EUDR compliance in 2026 means knowing whether your products and legal entities are in scope, tracing relevant commodities to their origin, testing deforestation and legality evidence, reducing any identified risk to a negligible level, and completing the required submission before covered goods enter or leave the EU market.
For large and medium enterprises, and for micro and small operators already covered by the EU Timber Regulation, the main application date is 30 December 2026. Most other micro and small enterprises have until 30 June 2027. The work should begin with your exact role, product codes, supply routes, and company size, not with a generic checklist.
What Does EUDR Compliance Require in 2026?
The legal starting point is Regulation (EU) 2023/1115 and its Annex I product list. The European Commission’s current explanation of EUDR compliance due diligence separates the operational work into three steps for upstream operators:
1. Collect the required product, supplier, production, geolocation, and legality information.
2. Assess the risk that a relevant product does not comply.
3. Reduce any identified risk to no or only a negligible level before placing the product on the EU market or exporting it.
The deforestation cut-off is 31 December 2020. Relevant commodities must not have been produced on land subject to deforestation after that date. Wood products are also subject to the forest-degradation requirement defined by the Regulation.
This is not only a document-collection exercise. Your system needs to connect product scope, source plots or establishments, supplier evidence, risk criteria, mitigation, approval, and submission. If the required information cannot be collected, or if the risk remains more than negligible, an upstream operator must not place the relevant product on the EU market or export it.
Who Must Act, and by When?
EUDR compliance responsibilities depend on the activity performed in the supply chain. The same corporate group can contain different legal entities with different roles, and one company may hold more than one role.
| Business position | Main responsibility under current EU guidance | Main application date |
| Large or medium upstream operator | Conduct due diligence, reach no or negligible risk, and submit a due diligence statement before placing a relevant product on the EU market or exporting it | 30 December 2026 |
| Micro or small upstream operator already covered by the EU Timber Regulation | Follow the applicable upstream requirements | 30 December 2026 |
| Most other micro or small enterprises | Prepare for the later application date and confirm any special role or product rule | 30 June 2027 |
| Micro or small primary operator in a low-risk country | Conduct due diligence with simplified reporting through a declaration, subject to the conditions in the amended rules | Applicable date depends on size and prior EUTR coverage |
| Downstream operator or trader | Keep required supplier and buyer information, notify relevant parties if a possible non-compliance is identified, and follow the additional rules that apply to its size and position | Applicable date depends on size and role |
| Non-EU producer or supplier not directly placing goods on the EU market | No direct EUDR obligation solely because it supplies an EU customer, but it may need to provide geolocation, legality, traceability, and product information to the responsible operator | Driven by the buyer’s compliance timetable |
The Commission’s current explanation of EUDR roles and responsibilities should be used with the legal text, official guidance, and FAQs. Do not assume that the party named as the supplier in a commercial contract is automatically the EUDR operator.
A useful first step is to establish a verified current state and then test it against the applicable date and requirement. VECTRA’s guide to baseline assessments and readiness assessments explains why those are separate management decisions.
What Changed Before the EUDR Compliance 2026 Deadline?
The rules and implementation tools have changed since the original 2023 Regulation was published. A readiness plan based on an early briefing deck may now be incomplete.
The European Commission confirmed in July 2026 that:
• the Regulation applies from 30 December 2026 for large and medium enterprises and for micro and small operators already covered by the EUTR;
• it applies from 30 June 2027 for most other micro and small enterprises;
• the Annex I product scope has been updated;
• soluble coffee, certain palm oil derivatives, and frozen cattle tongues were added, with those newly added products becoming subject to the Regulation from 30 December 2027;
• certain hides, skins, leather, re-treaded tyres, soybeans for sowing, specified vulcanized rubber articles, conveyor and transmission belts, and certain vehicle and aircraft seats were removed; and
• the Information System and its technical rules were updated to support due diligence statements, simplified declarations, and automated submissions.
The Commission’s July 2026 EUDR scope and implementation update provides the current summary, while the August 2026 EUDR implementation FAQ addresses detailed implementation questions. Product decisions should still be made against the current Annex I codes and the facts of the transaction.
The simplifications change how some responsibilities and submissions work. They do not remove the need to confirm product scope, collect the required evidence, identify the responsible legal entity, and follow the rules that apply to its role.
The 7 EUDR Compliance Checks to Complete
1. Confirm Product Scope by CN or HS Code
Begin with the product as traded, not only the commodity it contains. Annex I uses Combined Nomenclature and Harmonized System codes to define relevant products. A product containing wood, rubber, cocoa, or another covered input is not automatically in scope, and a product that appears unrelated at first glance may still be listed.
