Are Companies Ready for EUDR Enforcement? Dry Run Insights

Introduction

With the EU Regulation on Deforestation-Free Products (EUDR) set to enter into application on 30 December 2026, the focus is rapidly shifting from the question of what the EUDR requires to the far more consequential question of how competent authorities will actually enforce it. This Legal Update draws on the most recent practical information available on the approaches to EUDR checks developed by German, Belgian, Dutch, and French Competent Authorities as presented in recent reports on EUDR dry runs. It distils practical takeaways for operators seeking to be compliant and inspection-ready by December 2026. Read together with the EUTR¹ enforcement practices, this information paints a concrete picture of the enforcement landscape ahead.

Recent Sneak Peeks into Future Enforcement

In the context of substantial changes to the EUDR FAQs and the Guidance introduced by the Commission via the Simplification Package released on 4 May 2026, it was easy to overlook a reference to a telling report, Due Diligence in Practice: Insights from EUDR preparedness exercise in the coffee sector (part 1 published in November 2025 and part 2 published in February 2026), concerning September 2025 EUDR dry runs conducted with the participation of Belgian, French, German and Dutch Competent Authorities and facilitated by the European Forest Institute (EFI). Together, these reports offer a sneak peek at what information, data, and documentation are likely to be requested by the Competent Authorities during the checks and thus could be used as practical guidance for fine-tuning the due diligence systems of operators importing relevant products.

Another telling glimpse at what is expected of operators comes from the Useful Insights from Pilot Inspections for the EUDR,² released in August 2025 by the Netherlands Food and Consumer Product Safety Authority (NVWA), the Dutch Competent Authority, following pilot inspections involving 20 operators across various sectors. While less granular than the EFI reports, this document lists the main shortcomings of due diligence systems flagged by the NVWA during these inspections.

Operators that could be subject to checks by the German Competent Authority, the Federal Office for Agriculture and Food (BLE), should also familiarise themselves with information on BLE's service portal for conducting EUDR checks, as well as with information on deficiencies identified by BLE during dry runs that has been shared at various EUDR events.³

These recent developments offer an invaluable—and, in places, unvarnished—preview of enforcement in practice, and are well worth delving into.

On the Radar: Key Requests from Competent Authorities

The listing below highlights information, documents, and data that have been requested by Competent Authorities during inspections, based on the dry run exercises. Competent Authorities expect such information, documents, and data to be readily available for inspection and, in the case of the German Competent Authority, for upload via BLE's Service Portal.

Due Diligence System

• Documents establishing a functioning due diligence system (SOP, protocol, policy tailored to the operator's supply chain) and, inter alia:
  • Embedding methodology(ies) used by the operator to determine compliance of the relevant products with (i) deforestation-free and (ii) legality requirements;
  • Setting up a framework for documenting due diligence exercised;
  • Detailing traceability protocols used throughout the operator's supply chain(s);
  • Specifying procedure(s) employed by the operator throughout the entire supply chain(s) to ensure no or only negligible risk of circumvention or of mixing with non-compliant relevant products or those with origin in high-risk or standard-risk countries;
  • Containing clear attribution of functions and responsibilities in the operator's hierarchy;
  • Integrated into business operations of the operator, including procurement and supplier approval/onboarding process; and
  • Encompassing monitoring of plots of land (automated deforestation alerts for the sourcing areas) after onboarding.

  In plainer terms, Competent Authorities expect the due diligence SOP to demonstrate that due diligence is not a one-time exercise, but a continuous, living process embedded into day-to-day operations—one that allows the operator to determine, for each quantity (individual shipment) of every relevant product to be covered by a DDS and placed on the Union market, whether it complies with the EUDR.

  During the checks, the Competent Authorities will review in detail how the operator has used its due diligence system for one or a few particular shipments covered by relevant DDS(s).

Use of Due Diligence System for a certain quantity (individual shipment) of the relevant product placed on the Union market and covered by a particular DDS

• Plot/smallholder/forester/farm/estate/cooperative-level "adequately conclusive and verifiable" evidence directly relevant to the individual shipment of the relevant product demonstrating its compliance with the EUDR's (i) deforestation-free and (ii) legality requirements;
• Evidence of segregation and of no risk of circumvention, or of mixing with non-compliant relevant products, or those originating in high-risk or standard-risk countries at each junction (such as aggregation, processing, storage, and transportation) of the supply chain, which could be achieved via (a) detailed supply chain map accounting for each and every intermediary and evidence of segregation practices throughout the supply chain, and/or (b) chain of custody certification supported by an explanation of how it operates and what controls are put in place against risks of mixing with non-certified products;
• Clearly documented exercise of due diligence for a specific quantity (individual shipment) of the relevant product covered by a particular DDS using operator's Due Diligence System, with records detailing inter alia:
  • How compliance with the deforestation-free requirement was established, which datasets and methodologies were used;
  • How the operator established no or only negligible risk of mixing with non-compliant relevant products or those with origin in high-risk or standard-risk countries;
  • How initial examination of publicly available information was carried out to determine whether sourcing area is at a higher risk of non-compliance with the legality requirement and conclusions reached using a risk-proportionate approach;
  • Which plot/smallholder/forester/farm/estate/cooperative-level "adequately conclusive and verifiable" information, data and documentation was collected and how it supports compliance with the legality requirement;
  • How documentation, data and information was verified;
  • Where applicable, how risk assessment (on the level of both the country and the sourcing region) was carried out, on which information it was based, and which conclusions were reached;
  • Where applicable, how risk mitigation was carried out and which conclusions were reached; and
  • Conclusions of the due diligence exercise.

