EUDR from 30 December 2026: who counts as the operator, and what data you actually need

Introduction

The EU Deforestation Regulation — EUDR, Regulation (EU) 2023/1115 — has been postponed twice and amended repeatedly. That history has convinced a fair number of companies that it will be postponed again. It will not: the date has been fixed since the December 2025 amendment, and the Commission has confirmed through 2026 that no further delay is coming.

From 30 December 2026 the regulation applies to medium and large companies and to micro and small companies in the timber sector; from 30 June 2027 to the remaining micro and small companies. Anyone placing wood, coffee, cocoa, soya, palm oil, cattle or rubber — or products made from them — on the EU market from that date needs geolocation for every plot of production and a due diligence statement submitted in the EU information system. Without that data the product simply cannot be sold.

This article is written for operators anywhere in the Union. It covers the question that decides everything else — are you the operator? — what the data requirement means in practice, what low-risk classification does and does not save you, and where the work actually accumulates.

In short

Application: 30 Dec 2026 for medium/large companies and timber-sector SMEs; 30 Jun 2027 for the rest.
The operator is whoever harvests and first places on the market — which is not always the party you would expect.
Every EU member state is classified low risk. That removes risk assessment and mitigation, not the geolocation data and not the statement.
Micro and small primary producers in low-risk countries may replace geolocation with a postal address and declare only once.
The expensive part is not filing. It is collecting and validating plot data from suppliers who do not use software.
Evidence must be kept for five years and produced on request.

Looking for the software side?

We built a platform for exactly this workflow: collecting plot geolocation from suppliers, validating it automatically, keeping evidence complete and preparing the statement. Scope, target users and common questions are on the EUDR platform page.

What changed in 2025 and 2026

If your last serious look at the EUDR was in 2024, your understanding is out of date on several points that matter commercially.

Regulation (EU) 2025/2650, December 2025

The second postponement: application moved to 30 December 2026, and to 30 June 2027 for micro and small companies outside the timber sector.
New categories of market participant, in particular micro and small primary producers and downstream operators and traders. This shifts who in the chain carries which duty.
A one-off simplified declaration for micro and small primary producers, who receive an identifier to pass on instead of declaring per consignment.
Relief for downstream stages: downstream operators and traders no longer verify their suppliers' due diligence independently and do not pass on their own statements.
Product scope: books, newspapers and printed matter were removed from Annex I.

The simplification package, May 2026

The Commission presented its simplification report with updated guidance, an updated FAQ, a draft delegated act on product scope and changes to the information system. By the Commission's own estimate, annual compliance costs fall by roughly 75 % against the original design.

One point is worth stating plainly, because it is widely misunderstood: downstream operators and traders submit no due diligence statement at all — not even a simplified one, and not even when they are not an SME.

Delegated and implementing acts, 13 July 2026

Removed from scope: bovine hides, skins and leather, retreaded tyres, soya beans for sowing, certain vulcanised rubber goods, conveyor and transmission belts, and seats for aircraft and motor vehicles.
Added: soluble coffee, certain palm oil derivatives and frozen bovine tongues — the latter only with effect from 30 December 2027.
Clarified exemptions: samples and test material, waste, second-hand goods, packaging material, and products used in medicinal manufacturing.
Information system: the implementing act governs how the system works, including simplified declarations and updated technical specifications for the machine interface.

Scope is triggered by the HS code. If your product's customs tariff number appears in Annex I, you are covered — regardless of whether you think of yourself as a timber business. That is the first thing to check, and it takes minutes.

Who is the operator?

This is the question that determines whether you carry the full burden or almost none of it, and it is answered less often than it should be. An operator places a relevant product on the EU market for the first time, or exports it. The operator collects the Article 9 information, submits the statement, and answers for it.

For timber the decisive fact is who harvests. Two situations that look almost identical in the contract lead to opposite answers:

You buy finished roundwood at the roadside. The forest owner harvested and placed the timber on the market. They are the operator; you are downstream.
You buy standing timber and harvest it yourself. You harvested. You are the operator, with the full information duty including geolocation of every plot — even though the forest is not yours.

