EUDR: what the deforestation regulation actually requires of you, after two amendments.

What it actually is, in plain English

The European Union Deforestation Regulation (EUDR) is Regulation (EU) 2023/1115. It prevents seven commodities — cattle, cocoa, coffee, oil palm, rubber, soya, and wood — from being placed on the EU market or exported from it if they were grown on land deforested after 31 December 2020.

It does not matter that the deforestation was legal in the country of production. It does not matter that the operator (the legal term for whoever first places the product on the EU market) did not know. The legal threshold is whether the land was forest, in the regulation's specific definition, on 31 December 2020 — and whether it has been converted to agricultural use since.

The regulation defines forest as land of more than 0.5 hectares with trees taller than 5 metres and canopy cover above 10 percent, or trees able to reach those thresholds in situ, excluding land predominantly under agricultural or urban use. The definition is borrowed from the Food and Agriculture Organization (FAO). It is written into Article 2 of the regulation. In scope: forest, in the FAO sense. Out of scope: agroforestry, and plantation forests already established as forest. The line is sharper than it looks; consult the Commission's FAQ before you assume.

The seven commodities and their derived products — leather, chocolate, tyres, furniture, biofuels, soybean meal, paper — are listed by Combined Nomenclature (CN) code in Annex I. Check your CN code; the Annex was amended in December 2025 and printed products under Chapter 49 (books, newspapers, printed matter) were removed from scope. The Commission decided that books are not, on balance, a major driver of global deforestation.

Why it exists

EU consumption is, on the Commission's own impact-assessment numbers, responsible for roughly ten percent of global deforestation embodied in trade, with palm oil, soya, and beef the largest contributors. The Commission's view, set out in the regulation's recitals, is that closing this market to deforestation-linked goods reduces demand for the underlying commodities — and therefore the pressure on forests in producer countries.

You can disagree with the policy. You still have to comply.

The two amendments — what actually changed

The regulation was adopted on 31 May 2023 and entered into force on 29 June 2023. Its main obligations were originally meant to apply from 30 December 2024 for large operators, and 30 June 2025 for micro and small enterprises.

That deadline did not survive. In December 2024, an amending regulation postponed application by twelve months. In December 2025 — three weeks before the new deadline — Regulation (EU) 2025/2650 postponed it again, this time also rewriting parts of the substance. It has now been delayed twice and rewritten once. The third time will probably be a different article.

The current binding application dates are 30 December 2026 for large and medium operators, and 30 June 2027 for micro and small enterprises. These are the dates that apply. Earlier dates you may have read about in 2024 or earlier 2025 are no longer in force.

The December 2025 amendment did three other consequential things, confirmed in the Council's adoption press release. First, it introduced a “first downstream operator” concept: only the first downstream actor in the EU after first placement must collect and pass on the due diligence statement reference number. Subsequent traders and processors no longer file their own. Second, it exempted micro and small primary operators in low-risk countries from full due diligence — they file a one-time simplified declaration. Third, it removed printed products from Annex I.

The Commission was also tasked with a simplification review by 30 April 2026. There may be more changes. Build for flexibility.

“The geolocation of all plots of land where the relevant commodities were produced shall be provided as a single point of latitude and longitude, or, where the area is more than four hectares, as polygons.”— Article 9(1)(d), Regulation (EU) 2023/1115

Key dates

Who has to file

The regulation distinguishes operators (the first to place a relevant product on the EU market or export it from the EU) from traders (anyone else in the supply chain who makes the product available). After Regulation (EU) 2025/2650, a third category exists in practice: downstream operators and downstream traders, who handle products already covered by an upstream due diligence statement.

In practice: if you import cocoa beans from Côte d'Ivoire to a Belgian port, you are an operator and you file. If you buy those beans from the importer and resell to a chocolatier, you are the first downstream actor — you collect and retain the reference number but do not file a fresh statement. If you buy chocolate from the chocolatier and put it in retail bags, you are further down still and your obligations are largely informational.

The operator's job has not changed in substance. The downstream simplification means the EU information system handles a smaller volume of statements, not that the underlying due diligence is weaker.

The data you'll need

Article 9 of the regulation is the field list. For every batch you place on the market or export, you collect:

• The Combined Nomenclature (CN) code from Annex I.
• Quantity in kilograms, plus supplementary units where applicable.
• Country of production, and where applicable, the subnational region.
• Geolocation of every plot of land where the commodity was produced.
• Date or time range of production.
• The supplier's name, address, and email.
• A statement that the product is deforestation-free and produced in compliance with the laws of the country of production.

The geolocation rule is the operationally hard one. Geolocation is defined in Article 2(28): latitude and longitude with at least six decimal digits. Six decimal digits resolve to roughly eleven centimetres. For plots up to 4 hectares (and for cattle establishments), a single point is enough. For plots above 4 hectares used for non-cattle commodities, you provide polygons — enough latitude and longitude points to describe the perimeter. The format the EU information system accepts is GeoJSON (a JSON-based file format for geographic data) in the World Geodetic System 1984 (WGS84) projection, per the Commission's traceability guidance.

