EUDR compliance checklist for SMEs with no compliance team

If you have no compliance function, EUDR comes down to seven tasks done once per product line: confirm your role and size band, confirm your deadline, check your product against Annex I, build a due diligence file, assess risk unless you're exempt from it, file in TRACES, and keep everything for five years. None of it requires specialist software to start — a spreadsheet and the supplier's cooperation will get a small business through it.

Step 1: Work out whether you're an operator or a trader

This decides almost everything else, so get it right first. You are an operator if you place a relevant product on the EU market for the first time, or export it from the EU — you grew it, manufactured it, or you are the importer of record. You are a trader if you make an already-placed product available on the market further down the chain — a distributor, wholesaler or retailer buying from someone inside the EU who has already filed.

Following the amendment in Regulation (EU) 2025/2650, most downstream traders no longer file a due diligence statement at all — they only have to record who supplied them and which due diligence statement reference number travels with the product. Do downstream operators and traders still need an EUDR due diligence statement? sets out exactly who this applies to, because getting operator/trader status wrong is the single most common reason small businesses either over-comply or miss a real obligation.

Then work out your size band under Directive 2013/34/EU: micro is no more than 10 staff, €900,000 turnover and a €450,000 balance sheet; small goes up to 50 staff, €10 million turnover and a €5 million balance sheet. Exceed two of the three criteria and you move up a band — and if you sit inside a corporate group, the group's consolidated figures can push a standalone small business into the large category for this purpose.

Step 2: Confirm your actual deadline

There are three dates, not one, and which applies to you depends on size and product, not on when you'd prefer to start:

Deadline	Who it applies to
30 December 2026	Large and medium operators and traders; also micro and small operators whose products were already covered by the EU Timber Regulation
30 June 2027	Micro and small operators and traders, for products that were not already covered by the Timber Regulation
30 December 2027	Any operator or trader, of any size, for products newly added to Annex I by Delegated Regulation (EU) 2026/2102

The trap for small businesses is the Timber Regulation carve-out. If you import or sell timber, sawn wood, panels, plywood, pulp, paper or wooden furniture — anything already caught by the old EU Timber Regulation — your size buys you nothing. You are on the 30 December 2026 date regardless of headcount. EUDR deadline 2026: which application date applies to you walks through the full logic, and EUDR for furniture and timber importers after the Timber Regulation repeal covers the timber-specific version of this trap in detail.

Step 3: Check your product against Annex I — including what changed in 2026

EUDR covers seven commodities — cattle, cocoa, coffee, oil palm, rubber, soya and wood — plus listed derived products: items like chocolate, furniture, printed paper, tyres and processed leather that contain or were made using one of the seven. Delegated Regulation (EU) 2026/2102, in force since 18 September 2026, revised this list: it adds soluble coffee, frozen cattle tongues and certain palm-oil-based oleochemicals and soap products, which become subject to EUDR from 30 December 2027, and it removes cattle leather and vulcanised rubber articles such as conveyor belts, which are no longer in scope.

If your product sits anywhere near this boundary — a palm-derivative ingredient, a leather component, a rubber part — do not assume last year's scope list still holds. EUDR Annex I changes 2026: what's in and out under Delegated Regulation (EU) 2026/2102 has the current list.

Step 4: Build a due diligence file for each product line

For every relevant product you place on the market, you need to be able to show:

• What the product is and its CN code.
• The quantity.
• The country, and the geolocation of every plot of land where the relevant commodity was produced — polygons for plots over 4 hectares, a single point for smaller ones.
• Proof the product was produced on land that was not deforested or degraded after 31 December 2020.
• Proof it was produced in compliance with the relevant laws of the country of production — land use, labour, human rights, tax, and more.

This is the step that actually takes the time, because it depends on your suppliers producing the geolocation data in the first place. Start collecting it now rather than at the deadline, because a supplier who has never been asked for plot coordinates before will not produce them overnight. EUDR geolocation requirements: polygons, points and the 4-hectare rule explains the format competent authorities expect.

Step 5: Work out if you can skip the risk assessment

By default you must assess and, where needed, mitigate the risk that your product is non-compliant — analysing deforestation rates, forest presence, land tenure, corruption indicators and supply chain complexity for each country of production, and documenting the conclusion.

