EUDR: the clock is ticking for European companies (May 2026)

There are 226 days left until the EUDR becomes enforceable. On 4 May 2026 the European Commission released a package that has closed almost every remaining operational doubt for European companies: an updated guidance document, FAQs V5, the parliamentary review report, a revised draft Implementing Act on the information system, and a country benchmarking that remains in force despite a non-binding Parliament objection. Commissioner Jessika Roswall left no ambiguity that same day: "We all now need to work towards a successful entry into application of the law by the end of 2026." In plain terms: no more extensions.

For operators and importers established in the EU, this is the clearest scenario since the regulation was adopted in 2023. This article distils the real obligations that apply, the penalty regime that is now on the table, and the 7 actionable steps any European company can execute before 30 December 2026.

The calendar is final: 30 December 2026

The second amendment to Regulation (EU) 2023/1115, adopted by the European Parliament and Council on 19 December 2025 (Reg. (EU) 2025/2650), shifted application to 30-12-2026 for large and medium-sized companies. Micro and small enterprises trading products inherited from the former EUTR (timber, pulp, paper) are also bound on that date; the rest of micros and small companies have until 30 June 2027.

The Commission has explicitly declared in Report COM(2026) 191 final that it will not propose further amendments to the legal text. Betting on a third postponement is no longer a strategy; it is assumed risk. Between today and entry into force lie 226 calendar days — after subtracting holidays, year-end closings and the test period (Oct-Dec 2026, with no sanctions but with operational obligations live), the real window to have a productive system in place is about five months.

What the Commission released on 4 May 2026

The package incorporates six pieces worth keeping as a normative reference:

Report COM(2026) 191 final — simplification review under Art. 34(1a) EUDR.
Official Guidance C(2026) 3056 final — updates and replaces the previous C/2025/4524. Not binding per se, but reflecting the Commission's interpretation.
FAQs V5 (April 2026) — synthesises 110+ stakeholder submissions and 750+ questions analysed.
Draft Delegated Act on scope — feedback open until 1 June 2026.
Revised Implementing Act on the Information System — in adoption by Member States, including new APIs, a contingency plan and voluntary Due Diligence Statement grouping.
Press release IP/26/941 — public communication with the updated political position.

On top of that, Implementing Regulation (EU) 2025/1093 of 22 May 2025 set the country benchmarking. The European Parliament adopted on 9 July 2025 a resolution of objection (373-289) challenging methodology, data quality and transparency, but the resolution is non-binding and the Regulation remains fully in force. The Commission has committed to revising the classification during 2026 using updated data from the FAO Global Forest Resources Assessment 2020 (released October 2025). One key takeaway with the current classification: the Commission classified more countries as low-risk than initially anticipated, and the actual share of EU operators sourcing from low-risk countries rose from the 20% projected to 51%.

What is now settled for European companies

The three steps of due diligence

The procedure is stable and replicable:

Information gathering (Art. 9) — product, CN code, quantity, direct supplier, direct client, country of production, evidence of production under the country-of-origin legislation, evidence of no deforestation, and geolocation.
Risk assessment (Art. 10) — against the defined criteria. If the chain sources exclusively from low-risk countries, Art. 13 allows skipping the detailed assessment unless substantiated concern emerges.
Mitigation (Art. 11) — only triggered if risk is not negligible.

Geolocation: closed format

The standard:

GeoJSON
Latitude/longitude coordinates with six decimal places
WGS84 system (EPSG:4326)
Maximum file size of 25 MB per declaration.

The practical rule:

Plot commodities (coffee, cocoa, soy, palm, rubber, timber): for plots ≤4 ha a GPS point is enough (polygon is also valid); for plots >4 ha a perimeter polygon is mandatory.
Cattle: one point per establishment, regardless of size (Art. 2(29) EUDR).

The MSPO regime (Art. 4a) lets micro and small primary producers established in low-risk countries use a postal address or cadastral reference instead of coordinates, provided they themselves place the product on the EU market or export it directly. In practice it mainly impacts small European producers (smallholder foresters, coffee farmers, livestock farmers in EU Member States such as Portugal, Spain or Poland); its effect is limited for small non-EU producers, who typically sell to an intermediary and are not direct operators under the Regulation.

Due Diligence Statement chain: only the first operator submits

One of the most useful clarifications from the 2025 review: not every actor in the chain needs to submit its own Due Diligence Statement. The operator placing the product on the EU market for the first time is the one carrying the declaration. Non-SME downstream operators only need to register in TRACES and, if they receive directly from the initial operator, keep the upstream Due Diligence Statement reference number. There is no obligation to audit the European supplier.

