Why forest risk is now a business risk

New deforestation rules will reshape global supply chains. Russell Smyth explains what the EUDR means for businesses, compliance, risk management and long-term resilience

Global deforestation and forest degradation are among the most significant drivers of nature loss and climate change, with far‑reaching social and economic consequences for forest‑dependent communities and global supply chains.

Forest ecosystems provide critical habitats for biodiversity, function as important carbon sinks, regulate water systems and underpin livelihoods, food security, and cultural heritage.

Continued forest loss (both legal and illegal) presents systemic risks to nature, climate stability and long‑term economic resilience.

History

Historically, EU consumption has been linked to deforestation beyond its borders, driven by growing demand for agricultural commodities and forest products associated with land use change. The EU has been linked to a substantial share of global deforestation, driven largely by international trade supplying it.

As a result, the environmental impacts are often unseen, occurring upstream and out of sight of European consumers and regulators. This has been a key driver for regulatory intervention at the EU level, reflecting growing recognition that voluntary commitments and certification approach alone have not been sufficient to halt deforestation or forest degradation at scale.

In response, the EU Deforestation Regulation (Regulation (EU) 2023/1115, EUDR), as amended by Regulation (EU) 2025/2650 was introduced to address the links between EU demand, deforestation, forest degradation and associated human rights and governance risks.

Impact on supply chains

While the EUDR is fundamentally driven by environmental and governance objectives, it also has direct implications for the long‑term resilience of supply chains that rely on forest- and land‑based commodities.

By setting clear and enforceable requirements for deforestation‑free production and legal compliance, the EUDR aims to realign market incentives towards responsible forest management, sustainable agriculture and more transparent supply chains.

Over time, this is intended to support fair competition, provide greater confidence in the integrity of forest and timber supply, and help underpin more resilient sourcing strategies for EU‑linked value chains.

Sitting within the broader umbrella of the European Green Deal, the European Biodiversity Strategy for 2030, and the Farm to Fork Strategy, and forming part of a wider set of regulations focused on improving global value chains, the regulation will require any company importing or exporting specific commodities to or from the EU, or making them available on the EU market, to demonstrate that products are not produced on land that was deforested or degraded after 31 December 2020, and are produced in accordance with the laws of the country of production.

Simplification review

The European Commission published its simplification review in May 2026, providing further clarity on the practical application of the Regulation. The review confirms the core design of the EUDR, while introducing a set of targeted simplifications and clarifications that:

• further reduce administrative burden across value chains;
• confirm that due diligence responsibility sits with the first operator placing products on the EU market; and
• provide greater certainty on scope, obligations and implementation.

The Commission’s review also signals a shift from regulatory uncertainty to implementation readiness, with companies now expected to focus on operationalising compliance.

In this context, businesses should also anticipate that further refinements to scope and practical expectations may continue as implementation progresses.

Commodities covered

The EUDR targets seven commodities (cocoa, cattle, coffee, palm oil, soy, rubber, and wood), as well as a wide range of derivative products made from these commodities, including chocolate (cocoa), industrial fatty alcohols and glycerol (palm oil), and specified rubber‑based products.

The simplification review did not alter the core list of commodities but refined the scope of covered and excluded derivative products to improve clarity, proportionality and consistency across supply chains.

Recent guidance and the draft Delegated Act (May 2026) build on this by introducing targeted additions and exclusions (e.g. specific derivatives) and by increasing reliance on precise CN code classification.

Certain commodities and derivative products are explicitly out of scope under the EUDR, including, inter alia:

• Products containing a commodity listed in Annex I of the Regulation (which lists covered commodities and products) where the product itself is not listed in Annex I (for example, certain food products containing coca, such as cakes and pastries);
• Products that do not contain a commodity listed in Annex I;
• Certain products listed in Annex I that are made exclusively from recycled material (i.e. materials that have completed their life cycle and would otherwise be disposed of as waste);
• Certain leather and cattle-derived products;
• Products made solely from bamboo, as bamboo is categorised as a non-wood forest product, and therefore out of scope of EUDR. In the case of wood products that also contain bamboo components, those components are not subject to due diligence obligations.
• Second‑hand goods are explicitly clarified as out of scope, as obligations apply only to the first placing of a product on the EU market or export; and
• Packaging is assessed based on whether it is placed on the market as a product in its own right; packaging used solely to contain, protect or transport another product is treated as ancillary.

What does this mean for your business?

The Commission’s simplification review confirms that the EUDR’s core requirements and objectives remain unchanged, underscoring the need for businesses to focus on implementation rather than further regulatory uncertainty.

For businesses operating in producing countries, the inability to meet EUDR requirements may strain or sever relationships with EU customers. Meanwhile, for companies trading in or making available commodities on the EU market, aligning processes with the EUDR will require significant changes to information flows, governance structures and supply chain oversight.

Beyond supply chain disruption, violations of EUDR obligations expose businesses to severe penalties, including product confiscation and fines of up to four percent of annual EU revenue (subject to national legislative adoption).

This represents an immediate financial risk that could have a profound impact on the bottom line.

• Timeline: The EUDR will enter into force on December 30, 2026. For micro and small undertakings, it will enter into force six months later.
• Roles: Information and compliance responsibilities vary depending on role in the supply chain.
• Due diligence: In-scope products require a due diligence or simplified declaration to be sold or exported; customs may block non-compliant goods.
• Penalties: Penalty of 4 percent of annual turnover, sales ban, and exclusion from public procurement.

Key steps to comply with the EUDR

Businesses should be prioritising a structured approach to EUDR implementation across four key phases:

• Scoping: Identify products and supply chains in scope, determine the organisation’s role (operator or trader), and assess current maturity against EUDR requirements to define key gaps.
• Preparing: Establish governance, translate regulatory requirements into internal policies and processes, and design the due diligence and supplier engagement framework needed to support compliance.
• Implementing: Operationalise due diligence through data collection, risk assessment and mitigation processes, supported by appropriate systems, controls and technology integration across the organisation.
• Reporting: Submit Due Diligence Statements via the EU Information System, maintain a robust and auditable documentation trail, and ensure ongoing compliance through regular review and reporting.

In addition, companies should plan for “business as usual” ongoing compliance, including maintaining records for at least five years, preparing for National Competent Authority enquiries, and building an audit‑ready documentation repository.

Russell Smyth is Partner and Head of Sustainable Futures and Corporate Finance at KPMG