EUDR for cocoa and chocolate makers: what you must trace and file

Cocoa beans, paste, butter, powder and chocolate are all Annex I products under the EUDR, covered under CN headings 1801 to 1806. If you import beans, process them into chocolate, or buy already-imported cocoa mass within the EU, you need plot-level geolocation for every parcel the cocoa was grown on, evidence it is deforestation-free after 31 December 2020, and — if you are the first to place it on the EU market — a due diligence statement filed in the Information System before your application date.

What "cocoa" covers under the EUDR

Cocoa is one of the seven regulated commodities, and the CN headings that follow it track the processing chain from bean to bar:

CN heading	Product
1801	Cocoa beans, whole or broken, raw or roasted
1802	Cocoa shells, husks, skins and other cocoa waste
1803	Cocoa paste, whether or not defatted
1804	Cocoa butter, fat and oil
1805	Cocoa powder, not containing added sugar or other sweetening matter
1806	Chocolate and other food preparations containing cocoa

The heading changes at almost every processing step: beans (1801) become paste (1803), paste separates into butter (1804) and powder (1805), and any of those go into chocolate (1806). Whoever carries out one of these steps using cocoa already covered by someone else's due diligence statement is a downstream operator, not a fresh point of entry.

Two things that look like cocoa are not caught. A biscuit or cake with a chocolate coating sits under CN 1905, and ice cream sits under 2105 — both outside Annex I, because scope is set by CN code, not by whether cocoa is an ingredient. The Commission gives bread, cakes and biscuits containing cocoa as its own examples of products that are not relevant products. And since the Annex I recast that entered into force in September 2026 (Commission Delegated Regulation (EU) 2026/2102), cocoa shells, husks and other cocoa waste under CN 1802 are excluded where they meet the definition of waste under the Waste Framework Directive — see what changed in Annex I under 2026/2102 for the other products that moved in the same act.

Where you sit in the chain

The obligation that applies to you depends on where you sit, not on the fact that you handle cocoa at all.

• You import beans, paste, butter, powder or couverture from outside the EU. You are the primary operator. You file the due diligence statement, and geolocation for every plot the beans were grown on sits behind it.
• You are an EU chocolate manufacturer buying cocoa mass, butter or powder from an EU trader who has already filed. Since Regulation (EU) 2025/2650, you are a downstream operator. You do not file your own statement — you collect and retain the upstream reference number for five years, and you must be able to produce it to a competent authority. If you are not an SME, you must still register in the Information System even though you have nothing to submit.
• You buy finished chocolate from an EU brand to sell on, private-label it, or use it as an ingredient. Same downstream position — you hold the reference number, you do not generate one.

Get this wrong in either direction and you either file a statement you had no obligation to produce evidence for, or skip retention you were required to keep. Ask each cocoa supplier, in writing, whether they are the one filing and what reference number applies to your batch.

The geolocation problem specific to cocoa

Article 9 requires the coordinates of every plot the cocoa was grown on: a single point for plots of 4 hectares or less, a polygon above that. What counts as compliant geolocation covers the mechanics; cocoa's problem is getting that data at all.

West African cocoa — which is most of the world's supply — moves from smallholder farms through pisteurs, cooperatives and licensed buying agents before it reaches an exporter. A single export lot can carry beans from hundreds of farms of a few hectares each. Geolocating the cooperative's warehouse does not satisfy Article 9; every contributing plot needs its own point or polygon, tied to the specific parcel that beans in that lot came from.

This is not a hypothetical obstacle. Côte d'Ivoire's Conseil du Café-Cacao and Ghana's Cocobod have both been building national traceability systems around exactly this requirement, mapping registered farms against a national land register. Cameroon's cocoa sector has made real progress on the same problem but, by industry reporting, is further behind on full coverage. Where your exporter can point to a national or scheme-level register — Rainforest Alliance and Fairtrade have both been extending their own traceability platforms to capture EUDR-format coordinates — that is a genuine shortcut. Where they cannot, you are asking smallholder cooperatives to produce a kind of data most have never been asked for, and that takes months, not weeks, to arrive.

Building the data request that gets an answer

A request that simply asks an exporter or cooperative for "EUDR data" tends to get nothing back. One that names the fields does better:

1. Farm or plot identifier, matched to whatever unit the cooperative or licensed buying agent already tracks.
2. Coordinates or polygon for that plot, in a format you can check before it reaches the Information System — malformed geolocation is one of the most common reasons a due diligence statement is rejected.
3. Area, to confirm whether a point or a polygon applies.
4. Harvest period, so the plot ties to the specific lot or shipment it fed.
5. Land tenure or use-right evidence, even where informal — a village or cooperative attestation is often what actually exists at farm level.
6. Confirmation of no known deforestation or degradation after 31 December 2020.