The same logic applies to timber from your own forest: harvesting it and processing it makes you the operator for that volume. And importing from outside the Union always makes the importer the operator, because nobody upstream was subject to the regulation.

Why this matters more than it looks

A mill that buys some volume standing and some at the roadside is an operator for part of its intake and downstream for the rest — at the same time, from the same suppliers, sometimes in the same month. Both paths have to be kept apart and evidenced separately. Getting this wrong in either direction is expensive: too little collected means goods that cannot be sold, too much collected means work nobody owed.

The geolocation requirement

Due diligence has three steps: collect information (Art. 9), assess risk (Art. 10) and mitigate risk (Art. 11). The mandatory information includes the description and quantity of the goods, the country of production and — the part that causes the work — the geolocation of all plots on which the commodity was produced.

The technical requirements are precise, and the system enforces them:

Format: GeoJSON in WGS 84 (EPSG:4326).
Precision: at least six decimal places for latitude and longitude.
Geometry: a polygon is mandatory from a plot size of four hectares; a single point is sufficient below that.
Completeness: every plot of production must be included. One missing area makes the whole consignment contestable.
For wood specifically: the full scientific species name is mandatory — Picea abies, not "spruce". Where species vary, list every species that may be present.

On submission the system issues a reference number and a verification number. Those numbers are the currency of the supply chain: they go to your customers and are quoted at customs. All evidence must be retained for five years.

Where the work actually is

Filing is tedious but tractable. The bottleneck sits upstream, in collecting and validating plot data from suppliers who have no interest in software. In several member states private forest ownership is highly fragmented — hundreds of suppliers with a few hectares each rather than one supplier with a thousand. That structure, not the regulation's text, is what makes this hard.

And the data arrives broken in predictable ways: self-intersecting polygons drawn in a phone app, areas off by a factor of one hundred, coordinates in a national reference system instead of WGS 84, plots that fall outside the declared country of production, the same parcel submitted twice by two different people. Collected by email and spreadsheet, these are found at submission time — or not at all.

A working estimate

Budget 15 to 30 minutes per supplier and plot for manual handling, including chasing, format correction and plausibility checks. At 150 suppliers that is several person-weeks, repeated every year.

This is the part we automated

A personalised link instead of an account, a traffic light instead of chasing by email, an evidence register instead of a spreadsheet. What the platform does, step by step, is on the product page.

See the EUDR platform Talk to us

Low-risk countries: what it saves, and what it does not

In the Commission's country benchmarking, every EU member state is classified as low risk. This is a real relief and it is routinely overestimated.

For goods from low-risk countries, simplified due diligence under Art. 13 applies: risk assessment (Art. 10) and risk mitigation (Art. 11) fall away. What does not fall away:

The Article 9 information — including geolocation — must still be collected and documented in full.
The due diligence statement must still be submitted.
You must be able to show that the conditions for the simplification are actually met, in particular that there is no risk of circumvention or mixing. As soon as goods from a higher-risk country are blended in, the full procedure applies again.
The classification is dynamic and reviewed periodically.

The relief that gets missed: postal address instead of coordinates

For micro and small primary producers in low-risk countries — which covers the typical smallholder across much of the Union — Article 4a brings two substantial reliefs:

Instead of a statement per consignment, a one-off simplified declaration in the information system, producing an identifier that is passed on.
The geolocation may be replaced by the postal address of the plots or the holding. For this group, coordinate capture disappears entirely.

But note what this is tied to: the low-risk country and the producer's own size and role — not your size. Anyone who buys standing timber and harvests, who imports, or who exceeds those thresholds still needs full geolocation per plot. For a mill this means part of the supplier base will contribute only an identifier while another part still contributes polygons — and the two must be kept apart and evidenced separately.

