The European Union Deforestation Regulation — known by its acronym, EUDR — is the most consequential piece of supply chain legislation the EU has enacted in a generation. It does something no certification scheme, voluntary commitment, or industry roundtable has done before: it makes deforestation-free sourcing a legal precondition for selling certain goods in the European market.

The regulation has been delayed, reopened, and contested. It still has not taken effect. But after its current implementation date, importers, traders, and large operators placing covered goods on the EU market will be legally required to prove those goods did not come from land deforested or degraded after December 31, 2020.

This is a field guide to what the regulation actually does — written for compliance officers, supply chain leads, and anyone whose business touches the seven commodities the EUDR covers.

What the EUDR covers

The regulation applies to seven commodities that the EU has identified as the largest drivers of global deforestation linked to European consumption. Each commodity is covered both in its raw form and in the products derived from it — meaning a leather handbag, a chocolate bar, and a piece of furniture all fall under the same regulatory umbrella as the cattle, cocoa, and timber that produced them.

The inclusion of derived products is what gives the regulation its real reach. A US sportswear brand placing shoeboxes on the EU market is exposed to the EUDR through pulp and paper. A German automaker is exposed through leather seat covers. A French luxury house is exposed through cattle hides in its handbags. The regulation does not care whether the company sells the commodity itself — it cares whether the commodity is embedded in what the company sells.

What compliance actually requires

Every operator placing a covered product on the EU market — or exporting one from the EU — must file a due diligence statement before the goods cross the border. The statement is not a checkbox. It is a structured legal declaration that the operator has gathered, verified, and assessed risk on a specific set of information:

1. Geolocation of every plot of land Coordinates for the parcel where the commodity was produced. For larger plots, polygon boundaries. This is what makes the EUDR fundamentally different from prior deforestation regimes — proof at the plot level, not the country level.
2. Production date or time range When the commodity was harvested, cut, or otherwise produced — necessary to assess whether the land was deforested after the December 31, 2020 cutoff.
3. Supply chain information Name and contact of the supplier, name and contact of the operator placing the goods on the market, and information sufficient to trace the commodity from origin to entry point.
4. Verifiable evidence of deforestation-free origin Documentation, certifications, satellite analysis, or third-party verification demonstrating the land was not deforested or degraded after the cutoff date.
5. Evidence of legal production Confirmation that the commodity was produced in accordance with the relevant laws of the country of origin — land use rights, labor protections, third-party rights, tax and customs regulations.
6. A documented risk assessment A structured analysis of the risk that the commodity originated from non-compliant land, with mitigation measures where the risk is not negligible.

The country of origin is also assigned a risk classification by the European Commission — low, standard, or high. Low-risk countries trigger simplified due diligence. Standard and high-risk countries trigger the full risk assessment and mitigation procedure.

Who bears the risk

One of the most important features of the EUDR is who it puts on the hook. Earlier deforestation frameworks placed obligations on producers, certifiers, or voluntary signatories. The EUDR places legal obligation on the operator — the entity that first places the product on the EU market — and on traders who handle covered products downstream.

This is the regulation's compliance-risk transfer mechanism. The European importer, processor, or retailer is legally responsible for the deforestation status of goods produced thousands of miles away by suppliers they may have never met. The geolocation data must be collected. The risk must be assessed. The statement must be filed. The penalty for failure falls on the operator, not the smallholder farmer or the trader in the source country.

That mechanism is doing exactly what it was designed to do — and the early evidence is starting to come in.

What new reporting shows

In April 2026, the NGO Global Canopy released its Forest 500 Report 2026, examining how the 500 companies with the most influence over EUDR-covered commodities are preparing for the regulation. The findings, covered by Mongabay, paint a picture of partial movement against a backdrop of uneven readiness.

The headline finding: the EUDR is steering corporate behavior even before it takes effect. As Chloe Rollscane of Global Canopy told Mongabay, the regulation "is appearing in lots of company reporting" — and even though it's not yet in force, "it's obvious that companies are getting ready for it."

