EUDR compliance and requirements, so the cocoa, coffee, soya, palm oil, rubber, cattle and wood you trade can prove where they came from.

What it is

What is the EU Deforestation Regulation and what is it used for?

The EU Deforestation Regulation, Regulation (EU) 2023/1115 of 31 May 2023, governs the placing on the Union market, the making available and the export of commodities and products associated with deforestation and forest degradation. It replaces the EU Timber Regulation. The commodities are cattle, cocoa, coffee, oil palm, rubber, soya and wood, and Annex I lists the derived products caught by classification code.

Three conditions must be met before a product in scope can be traded: it is deforestation-free, meaning produced on land not deforested after 31 December 2020 (and, for wood, harvested without forest degradation after that date); it was produced in line with the relevant laws of the country of production; and it is covered by due diligence. Being a regulation, it applies directly in every Member State, with national competent authorities checking compliance.

Current text. Regulation (EU) 2023/1115, amended by Regulation (EU) 2024/3234 on the date of application and by Regulation (EU) 2025/2650, in force since 26 December 2025, on the obligations of operators and traders. The main obligations apply from 30 December 2026; micro and small operators established by 31 December 2024 apply them from 30 June 2027, unless they were already covered by the EU Timber Regulation. Commission Delegated Regulation (EU) 2026/2102 of 13 July 2026, in force since 18 September 2026, updated the list of relevant products in Annex I.

Who it is for

Who needs to comply with the EUDR?

Any business that places a relevant product on the EU market for the first time or exports it is an operator; businesses further down the chain are downstream operators or traders with lighter duties. Producers, processors and exporters outside the EU are rarely obligated themselves, yet they hold the plot and supplier data their EU customers depend on. Businesses usually reach Sterling from one of four starting points:

• An EU customer asks for origin and legality data. Buyers need information on your supply before they can submit a due diligence statement, and suppliers who cannot provide it risk being dropped.
• A tender or sourcing policy makes deforestation-free supply a condition. Retailers, brands and public buyers are writing the Regulation into supplier codes and contracts.
• A competent authority could inspect you. Member State authorities run checks from the application date, and the paper trail has to exist before the question arrives.
• Your group must apply one approach across subsidiaries. Importing, processing and exporting entities in different countries need one method for collecting information, assessing risk and keeping records.

The aim is traceable, defensible supply, not a certificate. The value depends on how well the system runs every time a shipment moves.

Requirements

What are the main EUDR requirements?

The Regulation is a law, not a management system standard, so it has no harmonised clause structure. Its obligations fall into the areas below, described at title level; your programme is tested against the current consolidated text and the Commission's guidance, and your legal advisers confirm how each duty applies to your role.

• Scope: the seven relevant commodities and the relevant products listed in Annex I by classification code.
• Deforestation-free: no deforestation after the 31 December 2020 cut-off date, and no forest degradation for wood.
• Legality: production in accordance with the relevant legislation of the country of production.
• Information collection: gather the information the Regulation requires on each product, its suppliers and where it was produced.
• Risk assessment: judge whether that information shows a risk that the product is non-compliant.
• Risk mitigation: reduce any risk identified before the product is placed on the market or exported.
• Due diligence statement: submitted by operators through the Commission's EUDR Information System; micro and small primary operators make a one-off simplified declaration instead.
• Downstream operators and traders: collect and keep supplier and customer information and give it to competent authorities on request; the first in line keeps the reference numbers, and non-SMEs register in the information system.
• Country benchmarking: the Commission classifies countries as low, standard or high risk, which shapes the depth of the assessment.

Compliance route

How do you comply with the EUDR?

No certificate ends the job. Compliance is demonstrated shipment by shipment, through a due diligence system that runs before every product in scope is placed on the market or exported.

1. 01
   Establish your role and your products in scope.Match your product codes against Annex I and decide, entity by entity, whether you act as an operator, a downstream operator or a trader, and whether SME or micro and small rules apply.
2. 02
   Gap analysis: map suppliers and origins against the obligations.Trace each commodity back towards its plots of production, test what data suppliers already hold and agree actions, owners and dates.
3. 03
   Build the due diligence system.Written procedures for information collection, risk assessment and mitigation, supplier onboarding clauses, country benchmark checks and record keeping.
4. 04
   Test it on live shipments and audit it internally.Run real consignments through the process, submit statements or declarations in the information system, and close the gaps an internal audit finds.
5. 05
   Operate, review and stay ready for checks.Keep the system current as suppliers, origins, benchmarks and guidance change, and answer competent authority requests with the records already in place.

Check the route before you sign. Nobody can sell you EUDR compliance as a certificate: the Regulation says certification or other third-party verified schemes may support the risk assessment but do not replace the operator's own due diligence responsibility. Check the current text and guidance on EUR-Lex and the Commission's EUDR pages, and test any claim a provider makes against them. The certification buyer's checklist

Cost

How much does EUDR compliance cost?

Supply chain shape drives the budget more than company size. A trader in one coffee origin with long-standing co-operatives faces a smaller task than a manufacturer buying rubber, palm derivatives and wood from dozens of countries through intermediaries.

Timeline

How long does EUDR compliance take?

The fixed point is 30 December 2026, or 30 June 2027 for eligible micro and small operators. The pace before then depends on how quickly suppliers return origin data and how many supply chains need mitigation. As an estimate, most programmes need four to nine months to reach a working due diligence system.

Your engagement

What your EUDR engagement includes

Every engagement follows Sterling OS™, adapted to supply chain due diligence. Sterling does not certify, verify or approve compliance: responsibility stays with you as operator or trader, competent authorities enforce, and we work alongside your legal advisers on how the law applies to you.

• Design™: guided support

  Your procurement and compliance team builds the procedures and records; a Sterling consultant provides the method, reviews each output and coaches your owners.

• Drive™: managed support

  The alternative to Design™ when capacity is short: Sterling drafts the procedures, runs supplier data collection with your buyers and leads the programme to a working system.

• Sustain™: once the system runs

  Periodic reviews, internal audits, supplier re-checks and updates when benchmarks, product scope or guidance change.

• Automate™: Effivity

  Suppliers, risk assessments, mitigation actions and documents held in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Compliance remains the responsibility of each operator and trader; enforcement sits with Member State competent authorities.

Often combined with

Standards organisations pair with EU Deforestation Regulation (EUDR)

• AA1000AA1000 implementation and requirements: apply the AccountAbility Principles and SES, then prepare for AA1000AS v3 assurance by a licensed provider.
• AEOAuthorised Economic Operator (AEO) readiness: what customs examines, who can apply and how Sterling prepares your controls and evidence for the customs visit.
• B Corp CertificationB Corp certification made clear: the new B Lab Standards, Foundation Requirements, seven Impact Topics, the audit route and how Sterling prepares you.
• BRCGS Storage and Distribution · Agents and BrokersBRCGS Storage and Distribution certification and Agents and Brokers: Issue 4 and Issue 3 requirements, scopes, audits and cost factors, with Sterling's support.
• C-TPATC-TPAT requirements and validation readiness for US importers and overseas suppliers: the Minimum Security Criteria, CBP's process and how Sterling helps.
• CBAMCBAM compliance and requirements explained: authorised declarant status, the 50-tonne threshold, verified embedded emissions and how Sterling helps you prepare.