EUDR Compliance in 2026: Requirements, a Checklist and How to Get Ready
- John Hall
- Customs Specialist at iCustoms.ai
EUDR compliance means you can show that every cattle, cocoa, coffee, oil palm, rubber, soya or wood product you place on the EU market, or export, is deforestation-free, legally produced and covered by a due diligence statement (DDS) or simplified declaration. You also keep the evidence for five years and pass references to the people who need them, including customs.
The EU Deforestation Regulation applies to large and medium companies from 30 December 2026 and to most micro and small companies from 30 June 2027. This guide sets out the requirements article by article, gives a 10-step checklist and a realistic timeline, and explains when software, consultants or managed services make sense.
EUDR Compliance Requirements, Article by Article
These are the EUDR requirements that shape day-to-day compliance, as amended in 2025.
| Article | What it requires | Who it applies to |
|---|---|---|
| Art. 3 | Products may only be placed on the market or exported if deforestation-free, legally produced and covered by a DDS or simplified declaration | Everyone placing or exporting relevant products |
| Art. 4 | Carry out due diligence, submit a DDS before placing or export, pass the reference to direct buyers, and do not place products unless risk is negligible | Upstream operators |
| Art. 5 | Collect and keep supplier and buyer records for five years; the first buyer keeps the DDS reference; report concerns | Downstream operators and traders |
| Art. 9 | Collect geolocation, quantity, country, production date, supplier details and evidence of legality | Operators |
| Art. 10 | Assess the risk of non-compliance against set criteria, such as country risk, supply chain complexity and mixing | Operators |
| Art. 11 | Mitigate any risk that is not negligible, for example with more information or independent audits | Operators |
| Art. 12 | Run a due diligence system, review it at least once a year and keep records; large operators report on it publicly each year | Operators |
| Art. 13 | Simplified due diligence when all products come from low-risk countries | Operators sourcing from low-risk countries |
| Art. 16 | Annual checks covering at least 9%, 3% and 1% of operators sourcing from high, standard and low-risk countries | Competent authorities |
| Art. 26 | The DDS reference must be on the customs declaration before release or export | Declarants and customs |
Micro and small primary operators in low-risk countries can file a one-off simplified declaration instead of a DDS per shipment. Penalties are set nationally and must include fines of at least 4% of total annual EU turnover for the most serious breaches. Read the consolidated regulation on EUR-Lex for the full text.
EUDR Compliance by Role
Your obligations depend on your role for each product, not on your company as a whole.
- Upstream operator: the first to place a product on the EU market or export it, such as an importer. Full due diligence and a DDS.
- Upstream micro or small primary operator: a small producer in a low-risk country selling its own harvest. A one-off simplified declaration.
- First downstream operator or trader: the first buyer from an upstream operator. Collects and keeps the DDS reference.
- Downstream operator or trader: later buyers who process or resell. Keep supplier and buyer records for five years.
Our EUDR role and deadline check walks through each role with examples and dates.
A 10-Step EUDR Compliance Checklist
Work through this EUDR checklist in order. Steps 5 and 6 usually take longest, so start them early.
- Name an owner and train the team. EUDR touches procurement, sustainability, legal, IT and customs; one person must own it.
- Confirm product scope by eight-digit CN code against Annex I, using our EUDR HS code checker.
- Confirm your role and date for each product and flow.
- Register in the EUDR Information System and test a statement in the acceptance environment.
- Map and onboard suppliers, starting with those behind your largest volumes.
- Collect and validate information: plot geolocation, production dates, quantities and legality evidence.
- Assess and mitigate risk, or apply simplified due diligence where all sourcing is low risk.
- Submit the DDS before placing or export, as explained in our EUDR due diligence statement guide.
- Connect to customs: agree how each reference reaches your forwarder, declared under TARIC code C716.
- Keep records for five years, review the system every year and publish your annual report if you are a large operator.
Your Due Diligence System and Annual Review
Article 12 asks operators to treat EUDR as a system, not a series of filings. The system covers information collection, risk assessment and mitigation, record keeping and reporting. It must be reviewed at least once a year and updated when something changes, such as a new sourcing country or a new country rating. Operators that are not small or medium companies must also report publicly each year on how the system works. According to the Commission’s FAQ, the first report covers 2027 and is published after 30 December 2027, and anything already reported under the CSRD or CSDDD need not be repeated.
