The EUDR poses enormous challenges for many companies throughout the supply chain. Despite ongoing criticism, the EU Commission is sticking to its implementation date of the end of this year. Improvements are needed.

By Dr. Michael Lendle, Theresa Usler und Philipp Scha

Regardless, affected companies will have to adapt their risk management and data management to the legal requirements. Hardly any other topic is currently being discussed as controversially in business and politics as ESG compliance. In addition to crises such as rising commodity prices and scarcity of raw materials, regulatory requirements for social and environmental compliance pose enormous challenges to companies at all stages of the supply chain. The basis for this is the EU Commission's flagship, the European Green Deal, as a comprehensive concept of directives and regulations, including the EU Supply Chain Directive (CSDDD) and the Ecodesign Regulation (ESPR). The goal of becoming the first climate neutral continent by 2050 requires a special focus on climate protection measures and the reduction of CO2 emissions. Agriculture is responsible for about 90 % of global deforestation. Between 1990 and 2020, more than 400 Mio. ha of forest will be cleared worldwide, and the EU is responsible for around 10 % of global deforestation.

To combat deforestation and biodiversity loss, the EU adopted the European Deforestation Regulation (EUDR) in May 2023 after relatively quiet negotiations. As of December 30, 2024, the EUDR will apply to medium and large companies that import, trade or export the relevant raw materials - cocoa, coffee, oil palm, cattle, soy, rubber and timber - and certain products made from them to the EU market. For small and micro companies (≤ 50 employees), the rules will apply from June 30, 2025. This includes the collection of information, data and documentation, the performance of a risk assessment and the adoption of risk mitigation measures. Once the due diligence obligations have been met, a due diligence declaration for each batch must be submitted and uploaded to the EU's centralized information system. This generates a reference number that companies must pass along the supply chain. Failure to comply with these requirements and non-compliance can result in severe penalties, such as disgorgement of profits or withdrawal of non-compliant products from the market. In addition, the EU Commission will publish the names of companies with specific violations on its website, which can lead to reputational damage. Given the risky and relevant nature of both cocoa and oil palm raw materials and products, which tend to be sourced from countries in the Global South and are a key ingredient in many recipes, this industry is particularly affected by the EUDR. The question arises as to how these comprehensive due diligence obligations can be implemented in practice.

As a first step, companies should determine their specific impact based on their products, their own market position, and the potential risks and issues at the upstream stages. The EUDR defines operators and traders with different due diligence obligations. If a due diligence declaration with a reference number is not yet available for a purchased raw material, the relevant information must be obtained from the supplier. The provision of geolocation data is particularly important. In the case of a cocoa processing company (= operator), the geolocation data with 6-digit longitude and latitude coordinates of all plots of land on which the cocoa beans were grown must be provided for each batch of imported cocoa in accordance with the EUDR. If this data is used to determine deforestation after the cut-off date of December 31, 2020, the raw material will not be considered deforestation-free and therefore not marketable on the European market. The challenge is to determine the exact origin of the cocoa and to enable cocoa farmers to provide geolocation data of sufficient quality. This requires close collaboration across the supply chain. In addition to data such as the trade name and quantity, the information to be recorded must also conclusively and verifiably include the absence of deforestation and compliance with country-specific laws. This forms the basis for the required risk assessment. To this end, the EU has established a set of evaluation criteria to assess the level of risk. Only raw materials and products with a negligible risk level may be marketed. In addition to deforestation-specific criteria such as the presence of primary forests or reports of illegal logging, social risks such as human rights violations and the rights of indigenous peoples must also be included in the risk assessment. If a non-negligible risk is identified, appropriate mitigation measures must be put in place. To do this, companies need effective policies, controls and procedures that are monitored and managed by an internal function such as the Chief Compliance Manager. This results in the need for a comprehensive monitoring and reporting system to meet documentation and reporting requirements.

It remains to be seen to what extent the regulation will come into effect on December 30, 2024, given the unanswered questions regarding data management and the associated bureaucratic burden. However, companies would be well advised to prepare for the requirements early on.