Concrete examples in the report include Peruvian coffee company Corporación Perhusa stating its coffee plots meet EUDR requirements based on official deforestation maps, and Domino's Pizza committing to make its European operations EUDR-compliant by the end of 2025. Traceability for every covered commodity except beef increased in 2025, with 23% of upstream companies and 14% of downstream companies now reporting traceability mechanisms.

But the report's deeper finding is that progress is partial and the gaps are large.

The leaders

Nineteen companies were classified as leaders — strong commitments paired with strong implementation. Nestlé is the headline example. With a complex supply chain spanning meat, palm oil, pulp and paper, soy, sugar, cocoa, and coffee, the company reports that 96.7% of its primary supply chains were deforestation-free at the end of 2025, achieved through a combination of satellite monitoring, on-the-ground assessments, certifications, and sourcing from low-risk regions.

The point Rollscane emphasized: "It can be done and it's proven it can be done."

The laggards

At the other end, 24 companies have never published any deforestation commitments at all. The Forest 500 report flags that this exposes them to legal action, reputational damage, and reduced access to capital once the regulation takes effect.

More troubling: 14 companies backtracked on commitments in 2025 — removing pledges or withdrawing from certification schemes. Brazilian meatpacker Minerva narrowed its commitment language in CDP reporting to focus on illegal deforestation only. (Brazilian law permits a certain level of legal deforestation; the EUDR prohibits all deforestation regardless of legal status — a critical distinction.) Nike rolled back a 2024 commitment to source FSC-certified packaging.

The leather question

The report also surfaces what may be the most contested EUDR fight currently underway: whether leather should remain in scope. The leather industry is actively lobbying the European Commission to exclude it, even as analysis from the NGO Earthsight found that seven of the ten Brazilian states with the most tree cover loss between 2020 and 2024 accounted for nearly a fifth of Brazil's leather exports to the EU in 2024 and 2025.

Meanwhile, downstream brands appear to be moving regardless — Inditex (Zara), Puma, Kering (Gucci, Saint Laurent), BMW, and Volkswagen are all cited in the Forest 500 data as improving leather traceability.

Why the delays matter

The EUDR has been delayed twice and reopened repeatedly. Each round of legislative uncertainty has a paradoxical effect: it appears to give companies more time, but it actually disincentivizes the investments compliance requires.

Miki Ng of Earthsight summarized the problem directly to Mongabay: "Efforts have been made by companies and countries to prepare for the law, and every time the law gets reopened or postponed, it doesn't create more legal certainty, it actually increases costs." Tina Schneider of the World Resources Institute called it a "constantly shifting legal landscape" that makes it harder for companies to commit to due diligence systems they cannot be sure will still be required in their current form.

The companies furthest along — the Nestlés, the Inditexes — are the ones that decided early that the regulation's direction of travel was clearer than its precise wording. The companies furthest behind are often the ones waiting to see whether the rules will weaken before committing capital to compliance infrastructure.

What this means in practice

For a company exposed to EUDR-covered commodities, the operational implication is straightforward, even if the implementation is hard. Compliance requires:

1. Plot-level traceability Either direct geolocation data from suppliers, or a verification system (satellite imagery, third-party mapping, certification frameworks) capable of producing it.
2. A defensible risk assessment Documented analysis of deforestation risk by region, supplier, and commodity, with mitigation procedures where risk is not negligible.
3. An audit trail Every data point, every supplier declaration, every certification, every risk assessment captured in a form that can be produced on demand for EU competent authorities.
4. Due diligence statement infrastructure The technical capability to file structured statements through the EU Information System before goods are placed on the market.

This is the infrastructure layer the regulation creates demand for — and it's why companies that built compliance systems early are now ahead of competitors that waited. The cost of catching up after enforcement begins is meaningfully higher than the cost of building in advance.

The bottom line

The EUDR is not a sustainability framework. It is a market access requirement enforced through customs procedure and backed by significant penalties. Companies that treat it as ESG reporting will struggle. Companies that treat it as customs compliance — with audit trails, structured data, and operational rigor — will move through it.

The Forest 500 data shows that a meaningful subset of large companies are doing the second thing. The question, as the December 30 deadline approaches, is how much of the rest of the market follows them — and how much of it discovers, the hard way, that the regulation means what it says.