The EU Deforestation Regulation, Regulation (EU) 2023/1115, applies from 30 December 2026 and repeals the old EU Timber Regulation, Regulation (EU) No 995/2010. The dates were rewritten by the amending Regulation (EU) 2025/2650 of 19 December 2025, which entered into force on 26 December 2025.
Most coverage of that amendment carried one headline: small businesses have until 30 June 2027. That is true only in a narrow set of cases. Reading it as a general extension is the most expensive mistake available on this subject.
Which EUDR deadline applies to you
Article 38(2) sets the general date of 30 December 2026 for Articles 3 to 13, Articles 16 to 24 and Articles 26, 31 and 32. Article 38(3) then defers that date to 30 June 2027, but only for operators who are natural persons or micro or small undertakings within the meaning of Article 3(1) or Article 3(2), first subparagraph, of Directive 2013/34/EU, irrespective of legal form, and who were established as such by 31 December 2024.
Two conditions sit inside that sentence and both are routinely missed. The 30 June 2027 date reaches only operators established as such by 31 December 2024, so a micro-enterprise incorporated in 2025 or 2026 is on 30 December 2026. And the deferral expressly excludes products covered by the Annex to the old Timber Regulation, so anyone dealing in wood, furniture or pulp and paper is on 30 December 2026 whatever their size. In practice the later date only helps micro operators in cattle, cocoa, coffee, oil palm, rubber and soya.
There is a third limit. Article 38(3) defers obligations for operators only, and the amended Article 2(15) defines operator so as to exclude downstream operators. Downstream operators and traders of every size apply from 30 December 2026.
The products that reach a consumer store
Seven commodities are in scope: cattle, cocoa, coffee, oil palm, rubber, soya and wood. What matters commercially is Annex I, which sets out the customs codes. These are the lines that turn up in ordinary consumer e-commerce.
- Wood, 4401 to 4421 — sawn wood, veneer, particle board, OSB, fibreboard, plywood, joinery, wooden tableware, pallets and the catch-all other articles of wood in 4421
- Charcoal, 4402, whether or not agglomerated
- Pulp and paper, Chapters 47 and 48, excluding bamboo-based and recovered waste or scrap products
- Furniture, ex 9401 for seats of wood, and 9403 30, 9403 40, 9403 50, 9403 60 and 9403 91 for wooden furniture and wooden parts
- Prefabricated buildings of wood, 9406 10
- Rubber, 4001 and derived headings including 4011 for new tyres and 4016 for other articles of vulcanised rubber
- Leather, ex 4101, ex 4104 and ex 4107, classified under cattle
Two scope changes matter, because a lot of published guidance predates them. Printed matter has already been removed: Regulation 2025/2650 deleted the Annex I line covering books, newspapers and other products of the printing industry in Chapter 49, and the Estonian Climate Ministry lists that exclusion among the agreed simplifications. The category is paper, not paper and printed matter.
Leather is in scope today but proposed for removal. The Commission's simplification package of 4 May 2026 included a draft delegated act amending Annex I, proposing to remove leather, retreaded tyres, product samples, second-hand goods and waste, and to add soluble coffee and certain palm oil derivatives. Feedback closed on 1 June 2026 and we could not confirm that the act has been adopted, so it remains a proposal rather than law. Note too that the leather lines are hides and leather as a material, not articles made from it, so a shop selling leather bags is not caught by those codes.
Operator, downstream operator, trader
The operator is whoever first places the product on the EU market or exports it. On import that is the person, company included, who imports under release for free circulation, and who needs a valid EU EORI number and registration in the Information System. A non-EU company can be the operator, but the Commission's position is that the chain must contain at least one EU-established upstream operator, so where a non-EU company imports, two operators coexist and both file their own statement.
A downstream operator is a person who, in the course of a commercial activity, places on the market or exports products made using relevant products that are all already covered by a due diligence statement or a simplified declaration. A furniture maker buying EU-placed declared timber is downstream. An importer bringing timber in from outside the EU is the primary operator.
