EUDR Compliance: Requirements, Geolocation & the 2026 Deadline

Who Must Comply, and When

Regulation (EU) 2023/1115 was amended by Regulation (EU) 2025/2650 on 19 December 2025. The amendment postponed both the EUDR application dates and simplified the EUDR regime.

There are now two application dates, but they do not divide businesses as simply as "large companies first, small companies later."

The Commission's own notice on the delay sets out these dates.

The Detail Many Businesses Miss

Being a small business does not automatically mean you have time until June 2027. If you are a downstream operator or trader, the rules apply from 30 December 2026, regardless of your size.

The same earlier date applies if you are a micro or small enterprise handling timber products that were already covered by the EU Timber Regulation.

Key takeaway: Your size alone does not determine your EUDR deadline. Your role in the supply chain and the type of product you handle also matter.

What is in Scope

Seven commodities are covered under Annex I: cattle, cocoa, coffee, oil palm, rubber, soya, and wood, along with the derived products listed under their relevant customs codes.

"Derived products" is where many businesses get caught off guard. i.e., you do not have to be a commodity trader to fall within EUDR.

Products such as chocolate, leather, furniture, paper, tyres, palm-based ingredients used in cosmetics and food, and beef products can fall within the regulation depending on their customs classification.

The July 2026 Scope Changes

The Commission adopted a delegated act amending Annex I on 13 July 2026. The two-month scrutiny period expired on 13 September 2026, reportedly without objection.

One important caution: adoption is not the same as entry into force. Confirm publication in the Official Journal before acting on these changes. Until then, the existing Annex I remains the operative list.

Subject to that publication, the changes include:

What Does the Leather Change Mean?

The removal of cattle hides, skins and leather is particularly important for footwear and leather goods businesses. If you have been preparing for EUDR on the assumption that hides and leather would remain in scope, it is better to re-check your product classification and customs codes.

Remember that the change does not remove cattle from EUDR. Cattle remain in scope, as does soya used to feed them.

Earlier scope change: Certain printed products - including books, newspapers, printed pictures and paper manuscripts - were already removed under the December 2025 amendment.

The Cut-Off Date: 31 December 2020

Everything in EUDR turns on a single historical date.

A product is deforestation-free only if the commodities in it were produced on land that has not been subject to deforestation after 31 December 2020. In addition to the above, for wood, it must also have been harvested without inducing forest degradation after that date.

31 December 2020 is a cut-off, not a deadline

This is a bright line, not a deadline.

Land converted from forest to agriculture before 1 January 2021 can supply EUDR commodities indefinitely. However, land that is converted on or after that date is permanently disqualified, and no amount of subsequent good practice repairs it.

Two Definitions Matter

Two definitions in the regulation carry more weight than they might appear to at first.

Deforestation

"Deforestation" means the conversion of forest to agricultural use, whether human-induced or not.

This means forest lost to fire or storm and then converted to agricultural use can still count as deforestation.

"Have been fed with"

The phrase "have been fed with" appears in the deforestation-free definition. Cattle fed on non-compliant soya are themselves non-compliant.

This pulls feed supply chains into scope for beef, dairy and leather operators.

What Due Diligence Actually Requires

Article 8 sets out three obligations, and they are sequential:

• Collect information
• Assess risk
• Mitigate risk

1. Collect information - Article 9

You need to collect and keep the required information for five years, and this applies to eight categories that include:

• Product details: Product description and trade name. For wood, this also includes the common and full scientific species names.
• Quantity: Net mass in kilograms.
• Country of production
• Geolocation: The geolocation of all plots of land, together with the date or time range of production.
• Suppliers: Name, postal address, and email address of every supplier.
• Business customers: The same details for every business customer.
• Deforestation-free evidence: Adequately conclusive and verifiable information showing that the products are deforestation-free.
• Legality evidence: The same standard of information showing that the commodities were produced in accordance with the relevant legislation of the country of production.

Don't overlook the legality requirement: EUDR has a legality limb as well as a deforestation limb. This can cover land use rights, environmental protection, forest-related rules, third-party rights, labour rights, free prior & informed consent where it applies, tax, anti-corruption, trade, and customs.

2. Assess Risk - Article 10

The standard is strict. You can place a product on the market only when your risk assessment finds no or only negligible risk of non-compliance.

This is not a balance-of-probabilities test, and it is not simply a matter of deciding what level of risk your business is willing to accept.

Risk assessments must be:

• Documented
• Reviewed at least once a year
• Made available to competent authorities when requested

3. Mitigate risk - Article 11

If the assessment identifies any risk above negligible, you must reduce it to negligible before placing the product on the market.

