EUDR: The Deforestation Regulation Applies From 30 December 2026 — Who Needs to Be Ready

EUDR has a reputation as the regulation that keeps getting postponed. It has been postponed twice — which is exactly why a large share of the companies in scope have not started preparing. The problem is that a third postponement did not come: large and medium-sized enterprises must comply from 30 December 2026.

That is three months. And if you make furniture, wooden packaging, pellets, chocolate or leather goods, preparation is not filling in a form — it is collecting geographic coordinates from your suppliers.

What EUDR is

EUDR is Regulation (EU) 2023/1115 on the making available on the Union market and the export from the Union of certain commodities and products associated with deforestation and forest degradation. It prohibits placing on the EU market goods produced on deforested land, regardless of whether that deforestation was legal in the country of production.

That is the key distinction: the Regulation sets two independent conditions. The product must be deforestation-free and produced in accordance with the legislation of the country of production. Legal logging on land cleared in 2023 does not pass.

Which commodities and products are in scope

The seven commodities look remote from a European manufacturer’s business until you read the list of derived products in Annex I.

The most underestimated case is wooden packaging. A company that does not trade timber at all, but packs its output in wooden crates or ships on pallets, can fall into scope through the derived product.

Operator or trader: the two roles

In practice an importer of cocoa or rubber is an operator and carries the full burden. A company buying from that importer and reselling is a trader with lighter obligations — but only if it is an SME.

The timeline after two postponements

The postponement came through Regulation (EU) 2025/2650, adopted at the end of 2025. It did not change the Regulation’s ambition — it moved the dates and reduced the administrative burden for the smallest operators. The core architecture is untouched.

The three steps of due diligence

1. Collect information. Product description, quantity, country of production and — the critical part — geolocation of all plots of land the commodity comes from, together with the date or time range of production. Larger plots require polygons, not a single point.
2. Assess risk. Evaluate the risk that the commodity is not deforestation-free: country risk classification, complexity of the supply chain, presence of indigenous peoples, reliability of the information, and the risk of mixing with product of unknown origin.
3. Mitigate risk. Where the risk is not negligible, take measures — additional information, independent surveys, supplier audits, satellite data — until it becomes negligible. If it does not, the commodity is not placed on the market.

Steps two and three fall away for commodities from low-risk countries where circumvention can be ruled out after assessing supply chain complexity. That is the most significant practical relief in the whole text.

The due diligence statement and the information system

The due diligence statement (DDS) is an electronic declaration the operator submits in the EU information system before placing the commodity on the market, assuming responsibility that due diligence has been carried out and the risk is negligible.

Registration is in the Commission’s system, which also offers a test environment for practice. Every statement receives a reference number that is passed down the chain — your customer will ask for it, because without it they cannot submit their own.

What the May 2026 simplification changed

On 4 May 2026 the Commission published its long-awaited simplification review together with updated guidance, a new FAQ edition and a draft delegated act on product scope. The main reliefs:

• Micro and small primary operators do not submit a new statement per shipment, but a one-time simplified declaration.
• A postal address is accepted instead of precise geolocation polygons for the smallest operators.
• Authorised representatives — cooperatives, for instance — can submit data on behalf of small producers.
• The information system was rebuilt and relaunched in June 2026 with new bulk-submission functionality.

The Commission estimates the measures cut annual compliance costs by around 75 % compared with the original design. The deadlines, however, did not move — and that is the point most often missed when reading the headlines.

Checks and penalties

Penalties sit in Article 25 and are among the toughest in EU product legislation: fines of at least 4 % of annual Union turnover for the preceding year, confiscation of the commodity and of the revenue from the transaction, temporary exclusion from public procurement and public funding for up to 12 months, and — for serious or repeated infringements — a temporary prohibition on placing the commodity on the market.

Enforcement in Bulgaria

The competent authority in Bulgaria under Regulation (EU) 2023/1115 is the Executive Forest Agency. It publishes the Commission’s guidance, the current FAQ editions, user manuals and training materials, coordinates with the Commission and validates the registrations of third-country operators importing into Bulgaria.

In practice this means your first check is unlikely to be at the border — it will be documentary, based on the statements you submitted and the records behind them.

Action plan before 30 December

1. Determine whether you are in scope. Pull the nomenclature codes for everything you import, produce and export, and match them against Annex I. Include packaging.
2. Determine your role. Operator, large trader or SME trader — the volume of obligations differs sharply.
3. Register in the system. Practise in the test environment first; submitting a statement is not intuitive.
4. Collect the geolocation. This is the longest step and it depends entirely on your suppliers. Start with one letter to all of them stating precisely what you need and by when.
5. Build the risk assessment. Document the criteria and the result — this is the record the competent authority will ask for.
6. Write the requirement into contracts. A supplier obligation to provide coordinates and a statement reference number, with consequences for failure.
7. Appoint an owner and a deputy. Statements do not wait for holidays.

Where ISO 14001 fits

An ISO 14001 certificate does not make you EUDR-compliant — the Regulation does not accept certificates as evidence. What an environmental management system gives you is the mechanism: identifying applicable legal requirements, evaluating compliance, controlling documented information and running an internal audit that catches the gap before the authority does.

Conclusion

EUDR is a regulation where preparation does not depend on you but on your suppliers — which is exactly why delay is dangerous. The procedure takes a week to write. Plot coordinates from a supplier in a third country take months to collect, and sometimes never arrive, which means changing supplier.

If you have not yet checked whether your codes appear in Annex I, that is this week’s work. If you have checked and you are in scope, call your suppliers today. The rest is documentation, and documentation is the easier part. See also how supplier audits work, because at high risk that is exactly what risk mitigation will look like.