For downstream operators and traders the obligation is far lighter. They do not submit statements at all; Recital 5 of the amending act says so. Article 5(3)(a) requires them to collect reference numbers only where their supplier is an operator, and Article 5(6) restricts even that to the first downstream operator or trader in the chain. Later actors keep supplier and customer records for five years. Non-SME downstream operators and traders must still register in the Information System, and everyone at every level must notify the competent authority of non-compliance they become aware of.
Online retailers and fulfilment providers are treated as operators or traders according to their actual role in the chain, which is a principle rather than an answer. We could not retrieve the Commission's specific guidance on marketplace liability, so treat that position as unconfirmed and work out your role from what you actually do with the goods.
The statement, geolocation and the Information System
Before placing a product on the market or exporting it, the operator exercises due diligence and submits a due diligence statement through the Information System, containing the Annex II information and declaring that no or only negligible risk was found. The system issues a reference number, which the operator passes down the chain.
Article 9 lists what must be collected and kept for five years: product description and trade name, species including the scientific name for wood, quantity in kilograms net mass, country of production, supplier and recipient details, adequately conclusive and verifiable information that the products are deforestation-free, and evidence of compliance with the legislation of the country of production. Geolocation is the part people underestimate: latitude and longitude to at least six decimal digits, and polygons for plots over four hectares used for commodities other than cattle.
Article 10 requires a risk assessment of that information, and the product cannot be placed on the market unless it shows no or only negligible risk. Article 11 requires mitigation where risk is not negligible, and adds governance duties for operators that are not SMEs, including a compliance officer at management level and an independent audit function. Article 33 governs the Information System, which is built on TRACES and connects to customs through the EU Single Window.
Simplified routes, and the size thresholds
- Article 13 simplified due diligence. Where the commodity was produced in a low-risk country, Articles 10 and 11 need not be performed, provided the operator has ascertained negligible risk of circumvention or mixing. Information pointing to non-compliance revives the full obligations at once
- Article 4a simplified declaration. Micro and small primary operators file once rather than per consignment and may give a postal address instead of geolocation. A primary operator grows, harvests or raises on its own plots, so this is a farmer or forest owner, not a reseller
- Authorised representative. An operator may mandate a representative established in the Union, and since the 2025 amendment a natural person or micro-enterprise may mandate its next downstream buyer. The operator remains fully responsible either way
The size definitions come from Article 3 of Directive 2013/34/EU, with the monetary thresholds as uprated by Commission Delegated Directive (EU) 2023/2775 for financial years beginning on or after 1 January 2024. Two of the three criteria must be met.
- Micro: balance sheet total up to EUR 450,000, net turnover up to EUR 900,000, up to 10 employees
- Small: up to EUR 5,000,000, up to EUR 10,000,000 and up to 50 employees
- Medium: up to EUR 25,000,000, up to EUR 50,000,000 and up to 250 employees
One sourcing note, because precision matters here: the delegated directive uprated the monetary thresholds, while the employee counts come from Article 3 of the directive itself, which it did not amend.
Country benchmarking, and why it is not settled
Commission Implementing Regulation (EU) 2025/1093 of 22 May 2025 sets the classification. It lists only low-risk and high-risk countries; standard risk is the residual for everything not listed. Low risk unlocks the Article 13 route, and high risk triggers enhanced scrutiny and a 9% minimum check rate. Four countries are high risk: Belarus, Myanmar, North Korea and Russia. Around 140 are low risk, including every Member State, the United States, China, India, Canada, Australia and Japan. Around 50 are standard, including Brazil and Indonesia.
Treat that list as current but not stable. On 9 July 2025 the European Parliament voted 373 to 289 to object to it, criticising opaque methodology, unpublished datasets and the placement of Brazil and Indonesia in standard rather than high risk. The implementing regulation nonetheless stands and is in force. Article 29 requires periodic review and we found no successor instrument, so 2025/1093 applies today with a revision expected. Do not build a sourcing decision on a country staying in the band it is in now.
