��ݮ��Ƶ

The took due diligence away from companies that buy relevant products already covered by a due diligence statement and process or resell them. Many compliance teams read that as "nothing left to do." But that reading is not correct, and it can stop shipments. From 30 December 2026, downstream operators and traders may only sell relevant products if they already hold a defined set of supplier and customer information.

The duty is small, but it is binary: either the record exists before the goods leave your site, or the sale breaks the regulation. The good news is that you already hold most of it. Supplier names, addresses and delivery notes sit in your purchasing records today.

Operator, Downstream Operator or Trader: Which Role Do You Hold?

Your obligations depend on your role for each product, not on your industry. The EUDR covers seven raw materials, the "relevant commodities": cattle, cocoa, coffee, oil palm, rubber, soya and wood. "Relevant products" are the products listed in Annex I that contain or are made from them, such as chocolate, wooden furniture and paper. For each of them, the EUDR knows three roles.

One company can hold two roles. A sawmill that imports logs is the operator for the logs: it carries out due diligence and files the statement. When it sells the sawn wood, it acts as a downstream operator. The same applies to a manufacturer that imports one input itself and buys the rest in the EU. For the imported input, it is the operator. The Commission explains these cases in its .

Suppliers outside the EU can shift the role to you. Take a cocoa company based outside the EU that imports cocoa beans into the EU and sells them to a German chocolate manufacturer. The non-EU company is an operator and files a due diligence statement. Because it is not established in the EU, the German manufacturer counts as an operator too, with full due diligence duties. The rule makes sure that every supply chain has an operator inside the EU that authorities can hold accountable.

What Changed in December 2025, and What Did Not

The created the downstream operator role and removed due diligence and the due diligence statement for downstream operators and traders. The Commission's FAQ is clear on this: no downstream operator or trader has to submit a due diligence statement, and the EU Information System does not even offer the option.

What remained is a duty to keep records and pass on information, plus registration for larger companies. The focus shifts from proving that a product is deforestation-free to proving who supplied it, who received it and, in some cases, which due diligence statement covers it. Responsibility for whether the product complies stays with the operator.

Obligations of Downstream Operators and Traders from 30 December 2026

From 30 December 2026, downstream operators and traders have the following obligations. Most apply to every company. Two apply only to companies that are not SMEs.

1. Have the information before you sell. You may only sell or export a relevant product once you hold the supplier and customer details listed below.
2. Register in the EU Information System (non-SMEs only). Larger companies register before they sell or export for the first time.
3. Record who supplied you. Name, registered trade name or trade mark, postal address, email and, if available, website. If the supplier is an operator, also note the reference number of its due diligence statement.
4. Record who you supplied. The same contact details for the business customers you sell to.
5. Keep everything for five years. Store the information for at least five years after the sale and hand it to the authorities when they ask for it.
6. Pass on warnings. If you learn that a product you already sold may not comply, tell the competent authority and your business customers straight away.
7. Check before selling if a concern comes up (non-SMEs only). If you learn before selling that a product may not comply, inform the authority. If it is a well-founded concern (the EUDR calls it a "substantiated concern"), also check that your supplier carried out due diligence, and sell only once that check shows no or only a negligible risk.

All companies also support the authorities during checks, for example by giving access to premises and records. The check in point 7 only starts with a concrete concern. Nobody expects you to review your suppliers' due diligence as a routine task.

‍

Together, all three classes are SMEs. A company above the limits for medium-sized undertakings is a non-SME and has to register. A note for German companies: the German Commercial Code (HGB) sets higher limits for small companies (EUR 7.5 million balance sheet total, EUR 15 million turnover), but the EUDR uses the EU values. Group thresholds play no role, because each legal entity is assessed on its own.

For downstream operators and traders, only the question SME or non-SME matters. The micro and small classes mainly matter for operators, which only have to start on 30 June 2027. That deferral does not apply to products covered by the old EU Timber Regulation, such as sawn wood, plywood, wooden furniture, pallets, pulp and paper.

When You Need DDS Reference Numbers

When an operator submits a due diligence statement (DDS) in the EU Information System, the system assigns it a unique reference number. That number links a batch of goods to the due diligence behind it. Operators pass it on to their business customers, for example on the invoice, on the delivery note or by email, and customs uses it when goods are imported or exported. Micro or small primary operators that file a simplified declaration receive a declaration identifier instead, which works the same way.

