EUDR Roles Explained: Operator, Downstream Operator, or Trader - What Are My Responsibilities?

Abstract

The amendment to the EUDR at the end of 2025 has fundamentally shifted the distribution of roles. The full due diligence obligation, including information gathering, risk assessment, risk mitigation, and the due diligence statement, now rests solely with the operator, that is, the company that first places a relevant product on the market in the EU or imports it. All other actors in the supply chain have significantly reduced obligations.

The first downstream operator or trader - that is, the first party following the operator - records supplier data as well as the reference or identification numbers of the due diligence statements and retains them for five years. They are not required to pass on these numbers. All subsequent parties no longer collect reference numbers but essentially document from whom they purchased and to whom they sold.

For management and compliance, this means that liability relief applies only if one’s own role is clearly defined. Anyone who misclassifies their role either creates unnecessary work or fails to fulfill obligations, a breach of which is subject to fines and, under the proposed German legislation, may be punishable by law. Therefore, by the end of the year, clarify for each affected product what role your company plays. This will determine the necessary processes, data requirements, and responsibilities.

What has changed with the EUDR amendment?

Regulation (EU) 2025/2650 of December 19, 2025, postponed the effective date of the EUDR by twelve months and redistributed the obligations along the supply chain. The basic structure remains unchanged: The ban is set forth in Article 3 of the EUDR, while the obligations of the individual roles are outlined in Articles 4 and 5.

The most significant change in terms of content concerns the roles. The downstream operator is now defined as a separate category, and the obligations of traders have been largely aligned with those of the downstream operator. The due diligence declaration is now submitted only where a product first enters the EU market. Under the original version, however, downstream operators were also required in many cases to submit their own due diligence declarations.

At the same time, the amendment required the Commission to conduct a simplification review. Since then, the rules have been clarified in several steps:

• May 4, 2026: The Commission publishes its report on simplification, an updated guidance document, and the fifth edition of the FAQs on EUDR implementation.
• Updated Supply Chain Scenarios: The Commission explains the role a company plays in typical supply chains for beef, cocoa, coffee, palm oil, rubber, soy, and wood.
• Delegated Act on Annex I: Leather and bovine hides, retreaded tires, and soybeans for seed are excluded from the scope of application. Instant coffee, certain palm oil derivatives, and frozen beef tongues are added, with a transition period ending on December 30, 2027.
• August 2026: A draft of a German implementing law for the EUDR and the Environmental Criminal Law Directive has been presented.

What deadlines apply to my business?

Large and medium-sized enterprises must apply the EUDR starting December 30, 2026; small and micro-enterprises must do so starting June 30, 2027. According to the Commission’s FAQs, classification depends on the thresholds of the individual companies (FAQ No. 3.8). Membership in a corporate group is irrelevant (FAQ No. 3.10); each subsidiary is considered on its own. The cutoff date for classification is December 31, 2024; for subsequent changes in company size, a two-year period applies.

Specifically, this means that a sales company with 40 employees can still be considered a small business even if it is part of a corporate group with several thousand employees, provided that its revenue or total assets also fall below the thresholds.

For more information on SME classification and corporate group structures, see our article “EUDR for SMEs and Corporate Groups.”

What is my role under the EUDR? The four-step review process

Your role is not determined by your company’s self-identification, but by your specific actions regarding a specific product. The same company can therefore be an “operator” for one product and a “trader” for another. Check the following on a product-by-product basis, in this order:

1. Is the product affected? Compare the customs tariff number (CN code) with Annex I of the EUDR. Only products listed there are subject to the regulation.
2. Are there any exceptions? These include, among other things, free paper promotional materials, samples, mailings, the packaging exemption, certain used products and secondhand goods, as well as the manufacture of pharmaceuticals.
3. What do you do with the product? Anyone who places it on the market in the EU for the first time or imports it is an operator. Anyone who processes a product that has already been placed on the market into a new relevant product is a downstream operator. Anyone who resells it without modification is a trader.
4. Where do you fit into the chain, and how large is your company? The first party after the operator has more obligations than all the others. Whether a company qualifies as an SME determines its registration and audit requirements.

Is the tariff code sufficient to determine whether a product is affected?

The tariff code is a good starting point, but it does not always provide a definitive answer. Two obstacles are particularly common in practice. First, some headings in Annex I are listed only with the prefix “ex”; in such cases, only a portion of the goods under that code falls within the scope of application. Second, the delegated act amends Annex I, so the classification of existing products that has already been determined should be reviewed again.

