Navigating the European Deforestation Regulation

October 22, 2026

Introduction

The EUDR has a product-based approach and imposes extensive due diligence requirements on enterprises to ensure that such products do not result from deforestation, forest degradation or breaches of local environmental and social laws.

Forests offer a wide array of environmental, economic and social benefits. However, deforestation and forest degradation are taking place at an alarming rate. Therefore, the European Union (“EU”) has taken a significant step with the introduction of the Regulation (EU) 2023/1115 concerning the making available on the EU market and the export from the EU of certain commodities and products associated with deforestation and forest degradation (“EUDR”).

The EUDR repeals and replaces the EU Timber Regulation (995/2010) which only applied to timber and certain types of timber products. The scope of the EUDR is much broader.

(Updated) date of application

The EUDR entered into force on 29 June 2023. As originally adopted, large and medium-sized enterprises would have been subject to the EUDR starting from 30 December 2024, and micro- and small enterprises would have followed as from 30 June 2025.

However, in response to concerns raised by countries and companies both within and outside the EU, the European Commission proposed in October 2024 to delay the EUDR’s application by 12 months. This proposal was approved by the Council on 16 October 2024 and by the European Parliament on 14 November 2024. Subsequently, the European Parliament referred the file back to the committee for interinstitutional negotiations. On 3 December 2024, negotiators from the European Parliament and the Council reached a provisional political agreement to postpone the application of the new rules under the EUDR. 

Large and medium-sized enterprises would have to respect the obligations under EUDR as of 30 December 2025, whereas micro- and small enterprises would have time until 30 June 2026. The additional timeframe was designed to help companies implement the rules more smoothly from the outset, without compromising the EUDR’s objectives. The postponement was formally adopted as Regulation (EU) 2024/3234 and was published in the EU Official Journal of the European Union on 23 December 2024.

A further, second 12 month-postponement has since been adopted. Regulation (EU) 2025/2650 was published in the Official Journal of the European Union on 23 December 2025. Under the EUDR as it now stands, the core obligations apply from 30 December 2026 for large and medium-sized enterprises, rather than from 30 December 2025. For operators that are natural persons, or micro- or small undertakings, established as such by 31 December 2024, those obligations now apply from 30 June 2027, rather than from 30 June 2026. 

Scope

The EUDR applies to seven commodities: cattle, cocoa, coffee, oil palm, soya, rubber and wood. It also applies to certain relevant (derived) products if they contain, have been fed with or have been made using any of the above-mentioned commodities (e.g. leather, chocolate), which are listed in Annex I of the EUDR. These products can be identified by their Combined Nomenclature tariff classification code.

A specific check using the tariff classification code is essential for a final determination of whether derived products are subject to the EUDR.

Obligations

The EUDR distinguishes between operators, downstream operators and traders. An operator is anyone who, in the course of a commercial activity, places a relevant product on the EU market for the first time or exports it from the EU (other than a downstream operator). A downstream operator is a category introduced with effect from the second postponement of the EUDR: it covers anyone who places on the market or exports relevant products, which are at their turn made using relevant products that are already covered by a due diligence statement or a simplified declaration, and its obligations are aligned with those of traders rather than operators. A trader is anyone else in the supply chain who, in the course of a commercial activity, makes relevant products available on the EU market. 

As the EUDR follows a product-based approach, the same company may qualify as an operator, downstream operator or trader depending on the particular relevant product and transaction concerned. Companies should therefore determine their role, and the corresponding obligations, on a product-by-product and transaction-by-transaction basis.

The core due diligence obligations rest with operators. Before placing a relevant product on the EU market or exporting it, an operator must exercise due diligence to demonstrate that the relevant product:

• is deforestation-free;
• has been produced in accordance with the relevant legislation of the country of production; and
• is covered by a due diligence statement, unless the specific simplified regime for micro or small primary operators applies.

The due diligence process involves collecting the information required under the EUDR, assessing whether there is a risk that the relevant products do not comply with the EUDR and, where the identified risk is not negligible, adopting adequate risk mitigation measures before the products are placed on the market or exported.

Following the amendments introduced by Regulation (EU) 2025/2650, downstream operators and traders are no longer required to submit their own due diligence statements for products already covered upstream. This significantly reduces duplication of due diligence requirements further down the supply chain. They nevertheless remain subject to specific obligations under the EUDR concerning, among others, the collection and retention of relevant supply-chain information. The European Commission has confirmed that the revised regime relieves downstream operators and traders from the obligation to submit due diligence statements in the EUDR Information System.

A specific, lighter regime also applies to micro or small primary operators. This category covers certain natural persons and micro or small undertakings that place on the market or export relevant products which they themselves have produced. Instead of submitting a full due diligence statement, qualifying micro or small primary operators can submit a simplified declaration through the EUDR Information System. The Commission's updated 2026 materials expressly recognize this as a simplified specific regime for micro and small primary operators.

Where the relevant commodities or products originate in a country, or parts thereof, classified as low risk, operators may benefit from simplified due diligence. Under this regime, the information-gathering requirements continue to apply, while the ordinary risk assessment and risk mitigation requirements are subject to the conditions set out in the EUDR.

The EUDR maintains a three-tier country benchmarking system, classifying countries or parts thereof as low, standard or high risk. The proposed additional “no-risk” category was not ultimately introduced. Pending the Commission's benchmarking exercise, countries initially received a standard risk classification. The Commission subsequently published the first country classification list on 22 May 2025. The applicable classification is relevant both to the due diligence requirements and to the level of scrutiny exercised by competent authorities.  

Due diligence statements and simplified declarations are handled through the EUDR Information System. Regulation (EU) 2025/2650 amended the system of submissions to reflect the simplified obligations, and the Commission subsequently adapted the implementing rules governing the Information System, including in relation to simplified declarations by micro or small primary operators.

Enforcement

The Member States’ competent authorities must oversee compliance with the EUDR and determine the specific penalties (which must be effective, proportionate and dissuasive), applicable to operators, downstream operators and traders. The EUDR provides some examples, such as:

• fines, where the maximum amount for legal persons is at least 4% of the annual turnover generated within the EU from the previous year (which can be increased to exceed the potential economic benefit gained);
• confiscation of the relevant products or the revenues gained from transactions from the relevant products;
• temporary exclusion for a maximum duration of 12 months from public procurement processes and from access to public funding;
• in the event of a serious infringement or of repeated infringements, temporary prohibition from placing or making available on the EU market or exporting and prohibition from exercising the simplified due diligence.

Furthermore, in case of non-compliance with the EUDR, Member States’ competent authorities may take interim measures (e.g. to suspend the placing or making available on the EU market) or take corrective actions (e.g. withdrawing or recalling the relevant product immediately).

Substantiated concerns about the non-compliance with the EUDR may also be reported to the Member States’ competent authorities by natural or legal persons.

Lastly, the EUDR also foresees that the European Commission can publish the name of the company that infringed the EUDR and the conduct that caused the infringement.

The EUDR forms part of a broader wave of EU legislation imposing sustainability, due diligence and supply-chain requirements on companies, alongside instruments such as the PPWR, EU Forced Labour Regulation and CSDDD. Companies should therefore consider EUDR compliance as part of their broader supply-chain compliance framework rather than in isolation.

EY Law can assist companies in preparing for EUDR compliance, from determining whether products fall within scope and identifying the company's role in the supply chain to assessing due diligence processes, contractual arrangements and risk mitigation measures. Our broader, harmonized approach to EU supply-chain regulations can also help companies identify synergies between the EUDR and other emerging regulatory requirements, reducing duplication and supporting a more efficient compliance framework.