Live Webinar - Nov 3, 2026 @ 4PM CET - What's Still Missing From Your EUDR File
Nine weeks before EUDR applies, seven common answers are still wrong. Here's what the regulation actually says on SMEs, certification, geolocation and more.
A purchasing manager at a mid-sized coffee distributor types a question into an AI assistant: we're an SME trader, when does EUDR apply to us? The answer comes back fast and confident. June 2027. It even cites a source.
The answer is wrong. Traders of every size start on 30 December 2026. But the claim appears in enough well-ranked pages that it has become the default answer, and the manager now has a plan built on a date that doesn't apply.
That is how most EUDR mistakes are being made this autumn. Not through ignorance, but through answers that sound right, were right under an earlier version of the rules, or are right for a different company. The regulation has been amended twice and its product scope changed in September. A lot of what circulates was written before that.
Nine weeks before the regulation applies, these are the seven we see most often.
At a glance:
The reality: Traders and downstream operators of every size start on 30 December 2026. The June 2027 date applies only to operators that are micro or small companies, established as such by 31 December 2024.
The confusion is understandable. The December 2025 amendment, Regulation (EU) 2025/2650, rewrote Article 38(3) to defer the regulation for "operators" that are natural persons, micro or small undertakings. It doesn't mention traders. And medium-sized companies, which are SMEs, get no deferral in any role.
What SME status does change for traders is the weight of the obligation, not the date. SME traders and downstream operators don't register in the EU information system, and they don't carry the duty to verify due diligence when a concern surfaces before sale. They still collect and keep supplier and customer details for five years, from December.
There are further exceptions inside the operator deferral itself: wood products already covered by the EU's previous timber rules get no extra time, whatever the company's size.
The reality: FSC, PEFC, Rainforest Alliance, RSPO and similar schemes can support your due diligence. None of them replaces it. The operator filing the due diligence statement remains responsible for the product's compliance.
The regulation lists certification among the information an operator may take into account when assessing risk. That is where its role ends. An independent assessment published by Earthsight in August 2026 reached the same conclusion: schemes can supply useful information, but they can't guarantee compliance with the law.
The gaps tend to sit in the same places. Not every certified farm or forest unit is checked against the EUDR's cut-off date of 31 December 2020 at plot level. Not every scheme collects geolocation in the form the information system needs. And mixed or mass-balance chains of custody can break the link between a product and the plots it came from, which is the link EUDR requires.
The practical approach is to treat a certificate as evidence that lowers risk, then check what it doesn't cover: plot geolocation, deforestation status after 2020 for each plot, and legality in the country of production.
The reality: Since December 2025, downstream operators and traders no longer file due diligence statements. They still have obligations, and the Commission's updated FAQs confirm it.
Every downstream operator and trader must hold, for at least five years, the name, address and email of who supplied the product and who it was supplied to. The first company after the operator also keeps the due diligence statement reference numbers or declaration identifiers. Large downstream operators and traders must also register in the EU information system before trading, and act when they learn a product may not comply.
The May 2026 guidance made one part of this easier: the duty to collect and keep information can be met with records already received in normal commercial documents, such as invoices. Easier is not the same as nothing. A competent authority checking a downstream company will look for exactly those records.
The reality: Sourcing only from low-risk countries lets an operator skip the risk assessment and risk mitigation steps. It does not remove the information requirements, the geolocation of every plot, or the due diligence statement.
This matters more than it might seem, because every EU member state is classified as low risk, along with most producing countries. Under the simplified due diligence in Article 13, an operator sourcing exclusively from low-risk countries still collects the full set of information under Article 9, including plot geolocation, still files a statement before placing goods on the market, and still has to run full due diligence if it learns of a risk.
What changes is the middle of the process, not the beginning or the end. An Austrian sawmill placing spruce from Austrian forests on the market needs the plot data just as much as an importer bringing in timber from Brazil.
The reality: A single point is enough only for plots of up to four hectares. Plots of more than four hectares need a polygon tracing their boundary, except for cattle establishments. And each plot needs its own geolocation: one polygon can't cover several plots.
The four-hectare rule comes from Article 2(28), and the wording matters at the edge: polygons are required for plots of more than four hectares, so a plot of exactly 4.00 ha can be described with a point. The rule that each polygon describes one plot comes from the Commission's FAQ, and it catches out suppliers who draw one shape around a cooperative's land and call it done.