You only need to record these numbers if your direct supplier is an operator. The Commission calls companies in this position "first downstream operators or traders." Everyone further down the chain keeps names and contact details only.

You do not need to investigate where you sit in the chain or chase suppliers for numbers. The operator has to pass the number on, and by doing so it tells you that it is an operator. If a supplier sends no number, you can assume in good faith that it is not an operator. You only hold back goods if you know a supplier is an operator and it still does not share the number.

Three details save real work.

• Link reference numbers to the goods you receive, not to the products you sell.
• You do not have to check whether the numbers are valid, and you do not pass them on to your own customers.
• Each statement also gets a verification number. It stays with the operator unless a larger company asks for it to look into a concrete concern.

Worked Example: What a Furniture Manufacturer Keeps on File

Take a German furniture manufacturer that makes wooden tables and is not an SME. It buys from three suppliers inside the EU and sells to furniture retailers and, through its online shop, to consumers. The example is illustrative and builds on cases from the Commission's FAQ.

Sawmill A harvests timber from its own forest and sells sawn oak. It is the operator for that wood, files a due diligence statement and passes the reference number on, so the furniture manufacturer records it. Sawmill B imports logs, files a statement for them and sells the sawn wood as a downstream operator. No number reaches the furniture manufacturer, so it records Sawmill B's contact details only. Wholesaler C resells plywood as a trader, with the same result.

The law prescribes what to keep, not how to structure it. Storing the reference number with each incoming delivery is the simplest way to link numbers to the goods you receive. Online sales to consumers need no customer record, because the EUDR only asks for details of the business customers you supply.

One addition makes the record stronger: a map of which supplier feeds which product line. The regulation does not ask for it, but it shows at a glance that every relevant input is covered upstream, which is the condition for being a downstream operator at all. If the manufacturer starts importing oak boards from outside the EU, the map shows exactly where it becomes an operator.

Teams that already collect supplier data for the PPWR Declaration of Conformity extend that supplier record instead of building a second one. The PPWR also assigns duties by your role in the chain, so the logic will feel familiar.

How Authorities Check Downstream Operators and Traders

When authorities check a downstream operator or trader, they look at exactly this record. If the documents raise questions, spot checks and on-site audits can follow. Every EU country has to check a minimum share of operators and larger downstream companies each year. That share rises with the deforestation risk of the countries the raw materials come from, from 1 percent for low risk up to 9 percent for high risk countries.

Each EU country sets its own fines, but the EUDR requires a maximum fine for companies of at least 4 percent of their EU-wide annual turnover. Authorities can also confiscate the products concerned. In Germany, the Federal Office for Agriculture and Food (BLE) is responsible for most companies. The German implementing act, which sets the national fines, passed the federal cabinet in August 2026 and still needs approval by parliament (as of October 2026).

When Customers Ask for More than the Law Requires

Downstream companies already receive customer requests for geolocation data, copies of due diligence statements or a confirmation that products are "EUDR compliant". The EUDR gives these requests no legal basis. Since there is no due diligence duty downstream, your suppliers have no duty to hand you geolocation data or other due diligence information either. A clear answer works better than trying to fill the gap. Explain your role, confirm that you keep the required supplier and customer records, and pass on reference numbers where your contract requires it. Questions about plots of land or risk assessments belong with the operator who filed the statement.

When these requests arrive inside wider sustainability questionnaires, the same supplier data answers them, as our guide on avoiding time loss in questionnaires shows. The same traceability also feeds value chain disclosures under the ESRS.

The obligations of downstream operators and traders under the EUDR come down to one record: who supplied you, who you supplied and, where your supplier is an operator, which due diligence statement covers the goods. Build it before 30 December 2026, keep it for five years, and the most binary rule in the regulation stops being a risk to your shipments.

How ��ݮ��Ƶ Supports Your EUDR Records

Most of what the EUDR asks downstream operators and traders to keep already exists in your company, spread across purchasing data, delivery notes and supplier emails. The work lies in turning it into one record you can show an authority within a reasonable time, and in keeping it current for five years.

��ݮ��Ƶ already brings supplier data for PPWR and other regulations together on one platform. Book a demo and learn how you can build your EUDR records on that same supplier data before 30 December 2026.