EUDR Applies From 30 December 2026: Where Deforestation Due Diligence Meets Your Sustainability Statement

Two projects are running in most companies with a physical supply chain right now, and in a surprising number of them the two teams have never met.

One is EUDR readiness: procurement and compliance, working backwards from a hard date. The other is CSRD reporting: sustainability and finance, working forwards from a materiality assessment. They are collecting overlapping data about the same suppliers, from the same commodities, in the same geographies - and producing artefacts that are not interchangeable.

The EU Deforestation Regulation starts applying to large and medium operators on 30 December 2026. That is roughly fifteen weeks away. Here is what it demands, what it shares with your sustainability statement, and - the part that gets companies into trouble - what it does not.

The dates and the commodities

Regulation (EU) 2023/1115 on deforestation-free products replaces the EU Timber Regulation. Application dates now stand as:

• Large and medium operators: 30 December 2026
• Micro and small operators: 30 June 2027
• Micro and small operators already covered by the EUTR: 30 December 2026

The regulation has been amended twice with simplification and postponement measures - in December 2024 through Regulation (EU) 2024/3234, and again in December 2025 - reducing administrative cost and burden. The Commission has said it will not reopen the text. Plan for 30 December 2026.

In-scope commodities are cattle, wood, cocoa, soy, palm oil, coffee and rubber, plus derived products including leather, chocolate, tyres and furniture. That derived-product list is where companies get caught: a furniture retailer, a car manufacturer buying tyres, a confectioner, and a coffee chain are all operators or traders under this regulation whether or not they think of themselves as having a forest footprint.

The core obligation is blunt. Any operator or trader placing these commodities on the EU market, or exporting from it, must be able to prove the products do not originate from recently deforested land and have not contributed to forest degradation. The regulation is intended to cut carbon emissions linked to EU consumption and production of the covered commodities by at least 32 million tonnes per year.

What EUDR actually requires operationally

Four things, in sequence.

Geolocation. Plot-level coordinates for where the commodity was produced. Not a country. Not a supplier address. The plot. This is the requirement that breaks traditional procurement data models, because most ERP systems have never held a coordinate for anything.

Legality evidence. Proof that production complied with the relevant legislation of the country of production - land use rights, environmental and forest law, labour rights, tax and trade rules, and third-party rights.

Risk assessment and risk mitigation. A documented assessment of the risk that a given consignment is non-compliant, and, where risk is more than negligible, mitigation steps taken before placing it on the market.

A due diligence statement. Submitted through the EUDR Information System established under Article 33, which launched on 4 December 2024, with user registration open since November 2024.

Two mechanics soften the load. An Implementing Regulation benchmarks countries by deforestation risk, and sourcing from low-risk countries permits simplified due diligence. And the EU Observatory on deforestation and forest degradation publishes maps and datasets on forest cover change, built on Copernicus and other sources, which you can use as an input to risk assessment rather than commissioning everything yourself. Enforcement sits with competent authorities designated by each Member State.

In May 2026, the Commission presented a package of measures: a simplification review report, updated FAQs and guidance, a draft delegated act on product scope, and updates to the Information System. If your scoping analysis predates that package, it is worth a second pass.

Where the two regimes genuinely overlap

The overlap is real, and it is mostly upstream data rather than downstream narrative.

Commodity volumes and sourcing geographies. The commodity-by-country picture you build for EUDR risk assessment is the same picture ESRS asks you to describe when explaining where your impacts sit in the value chain.

Plot and supplier geolocation. Under ESRS E4, location matters - proximity to biodiversity-sensitive areas, land-use change, ecosystem impact. EUDR forces you to collect exactly the spatial data that makes those disclosures defensible rather than generic.

Risk assessment and mitigation processes. EUDR requires a documented process. ESRS 2 requires you to describe your processes for identifying and managing impacts, risks and opportunities. The same process description can serve both if it was written once, properly.

Policies and governance. Supplier codes, deforestation commitments, escalation and remediation routes, and board oversight feed ESRS G1 business conduct disclosures and ESRS 2 governance disclosures.

Upstream labour risk. You are already in contact with the same tier of suppliers, asking about legality of production - which in practice includes labour rights. That contact is an opportunity for ESRS S2 data you would otherwise chase separately.

Where they do not overlap - and why it matters

This is the section to send to whoever is about to tell the board that "EUDR covers our E4 work".

EUDR has no materiality gate. If you place an in-scope commodity on the EU market, it applies. Full stop. ESRS E4 applies only if your double materiality assessment screens biodiversity and ecosystems in.

