EUDR due diligence for coffee importers: what's actually required in 2026

Regulation (EU) 2023/1115 — the EU Deforestation Regulation, universally shortened to EUDR — has been sitting on coffee importers' compliance roadmaps for two years. What has changed is that the enforcement clock is now close enough to be an operating problem rather than a policy footnote. For a coffee buyer placing product on the EU market, or exporting from it, the question is no longer whether EUDR applies, but whether the paperwork trail from farm plot to import declaration actually holds up. This piece is a working reference: what the regulation requires, how the three-part due-diligence process actually functions, where the enforcement timeline stands as publicly scheduled, and what changes when the lots you buy already carry verification evidence.

None of this is legal advice — see the note near the end — but it is a reasonably complete map of the terrain, written for people who buy and move coffee rather than people who litigate regulations.

What EUDR actually covers

EUDR replaced the older EU Timber Regulation with a broader instrument covering seven commodity groups: cattle, cocoa, coffee, oil palm, rubber, soya, and wood, along with a defined list of derived products (leather, chocolate, palm oil derivatives, furniture, printed paper, and — the one that matters here — roasted and green coffee, coffee extracts, and coffee-based preparations). Coffee sits squarely in scope, and the regulation applies whether the coffee crosses the border green, roasted, or as a processed extract.

The regulation is built around a single, blunt idea: products in these commodity groups may not enter or leave the EU market unless the operator or trader placing them can show, with evidence, that the goods did not contribute to deforestation or forest degradation after a fixed cutoff date, and that they were produced in accordance with the relevant laws of the country of production.

The obligation attaches at two moments: placing a product on the EU market for the first time, and exporting a product from the EU. Both operators (the party doing the placing or exporting) and, further down the chain, traders (parties making the product available on the market once it is already there) carry due-diligence responsibilities, though the depth of what each has to do differs. Larger operators and traders carry the full three-step burden described below; micro and small enterprises can, in some circumstances, rely on the due-diligence statement already filed by an operator earlier in the chain, provided they can produce it on request.

The core obligation, in plain terms

Strip away the legal drafting and the obligation reduces to three conditions that must all be true, and demonstrably true, before a shipment moves:

1. 1Deforestation-free — the coffee was grown on land that was not deforested after 31 December 2020. That date is fixed and is the single most-cited fact in the regulation; it does not move with the enforcement timeline.
2. 2Legally produced — the coffee was grown, harvested, and (where applicable) processed in compliance with the relevant laws of the country of production, covering land use, labor, environmental, and tax obligations, among others.
3. 3Covered by a due-diligence statement — before the product is placed on the EU market or exported from it, the operator must submit a due-diligence statement (DDS) attesting to the above, backed by the underlying evidence.

The regulation does not ask an importer to promise deforestation-free coffee. It asks the importer to prove it, plot by plot, and to keep the proof on file.

What 'legally produced' actually spans

The legality leg of the obligation is broader than it first sounds. It is not limited to environmental permitting — it covers compliance with the country of production's rules across land use and land tenure rights, environmental protection, forest-related rules, third-party rights (including free, prior and informed consent where indigenous peoples are affected), labor and human rights, tax, anti-corruption, trade, and customs regulations. In practice this means the legality evidence file for a coffee lot can end up including land title or use-right documentation, cooperative or farm registration records, and labor compliance attestations, not just a deforestation check.

The three-step due-diligence process

EUDR due diligence is not a single filing — it is a process with three distinct steps, each of which produces the evidence the next step depends on. Operators (and, further down the chain, traders) are expected to be able to walk through all three on request.

1. Information collection

This is the step that determines whether everything downstream is even possible. For each lot, the operator needs to collect and retain:

• Geolocation coordinates of every plot of land where the coffee was produced — for larger plots, polygon boundaries; for smaller plots, point coordinates are generally accepted, but the plot-level granularity itself is non-negotiable.
• A description of the product and the quantity involved.
• The name, address, and contact details of the supplier or operator who produced or supplied the coffee.
• The country and, where relevant, the region of production.
• Documentation supporting legal compliance in the country of production (land rights, permits, labor and environmental records, as applicable).
• Evidence of adequate control against the risk of non-compliant coffee entering the supply chain, when working through intermediaries.

Geolocation is the single hardest requirement to retrofit after the fact. A container of green coffee that has already been consolidated, blended across smallholder lots, and shipped cannot easily be traced back to the individual plots it came from. This is why the information-collection step, in practice, has to happen at origin — at the point of purchase or intake — rather than at the port.