The bigger problem in practice isn't the format. It's the data quality. Points placed at a farmhouse rather than the field, polygons that overlap a neighbor's, coordinates with too few decimal places, files with the latitude and longitude swapped. Any of these can push a plot into land that was forest in 2020, or make a statement fail validation. Checking geometry at the moment of collection is far cheaper than finding the problem when a statement is rejected.
The reality: Raw, tanned and processed cattle hides, skins and leather left the EUDR's scope on 18 September 2026. Beef, edible offal and prepared meat stay fully in scope.
The change came through Delegated Regulation (EU) 2026/2102, published in the Official Journal on 17 September. It also removed some vulcanized rubber goods, used and retreaded tires, soybeans for sowing and most vehicle and aircraft seats. It narrowed "cattle" to the genus Bos, which takes buffalo and bison out. It added soluble coffee extracts, 14 palm oil derivative codes and frozen cattle tongues, though those additions only apply from 30 December 2027.
This is the myth with the shortest shelf life, and it runs in both directions. Plenty of guides published before September still list leather as covered. Some summaries of the change suggest all cattle products are now out. Neither is right. Anyone who mapped their product scope against the old Annex I should run it again against the current one.
The reality: The application dates are set in law, in Regulation (EU) 2025/2650, published in the Official Journal in December 2025. No amending proposal has been adopted since. In May 2026, the Commission said it would not reopen the regulation.
Two delays have trained the market to expect a third, and the question still gets asked in every webinar. It's a fair question. It's also the wrong one to plan around.
Collecting usable geolocation from a real supplier base takes months, whatever the date says. Suppliers need to be asked, chased, trained and asked again. Plots need checking against satellite imagery. A company that waits for a third delay and doesn't get one has no route to being ready on 30 December. A company that starts now and does get one has simply finished early, with better supplier data than its competitors.
Do SME traders have until June 2027 to comply with EUDR? No. The June 2027 date applies only to operators that are micro or small companies established by 31 December 2024. Traders and downstream operators of every size, including SMEs, start on 30 December 2026, with lighter obligations if they are SMEs.
Is FSC or Rainforest Alliance certification enough for EUDR compliance? No. Certification can be used as information in the operator's risk assessment, but it doesn't replace due diligence. The operator must still hold plot geolocation, confirm no deforestation after 31 December 2020 and confirm legal production.
Do downstream operators have any EUDR obligations? Yes. They no longer file due diligence statements, but they must keep supplier and customer details for at least five years. The first company after the operator also keeps statement reference numbers. Large downstream operators must register in the EU information system.
Do I need due diligence if I only source from low-risk countries? Yes, in simplified form. You can skip risk assessment and mitigation, but you must still collect all required information, including plot geolocation, and file a due diligence statement before placing products on the market.
Is one GPS point enough for EUDR geolocation? Only for plots of up to four hectares and for cattle establishments. Plots of more than four hectares need a polygon of their boundary, and each plot needs its own geolocation.
Is leather still covered by EUDR? No. Delegated Regulation (EU) 2026/2102 removed cattle hides, skins and leather from scope from 18 September 2026. Beef, edible offal and prepared meat remain in scope.
Will the EUDR deadline be delayed again? The dates of 30 December 2026 and 30 June 2027 are set in Regulation (EU) 2025/2650. No further amendment has been adopted, and the Commission said in May 2026 it would not reopen the regulation.
Most of these myths share a cause. They were accurate once, under the original 2023 text or one of the drafts that came after it, and they've outlived the rules they described. The regulation has changed three times in ten months: the December 2025 amendment, the May 2026 guidance and the September scope change. Anything written before those dates deserves a second look, including answers from AI assistants trained on older pages.
The fix is unglamorous. When you get an answer about EUDR, ask which version of the rules it reflects. Check it against the regulation's current text, the Commission's latest FAQ and the Official Journal. And be suspicious of any answer that makes your obligations lighter or later without naming the article that says so.
If you'd like to check where your company actually stands, our free EUDR assessment works through your products, role and suppliers in one call.
Orbify monitors vegetation threats, climate risks, and infrastructure changes across your entire network — so you can prevent outages, optimize maintenance, and stay compliant.
Start with a 4-week pilot on your priority corridors. No enterprise contracts. No multi-month implementations. Just results you can verify against field data.