EUDR is product- and consignment-level. It tests a specific shipment against a legality and deforestation standard. ESRS is entity-level and narrative-heavy. A due diligence statement is evidence about a consignment; it is not a disclosure about your company.

The consequences differ in kind. EUDR failure is a market-access problem: goods that cannot lawfully be placed on the market, enforced by national competent authorities. CSRD failure is a disclosure problem, enforced through national supervisory regimes and your assurance engagement.

The direction of proof is opposite. EUDR asks you to prove a negative about a product. ESRS asks you to describe, fairly and with appropriate granularity, what your company does and what it affects. A strong ESRS E4 narrative proves nothing about a consignment. A pile of clean due diligence statements does not, on its own, produce an ESRS E4 disclosure.

One more timing point: the revised ESRS adopted on 3 July 2026 cut mandatory datapoints substantially and are expected to apply from FY2027. If you are designing the ESRS side of this data architecture now, design it against the revised standards, not the 2023 set.

Three failure modes worth avoiding

1. Two questionnaires, one supplier, contradictory answers. Procurement sends an EUDR data request in October. Sustainability sends an ESRS value chain request in January. The same supplier contact answers both, differently, because the questions were framed differently and nobody reconciled them. Your assurance provider will find the inconsistency before you do. Consolidate supplier outreach into one request with a single owner, even if the outputs feed two regimes.

2. Assuming EUDR discharges ESRS E4. It does not, for all the reasons above. The useful framing is that EUDR gives you inputs - spatial data, risk assessments, supplier evidence - that make E4 disclosures concrete instead of generic. It does not give you the disclosures.

3. Building EUDR data where your auditors cannot reach it. EUDR data often lands in a procurement or traceability tool, outside the reporting system and outside the control environment your assurance provider tests. If you later cite that data in your sustainability statement, it needs the same lineage, access and controls as any other reported figure. Decide that now, not during fieldwork.

The next fifteen weeks

Be honest about the order of priority: EUDR readiness comes first, because market access is at stake and the date does not move.

1. Confirm scope. Which legal entities are operators or traders, for which commodities and derived products, and under which size classification. Re-check against the May 2026 Commission package.
2. Close the geolocation gap. Identify the suppliers who cannot yet provide plot-level data and decide, commodity by commodity, whether you fix it, substitute, or stop.
3. Register and test the Information System workflow end to end with a real consignment before December, not with a sample in the final week.
4. Write the risk assessment methodology once, in a form that can be quoted in a sustainability statement without rewriting.
5. Tag every data element you collect with a second label: "also used for ESRS". That single act of housekeeping is what converts a compliance project into a reporting asset.
6. Brief your assurance provider early on where EUDR data lives and whether you intend to rely on it in the sustainability statement.

What changes for FY2027

Something uncomfortable happens once the plot-level data arrives: you find out things you previously had the luxury of not knowing.

Companies that complete EUDR mapping often discover exposure they had described in earlier reports in softer terms - sourcing regions with genuine land-use change risk, suppliers whose provenance claims do not survive verification, volumes whose origin is genuinely unknown. Under ESRS, better data can make disclosures look worse before it makes them look better.

That is not a reason to slow down. It is a reason to prepare the narrative deliberately: explain the improvement in data quality, distinguish newly identified exposure from newly created exposure, and show the trajectory. Reporting frameworks tolerate bad news explained well far better than they tolerate a disclosure that quietly changes shape between years.

FAQ

Does EUDR compliance satisfy ESRS E4? No. EUDR is product-level and applies regardless of materiality; ESRS E4 is entity-level and materiality-gated. EUDR data is a valuable input to E4 disclosures, not a substitute for them.

Do small suppliers have to give me geolocation data? EUDR obligations sit with the operator or trader placing goods on the EU market. In practice you need the data to discharge your own obligation, and you will have to contract for it. Note this is a separate question from the CSRD value chain cap, which limits what large reporters can demand from smaller suppliers for reporting purposes.

What if my double materiality assessment screened E4 out? EUDR still applies in full. Conversely, if EUDR work reveals significant deforestation-linked exposure, that is evidence you should feed back into your next materiality assessment.

Is the 30 December 2026 date still moving? The regulation has already been postponed twice, but the Commission has said it will not reopen the text. Prepare for the date as it stands.

Who enforces EUDR? Competent authorities designated by each Member State, through checks on operators, traders and consignments - a different enforcement route from the supervisors who review sustainability statements.