Send this well before you need it against a live shipment. National traceability programmes in Ghana and Côte d'Ivoire are being built out at different speeds across different regions, and a supplier who cannot answer within a reasonable window is a sourcing decision, not a paperwork one.

Does certification cover this already?

Not on its own. Rainforest Alliance, Fairtrade and company-run programmes such as Cocoa Life or Cocoa Horizons were built around social, environmental and agronomic standards that predate the EUDR, and none was designed to produce Article 9 geolocation or to test a plot against the regulation's specific 31 December 2020 cut-off. Several certifiers and origin programmes have been extending their traceability platforms to capture EUDR-format coordinates, and where that work is genuinely complete for your supply base, it is a real head start on collection. It is not a substitute for the due diligence statement itself, and a certified lot sourced from a standard-risk country still needs its own risk assessment — certification does not change the country's benchmarked tier.

Country risk: why Ghana is the exception

Commission Implementing Regulation (EU) 2025/1093 benchmarks Ghana as low risk — the only major cocoa-producing country currently in that tier. Every other significant origin sits at standard risk; none of the cocoa producers are high risk.

Origin	Share of world supply	Risk tier
Côte d'Ivoire	Largest producer	Standard
Ghana	Second-largest	Low
Indonesia	Major Southeast Asian origin	Standard
Ecuador	Largest fine-flavour origin	Standard
Cameroon	Growing exporter	Standard
Nigeria	Growing exporter	Standard
Brazil	Domestic and export	Standard
Peru	Fine-flavour, smallholder	Standard

The tier matters in two ways. It sets the official check rate — 1% of operators for low risk against 3% for standard — and, for a micro or small primary operator sourcing exclusively from low-risk countries, it unlocks the simplified declaration and postal-code geolocation instead of a per-consignment statement and precise coordinates. A small chocolate maker buying only Ghanaian beans can genuinely use the lighter route. Almost anyone blending Ghanaian cocoa with Ivorian, Ecuadorian or any other standard-risk origin cannot, and needs the full risk assessment and mitigation steps for the whole lot.

The Commission has a first review of this benchmarking due in 2026, so treat the table as current rather than fixed, and confirm a specific origin's tier before relying on it for a live shipment.

Deadlines for cocoa businesses

Cocoa was never covered by the EU Timber Regulation, so the carve-out that pulls small timber and furniture businesses back onto the earlier date does not apply here. A micro or small cocoa operator gets the full extension.

Business	Application date
Large or medium operator or trader	30 December 2026
Micro or small operator or trader	30 June 2027

See which application date applies to your business for how size is worked out under Directive 2013/34/EU. Unlike coffee and palm oil, no cocoa product was newly added to Annex I by the September 2026 delegated act, so there is no separate 30 December 2027 date running against any cocoa line — the exclusion of cocoa waste under CN 1802 is a scope narrowing, not a new date.

Filing in practice

If you are the primary operator, filing means: classify the product by CN code, gather geolocation for every plot behind the consignment, hold the legality and deforestation-free evidence, and submit the due diligence statement through the Information System before the goods are placed on the EU market. How to submit a due diligence statement in TRACES, step by step walks through the submission itself.

If you are downstream, the practical task is smaller but easy to neglect: get the reference number in writing from your supplier for every batch, file it against your own purchase records, and keep it for five years from the date the cocoa was placed on, made available on, or exported from the EU market. A chocolate manufacturer switching between two or three couverture suppliers should expect to be tracking several live reference numbers at once, not one.

Records and penalties

Whatever your role, due diligence records — geolocation, legality evidence, risk assessments where you carried one out, and statement or reference numbers — must be kept for five years. Penalties for non-compliance include fines of at least 4% of EU-wide annual turnover, confiscation of the cocoa or chocolate and any revenue from it, exclusion from public procurement for up to 12 months, and publication of the infringing company's name.

Where to start

Map every cocoa-containing line you sell against its CN code, and be honest about which biscuit or bakery lines are genuinely outside scope under 1905 rather than assumed to be in it. Confirm whether you are the one filing or the one retaining a reference number, and check your bean origins against the current country benchmarking before assuming you need the full risk assessment route. Check what the EUDR requires for your specific cocoa business and get a dated plan counted back from your deadline.