EUDR Compliance for Supply Chain Actors: Operators, Traders, and What Each Role Must Do

EUDR compliance for supply chain actors entails legally distinct compliance obligations for operators, traders, and retailers. Operators face the full due diligence burden, collecting geolocation data, performing risk assessments, and filing Due Diligence Statements (DDS) before placing goods on the EU market. Traders in the middle of the chain may use a simplified procedure, but only if their supplier has already filed a valid DDS. Retailers placing products directly on the EU market follow operator-level obligations. Non-compliance risks fines up to 4% of annual EU turnover, market bans, and confiscation of goods.

The EU Deforestation Regulation (EUDR) is not a future problem. It’s a present one. Large operators and traders are required to comply by December 30, 2025. SMEs follow by June 30, 2026. And yet, a significant share of supply chain teams still don’t know which category they fall into, let alone what their specific obligations are.

That ambiguity is expensive. Shipments blocked at EU ports. Contracts voided. Fines are calculated against the global annual revenue. Loss of EU market access potentially for years.

This guide maps EUDR compliance obligations by supply chain role. Whether you’re sourcing coffee from Ethiopia, palm oil from Indonesia, or cocoa from Ghana, here’s exactly what EUDR requires from you.

Key Takeaways

• EUDR distinguishes operators (full due diligence) from traders (simplified procedure). Your role in the supply chain determines your exact obligations.
• Due diligence requires GPS-level geolocation data for every plot of land, a documented risk assessment, and a filed DDS submitted to the EU TRACES system.
• Penalties are severe: fines up to 4% of EU-wide annual turnover, temporary market bans, and full product confiscation for repeat offenders.

What Is EUDR and Why Does It Affect Your Supply Chain?

The EU Deforestation Regulation (EU 2023/1115) entered into force on June 29, 2023. It prohibits the placing or making available on the EU market of specific commodities and products if they were produced on land that was deforested or forest-degraded after December 31, 2020. It also prohibits the export of such products from the EU.

The seven in-scope commodities are: cattle, cocoa, coffee, palm oil, soya, wood, and rubber. Derived products, including leather, chocolate, furniture, paper, and printed products, are also covered. This means virtually every food exporter, commodity trader, or F&B brand sourcing from tropical regions is affected.

Unlike certifications such as Rainforest Alliance or UTZ, EUDR is a legal regulation with criminal liability, not a voluntary sustainability standard. Certification alone is not sufficient for EUDR compliance. You must still complete due diligence, geo-map your supply base, and file a DDS.

EUDR Supply Chain Actors: Who Is Who Under EUDR?

EUDR defines three categories of economic actors, and each has a different compliance obligation. Getting this wrong is the most common and most costly mistake companies make in early EUDR preparation.

Operators: Full Due Diligence Required

If you’re the first entity to introduce a covered commodity into the EU market, whether as a direct importer or an EU-based processor sourcing from non-EU suppliers, you are an operator. This is the highest burden under EUDR.

Operators must collect and maintain supply chain data (including GPS coordinates for plots over 4 hectares), conduct a formal risk assessment against the country and commodity risk benchmarks published by the European Commission, implement risk mitigation measures, and file a Due Diligence Statement (DDS) in the EU TRACES NT system before each shipment.

There is no pathway around the DDS. Every shipment must have one. And each DDS must contain verifiable geolocation data, not just certification references.

Miss one step in due diligence and your shipment is at risk. Explore what upstream operators must do to stay compliant.

Downstream Operators Under EUDR

Under the EU Deforestation Regulation, downstream operators (including many traders and retailers) are not required to conduct full due diligence or submit a Due Diligence Statement (DDS) for every transaction.

Their responsibilities are tiered and verification-focused:

• Maintain traceability records (supplier and customer information)
• Ensure that upstream operators have completed due diligence (DDS exists)
• Retain documentation for at least 5 years
• Act only when a substantiated concern arises (e.g., data gaps, inconsistencies, risk alerts)

In essence, downstream operators follow a ‘trust but verify’ model, ensuring compliance without duplicating upstream efforts.

Are you a downstream operator under EUDR? Understand your exact responsibilities – what to verify, what to store, and when to act.

Micro and Small Primary Operators (MSPOs)

The EUDR introduces a Micro and Small Primary Operator (MSPO) category to ensure small producers are not excluded due to complex compliance requirements.

