EUDR 2026: Deforestation-free supply chain mandatory for German importers

Regulation (EU) 2023/1115 on deforestation-free products, or EUDR, comes into force for large and medium-sized companies on December 30, 2026, after the one-year postponement provided by Regulation (EU) 2024/3234. The application applies to micro and small companies from June 30, 2027. It covers cattle, cocoa, coffee, oil palm, rubber, soy and wood as well as a long list of processed products made from these raw materials.

Unlike the German Supply Chain Due Diligence Act, which follows a risk-based approach, the EUDR requires product-related proof down to the GPS coordinates of the production area. This shift from risk management to the obligation to provide evidence has consequences for purchasing processes, IT systems and audit logic. This article explains the obligations from December 2026, the demarcation from the LkSG and the operational requirements for the supply chain officer function.

According to Annex I, the EUDR covers seven raw materials and their derivative products. For cattle, meat, hides, leather and leather goods are covered by the regulation. For cocoa, all chocolate products. For coffee, roasted coffee, instant coffee and extracts. In the case of oil palm, the palm oil itself as well as margarine, soaps, cosmetics and biofuels. For rubber tires and industrial rubber products. For soy, soybeans, soybean oil and animal feed. For wood, boards, furniture, paper, packaging.

The timing of application has been postponed by Regulation 2024/3234. The obligation applies to large and medium-sized companies from December 30, 2026, and to micro and small companies from June 30, 2027. The decisive factor is import or placing on the market in the EU and export from the EU. The term placing on the market also includes the initial provision on the EU market by companies based in the EU who purchase from EU suppliers.

Not only classic importers are covered. Traders, processors and manufacturers who continue to sell products made from the raw materials mentioned in the EU also assume duties of care or information depending on their market position. The supply chain officer function thus expands beyond the LkSG logic. The appointment certificate, signed, filed, verifiable – this also applies to the EUDR declaration of conformity.

Art. 4 EUDR requires a due diligence declaration in the EU information system TRACES NT before every placing on the market or every export. The statement confirms three facts: first, that the products in question are deforestation-free, i.e. not produced on deforested or degraded land after December 31, 2020. Secondly, that they have been produced in accordance with the relevant legislation of the producing country. Thirdly, that a due diligence check was carried out in accordance with Article 8 EUDR.

The due diligence check itself consists of three steps. Collection of information in accordance with Article 9: description of the products, quantity, country of production, GPS coordinates of the production area, information about the suppliers in the chain. Risk assessment according to Art. 10: Assessment of the probability that products come from deforested areas or in violation of the law. Risk reduction according to Art. 11: Measures to reduce identified risks to a negligible level.

Geolocation is the hardest new data point. For areas smaller than 4 hectares, a single GPS point is sufficient. Polygons of the production area over 4 hectares must be recorded, usually in GeoJSON format. This data cannot be derived from classic purchasing systems. They must be recorded per delivery, checked against deforestation databases such as the Global Forest Watch and transferred to TRACES NT. Audit-proof, documented, Art. 4-firm.

The German LkSG has required companies with 1,000 or more employees to undertake human rights and environmental due diligence in the supply chain since 2024. The EUDR complements this regime but does not replace it. Three key differences shape practice. Firstly, the target group: The LkSG has a company-specific effect from the employee threshold. The EUDR works on a product-related basis without a threshold, apart from the distinction between large, medium and small companies for the due diligence intensity.

Secondly, the depth of evidence: The LkSG requires risk analyses along the supply chain with a focus on immediate suppliers. The EUDR requires traceability all the way to the production area, regardless of how many steps there are in between. Thirdly, the sanction logic: LkSG fines reach up to 8 million euros or 2 percent of the annual turnover for companies with a turnover of 400 million euros or more. EUDR fines can reach up to 4 percent of EU annual turnover, supplemented by import bans and market withdrawals.

The reporting systems must be integrated for companies that fall under both regimes. Double data management doubles the audit effort. CIVAC's compliance platform and officer-as-a-service organises both sets of rules in one workspace, with separate reporting lines to management. The EU data residency also meets the requirements of the TRACES-NT interface. The standard contracts for expanding the LkSG appointment certificate to include EUDR-specific tasks can be found on the CIVAC FAQ.

Geolocation per production area is the operational bottleneck of the EUDR. For a cocoa delivery from Côte d'Ivoire with 800 small farmers, this means: 800 GPS polygons or points, each with a date and identifier, all compared against deforestation databases since December 31, 2020. The data must be uploaded to TRACES NT per delivery; a subsequent collective upload is not permitted.

In practice, three data sources provide the polygons. First, direct collection by cooperatives and farmers, often via mobile apps. Secondly, purchasing from specialised platforms such as Satelligence, Sourcemap, Trase or Meridia. Thirdly, in-house measurement by on-site audit teams, which is only economical for large areas with in-house production. The data quality varies considerably: With poor GPS reception, mobile apps deliver polygons with 5 to 30 metres of inaccuracy, which is critical for areas smaller than 1 hectare.

The comparison with deforestation databases is typically carried out against the Global Forest Watch data sets, the University of Maryland's Hansen maps and the EU's own JRC data sets. Hits lead to manual review. When there are three-digit case numbers per delivery, automation is worthwhile. Workspaces with versioning per delivery, audit trail and reporting line to management are the operational requirement. Others run compliance like a filing cabinet. We run it like software.