Penalties, and what Estonia has not published
Article 25 requires effective, proportionate and dissuasive national penalties and sets an EU-level floor on the maximum. For a legal person the maximum fine must be at least 4% of total annual Union-wide turnover in the financial year preceding the decision, increased where necessary to exceed the economic benefit gained. That is a floor on the statutory maximum, not a minimum fine. Member States must also provide for the following.
- Confiscation of the relevant products
- Confiscation of revenues from the transaction
- Temporary exclusion from public procurement, up to 12 months
- Temporary prohibition from placing on the market or exporting the commodities
- Prohibition from using simplified due diligence, for serious or repeated violations
Estonia has published its competent authorities. Keskkonnaamet is the national coordinating authority and covers the non-food commodities, wood and rubber; Põllumajandus- ja Toiduamet covers cattle, soya, coffee, cocoa and palm oil. Domestic timber declarations run through the Metsaregister EUDR module and everything else through TRACES. What we could not confirm is whether Estonia has adopted a national implementing act or national penalty provisions: the ministry page cites no act or bill, states no penalty levels and describes no national inspection procedure. So we will not quote you an Estonian fine. That is a direct check of Riigi Teataja, and the answer may be that the rules are not written yet.
Most small sellers are entirely out of scope
If you sell clothing and textiles, electronics, cosmetics, supplements, jewellery, plastic goods, non-wooden toys or anything else outside Annex I, the EU Deforestation Regulation does not apply to you. There is nothing to register, nothing to file, no reference number to collect and no record to keep. You do not need an adviser, a platform or a compliance subscription for it.
If you are in scope, the work is real but finite. The hard part is not the paperwork, it is supplier data: species names, countries of production and six-decimal geolocation for plots you have never seen. Start there, and start with the supplier who will be slowest to answer.
Frequently asked questions
Does the EUDR apply to small businesses?
Yes. There is no small-business exemption, only a deferral. Micro-enterprises and natural persons established as such by 31 December 2024 get 30 June 2027 for some commodities, but everyone else, and all downstream operators and traders of any size, apply from 30 December 2026.
Is the EUDR deadline 30 December 2026 or 30 June 2027?
For most sellers it is 30 December 2026. The 30 June 2027 date reaches only operators who are natural persons or micro or small undertakings established as such by 31 December 2024, and it excludes wood and paper products covered by the old Timber Regulation annex.
Is furniture covered by the EU Deforestation Regulation?
Wooden furniture is. Annex I covers seats of wood under ex 9401 and wooden furniture and parts under 9403 30, 9403 40, 9403 50, 9403 60 and 9403 91, plus prefabricated buildings of wood under 9406 10. Metal, plastic and upholstered furniture without those wooden elements is not caught by those codes.
What is a due diligence statement under EUDR?
It is the declaration an operator submits through the Information System before placing a product on the market, containing the Annex II data and confirming that due diligence found no or only negligible risk. The system returns a reference number, which the operator passes down the supply chain.
Do I have to file anything if I only resell inside the EU?
Usually not. If everything you sell is already covered by a due diligence statement, you are a downstream operator or trader and you do not submit statements. If you are the first downstream party and your supplier is an operator, you collect and keep the reference number. Non-SME downstream actors still have to register in the Information System.
Is leather still covered by the EUDR?
Yes, as at the time of writing. Raw hides and tanned or finished leather under ex 4101, ex 4104 and ex 4107 are in Annex I under cattle. A draft delegated act published on 4 May 2026 proposes removing leather, but we could not confirm that it has been adopted, so it remains a proposal.
TagsEUDR small businessEUDR December 2026 deadlineEUDR due diligence statementdeforestation regulation furniture
General information, not tax advice
This article reflects Estonian law as it stands on the date shown. Rules change and individual circumstances differ - confirm your own position with us before acting.