MSPOs are:

• Primary producers (e.g., farmers growing coffee, cocoa, rubber)
• Classified as micro or small enterprises
• Located in low-risk countries under EUDR benchmarking

To reduce administrative burden, MSPOs can:

• Submit a simplified declaration
• Provide basic location data (e.g., postal address) instead of detailed GPS polygons

However, this does not remove compliance requirements. Instead, the responsibility shifts to exporters, cooperatives, and operators, who must:

• Aggregate and validate sourcing data
• Conduct risk assessments
• Submit DDS

MSPOs enable inclusion of smallholders, while maintaining system-level accountability across the supply chain.

Are you a small producer under EUDR? Understand if you qualify as an MSPO and what simplified requirements apply.

Traders: Simplified Procedure – But Not Fully Exempt

Traders operating downstream from an operator can use a simplified compliance procedure, but only if a valid, complete DDS has already been submitted by the upstream operator. The trader references this DDS by its unique reference number and attaches it to their own shipment records.

Here’s where companies get caught out: if you cannot obtain the DDS reference from your supplier, or if the DDS is incomplete, you fall back to full operator-level obligations. Traders cannot simply claim ignorance of the upstream data gap.

Many traders in the middle of multi-tier supply chains don’t know whether their upstream supplier has filed a DDS. Auditors will check. If no DDS reference is present, the trader, not the missing upstream party, faces enforcement action from competent national authorities.

Retailers and SMEs: New Obligations Under the Revised Timeline

Small and medium-sized retailers (under 250 employees, under 50M euros annual turnover) were granted an extended deadline: June 30, 2027. However, this doesn’t mean they can ignore EUDR until mid-2027. SME retailers must request and retain DDS reference numbers from their suppliers and document this chain of custody.

Large retailers that place products on the EU market for the first time are treated as operators and face the December 30, 2026, deadline with full due diligence obligations.

Understand EUDR Compliance Requirements for SMEs. Learn what small and medium enterprises must do to meet EUDR obligations.

Upstream vs. Downstream: Who Carries What Responsibility?

The EUDR responsibility structure is not flat; it flows upstream. The closer you are to the point of production (the farm, the forest, the herd), the more data you are expected to collect, verify, and hold.

The key insight: upstream actors (exporters, processors) accumulate the compliance infrastructure that downstream actors (traders, brands, retailers) rely on. If the upstream data is missing, broken, or unverifiable, the entire chain fails, and enforcement targets the party placing the goods on the EU market.

This is why a growing number of EU buyers are now contractually requiring their non-EU suppliers to provide EUDR-ready documentation as a condition of trade, even before formal enforcement begins.

What Does EUDR Due Diligence Actually Require?

Due diligence under EUDR is a three-step process defined in Article 8 of the regulation. Completing it correctly and documenting it is the difference between shipments clearing customs and shipments being seized.

Step 1: Information Collection

Operators must collect specific data for each commodity lot placed on the EU market. The regulation specifies exactly what this data must include:

• Geolocation coordinates (GPS polygons) for all plots of land where the commodity was produced, for plots larger than 4 hectares, full polygon mapping is required
• Country and region of production
• Quantity placed on the market (volume/weight/units)
• Name and address of the supplier to the operator
• Name and address of the trader/business customer receiving the product
• Evidence of legality under country-of-origin laws (land tenure, export licenses, environmental permits)

The 4-hectare threshold for polygon mapping is critical. Most exporters sourcing from smallholder networks have thousands of farmers with plots well under 4 hectares; EUDR allows a single GPS point for these. But for consolidation points, processing facilities, or larger estates, full polygon mapping is mandatory. This is the data gap most operators underestimate.

Validate your GeoJSON for Compliance.

Step 2: Risk Assessment

Operators must assess whether the collected data contains any indication that the relevant products are non-compliant. The risk assessment must consider: the country-level deforestation risk classification published by the European Commission; the product type and commodity; and the operator’s own supply chain configuration.

The Commission’s country benchmarking system classifies countries as Standard Risk, Low Risk, or High Risk. Products from low-risk countries benefit from simplified due diligence, but operators must still verify that the classification applies and maintain documentation showing they verified it.

Understand EUDR Risk Assessment for Your Supply Chain. Learn how to identify, evaluate, and mitigate deforestation and compliance risks.

Step 3: Risk Mitigation and DDS Filing

If any risk indicator is identified, operators must implement additional mitigation measures, including requesting additional information, undertaking independent surveys, or ceasing sourcing from a specific supplier. If risk is negligible or has been sufficiently mitigated, the operator files a Due Diligence Statement (DDS) in TRACES NT.

