The EUDR deadline is December 2026 and it is legally fixed. This guide breaks down what the EU Deforestation Regulation requires, what changed with the last delay, and what your ESG, Quality, and Compliance team should be doing now.
Maikel Fontein
11
min
EUDR got delayed twice. Most teams did the rational thing and moved it down the priority list each time.
But the December 2026 deadline is now legally fixed. And this month, the European Commission is required to publish its formal simplification review, the last major piece of guidance before enforcement begins. Whatever comes out of it, the core obligations are not changing. The data your team needs to collect, the supplier evidence, the geolocation records, none of that got simpler. The clock just got shorter.
This guide is for ESG, Quality, and Compliance professionals in food and beverage who need a clear, practical breakdown of what EUDR actually requires and where to focus between now and December.
What you need to know:
What it is: The EU Deforestation Regulation bans products linked to deforestation from the EU market unless companies can prove otherwise.
Who it affects: Food and beverage companies selling in or exporting from the EU that use cocoa, coffee, palm oil, soy, cattle, rubber, or wood in their products.
The deadline: 30 December 2026 for large and medium operators. 30 June 2027 for micro and small operators.
The core requirement: A Due Diligence Statement (DDS) submitted via EU TRACES, backed by GPS-level geolocation data for every plot of land where your commodities were produced.
What changed: The December 2025 amendment introduced downstream operator rules and a simplified declaration path for micro and small primary operators. The core obligations did not change.
What is the EU Deforestation Regulation?
The EU Deforestation Regulation (Regulation EU 2023/1115, also known as EUDR) bans products linked to deforestation from being sold in or exported from the EU unless companies can prove otherwise. It was adopted in June 2023 and is part of the EU's broader strategy to reduce its contribution to global deforestation and forest degradation.
The regulation targets seven commodities identified as major drivers of deforestation: cattle, cocoa, coffee, palm oil, rubber, soy, and wood. It also covers a wide range of derived products made from these commodities.
Products in scope include:
Chocolate and cocoa products
Coffee (including instant coffee and extracts with possible expansion via the April 2026 Delegated Act)
Leather and beef products
Palm oil derivatives and oleochemicals
Soybean oil and animal feed
Paper, furniture, and wood products
Natural rubber products
Scope is determined by the product's CN (Combined Nomenclature) code, not just whether it contains a listed ingredient. A product must appear in Annex I of the regulation to be in scope. If it is not listed there, it falls outside EUDR requirements even if it contains a regulated commodity.
The cut-off date: any product placed on the EU market must come from land that was not deforested or degraded after 31 December 2020.
The timeline: what changed and what is still coming
The EUDR has been delayed twice, which created genuine confusion about whether and when it would be enforced. Here is the current legally binding timeline.
30 April 2026 (this month): The European Commission is required to deliver a formal simplification review. This is expected to include a new Delegated Act clarifying which additional products are in scope (including possible additions like instant coffee and certain palm oil derivatives), updated FAQs, and revised guidance documents. The core obligations will not change, but implementation detail may shift. Follow the Commission's official EUDR page for updates.
30 December 2026: Main enforcement date for large and medium operators. Products placed on the EU market from this date must be backed by a compliant Due Diligence Statement.
30 June 2027: Extended deadline for micro and small operators.
One important note: the delays did not change what EUDR requires. They moved the clock. Companies that used the extra time to wait and see are now running out of runway.
What EUDR actually requires: the three obligations
For every relevant product you place on or export from the EU market, three things must be true.
1. Deforestation-free
The commodity must not have been produced on land that was deforested or subject to forest degradation after 31 December 2020. This applies regardless of whether the deforestation was legal in the country of production. EUDR goes further than previous legislation like the EU Timber Regulation even legally permitted deforestation makes a product non-compliant.
2. Legally produced
The product must comply with the laws of its country of origin. This includes land tenure legislation, environmental regulations, labor rights, and indigenous peoples' rights. Companies must collect and verify documentation that confirms legal compliance at the source.
3. Covered by a Due Diligence Statement (DDS)
A Due Diligence Statement is a legally binding declaration submitted via the EU TRACES system before a product is placed on or exported from the EU market. There is no workaround: without a valid DDS on file, a product cannot legally enter or exit the EU.
What goes into a Due Diligence Statement
A DDS is not a form you fill in quickly. It is a legal commitment backed by documented evidence. According to Annex II of Regulation EU 2023/1115, a compliant DDS must include:
Product details and HS/CN codes
Country of production
GPS coordinates or polygon files for every plot of land where the commodity was produced
Production dates confirming harvest or production occurred after 31 December 2020
Supplier and buyer information
A risk assessment confirming the deforestation and illegality risk is negligible
Details of any risk mitigation measures taken
All underlying records must be kept for at least five years and made available to competent authorities on request.
The geolocation challenge
This is where most food and beverage companies get stuck. EUDR does not ask for your supplier's office address. It requires GPS coordinates or polygon files for the actual plots of land where commodities were produced.
For cocoa, that means knowing which farms supplied the cooperative that sold to the exporter. For palm oil, it means identifying the specific plantations behind each mill. For coffee, it means farm-level traceability, not just country of origin.
