EUDR applies December 30: what your suppliers have to send you

I've watched companies scramble for supplier data more than once. In healthcare it was GUDID, the US FDA's database of medical devices. In foodservice it was GDSN, the global network for sharing product data, and then FSMA, the US food safety law. In retail it was CTPAT, the US customs program for supply chain security. Each program asked for different data, and each time things broke in the same places.

GUDID is the one I still think about. The first fight was ownership. The people who knew the product didn't own the data, and the people who owned the data had never been asked for these fields. Then the deadlines, phased by device class, moved and moved again. Teams were planning against a calendar that kept changing.

What those rounds taught me is that the first deadline is the cheap part. You can brute-force a first submission with enough people and enough weekends. What you can't brute-force is a process that keeps the data right for years, with a named owner. And none of it matters if the buyer on the other end stops believing what arrives.

The EU Deforestation Regulation, or EUDR, is the next one. For large and medium companies it applies from December 30, 2026, which leaves about two months. If you sell covered products into the EU, or buy from companies that do, most of what you need to prove compliance has to come from your suppliers.

What the EUDR requires

The EUDR says that certain commodities, and products made from them, can only be placed on the EU market or exported from it if they are:

• deforestation-free, meaning they weren't produced on land that was deforested or degraded after December 31, 2020;
• legally produced, under the laws of the country where they were grown or raised;
• covered by a due diligence statement, filed in the EU's information system.

The commodities are cattle, cocoa, coffee, oil palm, rubber, soy and wood. Derived products are covered too, from chocolate and furniture to leather goods and printed paper, identified by their customs codes.

The dates have moved twice, so it's worth stating them plainly. The regulation applies to large and medium-sized operators and traders from December 30, 2026, and to micro and small operators from June 30, 2027. In May 2026 the European Commission finished its simplification review and decided not to propose further changes to the core text, so those dates stand. A product scope update in September 2026 removed some products, like cattle leather, and added others, like soluble coffee and some palm oil derivatives, from December 30, 2027.

Penalties are set by each EU member state. The regulation requires them to include fines of at least 4% of a company's total annual EU turnover for the most serious cases.

Who has to do what

Your obligations depend on where you sit in the supply chain.

• Operators place a covered product on the EU market for the first time, or export it. They carry the main duty. They collect the data, assess the risk, reduce it to negligible and file a due diligence statement.
• Downstream operators process products that are already covered by a statement. They don't file their own. They must keep details of their suppliers and customers for five years, plus the statement reference where a supplier is the operator that filed.
• Traders, such as distributors, wholesalers and retailers, sell products that are already on the market. Their duties are similar. They keep supplier and customer details, and they must act on concrete evidence that a product isn't compliant.

If you're outside the EU, the regulation still reaches you. Your EU customers need your data to file, and they'll ask for it.

What your suppliers have to send you

For operators, the regulation spells out the information that has to sit behind every due diligence statement. In practice, nearly all of it comes from suppliers.

1. Product details. A description, the trade name, the customs (HS) code and the quantity.
2. Country of production, and the region where relevant.
3. Geolocation of every plot of land where the commodity was produced. A single point is enough for plots up to four hectares. Larger plots need a polygon, the outline of the plot. For cattle, it's the locations of every establishment where the animals were kept.
4. When it was produced, as a date or a time range.
5. Evidence that it's deforestation-free, showing no deforestation or forest degradation on those plots after December 31, 2020.
6. Evidence of legal production, covering the country's rules on land use rights, environmental protection, labour and human rights, tax, anti-corruption and trade.
7. Who supplied it. Names, addresses and email addresses of suppliers, and, where a supplier is itself an operator, the reference numbers of its due diligence statements.

Downstream operators and traders need less, mostly item 7. Even then, someone upstream has to have the rest.

Why this is harder than it looks

Most companies underestimate the distance between "the supplier has it somewhere" and "the supplier has it for this shipment."