For detailed information on classification, see our article “EUDR and HS/TARIC Codes,” and for information on packaging and promotional materials, see “EUDR Packaging Exemption.”

How can I tell where I am in the chain?

The key factor is the status of your direct supplier. If you purchase a listed product directly from the operator, you are either a first downstream operator or a trader. In that case, request the reference or identification number from your supplier and document it. If your supplier is itself only a downstream operator or trader, you do not need to obtain a reference number. In that case, you essentially document who your supplier is and, if your customers are themselves subject to the EUDR, to whom you have delivered the product.

An Overview of the Roles

For context, along the same dimensions in each case:

• Operator – Trigger: first placing on the market in the EU or export; Due Diligence Statement: Yes, with full due diligence requirements; Reference Number: Generated and provided to the buyer; Registration: Required regardless of company size; Verification Requirement: Comprehensive, as part of the company’s own due diligence obligations.
• First Downstream Operator or Trader – Trigger: Purchase directly from the operator; Due Diligence Statement: No; Reference Number: Collect and retain for five years; do not disclose; Registration: Only as a non-SME; Verification Requirement: Only in cases of justified concerns and only as a non-SME.
• All other downstream operators and traders – Trigger: Purchase from a downstream operator or trader; Due diligence statement: no; Reference number: no recording required; Registration: only as a non-SME; Due diligence requirement: only in cases of justified concerns and only as a non-SME.

When am I an operator?

An “operator” is anyone who, in the course of their business activities, places a relevant product on the EU market for the first time or exports it. This applies to two typical scenarios: the producer within the EU, such as a forestry operation that harvests and sells timber, and the importer who releases goods from a third country into free circulation under customs law.

The operator is central to the regulation. Its responsibilities include:

• the comprehensive duty of care, including information gathering (Art. 9), risk assessment (Art. 10), and risk mitigation (Art. 11)
• Submitting the due diligence statement to the EU information system and providing the reference number to the recipient
• Registration in the EU information system, regardless of company size
• the requirement to keep records and documentation for five years
• Notifying downstream operators, traders, and regulatory authorities when new information becomes available or when there are reasonable concerns regarding non-compliance
• comprehensive cooperation with the authorities

If the operator is not an SME, additional requirements apply, including a compliance officer, an independent audit body, and an annual reporting obligation. For micro- and small-scale producers in low-risk countries, including Germany, the amendment provides for a simplified, one-time declaration with an identification number.

As an importer of private-label products, am I considered an operator?

Yes, provided that you import the goods yourself from a third country. Whether a product is sold under your own brand name is irrelevant for the EUDR. The only decisive factor is that you are placing the product on the EU market for the first time. Even reselling the product in its original condition does not change this, because the import itself already constitutes placing the product on the market.

Here’s an example: The fictional company Holmwerk GmbH has teak garden benches manufactured in Indonesia under its own brand and registers them for free circulation itself. For these benches, Holmwerk GmbH is the operator, even if it resells them unchanged to home improvement stores. If, instead, it purchases the same benches from an importer in Hamburg, that importer is the operator and Holmwerk GmbH is the trader.

Who is considered the operator when importing using a third-party EORI number?

The operator is generally the person listed as the importer on the customs declaration, not the service provider who submits the declaration on their behalf. According to the European Commission’s FAQs, customs representatives are never “operators” within the meaning of the EUDR because they neither place relevant products on the market nor export them. This applies to both forms of customs representation under Article 18 of the Union Customs Code:

• Direct Representation: The service provider acts on behalf of and for the account of the client. The client is the importer of record and the customs debtor.
• Indirect representation: The service provider acts in its own name but on behalf of the principal. It becomes the declarant and is jointly liable with the principal for the customs debt. This liability arises under customs law. However, this does not make the service provider an “operator” as defined by the EUDR.

Neither the EORI number used nor the role as declarant determines the EUDR role. The situation is different if a service provider purchases the goods itself and places them on the EU market in its own name. In that case, it is considered an operator, but because of this placing on the market, not because of its role as a customs representative.

Often, the customs service provider is also expected to submit the declaration of due diligence on behalf of its client. To do so, it requires a separate mandate as an authorized representative under Article 6 of the EUDR. Customs representation and authorization are two distinct roles with separate mandates. In both cases, the responsibility for due diligence remains with the operator.

