The EU Deforestation Regulation (EU 2023/1115) has been in force since 2023. The regulation is currently in its transition phase, with implementation starting gradually – for the first actors already at the end of 2025.
This is not just a regulatory change, but a transformation that cuts across entire organisations. The regulation directly impacts how companies source, purchase, manufacture, and deliver products in EUDR scope.
The application of the regulation begins on 30 December 2025 for large and medium-sized enterprises and for products currently covered by the EU Timber Regulation. Smaller operators have a longer transition period, with enforcement starting on 30 June 2026.
“The regulation brings a dual obligation. A company must both practise due diligence and be able to demonstrate the traceability of products in the EU information system.” – Hanna Lehtinen, Partner, Borenius Attorneys Ltd
Three core requirements of the regulation
The regulation applies to products that contain or are produced using wood, coffee, palm oil, rubber, cattle, cocoa, or soy. To place such products on the EU market, companies must meet three requirements:
- The product must be deforestation-free
- It must be produced in accordance with the laws of the country of origin
- Products need to have Due Diligence statement (DDS) submitted. This will also generate a Due Diligence Statement code.
Obligations apply throughout the supply chain
Although the main responsibility lies with the entity placing the product on the EU market for the first time, obligations also apply to other actors in the supply chain. DDS codes can be referenced throughout, but the ultimate responsibility for compliance remains.
Companies need to begin aligning their operations with the regulation now, to avoid business disruptions once enforcement begins.
“Many companies are only now waking up to what the regulation really requires. It has been in force for a while, but there is little time left for implementation – especially in large organisations where transformation takes time.” – Hanna Lehtinen
What does the regulation mean in practice?
Expert work has identified key phases in which the regulation will concretely affect operations:
Procurement
Companies must implement risk systems to support due diligence and define contractual requirements for regulated products.
Operational purchasing and goods receipt
Purchases should only be made from audited suppliers. On goods receipt, the product must include a DDS code or required data to generate one. DDS code validity should be verified before storage.
Manufacturing
It must be possible to demonstrate Which material batches were used and what were the related DDS codes. A DDS code can only be modified within 72 hours of creation – and not at all if it has already been referenced.
Delivery and sales
If the DDS code has not been retrieved in advance and the EUDR system is down, delivery may be blocked. Customers have varying expectations on how they receive DDS codes: some via portal, some via API, email, or delivery message.
The DDS process has multiple phases that all interconnect. If an error occurs at any point, it can lead to delivery disruptions or even product recalls.
More than a system project
The EU’s EUDR system enables the management and recording of DDS codes, but it alone is not sufficient. Companies must build support for the entire process into their own systems: generating the DDS code, linking it to orders and deliveries, as well as reporting and archiving.
“This is not just a system implementation. It requires mapping business processes, identifying roles and responsibilities, establishing new ways of working – and leading the change across the organisation. Only after that you can define what needs to change in ICT.” – Miina Koponen-Eskola, Management consultant at Gofore.
Where to start?
- Identify whether the regulation applies to your company – and what role you have in the supply chain
- Review business process variations related to affected products
- Establish a due diligence process and define responsibilities
- Ensure your IT systems support data traceability of information
- Plan the management of DDS codes in manufacturing and delivery
- Ensure understanding among staff and key roles – change management is critical
- Act now – the transition ends for most operators on 30 December 2025
From left to right: Miina Koponen-Eskola/Gofore, Hanna Lehtinen/Borenius and Elina Mattila, Insight & Communications Lead.
Further information, please contact:
miina.koponen-eskola@gofore.com or elina.mattila@gofore.com