EU Finalizes Deforestation Regulation: What’s Changing for Companies

In a potentially important step to curb global deforestation, the European Commission recently finalized the European Union Deforestation Regulation (EUDR) after years of postponement. Locking in a 7-commodity scope and an imminent deadline, the July 2026 action brings new supply chain requirements for companies placing goods on the EU market or exporting goods from the EU.

The regulation applies to seven commodities, along with certain products derived from them. It requires companies to exercise due diligence regarding the products and to file formal due diligence statements.

Assuming no major objections are raised during the European Parliament and Council’s two-month period of scrutiny (mid-July through mid-September 2026), the finalized rules will take effect this year, with compliance obligations beginning December 30, 2026.

What is the EUDR?

The EUDR is a regulation that aims to ensure that products placed on the EU market or exported from the EU do not contribute to global deforestation or forest degradation. Specifically, the EUDR requires certain companies to exercise due diligence and disclose information about seven commodities— cattle, cocoa, coffee, palm oil, rubber, soy, and wood—and certain products derived from these commodities (such as chocolate, furniture, and personal care products) before they are placed on the EU market.

Who is in scope?

The EUDR applies to companies placing goods on the EU market—or exporting from it—that contain any of the covered commodities. The regulation distinguishes between upstream operators (those initially placing relevant products on the market, or exporting them), downstream operators (those placing products on the market that are made using relevant products), and traders (others making relevant products available on the market, such as distributors), setting out differentiated obligations for each of these actors. The regulation also differs in the requirements for large/medium operators and small/micro operators.

Why is the EUDR in the news?

While it has been on the horizon for years, the EUDR is making headlines again after the European Commission adopted Delegated and Implementing Acts that finalized the product scope and technical rules for the EUDR on July 13, 2026. These measures complete the simplification package the Commission had announced in May.

The Commission also affirmed there will be no further extensions to two looming deadlines:

• December 30, 2026, for large and medium-sized operators, as well as micro and small operators already covered by the EU Timber Regulation
• June 30, 2027, for other micro and small operators

The measures adopted also included some changes to covered products and the date for which they will be subject to regulation: soluble coffee, certain palm oil derivatives, and frozen cattle tongues will not be subject to the regulation until December 30, 2027. Targeted exemptions apply to specific categories like waste, used and second-hand products, and packaging material.

Lastly, the Delegated Act removed several products from the Regulation’s scope, including: cattle hides, skins, and leather; re-treaded tires; soybeans for sowing; articles of vulcanized rubber (conveyor or transmission belts); and seats for aircraft and motor vehicles.

What does compliance entail?

There are differing obligations for upstream operators, downstream operators, and traders. The most direct burden of responsibility is on upstream operators.

Requirements for Upstream Operators

For large and medium-sized upstream operators, the first main requirement is to exercise due diligence for each product by collecting information, conducting a risk assessment, and implementing risk mitigation procedures where needed.

1. Collecting information about each product (as outlined in Article 9 of the regulation) is needed to verify that the products are deforestation-free and produced in accordance with the relevant legislation of the country of production.

The information to be collected includes: the product’s Harmonized System code, scientific name, trade name, and quantity to be placed on or exported from the market; the country of origin and geolocation data for tracing products back to the plot(s) of land where they were produced; contact information for any business/person who supplied the products; verifiable information that the products are deforestation-free; and verifiable information that the products were produced according to the laws of their country of origin. To assist operators in proving they meet this legality criterion, the Commission is developing two Information Repositories, one listing relevant legislation of countries of production and another of applicable certification schemes.

2. A risk assessment regarding whether products may be non-compliant with the EUDR (as outlined in Article 10 of the regulation) should be conducted if the country of production is classified as either “high risk” or “standard risk” in the EUDR benchmarking system. This step verifies and analyzes the information collected in the previous step. Risk assessments are not required for countries classified as “low risk.”
3. Risk mitigation procedures and methods (as outlined in Article 11 of the regulation) must be adopted if risk assessment results indicate any risk level greater than “no risk” or “negligible risk” for the products. Risk mitigation steps must be adequate to achieve no or negligible risk.

The second main requirement for large and medium-sized upstream operators is to submit statements that verify that due diligence was exercised and document the information gathered during that exercise. These are formal, templated statements that must contain details about the operator and the products (as outlined in Annex II of the regulation).

In addition to information gathered in the due diligence exercise, statements must contain details about the operator, including their name, address, and the Economic Operators Registration and Identification (EORI) number (in accordance with Article 9 of Regulation (EU) No 952/2013). Finally, the due diligence statements must contain specific text from Annex II of the EUDR verifying that the company, in exercising due diligence, found that the products were at no or negligible risk of non-compliance with the regulation.

The due diligence statements must be submitted through the Commission’s web-based Information System. To offer flexibility, the regulation allows operators to mandate an authorized representative to submit a due diligence statement or a simplified declaration on their behalf.

For micro and small upstream operators, the regulation sets out simpler requirements. These operators must provide a one-time, simplified declaration statement. They do not need to carry out due diligence exercises in advance of submitting the statements, but must attest that they will carry them out before placing relevant products on the market.

Requirements for Downstream Operators and Traders

Downstream operators and traders do not have to submit due diligence statements, but must collect and retain information about their upstream suppliers (including the reference numbers for those operators’ relevant due diligence statements) and customers for five years. These parties also are obligated to provide assistance to relevant EU authorities regarding the implementation of the EUDR, including informing the authorities if they become aware of any substantiated concerns about the product not being in compliance.

Penalties for Non-compliance

Enforcement of the EUDR (as laid out in Articles 24 and 25 of the regulation) is generally up to the EU Member States. Potential consequences of non-compliance could include removal of products from the EU market and penalty fines. The fine amount will be set by EU Member States, but the maximum penalty must be at least 4% of the non-compliant party’s total annual EU-wide turnover in the financial year preceding the fine.

What now?

For companies that place covered commodities in the EU market, the finalized EUDR scope and updated guidance bring clarity after a long period of delays. Here are a few ways to take advantage of the news:

• Beginning now, companies can determine the products covered by the legislation, and then identify the role they play in bringing them to market, whether as an upstream operator, a downstream operator, or a trader.
• Though the traceability and documentation requirements for operators are substantial, companies that invest in mapping their supply chain, complete with geolocation of commodities’ origins, are in a significantly better position than if their visibility is limited to Tier 1 suppliers.
• As with other diligence exercises, it is essential to document methodologies used in data collection, risk assessment, and mitigation processes.

How G&A can help

Our team is expert in determining exposure to ESG-related regulations through scoping exercises, data audits, and process development. No matter where you are on your compliance journey, G&A can identify and support with the steps needed for compliance.

Madeline Blankenship

Senior Sustainability Analyst

Madeline Blankenship is a Sustainability Analyst at Governance & Accountability Institute, where she applies her expertise in research, data analysis, and sustainability reporting to support clients across industries advance their sustainability goals. With a passion for fostering collaboration, she works to align business value with the needs of communities and the environment.