Create a controlled scope register that records:
• the product and trade name;
• the current CN or HS code used for customs and EUDR analysis;
• the relevant commodity or derived product;
• the applicable Annex I version and review date;
• the placing-on-market, making-available, import, or export activity;
• the legal entity responsible for that activity; and
• the rationale and reviewer for the scope decision.
Do not copy a product list from a supplier or an old implementation memo without rechecking it. The 2026 product-scope changes make version control essential. If the code or product description is uncertain, obtain customs or legal advice before building the rest of the process around a doubtful classification.
2. Assign the Correct Role, Legal Entity, and Date
Map the transaction from production to the first EU market placement and onward. Identify who imports, who acts as customs declarant, who first places the product on the EU market, who processes it into another relevant product, who trades it, and who exports it.
treat company-group arrangements carefully. EUDR responsibilities attach to the legal entity carrying out the relevant activity. Central systems and shared teams can support the work, but they do not transfer legal responsibility away from the operator.
3. Connect Products to Source Plots and Establishments
Traceability must connect the relevant product to the place where the commodity was produced. For most relevant commodities, that means the geolocation of all plots of land. For cattle, the required location data refers to the establishments where the animals were kept under the applicable rules.
The EUDR Information System allows operators to provide coordinates individually, in bulk, or through GeoJSON files, and supports an API for bulk management. Test both the business data and the submission process. A technically valid file can still be wrong if it contains the wrong plots, an incomplete batch relationship, or mixed origin data.
Data controls matter as much as collection. VECTRA’s guide to stronger FMCG sustainability data and supplier evidence explains how ownership, definitions, validation, and audit trails prevent supplier information from becoming an unverified spreadsheet exercise.
4. Test the Deforestation-Free Evidence
The operator needs adequately conclusive and verifiable information that the relevant products are deforestation-free. A map should be treated as a source for analysis, not as a conclusion by itself.
Satellite imagery, the EU Forest Observatory, public datasets, supplier records, field information, and independent verification may all contribute. None should be treated as infallible. Record the data source, date, reviewer, finding, uncertainty, and decision so another competent person can reproduce the reasoning.
The control also needs to prevent mixing with products of unknown or non-compliant origin. Mass-balance claims, warehouse practices, aggregation points, transport documents, and processor records should be tested against the traceability model used for the due diligence decision.
5. Verify Legality in the Country of Production
EUDR legality is not limited to proof of title or a harvest permit. The relevant legislation of the country of production can cover land-use rights, environmental protection, forest-related rules, third-party rights, labor rights, human rights protected under international law, free, prior and informed consent where relevant, tax, anti-corruption, trade, and customs requirements.
Build a legality register by commodity and country. For each requirement, identify the source law, competent authority, supplier obligation, evidence expected, validity period, translation needs, and escalation route.
This is one reason a general supplier declaration is insufficient. The evidence must apply to the relevant producer, place, activity, product, and time. Where indigenous peoples, workers, or communities may be affected, the risk assessment should consider reliable information about claims, rights, consultation, and access to remedy. VECTRA’s guide to human rights due diligence for supplier impacts provides a separate method for assessing impacts on people. It supports the work but does not replace the EUDR legal test.
6. Document the Risk Assessment and Any Mitigation
If simplified due diligence does not apply, the operator must assess the risk of non-compliance using the Regulation’s criteria. Country benchmarking is one input, not the complete assessment.
The Commission’s country benchmarking guidance classifies countries as low, standard, or high risk. Sourcing only from low-risk countries may allow simplified due diligence where the conditions are met, but the operator must still collect the required information and remain alert to mixing, circumvention, or new concerns.
A documented risk assessment should address, as relevant:
• country classification and local deforestation conditions;
• forests and the presence or rights of indigenous peoples;
• reliable claims concerning ownership or use of production areas;
• corruption, falsified documents, weak law enforcement, conflict, or sanctions;
• the reliability and consistency of the Article 9 information;
• supply-chain complexity and the ability to connect products to origin;
• mixing, circumvention, unknown-origin, and prior non-compliance risks; and
• any other information indicating possible non-compliance.
Separate the initial exposure from the effect of verified controls. VECTRA’s supplier risk assessment checklist explains how to distinguish inherent risk from residual risk and connect a finding to a decision. For EUDR, the final threshold remains specific: the operator can proceed only where the risk is no or negligible.
Where the risk is not negligible, require additional information, conduct surveys or audits, strengthen traceability, support supplier capacity, change controls, or take another proportionate measure. Record why the measure addresses the identified risk and how its effectiveness was checked. A planned action does not reduce risk until it has been implemented and verified.
7. Test Governance, Submission, Retention, and Response
An EUDR process is not ready until it works under realistic operating conditions. The person approving a product should be able to see the scope decision, evidence status, risk conclusion, mitigation result, and applicable submission before the product moves.
