EUDR 2026: New Product Scope, Deadlines and Due Diligence Guide

The EU Deforestation Regulation (EUDR) is now an operational readiness issue, not a distant sustainability policy. Its main obligations start applying on 30 December 2026 to large and medium enterprises and to micro and small operators already covered by the EU Timber Regulation. Most other micro and small enterprises have until 30 June 2027.

The rule can affect a business outside Europe whenever its cattle, cocoa, coffee, oil palm, rubber, soy or wood products enter the EU. But commodity content alone does not decide scope. The product's Combined Nomenclature or Harmonised System code must appear in Annex I, and the company's role in the transaction determines which obligation it owns.

The European Commission's July 2026 implementation package adds two immediate planning consequences. First, an adopted delegated act would change Annex I by removing some products and adding others. That act is not yet in force as of 2 September 2026 because it remains subject to European Parliament and Council scrutiny. Second, Commission Implementing Regulation (EU) 2026/1565 now establishes technical rules for the EUDR Information System.

This guide turns those developments into a scope test, responsibility map and implementation checklist for importers, exporters, manufacturers, processors and compliance teams.

At a Glance

Does the EUDR Apply to Your Product?

Use a four-part test for each product and transaction. A company-level statement such as “we sell coffee” or “we use wood packaging” is not precise enough.

1. Is a relevant commodity involved?

The seven commodities are cattle, cocoa, coffee, oil palm, rubber, soy and wood. The EUDR also reaches specified products made from or containing these commodities, such as certain meat, chocolate, tyres, furniture, paper and wood products.

2. Is the product code listed in Annex I?

Annex I defines relevant products through CN/HS codes. The code is the legal boundary: a product made with a relevant commodity can still be outside scope when its code is not listed. Conversely, a listed product requires analysis even when the commodity is only one input.

Create a controlled product register containing the customs code, commodity, product description, country of production, supplier, EUDR scope decision and evidence for that decision. Do not rely only on marketing names or supplier categories.

3. Is the activity covered?

The EUDR concerns placing a relevant product on the EU market, making it available on the EU market, or exporting it from the EU in the course of a commercial activity. The same company can hold different roles across different transactions.

For example, an EU company importing coffee beans for release into free circulation is generally an upstream operator. A company buying those beans and producing in-scope coffee products from material that already underwent due diligence may be a downstream operator. A retailer selling an unchanged relevant product is generally a trader.

4. Does a specific exclusion or transition apply?

The legal text and current Commission guidance address boundaries including used goods, waste, packaging used only to support another product, samples and transitional products. Apply those rules to the exact facts and retain the reasoning. An exclusion should be documented as carefully as an inclusion.

What Changed in the 2026 Product-Scope Package?

On 13 July 2026, the Commission adopted a delegated act to amend Annex I. According to the Commission announcement, it would make targeted additions, removals and clarifications.

These changes are not all current law yet. A Commission delegated act must pass its scrutiny period before entering into force. Until then, use the current consolidated EUDR and Annex I for legal decisions, while maintaining a second “expected scope” field for implementation planning.

This two-state register prevents two opposite errors: dropping controls too early for a product expected to leave scope, or waiting until the final publication to begin collecting data for a newly added product.

Who Owns Each Obligation?

Regulation (EU) 2025/2650 changed the original reporting model. The principal due diligence and filing obligation now sits with upstream operators, while downstream operators and traders have lighter traceability duties.

A micro or small primary operator is a narrow category. It must be a natural person or qualifying micro or small undertaking, be based in a low-risk country, directly place or export its own primary production, and have grown, harvested, obtained or raised that product where it is based. Small size alone does not qualify an importer or processor for this simplified declaration.

Non-EU structures need extra attention. If a non-EU entity itself imports under release for free circulation, it may act as an upstream operator. The first EU-based person that then makes the product available can also be an operator. Map the importer of record, EU Economic Operators Registration and Identification (EORI) holder, contracting seller and first EU buyer rather than assuming the overseas producer owns the filing.

What Must Upstream Due Diligence Establish?

An upstream operator may place or export a relevant product only after its due diligence concludes that there is no risk or only a negligible risk of non-compliance. The process has three legal stages.

