EUDR compliance: traceability steps for commodity importers

Regulation (EU) 2025/2650, published in December 2025, postponed the EUDR again. According to the European Commission, large operators must now comply with their main obligations from 30 December 2026, and natural persons and micro and small enterprises from 30 June 2027. Linklaters records that the Parliament and Council reached provisional agreement on 4 December 2025, with the amending Regulation published in the Official Journal on 23 December 2025.

Two further dates matter. The Commission's page states that products newly added to the scope by Delegated Regulation (EU) 2026/2102 become subject to the Regulation from 30 December 2027, and that the EU Information System, through which due diligence statements are submitted, was launched on 4 December 2024. The system is therefore live; the rules that govern its use are what remain in motion.

The uncertainty is real. Linklaters notes that the Commission was required to carry out a simplification review by 30 April 2026, which could change the requirements again. EY draws the same conclusion: the final requirements remain uncertain. For a head of procurement, however, uncertainty about future easing is not a reason to wait. Supplier mapping and data collection take many months and do not depend on what the review concludes.

Procurement teams should also settle governance now. The EUDR sits across procurement, legal, sustainability, trade compliance, finance and IT, and without a named owner the work drifts. The programme lead needs authority to issue supplier requests, approve contract changes and escalate when a key supplier refuses. We recommend a steering group that meets monthly, a single risk register and a decision log recording why each sourcing choice was made. When competent authorities ask questions, the decision log is the evidence of reasonable care.

Timing is a practical concern as well as a legal one. Supplier data requests compete with harvest cycles, and many origin countries have narrow windows in which farm visits and cooperative meetings are possible. A programme that starts in the last quarter before the deadline will collide with those constraints. Working back from 30 December 2026, importers should identify which commodities have seasonal blocks and sequence them first, so the hardest data collection is not scheduled for the weeks when producers are busiest.

The implication is to plan to the 30 December 2026 date for every in-scope volume, and to treat any easing as a bonus rather than a baseline. EY adds that from 2027 downstream operators and traders must still collect supplier and customer data for in-scope transactions, even where a due diligence statement is only required when a product is first placed on the market or exported. What to do: confirm today which entities in your group are operators, which are traders, and which products fall in scope.

The regulation exists because the evidence on drivers is stark. The FAO reports that agricultural expansion drives almost 90 per cent of global deforestation, and that livestock grazing is responsible for almost 40 per cent of forest loss. In South America, it says, almost three quarters of deforestation is due to livestock grazing. The FAO adds that 420 million hectares of forest have been lost since 1990.

Recent data underline the point. Global Forest Watch figures reported by Climate Home News show 6.7 million hectares of primary tropical forest were lost in 2024, nearly twice the 2023 figure, with fires the main cause for the first time. Brazil alone accounted for 42 per cent of all tropical forest loss that year. Euronews reports that forest loss rose 200 per cent in Bolivia to 1.5 million hectares, and that farming for soy and cattle in Brazil rose by 13 per cent.

Fires complicate attribution, because a burn can be started for several reasons and the land-use outcome may only become clear later. Auditors and enforcement bodies will still ask whether the plots in your supply chain were affected, and what evidence you hold that they were not. A supplier in a region with high recent loss will receive closer scrutiny, however good its own practice.

Not all deforestation is equal in evidence terms. Large-scale clearance is visible in satellite imagery, and monitoring services can flag it quickly. Small and fragmented clearance, common among smallholders and in cattle supply chains where animals move between ranches, is harder to detect and attribute. For cattle the question is complicated because an animal may have lived on several properties. Importers should ask early how their suppliers keep animal movement records and how they handle indirect suppliers.

Climate conditions add volatility. The 2024 data show that drought and fire can raise forest loss sharply in a single year, and that a region regarded as improving can reverse quickly. Risk assessments should therefore be refreshed, not completed once. A supplier assessed as low-risk in one season may operate near an area where fires have since started. Build a refresh cycle into the programme, with triggers such as satellite alerts, changes in local legislation and adverse media.

The implication is that Latin American soy, cattle, coffee and cocoa volumes should be prioritised in any traceability roadmap. They combine high exposure with commodities that move through multiple intermediaries before reaching the importer. What to do: rank your sourcing regions by recent forest loss and by the number of intermediaries between farm and port, and start plot-level evidence work where both are highest.

The Commission has sorted countries into three tiers. Linklaters reports that about 140 countries are classed low risk, including all EU Member States, the UK, the US, Canada and China; around 50, including Indonesia, Malaysia and Brazil, are standard risk; and four, Belarus, Myanmar, North Korea and Russia, are high risk. The tier is attached to the country of production, not the importer.