The US Food and Drug Administration (FDA) measured that distance this spring. FSMA 204 is its new food traceability rule, and it asks companies that handle high-risk foods to record the lot code of each shipment and where that code came from. In readiness exercises with 15 companies, 80% had the lot code somewhere in their records. Only 40% had it at every step they performed, and just 27% had its source at every step. Most could respond within 24 hours. Far fewer could show that the data behind the answer was complete. A survey gets you the 80% answer. Only a request for one real shipment shows you the 27%.

Every regulation also has one field nobody has ever carried. For GUDID it was the unit of use identifier, which appeared on no label anywhere. For FSMA it's the lot code source, which isn't printed on the case. For EUDR it's plot geolocation. Collecting it takes a new process at a company three tiers away, run by someone whose job it has never been. Often that's an aggregator who buys from forty smallholders and has never once been asked where any of them are.

A few practical things add to it.

• Format matters. A polygon that doesn't close, coordinates in the wrong format, or a point where a polygon is required will be rejected. Checking this by eye doesn't scale.
• Every customer asks differently. A supplier selling to 20 EU customers may get 20 questionnaires in 20 formats, and the fastest responses go to whoever makes it easiest.
• It isn't a one-time request. A due diligence statement is tied to products and shipments. When a supplier changes a source, the data has to change too.
• The evidence has to be kept. Records must be kept for five years, so a folder of email attachments won't hold up.

What to do before December 30

If you do one thing before December 30, put one real shipment inside your supplier survey.

A readiness questionnaire is still the right start. It tells you which suppliers are in scope, who owns this at each one, and which tiers sit behind an aggregator. But a checkbox gets you the 80% answer. "Do you have plot geolocation?" Yes. So end the survey with a request. One product, one live purchase order, a date, and a request for the geolocation and legality evidence for that shipment. The suppliers who can do it prove it, and you get a working template for how the data should arrive. The ones who can't will show you where the real work is, by their silence or by what they send instead.

Then do what the FDA found set the best performers apart. They had the clearest agreements with each supplier on what gets collected, in what format, and how it gets sent, whatever system they used.

With about two months left, here's the rest of the order of work.

1. Map your exposure. List the products you buy or sell that fall under the regulation by customs code, and the suppliers behind each one.
2. Confirm your role for each product. Operator, downstream operator or trader decides what you have to collect and file.
3. Send one structured request to every affected supplier. Use the same fields, the same file formats and the same deadline for all of them, and make it easy to complete without training.
4. Check data when it arrives. Validate coordinates, polygon formats, production dates and statement references at submission, not weeks later.
5. Track and chase as a group. Know at any moment which suppliers have responded, which are incomplete and which haven't started.
6. Keep the record. Store each submission with who sent it, when, and what was approved, for at least five years.
7. Plan for change. New products come into scope on December 30, 2027, and suppliers will change sources. Build the request so you can run it again.

How we approach it at Clover

An EUDR request is a compliance campaign, the same kind of work as collecting certificates of insurance or FSMA 204 traceability plans. We run these for CTPAT and FSMA today. Software is how you hold those agreements with three hundred suppliers at once, and keep them from rotting back into a spreadsheet after the first submission.

In Clover, one workflow goes to every affected supplier at once. Each supplier gets a guided task with the fields and files you need. Submissions are checked as they arrive, completion is tracked across the whole group, and every response and decision stays on the record.

If you're working out how to collect EUDR data from your suppliers before December 30, see how compliance campaigns work, or book a demo and we'll walk through it with your supplier list. It's one example of the everyday work between companies and suppliers that we think deserves its own system.

Frequently asked questions

When does the EUDR apply? From December 30, 2026 for large and medium-sized operators and traders, and from June 30, 2027 for micro and small operators. Products added in the 2026 scope update, such as soluble coffee, follow from December 30, 2027.

Does the EUDR apply to companies outside the EU? The obligations fall on companies that place covered products on the EU market or export them. Companies outside the EU are affected through their EU customers, who need supplier data such as plot geolocation and production dates to file their due diligence statements.

What's the difference between an operator and a trader under the EUDR? An operator places a covered product on the EU market for the first time, or exports it, and must file a due diligence statement. A trader sells products that are already on the market. Traders don't repeat the due diligence, but they must keep supplier and customer details for five years and act on evidence of non-compliance.