You can skip this step under Article 13 if every country your product comes from is benchmarked low risk. Check the current list before assuming you qualify — benchmarking is reviewed and a country can move tier. EUDR country benchmarking explained: low, standard and high risk has the mechanics. If you are a micro or small primary producer sourcing only from low-risk countries, you may also qualify for the simplified declaration under Article 4a, which lets you give a postal address instead of precise coordinates and file once rather than per shipment — EUDR micro and small operator simplifications: what you actually get sets out who actually qualifies, because the three available simplifications apply independently and most small businesses assume being small gets them all three automatically.

Step 6: File in TRACES

Operators who are not exempt file a due diligence statement in the EU Information System, built on TRACES NT, before the product is placed on the market. The filing records the information above and generates a reference number that has to travel with the product through the supply chain — this is what a downstream trader records instead of filing their own statement. How to submit an EUDR due diligence statement in TRACES, step by step covers the mechanics of the system itself, including the account setup that is worth doing well before your deadline rather than in the final week.

Step 7: Keep everything for five years

Whatever your role, whatever simplification you qualify for, the records behind your due diligence statement — geolocation data, supplier information, risk assessment conclusions, the statement itself — have to be kept for at least five years from the date the product was placed on the market, and produced to a competent authority on request. This obligation does not shrink for small businesses; it is identical regardless of size.

What this checklist looks like end to end

Task	Applies to	When to start
Confirm operator or trader status	Everyone	Now
Confirm size band and deadline	Everyone	Now
Check product against current Annex I	Everyone	Now, and again if your product range changes
Request geolocation data from suppliers	Operators	As early as possible — this is the slowest step
Confirm country risk tier	Operators and traders claiming simplified due diligence	Before filing
Complete risk assessment, unless exempt	Operators not using simplified due diligence	Before your deadline
File due diligence statement or simplified declaration	Operators, and traders not covered by the 2025 downstream exemption	By your deadline, before placing the product on the market
Record supplier details and DDS reference numbers	Downstream traders	By your deadline
Retain all records	Everyone	Ongoing, 5 years minimum per product

What non-compliance actually costs

This is not a paperwork exercise with a nominal fine attached. Penalties under EUDR include fines calculated as a percentage of annual EU turnover, confiscation of the product and of revenues from any non-compliant transaction, and temporary exclusion from public procurement and EU funding. EUDR penalties: what non-compliance actually costs sets out the figures member states have actually legislated. For a small business, the turnover-based fine and the reputational cost of a public finding of non-compliance are usually the bigger risk than the headline figure.

Where to start if you haven't started at all

The order above matters because each step depends on the one before it — there is no point building a risk assessment before you know whether you are even in scope, and no point requesting geolocation data before you know which of your products are covered. Run the free checker to get your actual deadline, your role, and the specific obligations that apply to your business, rather than working through a generic checklist against your own guesswork.

FAQ

Do I need compliance software to meet EUDR as a small business? No. The regulation does not require any particular tool. A due diligence file can be a structured spreadsheet and a shared drive of supplier documents, provided it holds everything a competent authority would ask for and you can retrieve it within the filing and retention requirements.

What's the single biggest reason small businesses run out of time? Waiting to ask suppliers for geolocation data. Collecting plot-level coordinates from growers who have never been asked for them, especially across multiple tiers of a supply chain, is the slowest part of the whole process and the one least within your direct control.

Do I need a dedicated compliance person to do this? No size threshold requires one. Many micro and small operators handle this within an existing operations or procurement role, particularly once the initial due diligence file for each product line is built and only needs updating.

If I only sell a product that someone else already placed on the EU market, do I still need to do all of this? No. Most downstream traders record supplier details and the due diligence statement reference number rather than carrying out their own due diligence. Confirm you're genuinely a trader and not an operator first, since getting that distinction wrong in either direction creates a real compliance gap.

Does the checklist change if I qualify for a simplification? Yes, in scope rather than substance. Qualifying for simplified due diligence removes the risk assessment step; qualifying for the simplified declaration changes how and how often you file. Record-keeping and the underlying product and geolocation information are still required either way.

How do I know if my product is even covered by EUDR? Check it against the current Annex I list, not an older version — the product scope changed in September 2026 and will change again for products added by delegated act. If your product or its ingredients touch cattle, cocoa, coffee, oil palm, rubber, soya or wood, check specifically rather than assuming.

What happens if a supplier won't give me geolocation data? You cannot file a valid due diligence statement without it, and placing the product on the market without one is the compliance failure that carries penalties. This is a sourcing decision as much as a compliance one — some businesses have to move suppliers rather than accept the risk.

Is there a size below which none of this applies? No. There is no turnover or headcount threshold that removes the obligation entirely. The simplifications reduce how much has to be done and when, not whether anything has to be done at all.