The tiers drive enforcement intensity. Linklaters records minimum annual checks of 1 per cent for low-risk, 3 per cent for standard-risk and 9 per cent for high-risk countries. For an importer sourcing from Brazil, that means a standard-risk profile: more scrutiny than a European origin, though less than a high-risk origin would attract. Competent authorities will use the tier to decide where to look.

Nothing in the tiers removes the duty to hold evidence. The Commission states that, regardless of size, all operators will collect and retain information for 5 years. A low-risk origin makes the question easier to answer, but the importer still has to demonstrate that the product is deforestation-free and legally produced, and still has to keep the records that prove it.

Mixed-origin supply chains are where tier logic becomes difficult. A commodity traded through a hub may combine product from several countries, some low risk and some standard risk. The importer must be able to show which parts of a shipment came from where, or accept the stricter treatment. Segregation costs money, but it also reduces the volume exposed to higher-risk origins. Procurement should ask traders to quote for segregated and unsegregated supply, and compare the premium with the compliance saving.

Tier assignments may also be revisited. The Commission's classification can change as evidence accumulates, and a sourcing strategy built on the assumption that today's tier is permanent can be exposed. Importers should monitor announcements and keep alternative origins qualified, particularly for commodities where a single country supplies a large share of volume. The cost of qualifying a second origin is usually smaller than the cost of an unplanned supply gap.

The implication is that a sourcing map organised by tier gives a sensible first view of where to apply effort. What to do: tag every supplier and volume with its country of production and risk tier, identify blended shipments in which origins are mixed, and decide whether to segregate them. Blended lots are where the tier cannot be assigned with confidence, and where the exposure is greatest.

Brazilian trade data illustrate how much commercial value hangs on EU access. Farmdoc daily at the University of Illinois reports that the EU took 14 per cent of Brazil's soybean and derivative exports in 2022, worth $8.8 billion, and that the EU accounts for more than 50 per cent of Brazil's coffee exports, worth $4.3 billion in 2022. The EU is Brazil's second-largest trading partner, accounting for 16 per cent of Brazil's total trade.

Products specified by the EUDR account for 30 per cent of the total value of Brazilian trade in 2023, according to the same source. That is a large share of an economy's output exposed to one regulation. Producers, traders and exporters in Brazil therefore have strong reasons to supply the evidence that importers need, because the cost of losing the EU market is far higher than the cost of documenting origin.

Palm oil shows the other side of the picture. IISD reports that Indonesia supplies around 40 per cent of the EU's oil palm product imports. A buyer dependent on a single country faces concentration risk that traceability alone will not solve. If that country, or a single supplier, cannot evidence compliance, the importer may find alternatives scarce and prices higher.

The Brazilian figures also reveal a limit in the data. Farmdoc daily points out that the regulation, in its reading, does not cover the Cerrado savannah, where more than 60 per cent of Brazil's soybeans are currently grown. That should not be read as a free pass. Importers still need to show that product is legally produced and deforestation-free under the Regulation's definitions, and cannot assume that a plot falls outside scope. Treat the claim as a reason to ask for plot-level confirmation, not to skip it.

Cost-sharing is a negotiation. Producers in Latin America argue that they bear a heavy share of the burden, while importers argue that they carry the legal liability. In practice, the parties best placed to fund data collection are those closest to the margin: traders, exporters and cooperatives with scale. Procurement can propose shared funding, repaid through price adjustments or volume commitments. Clear terms prevent disputes and keep the relationship intact when the first audit arrives.

The implication for procurement is that supplier engagement should be framed as a shared commercial interest, not a demand. Suppliers that expect EU volumes to continue have every reason to invest, and importers can offer longer contracts or volume commitments in return for evidence. What to do: segment suppliers by how much of their sales depend on the EU, and offer the most dependent suppliers structured support, since they have the strongest incentive to comply.

IISD reports that the Commission estimates businesses' annual compliance costs will total around EUR 2.0 billion, down from an estimated EUR 8.1 billion before simplification. That is a large reduction, and the Commission says its simplification measures reduce administrative costs and burdens. It does not, however, remove the burden on the importer that is first placing product on the EU market.

Readiness varies. A March 2026 EUDR Community of Practice survey run by the European Forest Institute drew 145 substantive responses. Many respondents said they were ready, or would be by December 2026, but those dealing in wood and rubber had the highest proportions saying they would not be. The same analysis found that all three elements of the due diligence process continue to pose challenges.

