EUDR: what actually has to be working by 30 December

The Regulation applies from 30 December 2026 for large and medium operators, downstream operators and traders. Natural persons, and micro and small undertakings that were established as such by 31 December 2024, get until 30 June 2027.

With one carve-out that catches people. The later date does not apply to products that were covered by the Annex to the old EU Timber Regulation. A micro or small business handling those products is on 30 December 2026, the same as everyone else. If you are small and your range mixes wood with coffee or cocoa, you have two different dates six months apart running across the same order book.

Which gives most sites three months, and a great many food manufacturers are preparing for the wrong regime.

The December 2025 amendment did more than move the date. It rewrote where the burden sits. Full due diligence, meaning the information collection, risk assessment and risk mitigation duties in Articles 9 to 11, falls on the person who first places a relevant product on the EU market. Everyone downstream of that person is exempt from that work. The Commission's frequently asked questions, now in their fifth iteration, put it flatly: there are no due diligence obligations downstream.

Exempt from due diligence is not the same as exempt. Downstream operators and traders keep real legal duties on traceability and on reporting, non-SMEs pick up a verification duty and a registration requirement, and all of it is enforceable. But the shape of the job is completely different, and so is its cost.

If you are a food manufacturer buying cocoa, palm, soy or coffee from an EU importer, that sentence is the most important thing you will read about EUDR this year. And if you import any of it yourself, even for your own use, it does not apply to you at all.

So the first job is not building a system. It is working out which of three things you are.

Operator, downstream operator, trader

An operator places a relevant product on the EU market, or exports it, for the first time. An importer of cocoa beans is an operator. So is an EU cattle farmer selling live cattle. Operators do the full job: collect geolocation, assess risk, mitigate it to negligible, submit a due diligence statement before the product moves.

A downstream operator places on the market or exports a relevant product made using relevant products that are already covered by a due diligence statement or a simplified declaration. A chocolate manufacturer buying beans from an importer and making chocolate is a downstream operator. So is a company buying rough wood from an EU forest owner and exporting it.

A trader makes a relevant product available on the market without being either of the above. The retailer selling that chocolate is a trader.

Downstream operators and traders have the same obligations as each other, differing only by company size.

The tempting shortcut is to assume you are downstream because you are a manufacturer rather than an importer. That shortcut has a hole in it, and the hole is the word "import".

The trap: buying direct makes you an operator

Placing a product under the customs procedure "release for free circulation" counts as placing it on the market. It counts even when the product never gets sold on, and even when you bought it purely for your own business.

The Commission's examples are unambiguous. A car company that imports tyres to build cars is an operator for those tyres. A company that imports wooden tables and chairs for its own staff to use is an operator for the furniture. A farmer who imports soya bean meal to feed his own chickens is an operator for the meal, even though chicken is not a relevant product and he has no EUDR obligations when he sells the birds.

Apply that to a food site. If you buy your palm oil, cocoa butter or soy lecithin through an EU trader or importer, you are downstream. If your procurement team has cut out the middleman on any of those lines and you are the importer of record, you are an operator for that line, with the full geolocation and due diligence obligation, regardless of what you do with it afterwards.

Most sites are a mixture. That is the point. The question is not what your company is, it is what you are for each line you buy.

If you are downstream: the traceability duty

This is the first of your duties, and the one that decides what you build. Two more follow in the next section, so this is not the whole list.

Collect and keep information about your direct business partners, both suppliers and commercial customers: name, registered trade name or trade mark, postal address, email address, and web address where there is one. Keep it for five years from the date you place or make the product available. Make it available to a Competent Authority on request.

Where your direct supplier is an operator, you are a "first downstream operator" and you also keep the due diligence statement reference numbers or declaration identifiers they pass to you.

That is the traceability duty, plus two things inside it that matter more than they look.

You do not have to go looking. The obligation to pass on the reference number sits with the operator, not with you. You are not required to work out where you sit in the chain, or to chase suppliers for numbers, or to investigate whether a given supplier is an operator. Acting in good faith, you may assume a supplier is not an operator if they do not send you numbers. The only exception is where you actually know your supplier is an operator and they are not passing the number on, in which case you must stop placing the product.

There is no required system. The Commission is explicit that keeping this information does not oblige you to store it in any particular system or database, and does not require you to systematically check the content or validity of the reference numbers you receive. It is enough that you can retrieve and compile the information within a reasonable period when a Competent Authority asks, or when a substantiated concern arises.

One structural detail worth catching, because it decides how you build this. You must be able to link reference numbers and declaration identifiers to incoming product flows, not to outgoing ones. You do not have to trace a given reference number through to the finished pallet that left last Tuesday. If you have been scoping a project to carry EUDR references through your production records to finished goods, stop and check whether you are building something the Regulation does not ask for.

If you are a non-SME downstream operator or trader, add one thing: you must register in the Information System.

The other two duties

Being downstream does not make you passive, and these are the obligations that catch people who assumed exemption from due diligence meant exemption full stop.

Article 5(5) reporting. Every downstream operator and trader, SME or not, must immediately inform the Competent Authority when they obtain or are made aware of new information, including a substantiated concern, indicating that a product they have placed or made available is at risk of non-compliance. You must also tell the downstream operators and traders you supplied it to.