There is no minimum threshold by quantity or value. A 200-kilogram shipment of cocoa from a 0.6-hectare farm in West Africa needs a coordinate set as much as a 50-tonne palm-oil shipment from Indonesia.

The country benchmarking

Article 29 requires the Commission to classify each country (or part of a country) into one of three risk tiers: low, standard, or high. The implementing act — Regulation (EU) 2025/1093 — was published on 22 May 2025.

The result was, charitably, restrained. Four countries received high-risk status: Belarus, Myanmar, North Korea, and Russia — all of which were already subject to UN or EU sanctions affecting EUDR commodities. 140 countries were classified low-risk, including all EU member states, the United States, Canada, China, Japan, Australia, the United Kingdom, and South Africa. The remainder — roughly fifty countries, including all the major producers of the regulated commodities (Brazil, Indonesia, Malaysia, Côte d'Ivoire, Ghana) — fall into the standard tier by default.

The European Parliament adopted a non-binding resolution in July 2025 calling on the Commission to repeal and revise the list. The Commission has not. The classifications stand.

The classification decides how much due diligence you do. From low-risk countries, you collect the data and file the statement, but you do not have to perform a formal risk assessment or risk mitigation. From standard-risk countries, you do the full programme. From high-risk countries, you do the full programme and competent authorities check more of your shipments.

The hard part

The hardest part of EUDR compliance is producer-side data, particularly for smallholder-dominated supply chains. Most of the world's cocoa is grown by smallholder farmers, primarily in West Africa. They typically sell to intermediaries at the farm gate. Many do not have geolocation coordinates for their plots. Many do not have written land tenure documents. Many cannot read.

The EUDR does not exempt their buyers. If you import cocoa from Côte d'Ivoire, you must — somehow — gather plot-level coordinates for thousands of farms. This is what the regulation calls due diligence; it is what the supply chain calls homework that nobody used to do.

The December 2025 amendment provided a partial answer: micro and small primary operators in low-risk countries can submit a one-off simplified declaration. But Côte d'Ivoire is not low-risk, and most cocoa-producing countries are standard-risk. The operational burden falls on whoever sits between the smallholder and the EU port.

There is no clean answer. Cooperatives, traders, and importers are building infrastructure — sometimes from scratch — to collect coordinates, photograph land tenure documents, and verify against satellite imagery. The Commission has issued guidance and a FAQ; both run to dozens of pages and grow longer.

What the filing actually looks like

The EUDR Information System is built on TRACES (the Commission's Trade Control and Expert System), the platform already used for agri-food enforcement. The rules for its operation are set out in Implementing Regulation (EU) 2024/3084. Operators register, identify themselves, and submit a Due Diligence Statement (DDS) before placing the product on the market or exporting it.

On a Tuesday morning in February 2027, in roughly this order:

1. Your supplier in producer country X confirms a shipment, with the GeoJSON file already prepared.
2. You log into the EUDR Information System in TRACES.
3. You submit the DDS — CN code, weight, country of production, supplier, geolocation file, time range of production, and the deforestation-free attestation.
4. The system returns a reference number.
5. You include the reference number on the customs declaration.
6. Customs cross-check the reference against the Information System.
7. The shipment is released.

Step 1 — the file from the producer — is where most of the failure happens. The other steps are mechanical.

Penalties

Article 25 sets the floor. EU member states must lay down national penalties that are effective, proportionate, and dissuasive. The minimum maximum fine is at least 4 percent of total annual EU-wide turnover for the financial year preceding the fine, and may be raised higher to exceed any economic benefit of non-compliance. Confiscation of the product. Confiscation of the revenues. Up to twelve months of exclusion from public procurement and public funding. Temporary prohibition on placing or exporting the product. For repeat or serious offenders, loss of access to simplified due diligence.

The Commission will publish the names of legal persons found to have infringed the regulation. There is no minimum threshold by quantity or value: a single missed plot can in principle trigger the full penalty stack. In practice, for the first year or two of application, expect competent authorities to be lenient on first offences and harder on serial or wilful breach. This is not a guarantee; it is a pattern from comparable regulations like the old EU Timber Regulation that EUDR replaces.

How Bindu handles it

Bindu maintains the EUDR as an open, machine-readable rules file in our regulations repository — Article 9 fields, geolocation schema, country benchmarking lookups, derived-product CN codes, and the changes from Regulation (EU) 2025/2650 are all encoded as structured YAML. Bindu's compliance agent reads from that file, validates a shipment against the current rules, prepares the DDS, and produces an importer-ready dossier. When the regulation changes — and it will change again — the rules file updates and your filings adjust without anyone rewriting a spreadsheet. If you want to see how it works on a real shipment of yours, book a 30-minute demo.

Priya Ramaswamy leads regulations at Bindu. She writes about the rules importers actually have to file, and is sceptical of anyone who claims the answer is more spreadsheets.