Deforestation Due Diligence: EUDR and UK Environment Act Compliance

If your business places cattle, cocoa, coffee, palm oil, rubber, soy, wood, or products derived from them on the EU market, EUDR compliance requirements mean you must prove three things before the goods can be sold: the commodity was not grown on land deforested after December 31, 2020; production complied with the laws of the country of origin; and a due diligence statement has been filed through the EUDR Information System.¹ The main deadline is December 30, 2026, with a six-month extension for the smallest businesses.²

When the Rules Take Effect

The EUDR was originally scheduled to apply in late 2024, but two rounds of delay have moved the dates. The current deadlines, set by Regulation (EU) 2025/2650, are:²

December 30, 2026 for large and medium-sized operators, all downstream operators and traders regardless of size, and micro and small enterprises handling products that were previously covered by the EU Timber Regulation.
June 30, 2027 for natural persons and micro or small enterprises handling other EUDR products.

These are hard cutoffs. Once a deadline passes for your category, covered goods cannot legally enter or leave the EU market without a valid due diligence statement in the Information System.

Which Products Are Covered

Seven commodity groups sit at the center of the regulation: cattle, cocoa, coffee, oil palm, rubber, soy, and wood. Annex I of the regulation extends the scope to hundreds of derived products, including leather goods, chocolate, tires, glycerol, printed books, charcoal, plywood, particle board, and wooden furniture.³ If a product contains or is derived from one of the seven base commodities, assume it is in scope until you have checked Annex I and confirmed otherwise.

Operator or Trader: What You Have to Do Depends on Which You Are

The regulation assigns different duties depending on where you sit in the supply chain, and getting this classification right early is one of the most practical steps you can take.

Operators are businesses that first place a covered product on the EU market or export it from the EU. They carry the heaviest load: full due diligence before any product enters the market, submission of a due diligence statement through the EUDR Information System, and a duty to pass the statement’s reference number to the next buyer downstream.⁴

Traders are downstream actors who buy and resell products that an upstream operator already cleared. All traders must collect and retain information about their suppliers and buyers for at least five years and must notify authorities if they discover that a product might not comply. Large traders must also register in the Information System and verify that upstream due diligence was performed if they become aware of potential non-compliance. Small and medium-sized traders have no registration or verification obligation.⁴

Your size category is set by the EU’s standard SME thresholds. Micro enterprises have fewer than 10 employees and turnover at or below €2 million. Small enterprises have fewer than 50 employees and turnover at or below €10 million. Medium-sized enterprises have fewer than 250 employees and turnover at or below €50 million.⁵ If your business is part of a larger corporate group, group figures may need to be included.

The Three Conditions for Market Access

Before any covered product can be placed on the EU market or exported from it, three conditions must all be satisfied. Failing any one blocks the sale:⁶

Deforestation-free: the commodity was not produced on land that was deforested after December 31, 2020.
Legally produced: production complied with all relevant laws of the country of origin, including land use, labor, and environmental rules.
Covered by a due diligence statement submitted through the EUDR Information System before the product is placed on the market.

The legality requirement is where many businesses underestimate the work. Confirming that no trees were felled is not enough. You also need verifiable evidence that production respected the producing country’s rules on land tenure, indigenous rights, environmental protection, and tax obligations. A product from an undeforested plot can still be blocked if the local harvest permit was invalid or if labor laws were violated during production.

Geolocation and the Due Diligence Statement

The most distinctive feature of the system is the geolocation requirement. Operators and non-SME traders must collect coordinates for every plot of land where a commodity was produced. The precision depends on the plot’s size:⁷

Plots larger than four hectares: geolocation must be supplied as polygons, meaning latitude and longitude points (to six decimal places) tracing the perimeter.
Plots of four hectares or less: a single latitude and longitude point is acceptable, though a polygon can also be used.
Cattle products: every establishment in the animal’s life history must be geolocated with at least a single coordinate, covering birthplace, feeding farms, grazing lands, and slaughterhouses.

This data feeds into the due diligence statement, which operators submit to the EUDR Information System before any product reaches the market.⁸ The statement includes a description of the goods, quantities, country of production, and a reference number that the operator passes to downstream buyers. Without a valid statement, placing the product on the market is prohibited.

Gathering accurate geolocation from complex supply chains is, in practice, the hardest part of compliance. Companies sourcing through commodity traders or cooperatives may need to trace back through several layers of suppliers before reaching the actual production site. Building those data-sharing relationships now, well before December 2026, is the single most important preparatory step.

Risk Assessment and the Country Benchmarking System

After collecting geolocation and production data, operators must assess whether there is a risk that the product fails to meet the regulation. The starting point is the Commission’s country benchmarking system, which classifies every country of origin as low, standard, or high risk based on deforestation rates and governance strength.⁹

The current list places Belarus, the Democratic People’s Republic of Korea, Myanmar, and the Russian Federation in the high-risk category. Around 50 countries fall under standard risk, including Brazil, Indonesia, Colombia, Malaysia, and the Democratic Republic of the Congo. The low-risk category includes the United States, Canada, the United Kingdom, most of the EU, Australia, and over 150 other countries.⁹ Classifications are not permanent; the Commission plans its first review in 2026.

