Who is responsible for EUDR? Duties of importers, processors and traders

1. What does EUDR regulate, and when is a product covered?

EUDR, Regulation (EU) 2023/1115, aims to reduce the EU market’s contribution to deforestation and forest degradation. It concerns cattle, cocoa, coffee, oil palm, rubber, soya and wood, and specified products derived from them. Coverage depends on the current Annex I and the product code, not simply on a commodity appearing in the ingredients.

A covered product must be deforestation-free, produced in accordance with the relevant laws of its country of production and covered by the applicable statement or permitted simplified declaration. The deforestation criterion concerns land deforested after 31 December 2020; wood also requires consideration of forest degradation.

Start with a product list and CN codes. Do not assume every wooden item or every product containing palm oil is automatically covered. The product list changed in 2026, so older summaries may no longer be accurate.

• EUDR regulation and current versions

2. Upstream operator: the main responsibility for compliance

An upstream operator is a business or person that, in a commercial activity, first places a relevant product on the EU market or exports it, excluding a downstream operator. This may be an importer, but also an EU primary producer placing its own production on the market.

Before placing a product on the market or exporting it, the operator carries out due diligence. It gathers product and origin information, assesses risk and mitigates it where necessary. If it cannot establish no risk or only negligible risk of non-compliance, it cannot place or export the product.

After completing this process, it submits a DDS in the EUDR Information System and passes the reference number to its direct downstream buyer. A number generated by the system is not an official compliance certificate or a substitute for risk assessment.

• European Commission: roles and responsibilities

3. Imports from outside the EU: who is responsible?

If a Polish company imports covered coffee from outside the EU and first places it on the Union market, it will normally act as an upstream operator. A foreign producer’s declaration, an industry certificate or a customs broker handling clearance does not replace its duties.

Take particular care where a non-EU-established business carries out the import. The Commission explains that the first EU-established person making those products available on the market is also considered an operator. Such a chain may therefore contain both a non-EU operator and an EU operator with due diligence duties.

Do not determine responsibility only from a name on an invoice or an Incoterms term. Map customs clearance, first market placement, the seller and the first EU-established recipient.

4. A processor acting as a downstream operator

A business may buy a product already subject to due diligence and make another Annex I product from it. Where all relevant inputs have already undergone upstream due diligence, it can be a downstream operator rather than a new upstream operator.

For example, a chocolate maker buys cocoa already placed on the EU market by an importer. If the conditions are met for all relevant inputs, selling the chocolate can be a downstream activity. A new DDS is not required simply because the product or its code has changed.

The same company may have a different role for raw materials it imports itself. Determine the role for each product flow, not once for the entire company.

5. Traders and first downstream buyers: not everyone retains the same numbers

A trader makes an already-due-diligenced product available on the market, usually without changing its Annex I CN code. This may be a wholesaler or retailer. Traders and downstream operators retain the required information on suppliers and business buyers for at least five years and provide it to authorities on request.

There is an additional duty for the first downstream operator or trader: the direct buyer from the upstream operator. It retains the received DDS reference number or simplified declaration identifier for at least five years. It does not have to pass those numbers to its own buyers.

Do not design a procedure assuming every seller must collect and pass DDS numbers throughout the whole chain. Following the 2025 changes, supplier and buyer traceability must be distinguished from the first downstream buyer’s specific duty concerning reference numbers.

• Official explanation of first downstream buyer duties

6. Company size: what changes with SME status?

Company size does not automatically exempt a business from EUDR. It affects some duties and application dates. Large downstream operators and traders that are not SMEs must also register in the EUDR Information System. Registration itself does not create an obligation to submit additional DDSs.

According to the Commission’s explanation, large downstream businesses must verify upstream due diligence and negligible risk when they become aware of possible product non-compliance. This is not routine repetition of the entire assessment for every purchase. SME downstream operators and traders do not have that registration or verification duty.

