Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Picture a rubber distributor that believes it just resells.
In October, an NGO publishes a detailed report: one of the distributor’s rubber suppliers has been sourcing from plots deforested after the 2020 cut-off date. The report names names. Trade press picks it up. The distributor’s category manager reads it over coffee and forwards it to no one. Sales continue.
In January, the competent authority receives a substantiated concern citing the same report, and opens a check. The findings are short and unpleasant. The distributor was never registered in the EU Information System, although registration has been mandatory for large traders since day one. It kept invoices, but could not produce a usable record of which suppliers and which customers were linked to the affected products. And, decisively: it had been aware of relevant information indicating non-compliance for three months and had neither informed the authority, nor informed its customers, nor verified the supplier’s due diligence, nor stopped selling.
The consequences arrive in layers. A fine calculated by reference to EU-wide turnover, for which the Regulation sets a maximum of at least 4 percent. Confiscation of the affected products and of the revenues gained from them. Temporary exclusion from public procurement. And a detail few companies have priced in: the final judgment, with the company’s name and a summary of the infringement, is published by the European Commission for everyone to see, competitors, customers and journalists included.
Then the second wave begins, and it does not come from the regulator.
The wave nobody budgets for: your own customers
The workshops that bought the affected products must now take them out of commerce. They lose stock, sales and time. Their lawyers ask an obvious question: the distributor knew in October and kept shipping until January. Why?
The EUDR itself is enforced by authorities. But the duties it creates, to inform customers immediately and to stop selling non-compliant products, become the yardstick for civil claims under ordinary national law. A downstream buyer who can show that its supplier breached a legal duty of care and caused it loss has a claim for damages: the cost of the recalled goods, the disposal, the lost margin, sometimes the reputational cleanup. Months of silence after a public red flag is not a hard case to argue. In other words: the fine is the beginning, not the end.
Everything in this story is fictional. Every mechanism in it is in the Regulation.
"But I thought only operators had obligations now"
This is the most persistent misunderstanding of the amended EUDR, and it is easy to see where it comes from. The December 2025 amendment genuinely lightened the downstream burden: traders and downstream operators no longer perform due diligence, no longer submit due diligence statements, and no longer have to verify their suppliers’ homework as a matter of routine.
Lighter is not zero. Three obligations remain, and each carries the full penalty regime described above. Registration applies to large (non-SME) traders and downstream operators; record keeping and the duty to inform apply at every size.
1. Register once in the EU Information System. Before placing or making available any relevant product, a non-SME trader or downstream operator must be registered in the EU Information System (Article 5(2)). It is a one-time step, but it is not optional, and operating unregistered is an infringement in itself.
2. Keep records for five years. For every relevant product, you must be able to say who supplied it to you and whom you supplied (name, address, contact details), and, where your direct supplier is an operator, the reference numbers or declaration identifiers of their due diligence statements, which they are obliged to pass to you (Articles 4(7), 5(3)(a) and 5(4)). No specific system is prescribed. Being unable to produce the records when an authority asks is what gets punished.
3. Act immediately when you learn of a problem. This is the obligation that catches companies off guard, because it sleeps until the day it does not. If you obtain or are made aware of relevant new information, including substantiated concerns, indicating that a product you sell may not comply, you must immediately inform the competent authorities and the customers you supplied. In that case, large companies must additionally verify that due diligence was exercised upstream and must not sell the product until no or only a negligible risk is demonstrated (Articles 5(5) and 5(6)).
Note the trigger: made aware. An NGO report, a press investigation, a published judgment against your supplier. Once the information is out there and reaches you, the clock is running. And ignorance is a fragile defence when the information was public for months.
What prudent downstream companies are doing about EUDR compliance
The reactive duty in Articles 5(5) and 5(6) has a practical implication: you can only act immediately on information you actually see. Companies that wait to be told by their supplier that something is wrong are betting the 4 percent on their supplier’s honesty.
The pragmatic setup looks like this: register properly, keep clean supplier and customer records, and put a watchtower on your supply chain, continuous screening of media, NGO sources and the Commission’s public list of EUDR compliance judgments, scoped to each supplier, the commodity they provide and the region it comes from. When something surfaces, verify the supplier’s due diligence statement references in the EU Information System, document what you did, and decide on selling or suspending with a record that stands up in front of an authority, and in front of a customer’s lawyer.
That is precisely what we built. Trusty registers you in the EU Information System free of charge, and monitors each of your product profiles year round: screening, alerts, a verification module for DDS reference numbers and a documented audit trail. From 75 EUR per supplier per year.
The EUDR did not forget about distributors and resellers. Make sure it finds you ready.
Trusty provides software that supports and guides EUDR compliance. It does not provide legal advice. Regulation (EU) 2023/1115 as amended; obligations for downstream operators and traders of any size apply from 30 December 2026.
Need software for EUDR due diligence? EUDR Passport is free to set up, free for your suppliers, and costs €90 per product profile per year with unlimited DDS.
Frequently asked questions
Yes. They no longer perform due diligence or submit due diligence statements, but large (non-SME) traders and downstream operators must register in the EU Information System, and traders and downstream operators of every size must keep supplier and customer records for five years and act immediately when they learn that a product may not comply.
For every relevant product, who supplied it and whom you supplied, with name, address and contact details, and where the direct supplier is an operator, the reference numbers or declaration identifiers of their due diligence statements (Articles 4(7), 5(3)(a) and 5(4)).
It must immediately inform the competent authorities and the customers it supplied. In that case, large (non-SME) companies must also verify that due diligence was exercised upstream and stop selling the product until no or only a negligible risk is demonstrated (Articles 5(5) and 5(6)).
Fines with a maximum of at least 4 percent of EU-wide turnover, confiscation of the affected products and of the revenues gained from them, temporary exclusion from public procurement, and publication of the final judgment by the European Commission.
Related reading: whether you are an operator or a trader, nine everyday products inside EUDR scope, and EUDR compliance for SMEs.
30 DECEMBER 2026
FREE EUDR Obligations Checker: Answer a few simple questions and get an instant assessment of your EUDR obligations.