EUDR Due Diligence: Which Path You Need, and How to Do It

EUDR Due Diligence: Which Path You Need, and How to Do It

If you place cattle, cocoa, coffee, palm oil, rubber, soya, wood—or products made from them—on the EU market, the EU Deforestation Regulation (EUDR, Regulation (EU) 2023/1115) is hard to ignore. The headline rule is simple: relevant products must be deforestation-free, legally produced, and covered by the right paperwork before entering or leaving the Union market.

What actually trips companies up is the next question: how much due diligence do we have to do? An importer bringing cocoa into Rotterdam is not in the same seat as a chocolate maker buying already-covered butter from an EU supplier—and neither path is a simple "upload a certificate and hope."

This guide walks through the decision process in order: define your exact role, confirm scope, collect the required information, and choose between simplified or full due diligence.

About a 4-minute read.

Defining the Core Roles: Primary vs. Downstream Operators

Before evaluating your products, you must understand your regulatory definition. EUDR splits companies into distinct categories that dictate your compliance workload:

• Primary Operators (Operators): You are the company that first places relevant products on the EU market or exports them from it. You carry the heaviest compliance lift: you must gather plot-level evidence, conclude that risk is no more than negligible, and submit a due diligence statement (DDS) before placing or exporting goods. (Certain micro and small primary producers can use a lighter simplified declaration instead).
• Downstream Operators: You place or export products made only from relevant products already covered by an existing DDS or simplified declaration filed higher up the chain. You do not redo upstream plot-by-plot diligence or file a new DDS for that flow. Instead, you collect and retain party details and DDS reference numbers.
• Traders: Non-SME or SME traders who make relevant products available further down the EU chain. Their duties closely mirror downstream operators: hold the information, keep records, and escalate if real compliance risk appears.

The Golden Rule: Whoever first puts the product on the EU market (or exports it) is the primary operator and carries the full diligence. Everyone after that is a downstream operator or trader who inherits and documents the statement. If you call yourself "downstream" while buying uncovered goods directly from outside the EU, for that flow you are legally acting as the primary operator.

1. Are the goods in scope?

EUDR applies to relevant commodities and products listed in Annex I: cattle, cocoa, coffee, oil palm, rubber, soya, wood—and derived products under the matching CN codes.

• The Waste Carve-Out: Goods produced entirely from material that has completed its lifecycle and would otherwise be waste fall outside the regulation. However, if any virgin Annex I material is mixed in, the entire shipment is back in scope.

Not covered? Stop. Covered? Proceed to determine your role.

2. Primary Operators: Build the Information Pack First

Whether you later use simplified or full due diligence, primary operators always collect information first. Article 9 data collection cannot be bypassed.

For each relevant product, primary operators must organise and keep records for five years:

• A clear description of the product and commodities inside (for wood, common and scientific names).
• Quantity and country of production.
• Geolocation of every plot (or cattle establishment) plus production date/range:
  • up to 4ha: Precise point coordinates (minimum 6 decimals).
  • >4ha (non-cattle): Polygons.
• Who supplied you and whom you supply.
• Adequately conclusive evidence that goods are deforestation-free after 31 December 2020 (wood also covers forest degradation).
• Evidence of production under the relevant legislation of the country of production (land-use rights plus the wider legal framework).

If this data pack is thin, primary operators cannot honestly claim negligible risk—simplified path or not.

3. Then Choose: Simplified or Full? (Primary Operators Only)

Full due diligence has three layers: collect information, assess risk (Article 10), and mitigate where needed (Article 11).

• Simplified Due Diligence (Article 13): Allows primary operators to skip assessment and mitigation only when, after checking supply-chain complexity and circumvention/mixing risk, all production is in Commission-listed low-risk countries (or parts thereof). Any signal of non-compliance or circumvention pushes you back to full diligence.
• Full Due Diligence: Applies when any origin is standard or high risk, or when simplified conditions fail. High risk means heightened scrutiny. It does not automatically mean a mandatory private audit, but stronger mitigation (extra documents, independent checks, tighter segregation) is required to bring residual risk down to negligible.

(Note: Downstream operators and traders do not choose between simplified and full due diligence because they do not file the DDS.)

4. On the Full Path: Assess, Then Mitigate

When executing full due diligence, primary operators must read their Article 9 file against the supply chain: country classification, forests and indigenous peoples, deforestation pressure, document reliability, governance risk, mixing risk, past concerns, and any certifications.

• Certificates support diligence; they do not replace it.
• Primary operators may place or export goods only if risk is none or negligible. If not, mitigate until it is. Document what you decided, and review at least yearly.

5. File—or Pass the Reference On

• Primary operators: Submit the DDS, declaring that due diligence found no more than negligible risk.
• Downstream operators and traders: Collect valid upstream references, retain them for five years, and inform authorities or customers if serious new risk information appears.

The Decision Path in One Glance

1. Annex I product? If no, stop. If yes, continue.
2. First placer or exporter? If yes, you are a primary operator (must do DD + DDS). If handling only already-covered inputs, you are a downstream operator or trader (pass references).
3. Primary operators: Assemble the Article 9 data pack.
4. All origins low-risk and negligible mixing risk? Use simplified due diligence. Otherwise, use full due diligence.
5. Negligible risk confirmed? File the DDS (primary operators) or pass on the upstream references (downstream operators and traders).

Mistakes That Create False Comfort

• Confusing supplier HQ with the country of production (benchmarking follows actual production plots).
• Assuming low risk means no geolocation (simplified status skips assessment/mitigation, not Article 9 data collection for primary operators).
• Using a postal address instead of coordinates/polygons outside the micro/small primary regime.
• Leaning on a certificate as if it replaces plot-level evidence.
• Calling yourself a downstream operator while still being the first to place uncovered goods on the EU market.

Practical overview of Regulation (EU) 2023/1115 as consolidated—not legal advice. Check the official text, Commission guidance, and your competent authority for your specific products and role.