Why this regulation?
Imagine a chair made of oak. The logs were sourced from a Latvian forest, processed in Latvia, shipped through France, further processed in Spain, and finally sold in Italy. To operate legally, the forest operator in Latvia needs to follow local laws and ensure the oak comes from non-deforested areas. They are the only party fully responsible for the legality of the wood. Their customers, and their customers' customers, are not required to guarantee the oak was sustainably sourced. Some companies might rely on certifications like FSC or PEFC or their internal codes of conduct to ensure sustainable sourcing, but that is purely their choice. In many cases, saying "I did not know" was enough to excuse the use of illegal or deforested timber and understandably so: the opacity of the industry makes sustainable sourcing particularly challenging.
The European Union Deforestation Regulation (EUDR) aims to change this by making every supplier in the chain accountable for the origin of their materials. In our example, not only the forest operator in Latvia but also the sawmill, the trader in France, the manufacturer in Spain, and the retailer in Italy must ensure the legality of the oak. This is the heart of the regulation: every supplier must declare to the authorities that the raw material was legally harvested and does not come from illegal sources.
Currently, this task would be impossible. Suppliers are not obligated to share information about their suppliers. While the Latvian sawmill can audit the forest operator, beyond that, the origin of the raw material is lost. Relying on certifications is an option, but many sawmills are not certified, even if they buy sustainably sourced wood, because certification is costly and complex. This brings us to the second key part of EUDR: every supplier must share relevant information with their customers so they can assess the risk of illegality or deforestation. For example, the Latvian forest operator must share the geolocation of the logs with the sawmill, which passes it to the trader in France, and so on, down to the retailer in Italy. Each company must conduct its own due diligence, assessing the risk of illegality or deforestation. Based on this, they will decide whether to sell the product and declare to the authorities that the risk is low.
For which products?
EUDR applies to cocoa, timber, coffee, rubber, and their derivatives, within limits. The commission has published a list of HS codes for products covered by the regulation. For example, chocolate is included, but cookies are not. Wooden furniture is included, but packaging, if used as packaging, is not. A pallet manufacturer must comply as pallets are their core products, but a car manufacturer buying pallets for packaging does not.
How does it work?
The EUDR relies on three main pillars:
- Due diligence system: Companies dealing with products under the regulation must have a due diligence system and assess the risk of illegality and deforestation at least once a year. See it as a process that allows you to assess, for each supplier, and each product that is purchased from them, the risk that these products would be made from illegal sourced raw material, or coming from deforested areas. For example, the manufacturer in Spain must review all his catalog of furnitures annually. For each supplier, they assess the risk using geolocation data of the logs. If the risk is low, the product can be sold. If the risk is high, they may need to remove the product or gather more information to reduce the risk.
- Due diligence statement: Before selling a product, companies must submit a due diligence statement to the EU. This document includes geolocation data, the calculated risk of deforestation and illegality, company information, and a declaration that the product is safe to sell. Once submitted, the company receives a due diligence statement number as proof.
- Information sharing: Companies must share relevant information, like geolocation data, country of origin, and the due diligence statement number, with their customers.
- When buying from an EU supplier who has already submitted a due diligence statement, a company can rely on that statement and only submit its number. However, the company is still accountable if the supplier's statement is faulty. That is why it is crucial to assess the reliability of your supplier before relying on their due diligence.
Exceptions
The EU understands that these requirements can be burdensome, especially for smaller companies. The law places most of the regulatory burden on companies with the biggest impact on the supply chain, while smaller companies are exempt from some obligations. Therefore larger companies and those importing or exporting products bear the weight of the regulatory obligations, while smaller players have a lighter load.
- SMEs: Small and medium-sized enterprises (SMEs) that buy timber from EU suppliers only need to submit their supplier's due diligence statement number. They do not have to verify the information. For example, if the Latvian sawmill is an SME, they only need to submit the forest operator’s due diligence statement number. If the oak is illegal, the sawmill will not be held accountable. However, SMEs still need a due diligence system in place.
- SME traders: SMEs traders (meaning that do not process or import material from outside the EU) only need to share relevant information with their customers. They do not need to submit a due diligence statement or have a due diligence system. The french trader of hardwood from our example only needs to share to the manufacturer in Spain the information shared by their sawmill supplier in Latvia. However, SME traders exporting outside the EU must fully comply.
What happens in the case of an illegal batch?
If a company discovers that a product is illegal before it is sold, they must inform the authorities and remove the product from the market. The commission, with its data on the entire supply chain, will investigate every previous supplier. If a supplier (especially a larger company) failed to perform proper due diligence, they could face a fine of up to 4% of their revenue.
Let us break it down with our chair example. Let us say that the Latvian forest exploitant harvested oak logs from a deforested area:
- The forest operator chooses to fraud and submits a due diligence statement to the commission, claiming the logs are low risk. They sell the logs to the small Latvian sawmill and share the required geolocation data and the due diligence statement number.
- The sawmill, being an SME, does not need to verify the information from the forest operator. When they sell the processed timber to the French trader, they simply submit a due diligence statement that includes the previous statement’s number, unintentionally passing along the false information.
- The French trader, also a small business, sells the timber to a Spanish furniture manufacturer. As a small trader, they only need to share the geolocation data and the due diligence statement number from the sawmill. They are not required to submit a due diligence statement nor to conduct due diligence on the goods.
- The Spanish manufacturer sells chairs made from that timber to an Italian retailer. Even though the manufacturer is a large company and fully accountable for the origin of the logs, they fail to perform thorough due diligence, do not check the geolocation data, and submit their due diligence statement with the same faulty information passed down from the forest exploitant.
- The Italian retailer, however, does perform a thorough due diligence check. They notice that the logs come from a deforested area and decide not to sell the chairs, informing the authorities. Since each due diligence statement points to the previous one, authorities can trace the entire supply chain and investigate each supplier.
- The Latvian forest operator cannot prove they conducted proper due diligence since they knowingly provided geolocation data from a deforested area. They will almost certainly be fined. The sawmill, however, is not held accountable. They just need to show they have a due diligence system in place, even if they missed the issue in this case. The small French trader also will not be fined, as they only needed to pass on the relevant information.
- The situation is more complicated for the Spanish manufacturer. As a large company, they are fully responsible for conducting thorough due diligence for every batch from every supplier, so they should have caught the issue. However, if they can prove they have a strong due diligence system and that this particular batch was an exception, they might avoid a fine. Still, the manufacturer faces a high risk of being penalized, even if the law leaves some discretion to the authorities in these cases.