EUDR: Deforestation-Free Products and the Traceability Habit

Coffee, cocoa, wood, rubber: the EU now asks “from exactly where?” The Deforestation Regulation — Regulation (EU) 2023/1115, the EUDR — is not a Digital Product Passport law. It is a different instrument teaching the same lesson: a product placed on the EU market must show where it came from, plot by plot, with evidence that can be checked. For seven forest-risk commodities, “somewhere in that country” is no longer an answer.

The three conditions in Article 3

Relevant commodities and relevant products shall not be placed or made available on the market or exported unless all three conditions in Article 3 are fulfilled: (a) they are deforestation-free; (b) they have been produced in accordance with the relevant legislation of the country of production; and (c) they are covered by a due diligence statement. Deforestation-free (Article 2(13)) means the commodities were produced on land that has not been subject to deforestation after 31 December 2020 — and, for wood, that the wood was harvested without inducing forest degradation after the same date. One failed condition, one non-compliant product.

Seven commodities, and the products made from them

The Regulation covers seven relevant commodities — cattle, cocoa, coffee, oil palm, rubber, soya and wood — and the relevant products listed in Annex I that contain, have been fed with or have been made using them, from beef, chocolate and coffee to tyres, furniture and wood products. Scope is read in Annex I, by commodity and Harmonised System code, not by intuition. The operator — who places products on the market or exports them — carries the central duty; traders further down the chain carry duties of their own, and the first person established in the EU who makes available a product placed by an operator outside the Union is deemed to be the operator (Article 7).

The dates, after two postponements

The Regulation entered into force in June 2023, but its obligations were postponed twice — first by Regulation (EU) 2024/3234, then by Regulation (EU) 2025/2650 of 19 December 2025, which also simplified parts of the system. As amended, Article 38 provides that the core obligations (Articles 3 to 13, 16 to 24, 26, 31 and 32) apply from 30 December 2026. For operators that are natural persons or micro or small undertakings established as such by 31 December 2024, they apply from 30 June 2027 — except for products covered by the Annex to the old EU Timber Regulation (EU) No 995/2010, repealed with effect from 30 December 2026. The 2025 amendment also introduced downstream operators, whose obligations mirror traders’ — no new statement of their own, with the first downstream operator or trader collecting the reference numbers — and micro or small primary operators in low-risk countries, who file a one-time simplified declaration instead of a full statement and may give the plot’s postal address instead of its geolocation. Simplification changed who files what; it did not remove the traceability underneath.

Due diligence: information, risk, mitigation

Before placing a relevant product on the market or exporting it, the operator must exercise due diligence (Articles 4 and 8) in three steps:

• Information (Article 9): collect and keep for five years, with evidence: description and quantity, country of production, supplier and buyer identities — and the geolocation of all plots of land where the commodities were produced, with the date or time range of production. Geolocation (Article 2(28)) means latitude and longitude with at least six decimal digits; for plots over four hectares (other than cattle) it means polygons of the perimeter. For cattle, it refers to the establishments where the cattle were kept. Deforestation on a given plot automatically disqualifies its products;
• Risk assessment (Article 10): verify and analyse that information, including against the country benchmarking under Article 29 — low, standard or high risk. The product may be placed only if the assessment shows no or only a negligible risk of non-compliance;
• Risk mitigation (Article 11): where the risk is not negligible, adequate and proportionate measures — further information, independent surveys or audits, support to suppliers — until it becomes negligible, or the product does not move.

Simplified due diligence (Article 13) is available only where the country, or part of it, is classified low risk: information is still collected, but the assessment and mitigation steps need not be applied unless the operator learns of a risk. The system itself must be reviewed at least annually (Article 12).

The statement, and the reference number that travels

If due diligence concludes no or only negligible risk, the operator submits a due diligence statement through the EU information system (Article 33) before placing or exporting, assumes responsibility for compliance, and keeps a record of statements for five years (Article 4). Its reference number is the chain’s travelling credential: it must be passed downstream (Article 4(7)) and made available to customs by the person lodging the declaration for release for free circulation or export (Article 28). A different system from the DPP registry — the same pattern: a reference, checked against a central system, standing behind a physical product.

Not a passport — the same traceability habit

The EUDR creates no product passport and no QR code. What it creates is the data habit every other EU product rule now requires: know your chain to the plot, keep the evidence for five years, and produce a reference an authority can check. Wood is the bridge: the same timber that needs EUDR geolocation today is an input to furniture — a later group in the ESPR sequence we map in our ESPR timeline. Companies that build plot-level traceability for the EUDR are building, once, the discipline that passports and customer audits will ask for again. Companies that treat it as a form to file in December 2026 will discover the data cannot be collected backwards.

What companies should do now

• Map your scope in Annex I: which products contain, or are made using, the seven commodities — by HS code.
• Contract for geolocation: polygons and production dates sit with growers and first collectors; require them, structured, from every supplier, now.
• Build the system, not the file: information, risk assessment against the Article 29 benchmarking, mitigation — documented, reviewed annually.
• Prepare the statement workflow: who submits, and how reference numbers reach downstream operators and your customs declarant.
• Keep it for five years: statements and evidence are a five-year record, not a shipment attachment.

How Ledger Consortium helps

Ledger Consortium aggregates the product and supply-chain data held by you and your suppliers and anchors each record on a governed blockchain — timestamped and tamper-evident — so a geolocation file or due diligence record presented later is the record that was filed then. Anchoring proves a record existed and has not been altered; it does not certify that the data a client supplied was true — responsibility stays with the operator, as Article 4 provides. Predictable costs, no token or crypto exposure, GDPR- and eIDAS-aligned. In Italy, the Ledger DPP is distributed by Il Sole 24 Ore (Valore24), whose channel onboards dozens of companies per month. See a working passport in our live demo, read how identities are checked in the DPP registry article, and browse News.