Due diligence obligations along the supply chain - who has to do what and when?

Executive Summary

The EUDR obliges companies to ensure that certain raw materials and products made from them are deforestation-free, legally produced and traceable back to the production area. The role logic of the regulation is crucial: anyone who provides or exports relevant goods to the EU market for the first time (operator) must set up a robust due diligence system, assess risksand submit the DDS in the EU information system. The EUDR also makes a clear distinction between downstream operators (processors who turn already covered products into new relevant products) and traders (resellers of unaltered goods). Both have reduced obligations, but must keep information, maintain reference numbers and respond to substantiated concerns.

In practice, the more stable traceability, data quality and internal approvals are organized, the easier it is to pass on obligations efficiently. As soon as goods are further processed and a new relevant product is created or traceability becomes fragile, the need for testing and documentation increases again. Important: The EUDR does not allow mass balancing - products from deforestation-free sources may not be mixed with material of unknown or non-compliant origin along the chain. Although the current timetable provides a lead time, it is not a break: large and medium-sized companies must apply from December 30, 2026, micro and small companies from June 30, 2027.

Understanding EUDR roles: Operator vs. trader

Who is an operator within the meaning of the EUDR?

At the heart of the EUDR(Regulation (EU) 2023/1115) is the distinction between three actor roles, each with their own obligation profile. Since the trilogue decision of December 2025, the sometimes widespread equation of "market participant" and everything that comes after the initial placing on the market is no longer viable. Those who do not clearly define their role risk either over-compliance (unnecessary DDS, duplication of work) or under-compliance (lack of registration, lack of references, risk of fines).

You can find more information on the EUDR Regulation and its requirements in our EUDR article.

An operator is any natural or legal person who makes a relevant product available on the EU market for the first time or exports it from the EU. This includes importers from third countries as well as EU primary producers (e.g. foresters, farmers) and manufacturers who produce a relevant product from raw materials for the first time within the EU.

Important: Responsibility remains with the operator, even if third parties provide information or certifications are used. Certification schemes can be a useful source of information, but they are not a substitute for due diligence. Systems that allow mass balancing or the mixing of certified and non-certified material are explicitly not sufficient for EUDR compliance.

Special category: Micro or Small Primary Operator (MSPO)

A sub-category of operators is the MSPO, introduced with the trilogue package at the end of 2025. Four requirements must be met cumulatively:

• natural person or micro/small enterprise (thresholds of the Accounting Directive 2013/34/EU),
• established in a country classified as low-risk,
• brings directly to the EU market or exports,
• Products come from our own production (grown, harvested, extracted or reared) in the country of establishment.

Instead of a DDS, MSPOs submit a single Simplified Declaration (SD) and may provide the postal address of the production area instead of the geo-coordinates, provided this clearly reflects the geographical location. If a Member State provides the necessary data from national databases, the SD is not required. Fluctuations in quantity do not require a new SD. An update is only necessary if the business changes in such a way that completely new products are added (e.g. a soy farmer also starts selling wood).

Downstream operator (downstream market participant)

A downstream operator processes relevant products that are already covered by a DDS or SD into new relevant products and places them on the market or exports them. Typically, this results in an HS code change. A classic example: a chocolate manufacturer that produces chocolate from imported cocoa beans and sells it in the EU.

Important clarification: If a downstream operator manufactures a new relevant product from several components, some of which are not already covered by a DDS/SD, he must act as the operator for the components that are not covered - i.e. full due diligence including DDS. This constellation occurs regularly in mixed products and is often overlooked in projects.

Trader (Trader)

A trader is any person in the supply chain who is neither an operator nor a downstream operator and who resells a relevant product that has already been placed on the market unchanged. Typically wholesale or retail.

Logistics companies are only traders if they themselves provide/sell the product as an economic actor - pure transportation and storage service providers do not fall within the scope of application.

Roles can overlap

Depending on the product and supply chain, a legal entity can be an operator, downstream operator and/or trader at the same time. Classic constellation: a furniture company imports raw wood from Norway (operator), processes it into chipboard itself (also downstream operator) and sells the chipboard to a furniture manufacturer in the EU. DDS reference numbers do not have to be passed on within the same legal entity - the linking takes place internally.

You can find more details on intermediate processing and HS code changes in our article EUDR - Sale and processing of intermediate products and on group issues in EUDR - Group structures and SMEs.

Differences in duties at a glance

The operator bears the main responsibility: they must set up the due diligence process, obtain the geodata, assess the risk and submit the DDS. This documents that the goods are deforestation-free, that the laws of the country of origin have been complied with and that traceability is ensured.

