of their suppliers and customers and the reference numbers and keep them for five years. Non-SMEs additionally register and verify on reasoned concern.

How is company size counted?

Two of three criteria on the balance sheet date, without group consolidation. Small up to 5 million euros balance sheet total, 10 million euros turnover and 50 employees; medium up to 25 million, 50 million and 250.

Do I need geodata for German timber?

As an operator yes, with polygons from four hectares. Micro and small primary producers may give a postal address, and the planned administrative regulation is to ease that for German production.

What happens on infringement?

In Germany fines up to four percent of annual turnover, criminal offences for intent, sales bans and blocking of system access for up to one year, under the draft EntwaldungsMG.

Do I have to submit a statement for every shipment?

No. One statement can cover several shipments until the quantity is used up, for at most one year.

Does the EUDR also apply to exports?

Yes. The reference number must be in the export declaration, including for deliveries to Switzerland, the United Kingdom or Norway.

Where do I find the current status?

In EUDR current status, which we update monthly until the date of application and quarterly thereafter.

Sources and status: Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650. Delegated Regulation (EU) 2026/2102 (OJ L of 17 September 2026). Implementing Regulation (EU) 2024/3084 as amended by Implementing Regulation (EU) 2026/1565. Commission guidelines, OJ C/2026/3896 of 20 July 2026. Commission FAQ, fifth edition of 4 May 2026. Cabinet draft of the EntwaldungsMG of 12 August 2026 and AVV ministry draft of 7 August 2026. Commission country benchmarking. Webinar "Neuerungen EUDR" for IHK Arnsberg of 26 August 2026, updated to 18 September 2026. This article is not legal advice.

Photos: Bernd Dittrich, allPhoto Bangkok, Dimitri Karastelev, all via Unsplash.