Depending on the situation, this could mean:

• Requesting additional information
• Commissioning independent surveys or audits
• Strengthening the information collected under Article 9

Operators that are not SMEs also have two additional obligations to put in place:

• A compliance officer at management level
• An independent audit function to check internal policies and controls

Geolocation: The Requirement that Decides Everything

This is the part that can help determine whether your supply chain can comply with EUDR. The requirement is also more specific than many summaries make it sound. The regulation defines geolocation as:

The geographical location of a plot of land using latitude and longitude coordinates, with at least six decimal digits.

For plots of land larger than four hectares used to produce relevant commodities other than cattle, geolocation must be provided as a polygon with enough latitude and longitude points to describe the plot's perimeter.

What the Geolocation Rule Means in Practice

Four Things Follow:

1. A single point is the baseline

At least one latitude and one longitude point are required at minimum.

2. Six decimal places are required

The six decimal places do not mean a specific metre-level accuracy. The regulation specifies the coordinate format, not a particular accuracy measured in metres.

3. Above four hectares, a point is not enough

Plots over 4 hectares require a polygon with enough points to describe the actual perimeter. For plots of 4 hectares or less, a single point is sufficient.

4. Cattle are excluded from the polygon rule

The words "other than cattle" mean that the polygon requirement does not apply to cattle, regardless of plot size.

The four-hectare test applies at plot level. A "plot of land" means land within a single real-estate property as recognised by the law of the country of production.

This matters for smallholder supply chains in coffee, cocoa and rubber, where a single supplier may aggregate products from dozens of separate plots.

Cattle are a Different Problem

For cattle, geolocation refers to the establishments where the animals were kept - including any premises, structure or, in open-air farming, environment or place where livestock are kept temporarily or permanently.

Because cattle can move between locations, the geolocation requirement is cumulative across the animal's life.

The Commission's guidance confirms that cattle geolocation must cover all establishments associated with raising the animal, including the place of birth and every farm where it was kept up to slaughter.

This is more than a location field. It requires animal-level identity to be maintained across different holdings and ownership changes. This is why beef and meat operations generally face a more complex traceability challenge than crop operations, even though cattle are exempt from the polygon requirement.

Coordinates Alone are not Enough

Having the coordinates is only part of the requirement.

Article 9(1)(d) also requires the date or time range of production to be recorded alongside the geolocation.

Why does that matter? Because the production date helps establish whether the commodity meets the 31 December 2020 deforestation cut-off. Without that time information, the coordinates cannot be properly assessed against the cut-off date.

The Due Diligence Statement, and How Reference Numbers Travel

Before placing a product on the EU market or exporting it, an operator must submit a due diligence statement through the EUDR Information System, which is accessed through TRACES.

The statement contains six key details:

• The operator's name, address and EORI number
• The HS code, product description and quantity
• The country of production and the geolocation of every plot - or, for cattle, every establishment
• The reference numbers of any due diligence statements already submitted for those products
• A declaration that due diligence was completed and that no or only negligible risk was found
• The operator's signature

Once the statement is submitted, the system issues a reference number. That number is what moves through the supply chain.

Operators must share the reference number with downstream operators and traders. These businesses keep and pass on the number instead of creating their own due diligence statements.

For imports, the reference number must be provided to customs with the customs declaration before the product is released for free circulation.

One 2026 change worth knowing:

The downstream duty to collect reference numbers is passive. The Commission's guidance confirms that a downstream operator does not have to investigate or proactively ask a supplier for a reference number. When no reference number arrives, the operator may presume that there is no upstream reference number.

This reduces the need for downstream businesses to keep chasing suppliers for reference numbers.

Country Benchmarking: Low Risk Does Not Mean Low Work

Commission Implementing Regulation (EU) 2025/1093 of 22 May 2025 classified every country into three risk tiers. The results may surprise you.

High risk - four countries only:

Belarus, North Korea, Myanmar and Russia.

Low risk - roughly 140 countries:

This includes all 27 EU member states, the United States, Canada, Australia, New Zealand, the United Kingdom, China and India.

Standard risk - everything else:

This includes Brazil, Indonesia, Malaysia, the Democratic Republic of Congo, Côte d’Ivoire, Argentina and Colombia. They are classified as standard risk, not high risk, so full due diligence still applies.

The European Parliament voted to object to this classification in July 2025. However, the objection was not legally binding, and the Commission proceeded with the classification. The classification stands.

What Low Risk Actually Waives

This is one of the most misunderstood parts of the regulation.

Simplified due diligence under Article 13 waives Article 10 and Article 11 only - the risk assessment and risk mitigation steps.