The tier affects scrutiny intensity. Competent authorities in each member state must check at least 1% of operators dealing with low-risk countries, 3% for standard-risk countries, and 9% for high-risk countries.¹⁰

Beyond the country tier, the risk assessment must consider supply chain complexity, the presence of indigenous peoples in the production area, and the prevalence of land disputes. If the assessment reveals anything beyond negligible risk, the operator must take concrete mitigation steps before the product can proceed. Mitigation might involve requesting additional documentation from suppliers, commissioning independent audits, or using scientific testing such as isotope or DNA analysis to verify origin. Only when risk has been reduced to a negligible level can the due diligence statement be submitted and the product placed on the market.

Simplified Due Diligence for Low-Risk Sourcing

Sourcing exclusively from countries or regions classified as low risk earns a meaningful break. The Article 9 information and geolocation duties still apply, but the formal risk assessment and mitigation steps required for standard- and high-risk sourcing can be skipped.⁶

The simplified path is not automatic. Two things must be confirmed first: that supply chain complexity does not create opportunities for circumvention, and that the product has not been mixed with goods from standard- or high-risk origins. If either concern arises, the simplified route is unavailable and full due diligence applies. Access to the simplified path can also be revoked as a penalty for serious or repeated violations.¹

Records and Annual Reporting

Operators must store their due diligence statements and all supporting evidence for at least five years from the date they placed the product on the market. Traders must retain records of suppliers and buyers for the same period. Competent authorities can request these records at any time.⁴

Operators that are not SMEs face an additional duty: publishing an annual public report on their due diligence system, describing the measures taken to secure supply chain transparency and the results of risk assessments. Companies already subject to other EU value chain due diligence rules, such as the Corporate Sustainability Due Diligence Directive, can integrate EUDR reporting into those existing reports rather than producing a separate document.⁷

In practical terms, a centralized digital system is needed from day one. The volume of geolocation data, supplier declarations, satellite imagery, and risk assessment records for even a moderately complex supply chain is substantial. Companies that try to bolt on documentation after the deadline will be reconstructing records they should have been collecting all along.

Penalties for Getting It Wrong

Member states set the specific penalties, but Article 25 establishes minimums that every national regime must meet:¹

Fines of at least 4% of annual EU-wide turnover as the minimum ceiling for the maximum fine. Member states can set it higher. Fines must strip away the economic benefit of the violation and increase for repeat offenses.
Confiscation of non-compliant products and any revenue earned from selling them.
Exclusion from public procurement, grants, and concessions for up to 12 months.
Temporary trading prohibitions on placing, selling, or exporting covered products for serious or repeated violations.
Loss of the simplified due diligence route for repeat offenders.

The Commission also publishes the names of companies with final judgments against them, including a summary of the violation and the penalty.¹ For consumer-facing brands, the reputational exposure may matter more than the fine itself.

If You Supply the EU From Outside It

The regulation directly binds EU-based operators, but its effects reach every supplier upstream. Producers, processors, and exporters outside the EU will be asked by their EU buyers for geolocation data, evidence of legal compliance, and documentary proof that the commodity was not grown on deforested land. Suppliers who cannot deliver that data risk losing access to EU customers.

Non-EU operators placing products directly on the EU market can appoint an authorized representative within the EU to submit due diligence statements on their behalf. The representative must register separately in the Information System and be able to produce a copy of the mandate from the operator upon request. Appointing a representative does not transfer legal responsibility; the operator remains accountable.¹¹

A Note on the UK Regime

The UK has its own forest risk commodities framework under Schedule 17 of the Environment Act 2021, but it is narrower and not yet operational. It targets only commodities that were illegally produced, so it does not prohibit goods linked to deforestation that was lawful under local law. The EUDR, by contrast, blocks products from any land deforested after its cutoff date regardless of legality.¹²

The UK scope is limited to businesses with global annual turnover exceeding £50 million, with an exemption available for those using 500 tonnes or less of each regulated commodity per year.¹³ Schedule 17 provides for civil penalties and grants enforcement authorities powers of entry, inspection, and seizure, but the secondary legislation needed to activate the regime has not been enacted, and specific penalty amounts remain undefined.¹⁴ For companies selling into both markets, the EUDR is the more demanding standard by a wide margin. Meeting its requirements will generally cover whatever the UK eventually asks for; the reverse is not true.

1
EUR-Lex. Regulation (EU) 2023/1115 of the European Parliament and of the Council
2
European Commission. Delay Until December 2026 and Other Developments in the Implementation of EUDR Regulation
3
European Commission. Regulation on Deforestation-Free Products
4
European Commission. Subjects of Obligations
5
European Commission. SME Definition
6
European Commission. Guidance Document for the Regulation on Deforestation-Free Products (2026)
7
European External Action Service. Frequently Asked Questions: Implementation of the EU Deforestation Regulation
8
European Commission. The Information System of the Deforestation Regulation
9
European Commission. Country Classification List
10
European Commission. EUDR Benchmarking and Country Classification
11
Bundesanstalt für Landwirtschaft und Ernährung. EUDR Supply Chain Infographics (3rd Edition)
12
UK Parliament. Environment Protection – Written Questions, Answers and Statements
13
UK Parliament. Introduction of Forest Risk Commodities Regulations
14
Legislation.gov.uk. Environment Act 2021 – Schedule 17