The EU Deforestation Regulation (EU 2023/1115) has been in force since 2023. The regulation is currently in its transition phase, with implementation starting gradually – for the first actors already at the end of 2025.
This is not just a regulatory change, but a transformation that cuts across entire organisations. The regulation directly impacts how companies source, manufacture, and deliver certain raw materials and products that contain them.
The application of the regulation begins on 30 December 2025 for large and medium-sized enterprises and for products currently covered by the EU Timber Regulation. Smaller operators have a longer transition period, with enforcement starting on 30 June 2026.
“The regulation brings a dual obligation. A company must both practise due diligence and be able to demonstrate the traceability of products in the EU information system.” – Hanna Lehtinen, Partner, Borenius Attorneys Ltd
Three core requirements of the regulation
The regulation applies to products that contain or are produced using wood, coffee, palm oil, rubber, cattle, cocoa, or soy. To place such products on the EU market, companies must meet three requirements:
- The product must be deforestation-free
- It must be produced in accordance with the laws of the country of origin
- It must be accompanied by a Due Diligence Statement (DDS), which also generates a unique code
Obligations apply throughout the supply chain
Although the main responsibility lies with the entity placing the product on the EU market for the first time, obligations also apply to other actors in the supply chain. DDS codes can be referenced throughout, but the ultimate responsibility for compliance remains.
Companies need to begin aligning their operations with the regulation now, to avoid business disruptions once enforcement begins.
“Many companies are only now waking up to what the regulation really requires. It has been in force for a while, but there is little time left for implementation – especially in large organisations where transformation takes time.” – Hanna Lehtinen
What does the regulation mean in practice?
Expert work has identified key phases in which the regulation will concretely affect operations:
Procurement
Companies must implement risk systems to support due diligence and define contractual requirements for regulated products.
Operational purchasing and goods receipt
Purchases should only be made from audited suppliers. On receipt, the product must include a DDS code or enough data to generate one. Validity should be verified before storage.
Manufacturing
It must be possible to demonstrate which DDS-coded raw material batches were used. A DDS code can only be modified within 72 hours of creation – and not at all if it has already been referenced.
Delivery and sales
If the DDS code has not been retrieved in advance and the EUDR system is down, delivery may be blocked. Customers have varying expectations on how they receive DDS codes: some via portal, some via API, email, or delivery message.
“The DDS process has multiple phases that all interconnect. If an error occurs at any point, it can lead to delivery disruptions or even product recalls.” – Miina Koponen-Eskola, Senior Consultant, Gofore tells.
More than a system project
The EU’s EUDR system enables the management and recording of DDS codes, but it alone is not sufficient. Companies must build internal capabilities to support the full lifecycle: DDS creation, linkage to orders and deliveries, reporting, and archiving.
“This is not just a system implementation. It requires mapping business processes, identifying roles and responsibilities, establishing new ways of working – and leading the change across the organisation. Only then can you define what needs to change in ICT.” – Miina continues.
Where to start?
- Identify whether the regulation applies to your company – and in what role in the supply chain
- Map business process variations related to affected products
- Establish a due diligence process and define responsibilities
- Ensure your systems support data traceability
- Plan DDS code management in manufacturing and delivery
- Ensure awareness and ownership among key personnel – change leadership is essential
- Act now – the transition ends for most operators on 30 December 2025
From left to right: Miina Koponen-Eskola/Gofore, Hanna Lehtinen/Borenius and Elina Mattila, Insight & Communications Lead.
Further information, please contact:
miina.koponen-eskola@gofore.com or elina.mattila@gofore.com