2. Risk assessment

With the information in hand, the operator has to assess the risk that the product is not, in fact, deforestation-free or legally produced. This assessment draws on the collected information, but also on wider factors: the deforestation risk associated with the country or region of production, the prevalence of illegal production or trade in that origin, the complexity of the supply chain, and the reliability of the operator's own information sources. The European Commission's country benchmarking (low, standard, or high risk) feeds into this step, since it affects both the intensity of the review expected and, later, the frequency of customs checks.

3. Risk mitigation

Where the risk assessment does not return a negligible-risk conclusion, the operator has to take mitigating measures before the product can be placed on the market: requesting further information or documentation, commissioning independent surveys or audits, or engaging directly with suppliers to close specific gaps. Only once residual risk is negligible can the operator proceed to file the due-diligence statement.

In practice, mitigation for a coffee lot tends to mean one of a small number of concrete actions: cross-referencing submitted plot coordinates against satellite deforestation-monitoring data to confirm no forest loss occurred on that parcel after the cutoff date, requesting additional documentation from a cooperative or exporter where a supplier's paperwork is incomplete, or commissioning a third-party field verification where remote evidence alone is inconclusive. None of these steps are novel — commodity trading desks in cocoa and palm oil have been running comparable geolocation-and-satellite checks for several years — but coffee's smallholder-heavy, cooperative-mediated structure means the volume of individual plots requiring this treatment is often far larger than in more consolidated commodity chains.

Filing: the EU Information System (TRACES)

Due-diligence statements are submitted electronically through the EU's Information System, built on the existing TRACES platform (the same system historically used for sanitary and phytosanitary certification). Each DDS receives a reference number, which then has to accompany the shipment through customs and, in downstream trade, can be referenced by the next operator in the chain rather than re-collected from scratch — provided the underlying due diligence still holds. This referencing mechanism is the intended efficiency gain of the system: a well-documented lot should only need its full due-diligence workup done once, near the point of origin, not re-litigated at every hand-off.

How compliance is actually checked

Due diligence is not a one-time filing that then goes unexamined. Member state competent authorities are required to carry out checks on operators and traders, and the intensity of that checking scales with the risk classification of the country or region of production: a materially higher share of operators sourcing from high-risk countries are checked each year than those sourcing from standard- or low-risk countries. This is one of the reasons the Commission's country benchmarking matters beyond the risk-assessment step — it also determines how likely a given shipment is to be examined at all.

The regulation also creates a formal channel for third parties — including civil society organizations and NGOs — to submit a substantiated concern to a competent authority when they believe a specific operator's due-diligence statement does not hold up. A substantiated concern obliges the authority to assess it and can trigger a targeted review of the operator's evidence file. Combined with the risk-tiered check rates, this means the due-diligence file behind a DDS should be built to survive scrutiny initiated from outside the transaction, not only an internal audit.

Penalties for non-compliance are set at the member-state level but the regulation requires them to be effective, proportionate, and dissuasive, scaled to the environmental damage and the value of the goods involved. Publicly available summaries of the regulation describe measures that can include fines, confiscation of the non-compliant goods, confiscation of the revenues from the transaction, temporary exclusion from public procurement and EU funding, and temporary prohibition from placing further relevant products on the market. The exact fine schedules differ by member state and are set through national implementing legislation, so an importer should check the rules of the specific member state where goods are placed on the market rather than assume a single EU-wide figure.

The enforcement timeline: where things actually stand

The compliance start date has moved once already, and it is worth being precise about the sequence rather than working from an old headline. EUDR was originally set to apply from the end of 2024. Following pushback from trading partners, industry, and several EU member states over readiness — particularly around the Information System and geolocation data collection at the smallholder level — the European Commission proposed and the co-legislators adopted a roughly twelve-month delay.

As publicly scheduled at the time of writing, the revised application dates are: large and medium operators and traders from 30 December 2025, and micro and small enterprises from 30 June 2026. That gives smaller importers and roasters a narrower but real runway relative to larger trading houses, not an exemption. Given that this timeline has already shifted once, importers should treat these dates as the current schedule rather than a permanent fixture, and confirm the live status through the EU Information System or their compliance counsel before treating any date as final.

Whichever exact date applies to a given operator's size band, the practical planning horizon is the same: the evidence chain for a shipment has to exist before the shipment moves, and that evidence chain starts at origin, months before the boat leaves port. Waiting until the quarter before an operator's applicable date to start collecting plot geolocation data is, for most supply chains, already too late.