In practice, this means: Specify in the contract who is responsible for submitting the declaration of due diligence, and ensure that the reference number is available before the customs declaration is filed. Without a valid reference number, the goods will not be released for free circulation.

What do downstream operators and traders need to do?

Downstream operators and traders do not issue a due diligence statement and do not fulfill a full due diligence obligation. The scope of their obligations depends on whether they are directly behind the operator or further down the chain. For many companies, this represents a significant relief. However, the remaining documentation requirements must be fulfilled completely and verifiably to the authorities for a period of five years. The real challenge, therefore, lies less in the legal situation than in maintaining a robust data management system.

What are the obligations of the first downstream operator or trader?

The first downstream operator or trader purchases a product directly from the operator and thus plays a pivotal role in ensuring traceability. The operator must collect the following information and retain it for five years:

• Supplier Data
• Reference or identification numbers of the underlying statements of due diligence
• Data of its customers, provided that those customers are themselves subject to the EUDR

He is not required to disclose the reference number to his customers. However, he has the same disclosure obligations as the operator and must cooperate fully with the authorities. He is required to register in the EU information system only if he is not an SME. There is no reporting requirement.

What are the obligations of all other downstream operators and traders?

Starting with the second party downstream from the operator, the collection and retention of reference numbers is no longer required. Otherwise, the same obligations apply as for the first downstream operator: documenting supplier and, if applicable, customer data; retaining records for five years; cooperating with authorities; and registering as a non-SME. For example, a wholesaler who purchases coffee from a domestic roaster, who in turn obtained the green beans from an importer, is the second party downstream from the operator and is not required to record reference numbers.

What happens in cases of justified concerns?

If a downstream operator or trader that is not an SME has reasonable grounds to suspect that a product does not comply, it must, in accordance with Article 5(6) of the EUDR, verify whether the due diligence requirements have been met and whether no risk, or only a negligible risk, has been identified. Until this determination is made, the operator may not place the product on the market, make it available, or export it. There are three ways to conduct this verification:

• Verify the validity of the due diligence statement in the EU information system, if possible
• Use additional sources, such as annual reports or publicly available audit results from suppliers, or voluntarily request information about their due diligence processes
• Neither option is feasible: cooperating with the agency, identifying the upstream supplier, and having the agency trace the supply chain back to the first downstream operator

The regulation does not provide an exhaustive definition of when concerns are “well-founded.” The European Commission’s model complaint serves as a guide. Among other things, it includes information about the person filing the complaint, the alleged violation, the affected shipments and quantities, as well as supporting evidence such as photos, reports, or witness statements. A report that largely includes this information should therefore be taken seriously and reviewed with proper documentation.

Do traders have fewer responsibilities than downstream operators?

No. Under the amendment, the obligations of traders and downstream operators have been largely harmonized. The difference lies in the activity: The downstream operator processes a product that has already been placed on the market into a new relevant product, while the trader makes it available unchanged. However, the scope of obligations is determined by the position in the supply chain and the size of the company.

Case Study: What are the obligations of a manufacturer of wooden popsicle sticks?

The following anonymized case study from a consulting practice illustrates how role theory can be applied to a specific company and at what point an obvious assumption no longer holds true.

The background: A German company is one of the world’s largest suppliers of wooden tables. Just under 100 permanent employees work at its German location. The company sources its wood exclusively from regional sources, specifically, from forestry operations within a radius of about 300 kilometers. The company assumed that the foresters, as operators, would be required to provide all information by June 30, 2027, at the latest, and that the company itself would have to forward the EUDR numbers to its customers starting in mid-2027. It remained unclear what additional obligations the company would have as a purchaser of the wood.

Who is the operator in this case?

Operators are forestry businesses, as they harvest the wood and first place it on the EU market. If they are micro- or small-scale businesses, the extended deadline of June 30, 2027, applies to them. Since Germany is classified as a low-risk country, they can also use the simplified declaration as micro- or small-scale producers and receive an identification number instead of a standard reference number.

What role does the pallet manufacturer play?

The manufacturer is the first downstream operator. It purchases wood that has already been placed on the market and processes it into tables, which, as wood products, also fall under Annex I. Because it purchases directly from forestry operations, it is the first entity in the supply chain after the operator. With just under 100 employees, it is likely a medium-sized enterprise and thus also an SME; the final classification also depends on the company’s revenue and total assets. As a medium-sized enterprise, it must comply with the EUDR starting December 30, 2026.