In practice, that means written procedures, named owners, a log of decisions, and evidence that can be retrieved quickly if a competent authority asks.
A Realistic Readiness Timeline
Starting from scratch, a focused team can follow an example plan like this. If your date is close, run the steps in parallel and go live with your main flows first.
| When | What to do |
|---|---|
| Weeks 1 to 2 | Name the owner, confirm scope and roles, register in the Information System |
| Weeks 2 to 6 | Onboard priority suppliers and collect plot data and legality evidence |
| Weeks 5 to 7 | Validate data, assess risk, submit test statements in the acceptance environment |
| Week 8 | File the first live DDS and agree the reference handoff with your forwarder |
| After go-live | Onboard the remaining suppliers, review the system yearly, report if required |
Supplier data almost always sets the pace. If you have many smallholder suppliers, prioritise by volume and risk, and plan for a second wave after go-live.
Three Real-World Scenarios
A large importer of natural rubber gloves. A German distributor imports gloves (ex 4015) from Malaysia and releases them for free circulation. It is the upstream operator from 30 December 2026: it collects plot data through its manufacturer, assesses risk, files a DDS per shipment or per period, and sends each reference to its customs agent.
A small chocolate maker buying in the EU. A Belgian chocolatier with 30 staff buys cocoa butter from a Dutch processor. Because the processor already placed it on the market, the chocolatier is a downstream operator. From 30 June 2027 it keeps supplier and customer records for five years and files no DDS.
A medium timber trader. A Polish trader buys sawn oak from a sawmill in Ukraine through its own import, and also buys beech boards from an EU sawmill. For the oak it is the upstream operator and files the DDS. For the beech it is the first trader after the sawmill, so it collects the sawmill’s DDS reference and keeps it for five years, without filing its own statement.
Software, Consultants or Managed Services?
Most businesses use a mix of EUDR compliance services. Each fits a different job.
| Option | Best when | Watch out for |
|---|---|---|
| Software platform | You have recurring volume: many suppliers, shipments or statements | Someone still owns the risk decisions |
| Consultants or legal advisers | You are designing your due diligence system, legality checks or risk method | Not built to run daily filings |
| Managed service | You have little internal capacity and want the work run for you | You remain legally responsible; check you can access every record |
Whatever you choose, automate the repetitive work and keep human judgement where the law expects it.
- Automate: supplier data collection, geolocation checks, DDS creation and submission, reference sharing and record keeping.
- Keep human review for: unclear product scope, legality evidence, the risk assessment conclusion, mitigation decisions and sign-off.
For a full capability checklist to use with any provider, see our guide to EUDR software.
How iEUDR by iCustoms Helps
iEUDR by iCustoms is AI-powered, cloud-based EUDR compliance software built around the three parties that do the work.
- Non-EU suppliers: many are already onboarded in iEUDR. New suppliers are checked against official EU TRACES records and enter products, quantities and production sites in their own portal, free of charge and with built-in guidance and support. Every point and polygon is validated against the EUDR geolocation rules and converted to GeoJSON before they submit.
- Operators: your team reviews and approves each submission. iEUDR flags in-scope CN codes, then creates, validates and submits each DDS, singly or in bulk.
- Downstream operators: iEUDR retrieves, verifies and validates the DDS your suppliers send, and keeps every record for five years.
Each reference also reaches your forwarder before they file. To be clear about scope: iEUDR does not perform risk assessment or satellite monitoring today. Those remain with your team or a specialist provider, and iEUDR keeps the information they rely on in one place. Satellite imagery comparison and risk alerts with corrective action plans are planned for the next phase. Explore the full iEUDR compliance software.
Frequently Asked Questions
You may also like:
Is your business ready for 30 December 2026?
iEUDR takes you from supplier data to a validated, submitted DDS in one platform.
Subscribe to our Newsletter
About iCustoms
iCustoms is an all-in-one solution helping businesses automate customs processes more efficiently. With AI-powered and machine-learning capabilities, iCustoms is designed to streamline your all customs procedures in a few minutes, cut additional costs and save time.
Stuck at supplier onboarding?
Connect suppliers already on iEUDR and onboard the rest through one supplier portal.