Art. 25 EUDR frames the sanctions. Fines must be proportionate and capable of reaching at least 4 percent of the company or group of companies' annual turnover in the EU. In addition, the regulation provides for confiscation of the products in question, temporary exclusions from public procurement procedures and temporary exclusions from market access. In serious cases, income from the sale can be skimmed off.

The German implementation takes place through the EU Deforestation Regulation Implementation Act, which names the responsible authority and regulates additional regulations for enforcement. The BLE, the Federal Agency for Agriculture and Food, is expected to take over central supervision, supplemented by BAFA for certain product groups. The procedural logic is based on the LkSG enforcement, with extended audit rights in the supply chains.

Personal liability of the management arises according to Section 130 OWiG if the supervisory measures to prevent breaches of duty have not been taken. The deadline expires as soon as we become aware of it - this logic also applies to the due diligence declaration. Anyone who releases a delivery without waiting for the TRACES-NT confirmation risks a breach of duty. The appointment certificate of the supply chain representative should therefore expressly regulate the approval authority for the due diligence declaration.

Step one: product inventory. Which products with which raw materials from Annex I does the company sell? A complete materials list with customs tariff numbers serves as a basis. Step two: supplier mapping. Which suppliers supply which raw materials from which countries? High-risk countries according to the EU classification require more intensive due diligence. Step three: Identify data field gaps. What data is currently missing, especially geolocation and legal compliance in the producing country?

Step four: Contract amendments with suppliers. Supply and purchasing contracts must contain the obligation to deliver data, supplemented by audit rights and sanction mechanisms in the event of data failure. Step five: IT connection to TRACES NT. The interface can be accessed via REST API, alternatively via manual upload. Step six: Appoint the supply chain representatives with a clear mandate for EUDR compliance, including reporting line to management and escalation path in case of refused data delivery.

Licence the workspace for your internal representatives or have our representatives appointed. CIVAC comes with 490 ready-to-use audit templates, including supplier audit, due diligence report according to Art. 12 EUDR, risk assessment template, polygon validation protocol. The external supply chain officer has personal liability to the company and works in the same workspace as internal compliance. Ordered in two working days instead of two to six weeks.

Art. 13 EUDR allows simplified due diligence for raw materials from countries with a low risk of deforestation. The EU Commission publishes the country classification in an implementing act, which is expected to be updated every six months. Low risk does not mean exemption, but reduced risk assessment. The information collection in accordance with Article 9 remains fully intact, including geolocation.

From a German perspective, the EU internal market sources are particularly relevant. Wood from Germany, Austria, Poland or the Nordic countries falls into the low-risk category as long as national forestry laws are adhered to. Cattle raised within Europe are also subject to simplified testing. For cocoa, coffee, palm oil, soy and rubber, the producing countries are typically outside the EU, which is why full due diligence applies.

The simplified due diligence primarily relieves German wood processors, construction companies with national wood purchasing and furniture manufacturers. However, it does not change the obligation to geolocate and declare due diligence. Anyone who produces furniture from local oak wood must still upload the GPS polygon of the forestry district into TRACES NT. The auditor calls, the evidence is ready. - this logic does not differentiate according to risk class.

According to industry observations, three errors will occur most frequently in 2026. First: The due diligence declaration is approved by purchasing rather than by a designated compliance function. This means that there is no clear separation between management of the supplier relationship and compliance supervision. During official audits, this mixing is viewed as a breach of duty because the supervisory organisation cannot be identified according to Section 130 OWiG.

Secondly: GPS data is stored without versioning. If a supplier subsequently corrects a polygon, the historical trace is missing. In subsequent inquiries from the authorities, it is no longer possible to prove which data status was valid at the time of the due diligence declaration. Third: The TRACES-NT declaration of conformity is not archived in the company. The declaration remains in the EU system, but evidence to management and auditors requires a local copy with a time stamp.

Avoiding these errors requires clear processes. Separation between purchasing and compliance, versioned data storage with audit trail, local archiving of TRACES-NT declarations. The supply chain officer with a clear reporting line is the easiest lever. Turn reading into a mandate. - this logic applies particularly as the EUDR deadline approaches and the first authority samples are due at the end of 2026.

The EUDR will be implemented in earnest from December 30, 2026. Anyone who does not have an appointed supply chain officer with a documented reporting line, no geolocation data and no TRACES-NT interface at this point risks import bans and fines of up to 4 percent of EU sales. The preparation typically takes six to nine months, which is why the appointment of those responsible for 2026 is part of the annual planning.

CIVAC is the compliance platform and officer-as-a-service for companies that integrate EUDR and LkSG in one workspace. 25 agent roles are live, 490 audit templates are ready for use, the EU data residency meets the ISO 27001:2022 requirements and the EUDR interface obligations. Licence the workspace for your internal representatives or have our representatives order it. Both paths provide the verifiable oversight organisation that authorities expect from December 2026.

Turn reading into a mandate. Write to info@civac.de with the industry, affected raw materials from Appendix I and the current number of suppliers. You will receive a written assessment within two working days of the effort required for EUDR compliance by December 30, 2026. The contact form on civac.de forwards you directly to the ordering office.