Read "made aware" carefully. The FAQ says a company should be considered aware if the information reaches it by email, or during a meeting with its employees, or from the Commission, national authorities, other private entities, or the media. A campaign group publishing something about one of your suppliers is not something you can decline to have seen.

Article 5(6) verification, for non-SMEs. Where there is a substantiated concern, a non-SME downstream operator or trader has to verify that due diligence was exercised and that risk was negligible, and must stop placing the product until either that verification or the Competent Authority clears it.

This is reactive, not systematic. You are not required to audit your suppliers' due diligence as a matter of routine. But you do need a route to doing it quickly when something lands, which in practice means knowing today who you would ask and what you would ask for. The FAQ lists the options: check the reference numbers, look at the country risk list, read the public annual reports non-SME operators have to publish, ask the supplier voluntarily, or if none of that works, hand what you know to the Competent Authority and let it travel up the chain.

Scope questions that decide whether any of this applies

Before building anything, check the product is actually in scope. Several common assumptions are wrong.

Only Annex I products count. A product containing a relevant commodity but not listed in Annex I is out. Margarine made from palm oil is the Commission's own example of something not covered. Cars with natural rubber tyres are out, though the tyres themselves are in.

Composite products only carry due diligence on the relevant commodity in Annex I's left column. For a chocolate bar under code 1806, the relevant commodity is cocoa. The obligation extends to the cocoa powder and cocoa butter. The palm oil in the same bar does not pull the bar into scope through that route.

Transport packaging is out. Wood or paper packaging used exclusively to support, protect or carry another product is not a relevant product, whatever its HS code. Pallets under load are out. Pallets sold or exported in their own right are in. A repaired pallet is in scope only for the new wood used in the repair.

Recycled paper and board are out where the product is made entirely from material that had completed its lifecycle. Add virgin fibre and the virgin fibre needs tracing.

There is no de minimis. No volume threshold, no value threshold, including inside processed products.

The four-digit rule decides your role. A change of commodity code only makes you a downstream operator if it changes the digits listed in Annex I. Roasting coffee moves 0901 11 to 0901 21, which stays inside 0901, so a roaster buying imported green beans is a trader rather than a downstream operator.

Two carve-outs that are about scope, not timing

These get confused with the application dates. They are not dates the rules start. They decide whether the rules bite at all.

Cattle born before 29 June 2023 are outside the Regulation entirely, along with products derived from them. That is the date the Regulation entered into force, and it works through the definition of "produced".

Products placed on the EU market before the application date are in scope but pre-obligation. There is a transitional regime for stock that moved during the window between entry into force and application, including rules on what evidence proves it was placed, and on what happens when transitional stock gets mixed with post-application stock. If you will be carrying inventory across December, that regime is worth reading properly rather than assuming your stock is either fine or finished.

For timber specifically, the old EU Timber Regulation does not simply switch off. It stays applicable until 31 December 2029 for timber and timber products produced before 29 June 2023 that are placed on the market only from 30 December 2026, so the two regimes run alongside each other for a while.

If you are an operator, the hard parts

Geolocation to the plot of land, in the due diligence statement, before the product moves. Polygons for plots over four hectares, with latitude and longitude to six decimal places describing the perimeter. A single point is allowed for plots under four hectares, and for cattle establishments.

Two things bite harder than the mapping.

Mass balance is not allowed. Any chain of custody that permits mixing deforestation-free material with material of unknown origin at any step fails. Segregation is required at every step. Full identity preservation is not required, but mass balance is out, and if your palm supply chain runs on it, that is a sourcing problem rather than a documentation problem.

One bad plot fails the whole batch. If a non-compliant part cannot be identified and separated, everything it was mixed with is non-compliant. In a bulk shipment traced to several hundred plots, one plot deforested after 2020 takes the lot.

For bulk stored in silos, the Commission accepts a first in first out approach where you declare the place of production of everything that entered since the silo was last emptied, or where it is not emptied, up to a minimum of 200% of silo capacity. Declaring only the volume you are shipping is explicitly not allowed.

The Monday morning list

1. Confirm which date you are on. Large or medium is 30 December 2026. Micro or small established by 31 December 2024 is 30 June 2027, unless the product sat under the old Timber Regulation annex, in which case it is December for that line too.
2. Take your relevant commodity lines and mark each one operator, downstream, or trader. Not the company, the line. Check who is the importer of record, because that single fact decides which regime you are in.
3. For anything where you are the importer of record, ask whether you meant to be. Buying through an EU trader moves the due diligence obligation off your desk entirely.
4. For downstream lines, check what you are actually building. Direct business partner details, five years, retrievable on request. If your project plan is bigger than that, find out why.
5. Confirm whether you are a non-SME, and if so register in the Information System rather than waiting for December.
6. Write down who receives an Article 5(5) notification and what they do with it. Awareness includes something a colleague read in the press, so this needs to be a route people know, not a policy nobody has seen.
7. Check the Annex I codes for your actual product list before assuming scope. Margarine, transport pallets and fully recycled board are all out, and time spent on them is time not spent on the cocoa.
8. If you are an operator and any commodity comes to you on mass balance, escalate it now. Three months is enough to change a specification and not enough to change a supply chain.