All of these businesses must nevertheless meet their own information duties and respond to new information suggesting non-compliance. Use the relevant EU definitions to classify company size, not the informal description “small business”.

7. A simplified declaration is not available to every small importer

A qualifying micro or small primary operator can use a special simplified declaration. This concerns an eligible operator established in a low-risk country that places or exports products it produced itself in that country, for example products it grew or harvested.

Instead of separate DDSs, it submits a one-off simplified declaration, updated when important information changes. This model also allows the relevant postal address to replace geolocation coordinates. Due diligence remains required.

A small business importing coffee from a foreign supplier does not qualify simply because it employs only a few people. It must also meet the primary-production criterion and the other conditions.

• EUDR Information System: DDS and simplified declarations

8. A representative or certificate does not transfer responsibility

An upstream operator can give an EU-established authorised representative a written mandate to submit statements on its behalf. It can also use advisers or tools to document deliveries. The operator nevertheless remains responsible for its products’ EUDR compliance.

A supplier certificate may contribute evidence, but does not automatically remove the need to check origin and risk. Similarly, buying document templates does not establish that a particular delivery meets the rules.

The agreement should identify who provides data, who checks it, who submits the DDS and how missing information is handled. Dividing work between purchasing, logistics and compliance staff does not change the company’s legal role.

• European Commission: authorised representatives

9. Timelines: when do the duties start applying?

The main EUDR application date is 30 December 2026. Most micro and small businesses have until 30 June 2027. However, that extension does not cover micro and small businesses for products already covered by the existing EUTR: their date is 30 December 2026.

For new products added by Delegated Regulation (EU) 2026/2102, the Commission identifies 30 December 2027. This is a date for specified new entries, not another delay to EUDR as a whole. Check company status, the particular product and transitional provisions when establishing your deadline.

Do not leave role identification until the first delivery after your applicable date. Obtaining origin information and setting up records may require changes to supplier arrangements.

• European Commission: current application timelines
• Adopted December 2025 amendment

10. Possible non-compliance: what must a business do?

If information emerges suggesting a product may not comply with EUDR, simply filing it away is not enough. A business must meet the duties applicable to its role, including providing required information to competent authorities and buyers. Large downstream businesses also face the upstream due diligence verification described above.

A procedure should cover escalation, identifying deliveries and buyers, assessing whether a transaction needs to be paused and recording decisions. Conflicting origin information or a report of deforestation on a documented plot are examples of warning signs.

Member States establish penalties within EUDR’s requirements. Do not treat 4% of turnover as an automatic fine for every missing document: the regulation requires the maximum level of the relevant fine for legal persons to be at least 4% of annual EU-wide turnover. The actual sanction depends on the infringement and applicable national rules.

• Requirements and penalties: the EUDR regulation

11. Checklist: organise responsibility before the first delivery

Preparation starts with a map of products and flows, not an empty DDS form. Work through these steps for each product group.

• Check the current Annex I and the product’s CN code.
• Map the supplier, import, processing, first market placement and subsequent sale.
• Identify your role for each flow and your company-size category.
• Determine whether you need due diligence and a DDS, a simplified declaration or downstream records.
• If you are the first downstream buyer, link received DDS numbers or declaration identifiers to deliveries.
• Set rules for retention, access during checks and responses to possible non-compliance.
• Assign a process owner and confirm your applicable deadline.

12. How can you start organising EUDR documentation?

The EUDR package available through EPRPilot includes a role-identification decision tree, a procedure, a supplier letter and questionnaire, a register, a risk-assessment sheet and an inspection-readiness checklist. These are a starting point for organising the process, not a product compliance certificate.

Fill the templates with your actual business data and check their suitability for your role and the current scope of the rules. Where due diligence is required, the documents must reflect genuine origin and risk checks.

This article is general information, not individual legal advice. Reference date: 13 October 2026. Commission explanations help interpret the rules but do not replace the binding law. For a specific product decision, check the current Annex I, transitional provisions and national requirements.

• View the EUDR document package
• Full question-and-answer guide