Composite products: due diligence on the main commodity

For products combining several relevant commodities (a chocolate bar with cocoa and palm oil, for example), the Due Diligence Statement is prepared for the main commodity in the left column of Annex I. FAQ 1.3 V5 closed this: there is no obligation to submit a Due Diligence Statement per each commodity contained.

Country benchmarking: the risk map, in force (with an asterisk)

Reg. (EU) 2025/1093 classifies every producing country into three tiers: low, standard, and high risk. It remains in force: the objection adopted by the European Parliament on 9 July 2025, questioning methodology and data, is not legally binding and does not require the Commission to withdraw the Regulation. The operational consequence is direct: imports from low-risk countries qualify for the simplified procedure of Art. 13. Standard/high-risk imports (where 95% of global deforestation is concentrated) require full due diligence, with official inspection rates between 3% and 9% on volume and operators.

The Commission has committed to revising the classification during 2026 with new data from the FAO Global Forest Resources Assessment. Some countries may shift category, but until the revision is published, Reg. 2025/1093 is the applicable reference.

The penalty regime already on the table

Art. 25 EUDR sets harmonised minimums that Member States have transposed into national law. For a European company, the practical consequences of non-compliance are:

Fine: at least 4% of the operator's annual EU turnover from the prior fiscal year. For a company with €50M in EU turnover, that is up to €2M per infraction.
Confiscation of the product and of the income from the relevant transaction.
Exclusion from public procurement procedures for up to 12 months — a direct blow for B2B and institutional sales.
Temporary ban on placing products on the EU market.
Mandatory publication of the conviction, including operator identity and nature of the infraction (Art. 25(6)) (reputational risk).

Add to that customs blockade: from 30-12-2026, customs codes C716/C717 are mandatory. Without a valid Due Diligence Statement reference, the cargo will not clear.

Seven actionable steps European companies can execute now

Map the inventory by CN code. Cross-reference the SKU catalogue against Annex I of the EUDR. Watch composite products where the relevant commodity is hidden (biscuits with palm, feed with soy, furniture with tropical timber).
Classify the supplier base by country of origin. Apply the Reg. 2025/1093 classification to identify what share of sourcing qualifies for the simplified procedure and what share requires full due diligence.
Design the geolocation capture system. Decide whether data is requested from the supplier, delegated to an intermediary, or managed through dedicated software. GeoJSON, 6 decimals, WGS84 are non-negotiable.
Define the legal role of each entity within the group. Operator, downstream operator, trader — each has distinct obligations. Treating as a trader an entity that is actually operating under Art. 7 is a common and costly mistake.
Register in TRACES as soon as it reopens (June 2026). Test the updated forms and APIs before the official test period in October.
Define the Due Diligence Statement policy. Aggregated annual declarations, available since April 2025, cut the average cost per operator by around 10.7%. For repetitive flows with the same origin-product-supplier combination they are the efficient choice.
Contingency and retention plan. Define the procedure for TRACES outages (offline conventional reference numbers foreseen in the revised Implementing Act) and an internal audit plan for the mandatory 5-year information retention.

Myths you can drop

"There will be a third extension." — The Commission has closed the debate. No further amendments coming.
"You have to audit every supplier." — False. The obligation is to collect Art. 9 information and assess risk for each supplier. On-site verification only kicks in when there is substantiated concern.
"Every actor in the chain submits its own Due Diligence Statement." — False since the 2025 review. Only the first operator.
"TRACES will not be ready." — Reopens in June 2026 with APIs, contingency plan and dry runs already completed with voluntary companies.
"EUDR is prohibitively expensive." — The Commission itself cut the recurring cost estimate by 75%: from €8.1bn/year to €2bn/year.

Key takeaways

226 days to 30 December 2026. No further extensions on the horizon.
The 4 May 2026 package closes the operational doubts that remained open.
51% of EU operators source from low-risk countries: simplified due diligence available.
GeoJSON geolocation with 6 decimals; polygon >4 ha, point ≤4 ha.
Only the first operator on the EU market submits a Due Diligence Statement. Downstream merely records references.
Minimum fine of 4% of annual EU turnover + confiscation + public procurement exclusion + publication of the conviction.

How to prepare before December 2026

The real window to have a working system is five months. Generating or collecting geolocation for tens or hundreds of farms, integrating TRACES APIs, auditing legal compliance at country of origin or negotiating with non-EU suppliers all require calendar time, not just team time.

Coolx automates Due Diligence Statement creation and submission to TRACES, centralises suppliers, runs satellite deforestation analysis, manages legality and produces auditable reports, all in a single integrated and customised due diligence system. To see how it fits your operation ahead of the deadline, visit coolx.earth or contact our team.