  To put it simply, during an inspection, Competent Authorities will require operators to produce a complete "paper trail" showing that due diligence was actually exercised, and reflecting the process that led to the operator's conclusion on compliance of a specific quantity (individual shipment) of the relevant product with the deforestation-free and legality requirements. As one Competent Authority put it during the dry runs, "operators cannot hide behind a general DD-System; they are expected to provide evidence directly relevant to the specific shipments selected for inspection".⁴

  A word of caution on the risk-proportionate approach: in the updated Guidance released on 4 May 2026, the Commission validated a risk-proportionate approach to collection of "adequately conclusive and verifiable" information supporting compliance with the legality requirement (and thus, to due diligence regarding legality), suggesting that a two-step process akin to triage could be used: (a) initial examination of the publicly available information to determine risk of non-compliance with the legality requirement and (b) depending on the level of risk identified, either in-depth evidence collection (where risk is considered non-negligible) or reliance on the conclusions of the initial examination (where risk is considered negligible). While availability of the risk-proportionate approach is of immense help to operators, especially those dealing with non-certified products, those whose supply base is constantly shifting and/or composed of smallholders, it requires thoughtful application. When carrying out initial examination under this approach, operators should carefully review publicly available information to determine which legality indicators it covers (land-use and tenure rights, environmental and forestry legislation, labour and human rights, including FPIC, tax, anti-corruption, trade and customs regulations) and for which of them it allows to draw a reasoned conclusion on "assumed" compliance. More to the point, in their initial examination, operators can't rely solely on the Commission's country risk classification per Implementing Regulation (EU) 2025/1093 because, as stated in the Annex to the Communication from the Commission on the Strategic Framework for International Cooperation Engagement in the context of the EUDR, the Commission's methodology to classify countries as low risk is primarily based on examining deforestation in absolute and relative terms and not legality indicators.

  Beware also that, with regard to geolocations, the Competent Authorities expect the operators, inter alia, to be able to provide information on:

  • Methods used to collect geolocations and to transfer them along the supply chain, tolerance thresholds, data quality and consistency checks performed;
  • False positives identified in any of the datasets analysed (especially, Global Map of Forest Cover 2020) and processes used to resolve them;
  • Yield checks performed and analysis of low or high apparent productivity per plot;
  • Use of non-spatial evidence for complex landscapes (such as agroforestry systems) in cases where reliable plantation or commodity maps are absent;
  • Analysis of proximity of the plots of land to indigenous areas, forest edge, protected areas, watercourses and mitigation of the associated risks; and
  • Use of national deforestation monitoring data, where available.

  Regarding compliance with the legality requirement, the Competent Authorities expect the operators, inter alia, to be aware of and understand the relevant legislation in the country of production and to maintain an overview of its requirements mapped to the EUDR criteria. To help with this task, as announced in the updated Guidance, the Commission will establish a repository of relevant legislation allowing countries of production to provide content on the relevant legislation as per EUDR Article 2(40).

  For data-poor supply chains, such as those involving large numbers of smallholders, operators may resort to use of a risk-based approach to carrying out legality due diligence, prioritizing the areas with the most significant legality concerns: "you don't need an audit on all your farmers, but you are expected to have audits in all risky regions".⁵ In such cases, the Competent Authorities expect operators to document how the risk-based approach was used, and which evidence (proxy information) was collected and analyzed. To illustrate, where documentation for each farmer in a certain sourcing location is absent, data and documentation from the respective cooperatives along with local NGO reports could be used as proxy information.

  Where an operator's due diligence draws on a certification scheme, operators are expected to have assessed relevance and credibility of the certification scheme, including via:

  • Analysis as to which specific requirements of the EUDR are addressed by the relevant principles, criteria or indicators of the certification scheme;
  • Information on how compliance is checked during certification and re-certification process (e.g., via on-the-ground audits by qualified auditors); and
  • Information on the scheme's grievances mechanism and its effectiveness.

  To help with this task, as announced in the updated Guidance, the Commission will establish a repository allowing certification schemes to provide information on their scope.

  Operators are also expected to have documented integration of certification into the due diligence system and assigned to certification a clearly defined role, detailing how it supports collection of information and data, risk assessment, risk mitigation, and/or compliance monitoring. 

