With obligations becoming applicable to companies (other than micro or small entities) within the next six months the table below summarises the key steps that companies should be considering. 

Scope

Review whether any products that you “import”, “export” or “make available” (i.e. supply) on the EU market are in scope. 

Products will only be in scope if they are made from one of the seven commodities covered by EUDR (e.g. cattle, cocoa, coffee, palm-oil, rubber, soy and timber) and if they fall within one of the HS codes specified in Annex I to the Regulation.  Legal input may be required for these complex assessments. 

Role

Determine the role that your company has under EUDR based on its position in the supply chain for the relevant product or commodity i.e. are you an “upstream operator” and so the first entity in the supply chain required to issue a Due Diligence Statement (or DDS) under EUDR, or will you be a  “downstream operator” or “trader” and so able to refer to existing DDS published by upstream suppliers?  Do you qualify as an SME or non-SME?

Note, these are legally defined terms and so need to be considered carefully. 

Due Diligence System – Requirements for upstream operators 

Upstream operators (i.e. companies who are not able to rely on an existing DDS prepared by an upstream supplier) will need to put in place an EUDR due diligence system encompassing the full due diligence obligations applicable under the Regulation.  

The extent of the requirements depend on whether the products come from low, medium or high-risk countries. 

• Where products are identified as coming from low-risk countries companies must collect the data required under Article 9, which includes geolocation information for all products.
• For medium and high-risk countries, companies must undertake the risk assessment required by Article 10 and put in place risk mitigation measures as required by Article 11, where the risk assessment identifies more than a negligible risk of non-compliance.  (Note, risk assessment and risk mitigation is also required for products coming from low-risk countries where there are substantiated concerns or the company is aware of information that points to a risk of non-compliance.)

Due Diligence System – Requirements for downstream non-SME operators and non-SME traders

Put in place an EUDR due diligence system to "ascertain" that upstream entities have already exercised full due diligence which, as a minimum, requires collection of reference numbers and verification numbers of DDS submitted by upstream entities.  

Companies should consider whether additional steps are required to verify suppliers' compliance with EUDR based on their supplier risk assessment and bearing in mind that downstream operators and traders can still ultimately be held liable for supplying a non-compliant product even where due diligence has been exercised upstream.

Information System / TRACES

Register with the EU Information System/TRACEs and put in place procedures for collecting DDS from suppliers and issuing own DDS. 

Note there is a replica training platform (called ACCEPTANCE SERVER) available to help companies familiarise themselves with the process and formalities.

Customs alignment

Ensure your EUDR processes align with customs procedures and that practical/operational procedures are in place so that DDS reference numbers are available for timely inclusion on customs declarations and/or that appropriate TARIC codes are identified. 

Internal accountability / Governance arrangements

Companies need to identify persons within their organisation who will be responsible for EUDR compliance and put in place appropriate governance arrangements and processes to ensure and monitor EUDR compliance going forwards.

Record keeping

Put in place appropriate processes to record and keep data and evidence required under EUDR. 

Contractual protections

Review upstream and downstream contractual clauses and incorporate EUDR provisions where appropriate. Key points to consider are adequacy of compliance with laws/compliance with EUDR clauses, requirements to provide information/evidence for EUDR compliance and obligations to supply DDS reference and verification numbers. 

Public reporting – Non SME operators and traders only

Put in place process for preparing and reviewing EUDR report which has to be made publicly available, including on the internet.  

The first report will be in respect of actions taken in 2026 (and so will need to be published in 2027) and it can be incorporated into other ESG reporting (e.g. the CSRD report if one will be published to cover the relevant period).

Investigations Toolkit

Ensure existing internal investigations toolkits and protocols are adequate to deal with any suspected EUDR non-compliances and regulatory investigations, as well as considering impacts on product insurance if they are not permitted into the market.