Most supply chains do not have this data structured and verified. Collecting it requires direct engagement with suppliers, often several tiers deep, and in some cases producers who have never been asked for this level of documentation before.
A note on certifications
Certifications like FSC (for wood) and RSPO (for palm oil) can support your risk assessment. They do not replace due diligence. If a certification does not cover the specific plots in question, does not align with the 31 December 2020 cut-off date, or does not address legality in the way EUDR requires, you still need to verify independently. Use certifications as supporting evidence, not as a substitute for the process.
Who needs to comply: understanding your role in the supply chain
One of the most significant changes introduced by the December 2025 amendments was the introduction of a new category: downstream operators. Understanding which category you fall into determines what you are required to do.
Primary operators are the companies that place a relevant product on the EU market for the first time, or export it from the EU. They carry the full due diligence obligation: collecting data, conducting risk assessments, mitigating risks, and submitting a DDS via EU TRACES.
Downstream operators are companies that place on the market products that have already been covered by a DDS submitted upstream. Their obligations are significantly lighter: they do not submit a full DDS themselves, but they must collect and pass on the DDS reference numbers from their upstream suppliers.
Micro and small primary operators can submit a one-off simplified declaration rather than a full DDS, subject to specific conditions.
If you are unsure which category applies to your business, this is one of the first things to resolve. Your compliance obligations (and the volume of work involved) depend entirely on where you sit in the chain.
What this means for ESG, Quality, and Compliance teams specifically
EUDR will not arrive as a standalone compliance project with its own forms and dedicated portal. It will show up inside the supplier data requests and customer questionnaires your team already handles, with more depth and more traceability required than before.
Supplier data becomes compliance infrastructure. Knowing who your suppliers are is not enough. You need documented, verifiable origin data from them, and that data must stay current. If a supplier changes farms, sourcing regions, or processing partners, your records need to reflect that.
Customer questionnaires will get more specific. Retailers and B2B customers who are primary operators under EUDR will request deforestation-related data from their suppliers as part of their own due diligence process. Expect questions about commodity origin, risk assessment outcomes, and DDS reference numbers. These requests are already starting to appear.
Cross-team alignment is no longer optional. EUDR data sits across procurement, quality, ESG, and legal. If those teams are not working from the same structured system, discrepancies will surface in submissions and questionnaire responses. The governance and traceability challenge is as much internal as it is supplier-facing.
The volume of requests will increase. As large operators build their own compliance systems, they push data requirements down the supply chain. Mid-sized food and beverage companies that supply to larger retailers or manufacturers should expect an increase in the number and depth of EUDR-related requests in 2026.
Non-compliance has real consequences. Fines under EUDR can reach up to 4% of a company's total annual EU-wide turnover. Products can be seized or banned from the EU market. Competent authorities in EU Member States are authorised to conduct unannounced checks.
Four things your team should do before December 2026
1. Map your product portfolio against Annex I
Start by identifying which of your products are in scope. Cross-reference your product list against Annex I of the EUDR using CN codes. Remember that scope is based on the final product's classification, not just whether it contains a regulated commodity. Build this mapping into your ERP or compliance system so it is maintained as your portfolio changes.
2. Start supplier engagement now, not in Q4
Collecting geolocation data and deforestation-free evidence takes time, especially from smaller or more remote producers. The companies that started this process early are already building a data advantage. If you have not started, prioritise your highest-volume and highest-risk commodity suppliers first - cocoa, palm oil, soy, and coffee are typically where the traceability gaps are deepest.
3. Confirm your role in the supply chain
Determine whether your business falls under primary operator, downstream operator, or micro/small operator rules. This defines your exact obligations and the volume of work involved. If your products are manufactured using commodities that were already covered by an upstream DDS, your path to compliance looks different than if you are placing a commodity on the EU market for the first time.
4. Watch the April 2026 Simplification Package
New guidance, a Delegated Act updating Annex I product scope, and revised FAQs are expected from the Commission this month. Do not finalise your compliance approach based on old assumptions. The core obligations will not change, but the practical details on how to comply (which products, which exemptions, which data formats) may shift. Follow the Commission's official EUDR page for updates.
The bigger picture
EUDR is one of several regulations converging on food and beverage companies this year. PPWR tightened packaging compliance. CSRD made sustainability reporting continuous. EUDR raises supplier data expectations to plot-level traceability.
What these regulations have in common is that they all require the same thing: structured, verifiable, traceable data collected consistently, stored securely, and ready to share at short notice. The teams that build that infrastructure now will find each new requirement easier to absorb. The teams still relying on spreadsheets, email threads, and PDF certificates will find every deadline harder than the last.
December 2026 is eight months away. That is enough time to get ahead of this, but not enough time to leave it until it becomes urgent.
Key takeaways:
The December 2026 enforcement deadline is legally fixed and will not move again. GPS-level geolocation data for production plots is the hardest part to collect. Start now.
Your obligations depend on where you sit in the supply chain: confirm whether you are a primary or downstream operator.
The April 2026 Commission simplification package may update Annex I scope and implementation detail check it before finalising your compliance approach.
Traceability infrastructure built for EUDR will reduce the cost of every sustainability regulation that follows.