Downstream players (downstream operators and traders) work in a reference and verification logic. Their core duties are:

1. Collect information: Retain data on direct suppliers and commercial customers for five years.
2. Secure reference numbers: The operator is obliged to proactively pass on the DDS reference number to the first downstream operator/trader. The latter does not have to actively inquire about its position - if no reference number is received, it can assume that it is not a first downstream operator.
3. Take action in the event of concerns: Non-SMEs in particular must check for substantiated concerns and inform the authorities if necessary.

This means that you do not have to roll up every upstream check "again" as long as the internal processes are clean and references are assigned correctly.

Subsequent actors and EUDR compliance

Principle: No double reporting obligation

A key point in relieving the burden on companies is the principle that a due diligence declaration does not have to be submitted more than once for the same batch of a product. If an operator has already imported a product into the EU market with a DDS, subsequent operators do not have to submit a new declaration for this batch.

However, this principle does not apply without restriction. As soon as the goods are subsequently mixed, reworked or processed in such a way that a new relevant product is created, a new due diligence obligation can be triggered. As the EUDR does not allow mass balancing, the physical separation of compliant and non-compliant products must be guaranteed at all times. If traceability is lost, the relief effect no longer applies.

Special cases and exceptions

A new duty of care for downstream actors may arise if:

• A new relevant product is created by blending or processing (e.g. a chocolate manufacturer produces chocolate from cocoa beans that are not all covered by a DDS; it must then act as operator for the beans that are not covered).
• A product leaves the EU internal market again (re-export).
• Different batches are recombined in collection points or central warehouses and the clear traceability to the original DDS is lost.

Risk analysis: When is it necessary?

Risk analysis mandatory for operators

The EUDR obliges every operator to carry out a comprehensive risk analysis. This must take into account all available information: Proof of origin, geodata, proof of traceability and legality. Certificates such as FSC or PEFC can serve as a source of information, but do not replace the operator's own due diligence.

Simplified due diligence for low-risk countries

There is one important relief: If an operator sources raw materials exclusively from countries or regions classified as "low risk" by the EU Commission, it is exempt from the obligation to carry out risk analysis (Art. 10) and risk mitigation (Art. 11). However, the obligation to collect information in accordance with Art. 9 (incl. geodata) remains in place.

No need for risk analysis for downstream players

Traders and downstream operators do not usually have to carry out their own risk analysis. They can rely on the DDS submitted by the operator. A supplementary audit obligation only arises if there are substantiated concerns (e.g. through media reports or indications of discrepancies). This obligation is reactive, not proactive.

Is the supplier due diligence declaration sufficient?

Principle: No, the operator's DDS is decisive

A "supplier declaration" is an important building block in practice, but not the EUDR proof itself. It is merely a document that a supplier provides to the operator as a basis of information for the operator's own due diligence.

Only the declaration of due diligence (DDS) filed by the operator in the EU information system is authoritative. Only the reference number contained therein proves conformity.

For an operator to be able to rely on his supplier's data, the information must be complete, consistent and clearly attributable to the specific batch of goods. This includes

If this information is missing or contradictory, the operator must request additional information or carry out additional checks before submitting his DDS and placing the goods on the market.

What companies should look out for

Companies should critically examine information from suppliers:

• Are all the necessary details complete and logical?
• Does the declaration refer to a specific batch and not to the entire range? Blanket certificates are worthless for the EUDR.

It is not enough to simply file documents, especially in the case of a regulation that threatens heavy fines. A plausibility check of the contents is essential.

Technical tools to support due diligence

Reliable implementation of the EUDR duty of care can hardly be achieved manually. Specialized tools such as our EUDR module start exactly where the regulation creates pressure in practice:

• Geodata validation: Software automatically checks location coordinates for plausibility and compares them with satellite data to prove freedom from deforestation.
• Plausibility check of supplier declarations: Digital solutions automatically highlight contradictory or incomplete information and thus reduce the risk of incorrect DDSs being included in the flow of goods.
• Batch and reference tracking: Traceability systems ensure that reference numbers remain correctly assigned to batches, processing steps and deliveries - crucial as soon as goods are further processed or mixed.
• Audit trail function: Seamless documentation of data origin, checks and approvals makes due diligence verifiable in the event of an audit.

Bundling these functions in an integrated platform avoids data disruptions between geodata, risk analysis and documentation.

Conclusion

The regulatory requirements of the EUDR introduce new, comprehensive due diligence obligations. Unlike previous regulations, they affect not only the first distributor, but the entire supply chain.

The principle of shared responsibility offers opportunities, for example by relieving downstream players, but also harbors risks. Operators who blindly rely on supplier information or traders who ignore substantiated concerns risk fines, reputational damage and liability.

Companies should therefore urgently clarify their status under the EUDR (operator, downstream operator, trader). Supplier assessment, risk analysis and documentation can then be built on this basis in a targeted manner. Digital tools help to manage evidence efficiently and strengthen compliance in everyday life.