It does not waive:

• Article 9 information collection, including full geolocation. If you source from India, the United States, or another low-risk country, you still need the required plot and establishment geolocation.
• Submission of a due diligence statement.
• The Article 12 due diligence system, including its annual review and five-year record-keeping.
• The substantive prohibition itself.

The above waiver is also conditional. Before relying on the simplified process, you must assess the complexity of the supply chain and the risk of circumvention or mixing with products of unknown, high-risk, or standard-risk origin.

So even low-risk sourcing involves some mandatory assessment work.

• Low-risk does not mean no due diligence. It mainly removes the detailed risk assessment and mitigation steps under Articles 10 and 11.
• Processing in a low-risk country also does not make a standard-risk product low risk. Competent authorities are directed to act on information that points to this type of pattern.

Enforcement intensity also differs by country classification:

What This Means for Exporters

For exporters in low-risk countries - including India - the data burden is almost the same.

What you mainly avoid is the additional analytical work, not the traceability work.

You still need the required supply chain information, including geolocation, and you still need to submit and maintain the required due diligence records. Traceability therefore remains a core part of EUDR compliance.

Which Category Are You in?

The December 2025 amendment added a third role - the downstream operator - and it changes the obligations significantly.

The key word in the downstream operator definition is "all."

Every input must already be covered by a due diligence statement or a simplified declaration. If even one input is not covered, you become a standard operator and must meet the full due diligence requirements.

For a chocolate manufacturer buying covered cocoa, or a furniture maker buying covered timber, this can mean a significant reduction in obligations.

But if even one input is not covered, there is no reduction - the full requirements apply.

The Simplified Declaration

Article 4a, also introduced in December 2025, creates a simpler route for micro and small primary operators.

This applies to natural persons or micro and small businesses in a low-risk country that place products on the market or export products they produced themselves there.

It replaces the due diligence statement entirely. Instead of filing a statement for each consignment, the operator submits one single, one-time declaration before first placing the product on the market.

The system then issues a declaration identifier instead of a reference number. That identifier travels down the supply chain in the same way as a reference number.

What is simplified?

There are two further concessions:

• Postal address instead of coordinates: A postal address can be used instead of geolocation coordinates if it clearly identifies the location of the plots. Cadastral information can also be used.
• No new declaration in some cases: No declaration is required if equivalent traceability information is already available in a national database.

Important: The simplified process does not remove responsibility for compliance. By submitting the declaration, the operator takes responsibility for the product meeting the EUDR requirements.

The Commission’s FAQ also confirms that these declarations do not need to be updated simply because the annual production quantity changes.

Penalties

Article 25 requires Member States to set penalties that are effective, proportionate and dissuasive, and it lists what those penalties must include.

Fines

For legal persons, the maximum available fine must be at least 4% of the company's total annual EU-wide turnover in the preceding financial year.

The fine must also be set high enough to remove the economic benefit gained from the infringement. For repeat infringements, the amount can increase.

Important: 4% is not the maximum fine.

National laws must allow fines of at least 4% of EU-wide annual turnover. The fine can be higher if needed to take away the financial benefit gained from the violation.

Other Possible Penalties

Fines are not the only consequence. Penalties can also include:

• Confiscation of the products and the revenue from the transaction
• Exclusion from public procurement and public funding for up to 12 months
• Temporary prohibition on placing products on the market or exporting them in cases of serious or repeated infringements
• Loss of access to simplified due diligence

Member States must also notify the Commission of final judgments against legal persons within 30 days, and the Commission publishes them.

So the impact is not limited to the financial penalty. Public disclosure can also create reputational exposure.

What To Do in the Remaining Weeks

1. Confirm your category first

Are you an operator, trader, or downstream operator?

Your category determines what you need to do. Check the word "all" carefully — one uncovered input can make you an operator.

2. Confirm your scope, including the July 2026 changes

Check your customs codes against Annex I. Also check whether the delegated act has been published in the Official Journal before assuming that leather is out of scope.

3. Check your geolocation data against the actual rules

Don't just ask, "Do we have coordinates?" Check that you have:

• Six decimal places for coordinates
• Polygons for every non-cattle plot above 4 ha, measured at plot level
• Every establishment for cattle across the animal’s life
• A production date or time range attached to each record

4. Find your data gaps upstream

Plot boundaries from smallholder suppliers are one of the hardest data points to collect under the regulation, and they depend on other people. This is the work that cannot be compressed.

5. Register in the Information System

Don’t wait until the end of December. Register early and test a submission using real data.

Our guides to farm traceability and food traceability software explain how plot, harvest, and lot records connect to the shipment that eventually carries the declaration.