  Where an operator's due diligence makes use of online platforms and service providers, operators should have regard to the following:

  • Online platforms and service providers can support due diligence exercised by operators, but can't replace it (no delegation of risk assessment in its entirety); and
  • Conclusions of online platforms and service providers must be documented and supported by a description of analysis they carried out;

  Operators using online platforms and service providers are expected to:

  • Have familiarized themselves with information on datasets, documents and information as well as on methodologies used by online platforms and service providers in their assessments;
  • Understand analysis carried out by the online platforms or service providers to reach their conclusions;
  • Verify evidence used by the online platforms and service providers;
  • Supplement assessments of online platforms and service providers with assessments based on/obtained from additional sources;
  • Document how information provided by online platforms and service providers is used in the due diligence process; and
  • Reach their own conclusion on compliance with deforestation-free and legality requirements.

  Where operators use in their due diligence data/information obtained from national information systems/databases, operators are expected to:

  • Document use of the systems/databases (maintain records reflecting access to the system and information obtained);
  • Have verified data/information obtained with sample documentation and ground checks, especially for countries/regions known for corrupt practices or weak governance and to have documented such verification; and
  • Document how the data/information was used in the due diligence process.

Full Traceability

• During the inspections, the operators will need to produce data or documentation demonstrating a clear link between:
  • The specific quantity of the relevant product (shipment);
  • Geolocations submitted in a DDS; and
  • Evidence supporting compliance with the deforestation-free and legality requirements.

  Stripping this back as far as we can—'putting it simply' would flatter the complexity out of existence—operators importing relevant products must demonstrate:

  • A path of the product from a plot/smallholder/farm/estate/forester to placement under procedure "release for free circulation" using either chain of custody documentation (which is practically impossible in most cases) or an electronic system that allows access to all information relating to the commodities/products through their life cycle (blockchain or similar) (which is not yet widely used); and
  • Documentation, data and information supporting compliance with deforestation-free and legality requirements specific to the respective plots/smallholders/farms/estates/foresters, establishing no risk of mixing with non-compliant relevant products throughout the whole supply chain, and, where applicable, risk assessment and risk mitigation.

Key Takeaways

The EUDR dry runs conducted by Belgian, French, German, and Dutch Competent Authorities have yielded a wealth of practical insights for operators preparing for enforcement.

1. Due diligence is a continuous process, not a one-time exercise. Competent Authorities expect operators to demonstrate a functioning, company-specific Due Diligence System that is embedded into day-to-day business operations—including procurement and supplier onboarding—and that is applied to every quantity of the relevant products to be covered by a DDS and placed on the Union market. A system that exists only on paper, without evidence of consistent practical application, will not satisfy inspectors.
2. Provide detailed evidence, not summaries. Competent Authorities will not accept outcome statements or executive summaries as proof of compliance. They expect to see all the underlying information that was used to reach the operator's conclusion and documented analysis of this information. As one authority put it: "Don't worry about sending us lots of information — that's actually what we expect. We don't care about getting too much information, we care if information is lacking".⁶
3. To prove compliance during inspections, operators cannot rely on a general Due Diligence System alone; they must link documented exercise of due diligence to the specific shipments under inspection. For each such shipment, operators must demonstrate traceability from the geolocated plots to the product entering the European Union, the evidence supporting compliance with deforestation-free and legality requirements, evidence supporting mixing risk management, as well as relevant assessments (including, where applicable, risk assessment and risk mitigation) and conclusions reached.
4. Legality due diligence requires understanding the laws of the country of production. Operators must maintain an overview of relevant legislation in each country of production, mapped to the EUDR's legality criteria.
5. Operators drawing on certification in their due diligence process must assess its alignment with the EUDR and robustness and document the assessment. Competent Authorities expect a clear explanation of the role certification plays within the operator's Due Diligence System.
6. Due diligence as a whole, or risk assessment in its entirety, cannot be delegated to third-party service providers or online platforms. Use of the online platforms and service providers must be integrated into operator's due diligence. Operators are expected to understand and be able to explain the data and methodologies used by the service providers. The conclusions and analysis of third-party assessments must be documented and supplemented with the operator's own assessment.
7. The use of risk-proportionate approach to the collection of "adequately conclusive and verifiable" information supporting compliance with the legality requirement and to legality due diligence requires careful documentation. While the Commission's updated Guidance validates a risk-proportionate approach, its use must be substantiated.
8. Data-poor environment of smallholder supply chains is not an excuse for not exercising due diligence. Operators dealing with such environments may resort to using proxy information, data and documentation in their due diligence.

Conclusion

The information from the recent dry runs leaves little room for doubt: EUDR enforcement will be substantive, evidence-based and risk-focused. Competent Authorities have demonstrated both the willingness and the technical capacity to dig deep into operators' due diligence systems and their application to specific shipments. The bar is high—and it is not enough to have a robust system on paper if it cannot be shown to work in practice.

Operators should use these dry run insights to stress-test their own due diligence systems, fill gaps, and ensure that exercise of due diligence is well documented and compliance with deforestation-free and legality requirements is supported by robust evidence. The time to prepare is now.