Which Commodities and Products Fall Under the EUDR

The EUDR continues to cover seven main commodities: cattle, cocoa, coffee, palm oil, rubber, soy and wood. The regulation also applies to numerous derivative products included in Annex I to Regulation (EU) 2023/1115, identified through their relevant customs codes.

Applicability does not depend on the commercial category used internally by the company, but on the product’s customs code and its connection to one of the seven covered commodities.

In July 2026, the European Commission adopted a delegated act updating the product scope of the EUDR. The list of commodities remains unchanged, while several amendments have been proposed for derivative products included in Annex I.

The Commission proposed removing bovine hides, skins and leather, retreaded tyres, soybeans intended for sowing, certain vulcanised rubber articles, conveyor belts and transmission belts, as well as seats for motor vehicles and aircraft.

The products added to the scope include instant coffee, certain palm oil derivatives and frozen bovine tongues. The newly added products will become subject to the regulation from 30 December 2027.

The delegated act must complete the scrutiny period by the European Parliament and the Council before formally entering into force. Companies should therefore check the latest version of Annex I before finalising the classification of their product portfolio.

The EUDR may affect sectors including food and beverage, furniture, paper and packaging, cosmetics, automotive, fashion, retail, manufacturing and international trade.

A company may fall within the scope because it handles cocoa- or coffee-based products, natural rubber, paper, wood, bovine meat, soy or ingredients derived from palm oil.

Components, semi-finished goods, packaging and processed products may also generate obligations, but only when they correspond to one of the customs codes listed in the regulation. For packaging, companies must also consider the function of the product and the applicable exclusions, while keeping these requirements separate from those introduced by the PPWR on packaging and packaging waste.

The first activity should therefore be the classification of the product portfolio. For each potentially relevant product, the company should verify:

• the customs code;

• the associated EUDR commodity;

• the country and area of production;

• the supplier;

• the company’s role in the commercial flow.

It is not enough to know that a supplier handles commodities subject to the EUDR. Companies must identify the specific products, volumes, batches and origins for which the information required by the regulation must be collected.

Which companies are affected: operators, downstream operators and traders

Once the relevant products have been identified, the company must determine which role it plays within the supply chain. The regulation distinguishes between operators, downstream operators and traders, with different obligations applying to each category.

An operator is the entity that places a relevant product on the European Union market for the first time or exports it. This entity is primarily responsible for carrying out EUDR due diligence, verifying product compliance and submitting the related due diligence statement.

A downstream operator places on the market or exports a product made using relevant products that are already covered by a due diligence statement or simplified declaration.

A trader makes available on the market a relevant product that has already been placed on the market by another entity.

Downstream operators and traders are not generally required to submit a new due diligence statement. However, they must hold the required information, retain it for at least five years and make it available to the authorities in the event of an inspection.

Downstream operators and traders that are not SMEs must also register in the EUDR Information System.

A coffee importer, a company introducing cocoa into the EU market or a business marketing wood products must verify how the product enters the European market, who carried out the due diligence and which information must be passed along the supply chain.

A food company using cocoa that has already been placed on the market, for example, may act as a downstream operator. The company’s role therefore depends on the product, the transaction and its position within the commercial flow.

The mapping exercise should follow the actual supply chain flows, not only the organisational chart. Within multinational groups, different legal entities may be responsible for importing, processing, exporting and distributing products.

EUDR governance should therefore clarify:

• who classifies products and verifies customs codes;

• who collects information from suppliers;

• who assesses risk;

• who submits the due diligence statement;

• who retains and shares supporting evidence;

• who manages inspections and non-compliance alerts.

The EUDR cannot be managed solely by the sustainability team, as operational responsibilities are distributed across several functions and legal entities.

EUDR deadlines in 2026 and 2027: what changes with the postponement

Regulation (EU) 2025/2650 updated the EUDR application timeline and introduced several simplifications.

The main EUDR deadlines are:

• 30 December 2026 for medium-sized and large operators;

• 30 June 2027 for operators established as micro or small enterprises by 31 December 2024;

• 30 December 2026 for micro and small enterprises handling products already covered by the EU Timber Regulation.

The EUDR postponement did not simply move the application dates. The amended regulation also revised certain obligations along the supply chain and introduced a simplified regime for specific micro and small primary operators.

The European Commission published the fifth edition of its EUDR implementation FAQs, updated on 4 May 2026. The document clarifies practical issues including traceability, geolocation, due diligence statements, supply chain roles and use of the EU Information System.

The deadlines should be assessed against each company’s purchasing, production and distribution cycles. A commodity purchased today may be processed, imported or placed on the market several months later.

Non-EU suppliers may also need time to collect geographic coordinates, information on upstream producers and supporting documentation.

The period before the regulation becomes applicable should be used to prepare data, processes and internal responsibilities.

The company’s EUDR roadmap should define in advance:

• the products and flows concerned;

• the people responsible for each activity;

• the data sources;

• the supplier information collection process;

• control and validation criteria;

• the management of statements and supporting evidence.

