EU Deforestation Regulation (EUDR) Guide

The EU Deforestation Regulation (EUDR) covers imported and exported products that contain or are made of certain commodities, such as wood and rubber. It contains documentation requirements and requires businesses to establish a due diligence system to ensure that their products comply with the regulation.

This guide explains the requirements of the EU Deforestation Regulation and addresses some common questions related to the regulation. The information provided comes from the regulation and related guidance pages published by the European Commission.

What is the EU Deforestation Regulation (EUDR)?

The EU Deforestation Regulation aims to reduce the contribution of the European Union to:

• Global deforestation
• Greenhouse gas emissions
• Global biodiversity loss

It does this by setting rules for importing and exporting certain commodities and products. Only those that are deemed deforestation-free, are legally produced according to the rules of the country of production, and are covered by a due diligence statement can be imported or exported.

Note that some of the requirements of the regulation depend on:

a. The risk classification of the country where you are importing from (low, standard, or high risk)

b. Whether your company is an SME or not (see FAQ at the bottom of the guide for the definition of SME)

c. Whether your company is defined as an operator or a trader

Finally, note that the regulation is set to replace the EU Timber Regulation on 30 December 2025.

Which products are covered?

The regulation covers products listed in Annex I which contain, or have been fed with, or have been made using the following commodities:

• Cattle
• Cocoa
• Coffee
• Oil palm
• Rubber
• Soya
• Wood

Note that this does not mean that all products made of listed raw materials are covered – only if the product is subject to an HS code listed in Annex I.

---

Article 1(1): This Regulation lays down rules regarding the placing and making available on the Union market as well as the export from the Union of relevant products, as listed in Annex I, that contain, have been fed with or have been made using relevant commodities, namely cattle, cocoa, coffee, oil palm, rubber, soya and wood, with a view to: […]

---

The EU Commission’s FAQ document on the regulation states that the regulation’s requirements apply to:

• Commodities produced inside or outside the EU
• Products produced in the EU or imported

Here are some examples of covered products, and the respective commodities used are found in Annex I of the regulation:

a. Leather of cattle

b. Articles of apparel and clothing accessories of vulcanised rubber

c. Wooden frames for paintings

d. Cases for jewellery or cutlery

e. Printed books

f. Wooden furniture

Note that Combined Nomenclature (CN) codes for the products listed above can be found in Annex I. The CN codes are used to classify goods.

Exempted products

The regulation does not apply to goods that are recycled. These are items that are produced entirely from waste or other articles that have been discarded as waste. However, if the product contains non-recycled material, it is subject to the regulation.

The regulation also exempts “packing material” used to support, protect or carry another product. The EU Commission’s FAQ document on the regulation mentions that this exemption applies to “packaging material”.

Furthermore, it also mentions that there is a proposal to exempt user manuals, information leaflets, catalogues, marketing materials, as well as labels accompanying other products, unless they are placed or made available on the market or exported separately.

Which entities are impacted by the EUDR?

The EUDR requirements differ depending on the type of entity. How the requirements differ is explained below.

Operators

An operator refers to a person or a business that imports or exports products covered by the regulation. Operators must do the following:

• Exercise due diligence
• Create due diligence statements
• Comply with other documentation requirements as outlined below

SME operators

Micro, small and medium-sized enterprises (SMEs) that are operators are not required to exercise due diligence for their products if they have already been subject to due diligence and if a due diligence statement has already been submitted.

A definition of SME is provided in the FAQ section at the bottom of this article.

Traders

Traders refer to any person within the supply chain, other than the operator, who makes the relevant products available on the market. Under the regulation, traders that are not SMEs, are considered as non-SME operators and must comply with the requirements affecting operators.

SME traders

Under the regulation, SME traders are only required to keep information about the operators or traders who supply them with or to whom they supply the relevant products.

Country risk classification – Low, standard, high

Countries are classified according to the level of risk of producing commodities covered by the regulation that are not deforestation-free. The EU Commission has published a country classification list in which they classify countries and their parts into low, standard, and high risk countries.

Low-risk countries

Operators whose products are produced in low-risk countries do not have to fulfil all the due diligence requirements (i.e. they do not have to adopt risk assessment measures and risk mitigation measures). This is what the regulation refers to as “simplified due diligence”.

Examples of such countries include the United States, the United Kingdom, China, Vietnam, Thailand, Australia, New Zealand, and India.

Standard-risk countries

Operators whose products are produced in standard-risk countries must comply with all the due diligence requirements (i.e. information requirements, and adopting risk assessment and mitigation measures).

Note that standard-risk countries are those that are neither listed as low risk or high risk countries.

High-risk countries

Operators whose products are produced in these countries must comply with the same due diligence requirements as those from standard-risk countries.

However, according to the published FAQ document under the regulation, shipments from high-risk countries are subject to enhanced scrutiny from the authorities.

Examples of high-risk countries include Russia and North Korea.

Due diligence requirements

To comply with the regulation, operators must exercise due diligence before importing or exporting covered products.