Each DDS has a unique reference number, which is the link that downstream traders rely on. A DDS must be filed before each and every shipment placed on the EU market, it cannot be used retrospectively.

Learn How to File Your EUDR Due Diligence Statement Step by Step. Follow a clear process to prepare, validate, and submit your DDS accurately.

What Are the Penalties for EUDR Non-Compliance?

National competent authorities enforce EUDR in each EU member state. Penalties must be ‘effective, proportionate, and dissuasive.’ The regulation mandates minimum penalty levels; member states may go higher.

The 4% of annual turnover penalty is calculated against the company’s ENTIRE EU-wide annual revenue, not just the value of the shipment in question. For a company with 100M euros in EU turnover, a single compliance failure could result in a 4 million euro fine. This is not a cost-of-doing-business risk; it’s a material financial and reputational exposure.

How to Build an EUDR-Ready Supply Chain (Step-by-Step)

Compliance isn’t a one-time project. It’s an operational system. Here’s how supply chain teams are building EUDR-ready infrastructure right now:

1. Map Your Supply Base to Plot Level

Start with your tier-1 suppliers and work backward. For each commodity, you need to know: which farms produced it, the GPS coordinates of those farms, and whether those coordinates fall inside or outside deforested areas as of December 31, 2020. This is the hardest part and where most compliance programs stall.

TraceX’s sustainable sourcing platform digitally onboards smallholder farmers at scale, capturing GPS plot polygons, land tenure documentation, and deforestation status in real time. Offline-first mobile apps allow field agents to collect data in remote, low-connectivity regions.

Understand EUDR Requirements for Producers and Smallholders. Learn how farm-level data and traceability impact compliance.

2. Automate Geolocation Verification

Once GPS data is collected, it must be cross-checked against authoritative satellite datasets, specifically the Joint Research Centre (JRC) Global Forest Cover data and the Hansen Global Forest Change dataset. Manual verification across thousands of plots is not operationally viable.

TraceX’s AI compliance engine automates this cross-referencing, flags plots with deforestation risk, and generates real-time alerts when satellite data shows new forest loss, allowing operators to respond before a DDS is filed.

3. Build Supplier Data Systems, Not Email Threads

Collecting KYC documentation, land tenure records, and certifications from hundreds of suppliers via email is a compliance liability waiting to happen. Data gets lost, versions multiply, and audit trails disappear.

The most resilient EUDR programs use supplier portals, structured, role-based platforms where suppliers upload documentation once, and operators pull it as needed. TraceX’s agentic AI layer takes this further: it auto-parses uploaded supplier documents, extracts required fields, and populates DDS drafts automatically.

4. Integrate DDS Filing with Existing Operations

The DDS must be filed in TRACES NT for every shipment. Companies that are not already integrated with TRACES face a manual bottleneck at exactly the moment compliance pressure is highest. The best-in-class approach integrates DDS generation and TRACES submission directly into existing ERP and procurement workflows.

TraceX is TRACES-ready via API, enabling automated DDS submission that triggers at the point of shipment confirmation, no manual re-entry required.

Understand How EU TRACES Works for EUDR Compliance. Learn how to register, submit, and manage due diligence statements.

5. Maintain Audit-Ready Documentation for 5 Years

EUDR requires all due diligence records to be retained for a minimum of five years. Competent authorities can request access at any time. Companies that store compliance documentation in spreadsheets, email chains, or disconnected systems will struggle to produce a coherent audit trail under pressure.

A centralized, immutable compliance record with blockchain-backed data integrity is the gold standard. TraceX uses blockchain to ensure that once a record is written, it cannot be altered retroactively, providing regulators with a single, verifiable source of truth.

How TraceX Solves the EUDR Compliance Challenge

TraceX is a full-stack EUDR compliance platform designed specifically for agri-food exporters, commodity traders, and F&B brands sourcing from emerging market supply chains. Unlike point solutions that address one piece of the compliance puzzle, TraceX covers the entire workflow from farm-level data collection to DDS submission and audit reporting.

The Bottom Line for Supply Chain Teams

EUDR is not a compliance checkbox. It’s a fundamental restructuring of how agricultural supply chains prove their environmental credibility to access the EU market. The regulation is built to be enforced with penalties scaled to create real financial consequences for non-compliance.

The supply chain teams that will navigate this well are the ones who start with a clear understanding of their role, operator, trader, or retailer, and build data infrastructure that makes due diligence a systematic process rather than a last-minute scramble.

Frequently Asked Questions (FAQ’s)