These elements should be operational before the product is imported, placed on the EU market or exported.

EUDR Due Diligence: Data, Risk and the Due Diligence Statement

EUDR due diligence is the process through which an operator demonstrates that the relevant products comply with the requirements of the regulation.

It consists of three stages: information collection, risk assessment and risk mitigation, where necessary.

When the process identifies no or only a negligible risk of non-compliance, the operator submits an EUDR due diligence statement, commonly referred to as a DDS, through the EU Information System.

Regulation (EU) 2025/2650 also introduced a specific regime for certain micro and small primary operators established in countries classified as low risk. These entities may submit a one-off simplified declaration and receive an identifier to associate with their products.

Information Collection

For each relevant product, the information to be collected includes:

• description and quantity;

• the associated EUDR commodity;

• country of production;

• supplier and customer details;

• commercial documentation and batch references;

• geolocation of the plots of land or production establishments;

• date or time range of production;

• evidence of compliance with the legislation of the country of production.

Simply stating the country of origin is not sufficient. The operator must be able to connect the product to the specific areas where the commodity was grown, harvested, raised or produced.

For micro and small primary operators eligible for the simplified regime, geolocation may, under certain conditions, be replaced by the postal address of the plots of land or production establishment.

Data Quality and Verifiability

The information must be complete, consistent, up to date and traceable to verifiable sources.

A generic supplier declaration is not sufficient when it does not allow the company to connect the batch, commodity, production area and supporting documentation.

Technology can support the collection, organisation and verification of information, but it does not replace the operator’s technical assessment. Responsibility remains with the entity submitting the due diligence statement.

Risk Assessment and Mitigation

The operator must assess the risk that the product does not comply with the EUDR. The product may be placed on the EU market or exported only when the risk is assessed as non-existent or negligible.

The assessment may consider:

• the risk level assigned to the country of production;

• the risk associated with the area of origin;

• the complexity of the supply chain;

• the presence of intermediaries;

• the risk of mixing with non-compliant products;

• the reliability of the information provided;

• the quality of the geographic coordinates;

• consistency between documentation, volumes and declared data.

Where the risk is not negligible, the company may need to request additional documents, carry out supplier checks, use geospatial analysis, commission audits or change its sourcing conditions.

The due diligence statement is not an isolated form, but the outcome of a documented process. It must be supported by collected data, completed checks, a documented risk assessment and traceable mitigation measures.

Downstream operators and traders are generally not required to submit a new DDS, but they must retain and share the information required by the regulation. Where they receive substantiated concerns, they must verify that due diligence has been carried out before marketing the product.

To measure the process, companies can define specific EUDR KPIs, such as:

• percentage of products classified;

• share of volumes covered by geolocation data;

• percentage of suppliers providing complete information;

• rate of incomplete documentation;

• number of non-negligible risk cases;

• open mitigation actions;

• average time required to close checks.

These indicators help monitor progress and identify areas where data and controls need to be strengthened.

EUDR supply chain: suppliers, ESG data and business processes

EUDR compliance depends on the company’s ability to collect and update information across its supply chain.

Supplier engagement is particularly sensitive because the actors involved may have different levels of regulatory exposure, digital maturity and ability to provide the required data.

The first step is supplier segmentation. A supplier providing products that are not included in Annex I requires only limited checks.

A strategic supplier of cocoa, coffee, natural rubber, wood, soy, bovine products or palm oil derivatives requires more extensive verification, particularly in fragmented supply chains or those involving numerous intermediaries.

This segmentation allows companies to adjust requests based on risk rather than applying the same documentary burden across the entire supplier base.

Data collection cannot be limited to sending a standard questionnaire. Information may not yet be available in the required format, or suppliers may not have adequate systems for linking products, batches and production areas.

Supplier engagement should therefore include:

• clear instructions;

• training and operational support;

• consistent data collection templates;

• completeness checks;

• updated contractual clauses;

• procedures for managing missing or inconsistent data.

In fragmented supply chains, companies may need to work through cooperatives, producer groups, qualified traders or local partners. This can improve information quality without multiplying unmanageable requests to every individual upstream producer.

The EUDR should also be integrated into existing business processes. Companies already carrying out ratings, audits or supplier ESG assessments can connect the regulation’s requirements to their existing supplier assessment workflows.

An ESG data management platform can support the centralisation of EUDR data, documents, responsibilities, deadlines and verification status, connecting products, suppliers, batches, production areas, risk assessments and submitted statements.

Regulations such as the CSRD and CBAM have different objectives and requirements, but share an operational need with the EUDR: reliable, verifiable and updatable information across the value chain.

Conclusion

The 2026 and 2027 deadlines give companies time to make their processes, responsibilities and information flows operational. Preparation should focus on product classification, origin and geolocation data, risk assessment and the management of due diligence statements.

A well-structured EUDR process reduces the risk of operational disruptions, incomplete supplier requests, documentation inconsistencies and difficulties during inspections.

For further information on official updates, companies can consult the European Commission page dedicated to the EU Deforestation Regulation and the updated EUDR FAQs