Use the Information System acceptance environment to test registration, user access, data upload, review, submission, and exception handling before relying on the production environment. The Commission distinguishes clearly between the two: acceptance submissions have no legal value, while production submissions do.
Supplier expectations should also be reflected in contracts, operating instructions, and controlled evidence requests. VECTRA’s guide to moving a supplier code of conduct from policy to practice explains how to connect requirements to evidence, monitoring, corrective action, and escalation.
What Should Non-EU Suppliers Prepare?
Most non-EU producers do not have direct EUDR obligations unless they directly place relevant products on the EU market. They can still determine whether an EU buyer can comply on time.
Suppliers should be ready to provide accurate and consistent information covering:
• the producing entity and relevant intermediaries;
• product description, commodity, quantity, and production period;
• production country and, where relevant, subnational region;
• plot coordinates or required cattle-establishment information;
• documents supporting the right to produce or use the land;
• evidence that the commodity is deforestation-free;
• evidence of compliance with relevant laws in the country of production;
• chain-of-custody and segregation information; and
• prompt notification if any information changes or becomes unreliable.
EU buyers should explain why each item is requested, define the format, protect sensitive information, allow realistic time for correction, and avoid asking smallholders for multiple inconsistent templates. Supplier capacity-building can be a legitimate risk-mitigation measure when it addresses a defined gap and the result is verified.
VECTRA’s Pre and Post Audit Assistance service can support readiness testing, evidence review, gap closure, and re-testing. For organizations that need to connect product scope, supply-chain data, supplier risk, mitigation, and regulatory controls, VECTRA’s Compliance, Risk & Due Diligence service provides the primary commercial route.
SUMMARY
Who
Large and medium enterprises carrying out covered activities, and micro and small operators already covered by the EUTR, face the 30 December 2026 application date. Most other micro and small enterprises follow on 30 June 2027. Non-EU suppliers may need to provide the evidence their EU customers require.
What
Covered products must satisfy the deforestation-free and legality conditions, follow the applicable due diligence process, and be covered by the required statement or declaration before the relevant market action.
When
The deadline depends on company size, role, prior EUTR coverage, and whether a product was newly added for 30 December 2027. Due diligence must be completed before the product is placed on the EU market or exported.
Where
The rules govern relevant products placed or made available on the EU market or exported from it. The evidence reaches back to the countries, plots, establishments, suppliers, and intermediaries connected to production.
Why
The business needs a defensible decision that covered products meet the Regulation, not a collection of disconnected declarations. Strong preparation also reduces border delay, blocked product, rushed supplier requests, and inconsistent decisions across legal entities.
Start With One Real Product Flow
Choose one relevant product expected to move soon after the applicable date. Trace it from the responsible legal entity back to every required plot or establishment, then forward through risk assessment, approval, Information System submission, customs, and downstream records. Record every missing connection. That exercise will show whether the immediate problem is scope, role, data, evidence, risk judgment, supplier capacity, or system control.
Frequently Asked Questions
What is the EUDR compliance deadline?
The Regulation applies from 30 December 2026 for large and medium enterprises and for micro and small operators already covered by the EU Timber Regulation. It applies from 30 June 2027 for most other micro and small enterprises. Newly added products identified in the 2026 scope update are subject from 30 December 2027.
Which commodities does the EUDR cover?
The seven commodities are cattle, cocoa, coffee, palm oil, rubber, soy, and wood. Annex I defines the relevant products by CN or HS code. Check the current Annex rather than assuming every product containing a covered commodity is included.
Does a low-risk country remove the need for due diligence?
No. An operator sourcing only qualifying products from low-risk countries may use simplified due diligence if the conditions are met. It must still collect the required information and act if new information indicates possible non-compliance or circumvention.
Is certification enough to prove a product complies?
No. Certification and third-party verification can contribute information, but the responsible operator must ensure that the evidence meets the Regulation’s requirements and supports the product-specific conclusion. The legal responsibility is not transferred to the certifier.
Do non-EU suppliers have direct EUDR duties?
Generally, a producer or supplier outside the EU does not have a direct obligation unless it directly places relevant products on the EU market. It may still need to provide geolocation, legality, traceability, and product data to the operator responsible for compliance.
How long must EUDR records be kept?
Operators must retain due diligence documentation for five years from the date the relevant product is placed on the EU market or exported. Downstream operators and traders also have five-year record-keeping duties for specified supplier, buyer, and reference information.
View Related Posts
• PPWR Compliance 2026: What Applies Now and What to Fix First
• Why Operational Resilience Is More Than a Dashboard
VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.
Chaussée de Wavre 1517B, 1160 Brussels, Belgium.
A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.