Stage 1: collect Article 9 information

The data package includes:

• Product description, trade name and applicable commodity or product inputs
• Quantity and the units required for the relevant customs code
• Country of production and, where relevant, the region within it
• Geolocation of every plot where the commodity was produced, plus the production date or time range
• Supplier and direct downstream customer information
• Verifiable evidence that the product is deforestation-free
• Verifiable evidence that production complied with relevant law in the country of production

If required information cannot be collected, the product cannot proceed to the market or export step. Certification can support the evidence package, but it does not replace the operator's legal responsibility or the required data.

Stage 2: assess risk

The operator evaluates the evidence against Article 10 criteria. These include the country risk classification, forest presence, prevalence of deforestation, indigenous peoples' rights and claims, corruption and law-enforcement conditions, supply-chain complexity, mixing risk, document reliability, sanctions or conflict, and previous non-compliance.

The decision must be reproducible. Retain the source used, the evaluator, the date, the risk finding and the logic connecting the evidence to the result.

Stage 3: mitigate more-than-negligible risk

Where the assessment does not reach no or negligible risk, the operator must mitigate before placement or export. Measures can include collecting more information, commissioning independent surveys or audits, segregating material, changing a supplier, or supporting supplier capability. The process ends only when residual risk is negligible.

Operators sourcing entirely from low-risk countries may use simplified due diligence if there is no mixing with material from standard-risk, high-risk or unknown origins. They must still collect Article 9 information and remain alert to information suggesting risk. “Low risk” does not mean “no evidence required.”

Build Evidence at Plot and Shipment Level

The most consequential EUDR data requirement is geolocation. Coordinates must connect each relevant commodity in a product to every plot where it was produced. For plots larger than four hectares, the original regulation requires polygons rather than a single point, except for cattle where the location logic concerns establishments.

A workable evidence model separates stable master data from transaction data:

The control should survive aggregation and processing. If one chocolate shipment contains cocoa from multiple plots, every applicable plot must remain traceable. Mixing with material of unknown origin is a risk factor, not an administrative gap that can be resolved by averaging.

Information System: What to Test Before December

Commission Implementing Regulation (EU) 2026/1565 establishes operational rules for the EUDR Information System. The Commission system supports user submissions and bulk machine-to-machine connections through an application programming interface (API).

Do not treat successful registration as operational readiness. Test the full transaction path:

1. Register each entity under the correct role and connect its EORI or other required identifier.
2. Validate that product codes, quantities, countries and geolocation files pass system rules.
3. Submit a test statement through the intended user-interface or API route.
4. Capture statement reference and verification numbers without manual rekeying.
5. Pass the reference to the first downstream buyer and retain it against the transaction.
6. Correct or withdraw data using an approved process when a shipment changes.
7. Reconcile submitted quantities to customs, enterprise resource planning and shipment records.
8. Test access control, delegation, audit logging, API failure, duplicate submission and business continuity.

The Commission continues to update technical documentation and functionality. Treat system manuals and API specifications as controlled external dependencies with an owner, monitored version and regression-test plan.

Deadlines: Fixed, Later and Still Evolving

Do not use the 2027 small-business date as a general supplier exemption. A large or medium importer that starts on 30 December 2026 still needs evidence from small non-EU suppliers before its own deadline.

What Enforcement Exposure Looks Like

Member States set and apply penalties, but Article 25 requires effective, proportionate and dissuasive measures. For legal persons, the maximum fine available under national rules must be at least 4% of total annual EU-wide turnover in the financial year before the fining decision and may need to exceed the economic benefit obtained.

The regulation also provides for confiscation of relevant products or revenue, temporary exclusion from public procurement and public funding, and temporary prohibitions on placing, making available or exporting relevant products in serious or repeated cases. Customs and competent-authority controls also create an immediate market-access risk when a filing or product cannot be validated.

EUDR Implementation Checklist

1. Establish two product-scope registers

Record scope under the law currently in force and expected scope under the July 2026 delegated act. Include the exact CN/HS code, commodity input, exclusion rationale and owner. Reconcile both lists when the final act appears in the Official Journal.