Downstream operators and traders

If you are downstream, the 2025 amendment removed most of the burden. What remains is specific and still binding:

Registration in the information system — mandatory for non-SMEs (Art. 5(2)).
Collect the reference and verification numbers from the upstream stage, retain them for five years, and produce them to authorities and at customs on request.
If the first downstream operator does not receive those numbers from a supplier who is evidently an operator, the goods must not be placed on the market (Art. 5(1)). There is no duty to investigate proactively whether a supplier is an operator.
On substantiated concerns, a downstream non-SME must check whether due diligence was performed upstream (Art. 5(6)). Relief is not exemption.

In practice the risk here is administrative rather than legal: numbers arrive by email, in varying formats, from dozens of suppliers, and have to be matched to consignments and still be findable in year five.

Penalties and liability

Member states set their own penalties within a framework the regulation prescribes. It includes fines of up to 4 % of annual Union-wide turnover, confiscation of the goods and of the revenue derived from them, temporary exclusion from public procurement and from public funding, and publication of the decision.

The commercial reality usually bites earlier than any of that. Without a reference number your customer cannot resell the goods, so they will not take them. Market access, not the fine, is the mechanism that will change behaviour first — and it takes effect on day one, without any authority having to act.

What to do now

Check your HS codes against Annex I. Minutes of work, and it determines everything else.
Determine your role per supply route — operator, downstream operator or trader — and write down who harvests in each case. Expect more than one answer.
Register in the information system. Mandatory for operators and for downstream non-SMEs, and it is not instant, so do not leave it to December.
Segment your suppliers: who will provide an Article 4a identifier, and who must provide plot geometry.
Start collecting geolocation now. Supplier response time, not your internal process, sets the schedule.
Decide how you will retain evidence for five years in a form that still proves something when someone asks in 2031.

The ordering is deliberate. Steps 1 to 3 are yours alone and can be finished this month. Steps 4 and 5 depend on other people, which is exactly why they cannot wait.

How we solve the data problem

We built a platform for steps 4 to 6: an EUDR geolocation and evidence platform for companies sourcing from many small suppliers. The underlying assumption differs from most compliance tools — we do not try to teach your suppliers software. A forest owner who sells timber twice a year will not install an app or create an account. They will click exactly one link, and that has to be enough.

Collection without an account: a personalised, signed, time-limited link. The supplier draws the plot on aerial imagery or uploads GeoJSON, KML, GPX, Shapefile or WKT.
Automatic validation with a traffic light: geometry validity, plausible area, location inside the declared country, forest cover at the 31 December 2020 cut-off and loss since — with a plain explanation of what to fix, shown to the supplier before they confirm.
Evidence register: incoming and outgoing reference and verification numbers per consignment, with every gap flagged automatically.
Statement preparation: built against the official interface specification of the EU information system, with a standards-compliant GeoJSON export as the manual route.
Tamper-evident archive: a hash-chained log and a ZIP export with manifest, checksums and a verification script an auditor can run without our software.
The legal position is configuration: roles, mandatory fields, thresholds and retention periods are declarative. When the interpretation changes, a file changes — not a release.

Full scope and common questions are on the EUDR platform page.

Tell us about your supply chain

Every intake structure is different: how much is bought standing, how fragmented the supplier base is, which country the plots are in. Describe yours and we will tell you honestly what applies to you and what we can take off your desk. A first conversation costs nothing.

Start the conversation See the platform

Sources

As of 2 September 2026. This article reflects the state of information at the time of writing and is not legal advice. Penalty ranges and enforcement details are set nationally and differ between member states.

Regulation (EU) 2023/1115 on deforestation-free supply chains — EUR-Lex
Regulation (EU) 2025/2650 amending Regulation (EU) 2023/1115 — EUR-Lex
European Commission: "Commission updates product scope and tools to support EUDR", 13.07.2026 — environment.ec.europa.eu
European Commission: deforestation topic page, guidance and FAQ — environment.ec.europa.eu
Council of the EU: "Deforestation: Council signs off targeted revision", 18.12.2025 — consilium.europa.eu
Commission country benchmarking (all EU member states: low risk), 22.05.2025 — environment.ec.europa.eu

A German-language companion article covering the Austrian situation in detail is available at EUDR ab 30.12.2026.