The reason is data, not technology. Software can store geolocation files, risk scores and declarations, but it cannot create information that the supplier does not hold. Smallholders in particular may have no formal plot boundaries, and intermediaries may mix volumes from many farms. Tools that promise EUDR compliance in a few clicks usually assume that supplier data already exists.

Not all costs are equal. Direct costs such as geolocation surveys, satellite monitoring and third-party verification are visible and can be budgeted. Indirect costs are larger and less visible: staff time spent chasing suppliers, delays at ports when declarations are incomplete, and write-offs when product cannot be placed on the market. A sensible budget distinguishes between the two and sets a contingency for the indirect costs that tend to surface in the last quarter before a deadline.

Technology choices should follow three tests. Does the platform accept data in the formats suppliers can actually produce, such as shapefiles and GPS points collected on a phone? Does it connect to the EU Information System in the way the Commission expects? And can it be changed if the rules change again? A platform that scores poorly on any of these will add work rather than save it. Pilot with real supplier data before signing a multi-year contract.

The implication is that spending should follow the data gaps. A modest investment in supplier outreach, field verification and cooperative-level data collection will often deliver more than a large platform subscription. What to do: audit the completeness of supplier data before selecting software, define the minimum dataset per supplier, and treat missing items as procurement risks with owners and dates.

The practical programme is short and ordered. First, map every in-scope product to its suppliers, intermediaries and plots of origin. Second, collect the evidence: geolocation of plots, proof of legal production and information on land-use history. Third, assess the risk, using the country tier and supplier-specific signals. Fourth, mitigate where risk is not negligible, by sourcing elsewhere, verifying in the field or requiring corrective action. Fifth, declare through the Information System and retain the records for 5 years.

The first step is the hardest and the most neglected. Many importers know their direct suppliers but not those two or three steps back. Without a map, risk assessments are guesses and evidence requests go to the wrong parties. A map also shows how many different cooperatives, traders and processors feed each shipment, which is the single best predictor of how long the programme will take.

The second step requires contractual levers. Supply agreements should oblige suppliers to provide geolocation data, to notify changes in sourcing, to permit audits and to accept termination if evidence is not provided. They should also specify who bears the cost of data collection. Importers that leave these terms for later will find that suppliers who would have agreed readily in 2024 become reluctant once the deadline is near.

Governance of the data needs the same care as collection. Records will include personal data about farmers and landholders, and importers have duties under data protection law. Access should be limited, retention periods defined and suppliers told how their data will be used. Data-sharing agreements with cooperatives and traders prevent later disputes about ownership. Many suppliers are more willing to share when they know their commercial information will not be passed to competitors.

The implication is a plan with owners, a budget and a critical path. What to do: assign a single programme lead in procurement, agree the minimum dataset, run a pilot with a handful of strategic suppliers to test the process, and expand in waves by commodity and tier. A pilot will reveal the practical obstacles that policy documents cannot.

A compliance-only mindset leaves value on the table. Suppliers that can document origin tend to be better managed, more reliable on delivery and more willing to share information that helps with other risks, including labour conditions and quality. Importers can use that visibility to differentiate the product they sell, to defend a price premium and to answer customer questions about origin.

There is a defensive logic too. Where the EU is such a large share of a producer's exports, as with Brazilian coffee, suppliers that cannot meet the standard will be pushed towards other markets, and importers that depend on them will lose volume. Early collaboration reduces the chance that a key supplier exits, and gives the importer first call on compliant volumes when the market tightens.

The investment case should be built in commercial terms. Compare the cost of supplier programmes with the revenue protected, the premium defended and the penalties and delays avoided. Because the regulation is likely to be adjusted again, design the programme so that the core data model, geolocation, legality and land-use history, can be reused whatever the final requirements are.

Finally, communicate the programme. Customers, investors and lenders will increasingly ask how an importer manages deforestation risk, and a documented programme with credible metrics answers the question. Suppliers take their cue from the importer: a visible programme with leadership backing signals that volumes depend on compliance. Silence invites suppliers to assume the deadline will move again, which is the most common reason programmes start too late.

The implication is that procurement should ask for a budget as a commercial investment, with measurable returns, rather than as a legal cost. What to do: define three or four indicators, such as the share of volume with plot-level evidence, the share of suppliers rated low-risk and the time to onboard a new origin, and report them to the board each quarter.

Karter McKinley helps procurement and sustainability teams turn EUDR into a delivery plan: supplier mapping, evidence design, contract language, programme governance and a business case that links traceability to supply security and market access. We work alongside legal and technical specialists where specific advice is required. This briefing is general information, not legal advice.