What obligations arise from this?

As a first downstream operator and an SME, the company must:

• enter the data for his forestry operations as suppliers
• Obtain and save the reference or identification numbers for each shipment
• Document customer data to the extent that the customers themselves are subject to EUDR requirements
• Keep all documents for five years
• In the event of new information or justified concerns, inform the authorities and affected stakeholders and cooperate with the authorities

A separate due diligence statement, registration in the EU information system, and the audit requirement under Article 5(6), which applies only to non-SMEs, are not required.

Is the manufacturer required to provide the numbers to its customers?

No, and this is the most important difference from the original assumption. Under the amendment, the first downstream operator is not required to pass on the reference number to its customers. Traceability is ensured through its own documentation, not through transmission down the entire supply chain. Many customers will still request the numbers. This is then a contractual obligation, not a legal one, and should be addressed accordingly in supply contracts.

What are the rules during the transition period through mid-2027?

Between December 30, 2026, and June 30, 2027, the manufacturer’s obligations will already be in effect, but those of small forestry operations will not yet apply. During this period, it may happen that a forestry operation is not yet able to provide a number. In such cases, document why no number is available, for example, by providing information on the supplier’s size and the delivery date. Also, check whether, in individual cases, you have timber harvested yourself or purchase it on the stump. For these quantities, you could become an operator yourself.

What conclusions can be drawn from this case?

This case highlights two common sources of error. First, the disclosure requirement under the old version is often still assumed to be current law, which leads to unnecessary litigation. Second, the deadlines for different parties are often assumed to be the same, even though they may differ for the supplier and the customer. Both of these issues can only be avoided by individually reviewing the role, company size, and deadlines for each supply route.

Special Cases and Obstacles in Role Definition

What are the rules for companies established after December 31, 2024?

For them, the deadline is generally December 30, 2026. The extended deadline of June 30, 2027, applies only to companies that were already classified as small or micro-enterprises as of the cutoff date of December 31, 2024. However, SME status remains relevant for registration, audit, and reporting requirements.

Does this role apply to the entire corporate group?

No. The role is determined on a company-by-company and product-by-product basis. If one subsidiary imports, a second processes, and a third distributes, each company has its own role with its own responsibilities. The SME thresholds are also assessed on a company-by-company basis; group affiliation is irrelevant.

Can the role vary within a company?

Yes, in practice, that's more the rule than the exception. Typical scenarios include:

• A trader imports part of their product line themselves and acts as the operator for those products; for the rest, they act as a trader.
• A manufacturer sources most of its supplies within the EU but obtains certain intermediate products directly from third countries and acts as an operator for these products.
• A company may be the first downstream operator for one product and the second or third operator for another, depending on whether the supplier is an operator.

What happens if a product is no longer covered or a new one is added?

For products being phased out, the requirements are completely waived; for newly added products, they do not take effect until after the transition period has ended. Under the delegated act regarding Annex I, this applies, on the one hand, to leather and bovine hides, retreaded tires, and soybeans for seed. On the other hand, instant coffee, certain palm oil derivatives, and frozen beef tongues will be subject to these requirements as of December 30, 2027. Therefore, please review your product portfolio again now.

Conclusion

The amendment has significantly simplified the EUDR for most companies. The full burden of due diligence falls on the operator; downstream operators and traders essentially document who supplies and who receives the goods. However, this reduction in burden requires that one’s own role be clearly defined. Anyone who mistakenly considers themselves a trader, even though they are an importer, fails to meet the regulation’s key obligations.

By December 30, 2026, companies should have completed these five steps:

1. Review the product portfolio and identify the affected products based on their tariff codes
2. Take into account the changes made in the amended Annex I
3. Define and document roles by product, delivery method, and company
4. Notify suppliers and record data such as reference and identification numbers in a structured manner
5. Adapt compliance processes, internal systems, contracts, and documents

lawcode’s supply chain compliance software helps you centrally capture supplier data, reference and identification numbers, and supporting documentation; ensure they are retained for five years; and handle reports of substantiated concerns in a structured manner. In a demo, we’ll show you how this can be applied to your supply chains. [Internal link/CTA: lawcode solution for EUDR and supply chain compliance]