2. Map transaction roles, not just legal entities

For each import, production, processing, sale and export route, identify the upstream operator, first downstream buyer, later downstream actors, EORI holder and authorised representative. One entity may occupy more than one role.

3. Contract for plot-level evidence

Update supplier requirements for geolocation, production dates, quantity links, legality evidence, change notification and audit access. Define accepted formats and validation rules instead of asking suppliers for generic “EUDR compliance.”

4. Create a reproducible risk method

Map Article 10 criteria to sources, scoring logic, reviewer authority and escalation thresholds. Include checks for indigenous rights, document reliability, mixing, circumvention and supply-chain complexity.

5. Design mitigation and release controls

Define who can approve mitigation and who can block a shipment. The commercial release control must verify a negligible-risk conclusion and accepted statement before EU placement or export.

6. Integrate the Information System

Choose manual or API submission based on volume, then test validation, identifiers, corrections, reconciliation and continuity. Store reference numbers against the exact lot or shipment and pass them to the first downstream buyer.

7. Retain evidence and monitor exceptions

Keep due diligence and required supply-chain records for at least five years. Monitor supplier, plot, country classification, product code and legal changes that can invalidate an earlier decision.

8. Run a pre-deadline transaction test

Select one high-volume or complex product and execute the process from classification through supplier evidence, plot validation, risk assessment, mitigation, filing, customs data and downstream handoff. Record failures and retest before production launch.

Frequently Asked Questions

When does the EUDR start to apply?

The main EUDR obligations apply from 30 December 2026 to large and medium enterprises and to micro and small operators already covered by the EU Timber Regulation. They apply from 30 June 2027 to most other micro and small enterprises.

Which commodities are covered by the EUDR?

The EUDR covers cattle, cocoa, coffee, oil palm, rubber, soy and wood, but only products identified by the Combined Nomenclature or Harmonised System codes in Annex I are in scope. A product's material alone is not enough to decide applicability.

Who must conduct EUDR due diligence and file a statement?

The upstream operator that first places an in-scope product on the EU market or exports it must conduct due diligence and submit a due diligence statement. A qualifying micro or small primary operator uses a simplified declaration instead.

Do downstream operators and traders need to file due diligence statements?

No. Under the December 2025 amendment, downstream operators and traders do not conduct due diligence or submit their own statements. They have record-keeping and notification duties, and the first downstream buyer must retain the upstream reference number or simplified-declaration identifier.

Are the Commission's July 2026 product-scope changes already in force?

Not yet as of 2 September 2026. The Commission adopted the delegated act on 13 July 2026, but it remains subject to European Parliament and Council scrutiny before it can enter into force. Companies should scenario-plan the changes and confirm the final Official Journal text before changing legal scope decisions.

Research and Review

This guide was prepared from Regulation (EU) 2023/1115 and its December 2025 amendment, the Commission's July 2026 implementation package, Commission Implementing Regulation (EU) 2026/1565, the April 2026 guidance and FAQ, and the Commission's current implementation pages. Legal status, application dates and implementation material were reviewed on 2 September 2026.

The article distinguishes binding legislation from Commission guidance and from the product-scope delegated act that remained under legislative scrutiny on the review date. It is an implementation aid, not legal or customs-classification advice. Confirm final product codes against the latest consolidated Annex I and obtain specialist advice for disputed classifications. See our editorial policy for sourcing, automation and correction practices.

Official Sources

1. Regulation (EU) 2023/1115 — controlling EUDR text, including product conditions, due diligence and penalties
2. Regulation (EU) 2025/2650 — amended application dates and simplified supply-chain roles
3. Commission updates product scope and digital tools — 13 July 2026 package and status of the delegated act
4. Commission Implementing Regulation (EU) 2026/1565 — technical rules for the EUDR Information System
5. EUDR roles and responsibilities — Commission role mapping after the 2025 simplification
6. EUDR due diligence — Commission explanation of information, risk assessment and mitigation
7. EUDR implementation FAQ — Commission publication page updated 21 August 2026
8. EUDR country classifications — current country risk list