What this means for a coffee importer, practically

Of the three due-diligence steps, information collection is where nearly all of the operational cost sits. Risk assessment and mitigation are analytical and documentary work that a compliance team can do once the underlying data exists. But if a lot arrives without plot-level geolocation, or without a clean chain of supplier identity back to the farm gate, no amount of downstream analysis manufactures that data. It either exists or it does not.

This is the structural reason sourcing decisions and compliance exposure have become the same decision for many buyers. A lot that already carries geolocation coordinates, supplier identity, and supporting documentation at the point of purchase front-loads pillar one of due diligence before the importer ever touches it. That, in turn, narrows what the risk assessment in pillar two actually has to evaluate — the open question shifts from "do we have any evidence at all" to "does the existing evidence clear the bar," which is a materially easier position to work from.

Coffee's supply structure makes this harder than it is for a single-estate commodity. A large share of specialty and mainstream coffee alike passes through cooperatives, washing stations, or aggregators that pool cherry or parchment from many smallholder plots before it is milled and exported. Under a segregated model, each contributing plot's geolocation has to be captured and carried through to the export lot without being lost in the blend. Under a mass-balance model, volumes are tracked in aggregate rather than plot-by-plot, which is operationally simpler but produces a weaker evidentiary link between a specific bag and a specific verified plot. Buyers evaluating a supplier relationship should ask, explicitly, which model is in use — the answer changes what a due-diligence file for that lot can actually prove.

• Push the geolocation and supplier-identity capture back to the point of purchase at origin, not the point of export.
• Treat country- and region-level risk classification as an input to sourcing decisions, not just a compliance afterthought.
• Keep the documentary trail — legality evidence, supplier records, any independent verification — attached to the lot, not filed separately from it.
• Build the DDS reference-number workflow into procurement systems now, ahead of the applicable date, rather than treating it as a customs-desk problem to solve later.

How verified-lot sourcing fits into this

This is the specific place where a sourcing platform can reduce real work rather than add a marketing layer on top of it. On a verified marketplace, each lot listing can carry an EUDR compliance tier, derived from the underlying verification performed on that batch — the geolocation, supplier, and legality evidence collected at intake — rather than asserted after the fact. That tier tells a buyer, at a glance, roughly how much of the information-collection step is already done for a given lot, before an RFQ is ever sent.

Alongside the compliance tier, listings typically carry relevant certifications and a coarse origin region (rather than an exact farm location, for reasons covered below). Where an AI trust vouch is present, it is worth being precise about what it is: a plain-language summary, generated by Claude (Anthropic), of the underlying evidence on file for that lot — the EUDR documentation, any certificate of analysis, and cupping records — with citations back to what it actually read. It is a summary of existing evidence, not an independent certification and not a substitute for an operator's own risk assessment.

The same honesty applies to pricing. A fair-price band shown against a lot is an AI estimate — a range generated from available market and lot data, labeled as such — not a live market quote and not a broker's bid. Buyers should treat it as a starting reference for negotiation, not a transaction price.

Verification at origin does not replace an importer's due diligence obligation. It supplies the evidence that due diligence is built on.

One deliberate design choice worth flagging: producer identity on these platforms is typically anonymized until an RFQ is accepted. That protects smallholder producers from being disintermediated or undercut once identified, while still giving a buyer the region, certification, and verification-tier information needed to make a sourcing decision and start the compliance process. Full supplier identity — the detail the DDS ultimately requires — becomes available once the transaction is underway.

A short checklist for the next twelve months

The gap between "aware of EUDR" and "operationally ready for EUDR" is almost entirely a data-collection gap, and data collection at origin takes a full harvest cycle or more to do properly — it cannot be compressed into the weeks before an applicable date. The following is a reasonable order of operations for a coffee importer working backward from either 30 December 2025 or 30 June 2026, depending on enterprise size, as currently scheduled.

• Confirm which applicable date (large/medium vs. micro/small enterprise) governs your organization, and treat that date as the internal deadline, not the public one.
• Audit current suppliers for plot-level geolocation coverage today, not at the applicable date.
• Prioritize origins and lots that already carry verification evidence when geolocation gaps exist in the existing supply base.
• Build the DDS/TRACES reference-number step into procurement workflow, so it is routine by the time it is mandatory.
• Revisit country risk classifications periodically — they are not static, and sourcing decisions should track them.

This article is general information for coffee importers and buyers, not legal advice. EUDR implementation details, timelines, and guidance continue to evolve; confirm current requirements with your own compliance counsel and the EU Information System before relying on any date or procedure described here.

For importers building out a compliant supply base now, browsing verified lots with their compliance tiers and underlying evidence attached is a reasonable place to start narrowing the sourcing list.