Socious Report
Socious Work
Socious VerifyThe EUDR Deadline Moved. The Cut-Off Date Did Not.
On 19 December 2025 the European Parliament and Council adopted Regulation (EU) 2025/2650, “amending Regulation (EU) 2023/1115 as regards certain obligations of operators and traders.” It was published in the Official Journal on 23 December 2025 (EUR-Lex).
The headline was a delay. The EU Deforestation Regulation now applies from 30 December 2026 for large and medium operators, and from 30 June 2027 for natural persons and micro and small undertakings (European Commission). The Commission’s own recital gives the reason plainly: the twelve-month postponement was “necessary in order to allow third countries, Member States, operators and traders to be fully prepared.”
Most companies read that as a year back. It is worth checking what actually moved.
The date that did not move
EUDR turns on one fixed point. A product is “deforestation-free” only if the commodity in it “was produced on land that has not been subject to deforestation after 31 December, 2020” — and, for wood, harvested “without inducing forest degradation after 31 December, 2020” (Regulation (EU) 2023/1115, Article 2(13)).
The string “31 December 2020” does not appear anywhere in the amending regulation. The cut-off is untouched.
That has a consequence nobody put in a press release. The obligation is to prove a negative across the whole window between the cut-off and the moment you place the product on the market. Push the application date out by a year and the window gets a year longer. A supplier relationship that began in 2023 now needs land-status evidence reaching back three years before it started, and the delay added twelve months to the far end, not the near one.
So the year is not free. It is a year of records you will be asked about.
What the statement actually asks for
The mechanism is Article 4: an operator may not place a relevant product on the market “without prior submission of a due diligence statement,” and by submitting it “the operator shall assume responsibility for the compliance of the relevant product.”
Article 9 sets out what has to sit behind that signature. Operators collect and keep for five years, per product: a description including species name for wood, the quantity, the country of production, and “the geolocation of all plots of land where the relevant commodities that the relevant product contains, or has been made using, were produced, as well as the date or time range of production.”
Geolocation is defined tightly. Latitude and longitude “using at least six decimal digits,” and for plots over four hectares — everything except cattle — “polygons with sufficient latitude and longitude points to describe the perimeter of each plot of land” (Article 2(28)).
Six decimal places is roughly a tenth of a metre. This is not a supplier questionnaire. It is a land registry, assembled from your suppliers’ suppliers, for seven commodities: cattle, cocoa, coffee, oil palm, rubber, soya and wood, plus the products made from them — leather, chocolate, tyres, furniture.
What the simplification actually simplified
The December 2025 amendment is not cosmetic, and it is worth being precise about what it did.
It created a new category, the “downstream operator” — someone who places on the market products “made using relevant products, all of which are covered by a due diligence statement or by a simplified declaration” (new Article 2(15b)). Downstream operators no longer file their own statements. They collect and retain the reference number of the original one. The responsibility for the statement now sits with the operator who first places the product on the EU market.
If you are a European manufacturer buying already-compliant inputs, that is a real reduction in filings. If you are the first operator — the importer, the trader bringing the commodity in — nothing about your evidentiary burden changed. It concentrated on you.
Read your position in that chain before deciding the amendment helped.
Low risk is a workload, not an exemption
On 22 May 2025 the Commission adopted Implementing Regulation (EU) 2025/1093, the country benchmarking system (EUR-Lex). Four countries are classified high risk: Belarus, the Democratic People’s Republic of Korea, Myanmar and the Russian Federation. A long list is low risk — Japan is on it. Everything unlisted defaults to standard.
Low risk means simplified due diligence under Article 13: an operator sourcing entirely from low-risk countries is not required to perform the risk assessment and mitigation steps of Articles 10 and 11.
Two things are easy to miss.
First, the relief is conditional on an assessment you still have to do. Article 13 grants it only “after having assessed the complexity of the relevant supply chain and the risk of circumvention of this Regulation or the risk of mixing with products of unknown origin or origin in high-risk or standard-risk countries.” You have to be able to show that assessment on request. The information requirements of Article 9 — geolocation included — are not among the articles waived.
Second, it is revocable in two directions. Article 13(2) snaps the full obligations back the moment an operator “obtains or is made aware of any relevant information” pointing to a risk. And Article 25 lists “prohibition from exercising the simplified due diligence set out in Article 13” as a penalty for serious or repeated infringement. Simplified due diligence is a privilege the regulation can withdraw.
The number at the end
Article 25(2)(a) requires Member States to set fines “proportionate to the environmental damage and the value of the relevant commodities or relevant products concerned,” and specifies that for a legal person “the maximum amount of such a fine shall be at least 4 % of the operator’s or trader’s total annual Union-wide turnover in the financial year preceding the fining decision,” increased where necessary “to exceed the potential economic benefit gained.”
Alongside the fine: confiscation of the products and of the revenue from them, exclusion from public procurement for up to twelve months, and — for serious or repeated breaches — a temporary ban on placing the products on the market at all.
That last one is the one to brief the board on. EUDR is not a disclosure regime with a reporting penalty attached. Article 4(4) says an operator shall not place products on the market where due diligence “has revealed a non-negligible risk that the relevant products are non-compliant.” The failure mode is not a qualified opinion in your annual report. It is goods that cannot enter.
Why this lands on the reporting team
EUDR sits outside the sustainability statement. It is enforced by customs and competent authorities, not by an auditor, and nothing in it is an ESRS datapoint.
But look at what it forces a company to hold: a verified list of suppliers, the commodity each one supplies, the country and the plot it came from, the date it was produced, and the volume — kept for five years and traceable to source. That is the same substrate that sits under the value-chain questions in ESRS E4 on biodiversity and ecosystems, under supply-chain due diligence, under Scope 3 emissions, and under CBAM’s embedded-emissions declarations for the goods it covers.
Four regimes, four filing calendars, four sets of competent authorities — and largely one underlying question: who supplied what, from where, when, and how much.
Companies that answer that question four times, in four spreadsheets, on four deadlines, will spend the next three years doing the same work repeatedly and reconciling the versions afterwards. Companies that answer it once, structured, will file four times from one dataset.
Three things worth checking before December
Where you sit in the chain. First operator or downstream operator is now a legal distinction, not a commercial one. It decides whether you file statements or collect reference numbers.
Whether your supplier records carry origin at plot level. Not country. Not region. Coordinates, to six decimals, with polygons above four hectares — and a production date. Most procurement systems hold neither field, and the gap is usually two tiers upstream, where nobody has your phone number.
What your evidence looks like back to 2020. The cut-off is fixed and the window keeps growing. If your answer for a given plot is “our supplier confirmed it,” ask what that confirmation is evidence of, and whether it would survive a competent authority asking to see the underlying data.
Where Socious Report fits
Socious Report takes the mechanical half of this. Ingest supplier and origin data once, and the platform drafts audit-ready disclosures against CSRD, SSBJ and ISSB from that single dataset, with every figure traceable back to its source. The judgment — which suppliers you keep, what risk you are willing to carry, when to walk away from an origin you cannot verify — stays with the people who should be making it.
If you want a starting point, the free CSRD readiness check scores seven dimensions in about three minutes. It will not tell you whether your cocoa is deforestation-free. It will tell you whether the supplier data foundation underneath that question exists yet.