Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
For businesses placing coffee, cocoa, soy, palm oil, rubber, cattle and timber on the EU market, the message is clear. Compliance is still mandatory, still strict, and still enforceable. What has changed is how regulators expect companies to demonstrate control.
The core obligation has not changed
At its foundation, the EUDR simplification still requires companies to ensure that all relevant products are deforestation-free, legally produced, and covered by a valid due diligence statement (or, for micro and small primary operators, a simplified declaration) before being placed on the EU market or exported.
There is no exemption hidden in the simplification. If anything, enforcement expectations are becoming sharper. Authorities are no longer satisfied with statements of intent or static policies. They expect evidence that systems are functioning in practice.
A more usable risk-based approach
One of the most important clarifications is the operationalisation of the risk-based approach. Countries are classified as low, standard, or high risk, and this classification directly impacts the level of due diligence required.
For low-risk origins, companies benefit from reduced obligations, particularly around risk assessment and mitigation. However, this does not remove the need for traceability or data collection. Businesses must still gather geolocation data, verify supply chains, and maintain documentation. The difference is in the depth of scrutiny, not the existence of it.
For standard and high-risk countries, the expectations remain rigorous, with detailed risk assessments and mitigation measures required.
Reusing due diligence statements
A major efficiency gain comes from the ability to reuse due diligence statements under specific conditions. One due diligence statement can cover several shipments of the declared quantity placed within one year of submission, provided due diligence covers the whole quantity, so companies do not need to create a new statement for each shipment.
This reduces administrative burden, but it introduces a new responsibility. Businesses must be able to prove that nothing material has changed. Without strong internal controls and monitoring, reuse becomes a liability rather than a benefit.
Geolocation requirements are still central
Geolocation data remains one of the most critical, and challenging, elements of EUDR compliance. The Commission’s review report of 4 May 2026 (COM(2026) 191) does not remove this requirement, but it does clarify how it can be applied in practice.
There is now more flexibility in how geolocation data is collected and managed, particularly for complex supply chains involving smallholders. In certain cases, aggregation of plots is permitted. However, this flexibility does not reduce the need for traceability. Companies must still be able to link products back to the land where they were produced and demonstrate that no deforestation has occurred after the cutoff date.
Greater flexibility for downstream operators
Downstream companies, such as manufacturers and retailers, can rely more heavily on due diligence conducted by upstream operators. This is particularly relevant for businesses that do not have direct relationships with producers.
However, this is not a transfer of responsibility. Downstream operators must collect and keep the reference numbers of the due diligence statements where their supplier is an operator; those that are not SMEs verify upstream due diligence only where they have substantiated concerns (Article 5(3) and 5(6)). If something goes wrong, liability does not disappear simply because another party conducted the initial checks.
Group-level due diligence and centralisation
The Commission’s review report of 4 May 2026 encourages companies to centralise due diligence processes across business units, subsidiaries, or product lines. This allows for more efficient compliance, particularly for multinational organisations.
Centralisation reduces duplication, but it also raises the bar for governance. Companies must ensure consistency, maintain clear documentation, and be able to demonstrate that controls are applied uniformly across the organisation.
A clearer definition of negligible risk
The concept of “negligible risk” has been refined. Companies are now expected to justify this classification using objective and verifiable criteria, such as country risk levels, supplier track records, and supporting data.
Assumptions are no longer sufficient. If a business claims negligible risk, it must be able to show exactly how that conclusion was reached and what evidence supports it.
Certification is not a shortcut
Third-party certification schemes can support risk assessment, but they do not replace due diligence. The Commission’s review report of 4 May 2026 makes this explicit.
Businesses can use certifications as one input among many, but they must still independently verify key requirements, particularly geolocation data and deforestation status. Relying solely on certification creates exposure rather than protection.
Documentation is now the real test of compliance
The simplification reduces duplication, but it increases expectations around documentation and auditability. Regulators want to see a clear trail showing how decisions were made.
This includes evidence of how risk was assessed, what data was used, how suppliers were evaluated, and under what conditions due diligence statements were reused. Companies that cannot produce this level of transparency will struggle during inspections.
SMEs are supported, not exempt
Small and medium-sized enterprises benefit from some practical relief, particularly when relying on upstream operators. However, they are still within the scope of the regulation.
SMEs that are operators must still exercise due diligence (micro and small primary operators through a one-time simplified declaration), and SMEs acting as downstream operators or traders must collect and keep reference numbers where their supplier is an operator and keep records. The simplification makes compliance more achievable, but not optional.
The real shift: From policies to systems
The most important takeaway from the EUDR simplification is not procedural but structural. Compliance is moving away from static documentation and toward dynamic, system-based control.
Businesses that rely on manual processes, fragmented data, or outdated policies will find it increasingly difficult to meet regulatory expectations. In contrast, companies that invest in structured workflows, data integrity, and audit-ready systems will not only comply more easily but also benefit from the efficiencies described in the Commission’s review report of 4 May 2026.
The simplification does not lower the bar. It exposes who is truly in control of their supply chain and who is not.
Summary of EUDR simplification:
- Core obligations unchanged: products must still be deforestation-free, legally produced, and covered by due diligence statements or simplified declarations
- Changes to the law itself: Regulation (EU) 2025/2650 amended the EUDR and Delegated Regulation (EU) 2026/2102 amended Annex I, alongside updated guidance, FAQs and implementation support
- Significant cost reduction expected: simplification aims to reduce compliance burden by up to ~75% through streamlined processes
- Risk-based approach clarified: existing framework made more practical, especially for low-risk country sourcing
- Geolocation requirements remain fully in place: no removal, only clearer guidance on how to implement them
- Greater reliance on upstream operators: downstream companies can rely on existing due diligence, collect reference numbers where their supplier is an operator and, if they are not SMEs, verify only where there are substantiated concerns
- Simplified processes for SMEs: reduced administrative burden, but no exemption from compliance
- Improvements to EU systems: updates to the due diligence submission platform to make compliance more efficient
- Product scope adjustments (update, 4 November 2026): the Commission Guidance (3rd edition) followed on 13 July 2026, and Delegated Regulation (EU) 2026/2102 has amended Annex I since 18 September 2026, removing some products and adding others from 30 December 2027
- Certification remains supportive only: cannot replace internal due diligence obligations
- Focus on usability over theory: guidance designed to make compliance operational rather than interpretative
Trusty EUDR Passport
EUDR Passport is an all-in-one platform for creating, validating, and submitting Due Diligence Statements directly to the EU Information System.
Create, validate, and file DDS submissions in minutes, without hiring consultants or buying expensive enterprise tools.
Need software for EUDR due diligence? EUDR Passport is free to set up, free for your suppliers, and costs €90 per product profile per year with unlimited DDS.
Frequently asked questions
Yes, in part. Regulation (EU) 2025/2650 amended the EUDR and Delegated Regulation (EU) 2026/2102 amended Annex I; the rest of the simplification comes through updated guidance, FAQs and implementation support. Every relevant product must still be deforestation-free, legally produced and covered by a due diligence statement (or, for micro and small primary operators, a simplified declaration).
One due diligence statement can cover several shipments of the declared quantity placed within one year of submission, provided due diligence covers the whole quantity.
No. Certification schemes can support the risk assessment as one input, but companies must still independently verify the key requirements, in particular geolocation data and deforestation status.
With objective and verifiable criteria such as country risk levels, supplier track records and supporting data, and a documented trail that shows how the conclusion was reached.
30 DECEMBER 2026
FREE EUDR Obligations Checker: Answer a few simple questions and get an instant assessment of your EUDR obligations.