The regulation describes due diligence as a process which involves the following activities:

a. Collecting information, data and documents required to comply with the regulation

b. Adopting risk assessment

c. Adoption risk mitigation measures

Note that, according to Article 13, the activities described in points b. and c. above are only required for products that are imported from standard-risk or high-risk countries.

Conversely, if the commodities come from low-risk countries, the operator can exercise simplified due diligence, which means that risk assessment and risk mitigation measures are not required.

Additionally, according to Article 4, SME operators do not have to exercise due diligence if they have evidence that the relevant product has already been subject to it.

Information requirements

When exercising due diligence, operators must fulfil the information requirement, which entails collecting:

a. Information about the relevant products for traceability purposes

b. Evidence to demonstrate that the products are deforestation-free and that the commodities used have been produced legally.

The regulation lists the following types of information that must be collected to satisfy the information requirements:

Traceability information and geolocation data

• Product description
• The quantity of the relevant products
• The country of production
• Supplier’s name, postal address and email address
• Name, postal address and email address of recipients of the relevant products
• The geolocation of all plots of land where the commodities used to create the products were produced
• The date or time range of production

Also, the EU Commission has a guidance page explaining how geolocation data can be collected, reported and verified.

Other information

• Conclusive evidence that the relevant products are deforestation-free
• Conclusive evidence that the relevant commodities have been produced and used legally, following the relevant laws of the country of production

Further details concerning the information to be collected above are contained in Article 9 of the Regulation.

Risk assessment measures

The operator should collect the information, data and documents used to show compliance with the regulation and carry out a risk assessment. The operator should assess all the evidence collected and decide whether there is a risk that the product is not compliant.

When conducting the risk assessment, the operator should consider the criteria listed in Article 9 of the regulation. Here are some examples of what should be taken into account:

a. The presence of forests and indigenous peoples in the country of production

b. Deforestation or forest degradation in the country of production

c. Difficulties in establishing a connection between the covered product and the plot of land used to produce the commodities

The full list of information that the risk assessment must take into account is contained in Article 10 of the Regulation.

The operator should document their risk assessment on an annual basis. The documentation should show how:

• The information gathered was checked against the risk assessment criteria
• The operator determined the degree of risk

These measures are not required if the operator is exercising simplified due diligence because the relevant commodities or products come from low-risk countries.

Risk mitigation measures

If the outcome of the risk assessment mentioned above is that there is a risk that the product is non-compliant, the operator must adopt risk-mitigating measures and procedures such as any of the following:

• Requiring additional information about the product
• Carrying out independent surveys or audits
• Taking other measures relating to the information requirements in Article 9

However, this does not have to be done if the risk assessment shows that there is no risk of non-compliance.

Additionally, the operator must have policies, controls and procedures mentioned in Article 11 of the regulation. Here are some examples of what they should include:

• Model risk management practices
• Internal control and compliance management
• An appointment of a compliance officer at a managerial level

The decision process concerning the adoption of risk mitigation procedures and measures above must be documented and reviewed on an annual basis.

These measures are not required if the operator is exercising simplified due diligence because the relevant commodities or products come from low-risk countries.

Simplified due diligence

As mentioned above, the operator does not have to fulfil the following due diligence obligations if it has determined that all the covered commodities and products have been produced in low-risk countries:

• Adopting risk assessment measures
• Adopting risk mitigation measures

However, operators engaging in simplified due diligence must still fulfil the information requirements.

Due diligence statement

Operators cannot import or export products covered by the regulation unless they upload a due diligence statement in the Information System created by the European Commission. This registry can be accessed through TRACES NT.

Content requirements

Here are some examples of the information that needs to be featured in the due diligence statement:

a. Operator’s name and contact details

b. Operator’s EORI number

c. Harmonised System code for the product

d. Product description

e. Country of production relevant to the relevant commodity

f. Geolocation of all plots of land relevant to the production place of the relevant commodity

g. Reference to another existing due diligence statement (if applicable)

The content requirements for the due diligence statement are contained in Annex II of the Regulation.

An operator or a trader can appoint an authorised representative to submit the due diligence statement on their behalf.

Note that SME operators do not have to submit a due diligence statement if their products have already been subject to due diligence.

Registration on the Information System

As mentioned above, the registry can be accessed through TRACES NT, and operators are required to provide a valid Economic Operators Registration and Identification (EORI) number to register issued by an EU member state.

According to the FAQ guide under the regulation, domestic operators and traders who do not have EORI numbers can use other identifiers, such as:

• VAT number
• National Company Number
• Taxpayer Identification Number

For a step-by-step guide on how to use the registry, you can refer to the EUDR User Guide published by the EU Commission.

Other documentation requirements

In addition to the documentation requirements mentioned above, if you are required to exercise due diligence, the regulation requires the operator to establish a due diligence system. This refers to procedures and measures that the operator has in place to ensure the covered products comply with the regulation.

Operators must keep all documentation relating to due diligence and make it available to authorities when receiving their requests. Additionally, operators that are not SMEs must publicly report on an annual basis the steps taken by them to fulfil their due diligence obligations under the Regulation.

FAQ

When do businesses need to comply with EUDR?

When the business is importing or exporting a product or a commodity that is listed in Annex I, like paper and wooden furniture products.

Which countries are low risk?

The list that classifies countries into low, standard and high risk countries was published in May 2025 in an implementing regulation and is available on the “Country Classification List” page of Europa.eu.

Under the regulation, “low risk” countries are countries which are highly unlikely to produce a product that is not deforestation-free. Operators importing or exporting products produced in such countries can exercise “simplified due diligence” as explained above.

Here are some examples of such countries:

• United States
• Canada
• Australia
• New Zealand
• United Kingdom
• China
• Vietnam
• Japan
• India
• Thailand
• EU member states

Which countries are standard and high risk?

The implementing regulation mentioned above listed the following countries as high risk:

• Belarus
• Democratic People’s Republic of Korea
• Myanmar
• Russian Federation

Countries having a standard risk (e.g. Brazil) are not listed on the implementing regulation but are listed on the “Country Classification List” page of Europa.eu.

Operators that import or export products produced in countries classified as standard or high risk must exercise due diligence.

How does the EUDR affect packaging material?

The regulation exempts “packing material” containing wood (CN code 4415) and used to support, protect or carry another product. The EU Commission’s FAQ document on the regulation mentions that the exemption applies to “packaging material”.

Note that if the packaging material is imported or exported as standalone packaging (e.g. just the packaging is sold) is still covered by the regulation.

As explained above, we found that there is a proposal to exempt the following items that accompany products:

• User manuals
• Information leaflets
• Catalogues
• Marketing materials
• Labels

Are there any labelling requirements?

We could not find any evidence of labelling requirements in the regulation.

How does the EUDR affect micro, small and medium-sized enterprises?

In the Regulation, SMEs refer to businesses that have two or more of the following characteristics:

• A balance sheet total of EUR 25,000,000 or less
• A net turnover of EUR 50,000,000 or less
• 250 Employees or less

SME operators do not have to exercise due diligence if they have evidence that their product has already been subject to due diligence by an operator located in the EU.

If this is the case, the SME operator should ask for the reference number of the due diligence statement created by the supplier. The reference number would need to be provided to the authorities upon request.

However, if the product or parts of it have not been subject to due diligence, SME operators must exercise it in full and submit a due diligence statement.

As for SME traders, they do not have to exercise due diligence but must collect the following information about the operator or trader that supplied products to them or that they supplied to:

• Name, registered trade name or registered trade mark
• Postal address
• Email address
• Web address (if available)
• Reference numbers of due diligence statements associated with those products received

How does the EUDR differ from the EUTR?

According to Charles Townsend from ForWood Consulting:

“EUDR is very different from the European Union Timber Regulation (EUTR). The EUTR is focused only on a range of timber and paper products and requires only that proof be provided that the trees that were harvested to make the products were legally harvested and legally traded through the supply chain.

The scope and focus of EUDR are totally different and much wider in scope.

EUDR is focused on deforestation – defined as ‘the conversion of forest to agricultural use, whether human-induced or not – and on ‘forest degradation’, defined as ‘structural changes to forest cover, taking the form of the conversion of:

(a) primary forests or naturally regenerating forests into plantation forests or other wooded lands; or

(b) primary forests into planted forests;’

EUDR and EUTR comparison

1. Critically – EUDR covers not only timber but also five other commodities (cattle, cocoa, coffee, oil palm, and soya) and includes the production of feed used for cattle

2. EUDR includes exports from the EU as well as imports.

3. EUDR requires the upload to an EU Commission database of a Due Diligence Statement confirming low risk BEFORE import or export – Article 4.2.

4. EUDR requires that the location of all relevant forests be defined as 1 second of latitude and longitude. (This is an area about 31m x 32m = 0.1 hectares) Big forests must have the perimeter fully defined by a series of latitudinal/longitudinal coordinates to map a polygon).

5. Requirements include proof of free, prior and informed consent by indigenous people.

6. EUDR requires an ‘independent audit function to check the internal policies, controls and procedures’ (Article 11.2b).

7. SMEs and micro businesses (as defined in EU Directive 2013/34) are treated differently.

8. Requirement for a specific species-related risk assessment is removed.

9. FLEGT licenced timber remains ‘legal’ but is not necessarily ‘deforestation free’.

10. The scope of EUDR extends to include many more customs tariff codes including chapter 49 – ‘Printed books, newspapers, pictures and other products of the printing industry, manuscripts, typescripts and plans, of paper’.”

Has FSC already implemented the EUDR requirements?

According to Charles Townsend from ForWood Consulting:

“FSC and PEFC certification for timber products is a voluntary certification scheme. EUDR will be a mandatory legal requirement. For wood and paper products, FSC and other certification programs will provide valuable evidence to assist with EUDR compliance, but none provide a ‘green lane’ through this legislation.

Likewise, for the other commodities, there are no certification schemes that provide proof of compliance, such as Fairtrade.”