EUDR Downstream Operators: What the New Category Means and What You Actually Have to Do

If you buy cocoa, coffee, soy, palm oil, rubber, timber, or cattle derivatives from a supplier who has already filed a due diligence statement, you are probably a downstream operator under the EUDR - and that matters enormously for what you have to do.

Regulation (EU) 2025/2650 was formally adopted by the European Parliament on 17 December 2025 and by the Council on 18 December 2025, and published in the EU Official Journal on 23 December 2025. That single amendment rewrote the compliance picture for most mid- and downstream businesses. The obligation to conduct full due diligence and file a Due Diligence Statement (DDS) now rests exclusively with the operator who first places a regulated product on the EU market. Everyone else - the manufacturer who buys in compliant inputs, the retailer who sources from an EU importer, the exporter who ships goods already covered by an upstream DDS - falls into the new downstream operator category and faces a much lighter set of duties.

This guide explains the definition precisely, walks through the three things downstream operators no longer have to do, and then covers the obligations that remain. It ends with a practical checklist to help you confirm your classification before the application date arrives.

---

What Is a Downstream Operator?

A "downstream operator" means a natural or legal person who, in the course of a commercial activity, places on the market or exports regulated products made from regulated materials, all of which are covered by a due diligence declaration or a simplified declaration.

The key phrase is all of which are covered. Every regulated input in your product must already have an upstream DDS or simplified declaration behind it. If even one input lacks that coverage, you are not a downstream operator for that product - you are a primary operator with the full due diligence burden.

Concrete examples

Processors and exporters will be considered downstream operators depending on their role in the supply chain: processors if they take relevant products that have already been subject to due diligence and use them to make other relevant products that they then place on the market or export; and exporters when they export products that were manufactured from relevant products already covered by a due diligence statement or simplified declaration.

In practice, this covers a wide range of EU businesses:

• A chocolate manufacturer that buys cocoa mass from an EU importer who filed the DDS at the border
• A furniture retailer that sources wooden components from a domestic wholesaler whose supplier filed the DDS on import
• A food brand that formulates products using palm oil purchased from an EU commodity trader with a valid DDS
• An EU-based exporter re-exporting goods that were imported and declared by another operator

If the cocoa was already placed on the EU market with a DDS when you bought it, you are a downstream operator. If you import directly from origin, you are the primary operator with full DDS filing obligations.

That distinction - who first places the product on the EU market - is the single most important question to answer about your supply chain.

---

Three Things Downstream Operators Do NOT Have to Do

1. Conduct their own due diligence

The obligations to undertake due diligence and submit the required due diligence statement now fall exclusively on the operators who first place a relevant product on the EU market or first export it. Downstream operators are entirely outside this obligation. You do not need to collect geolocation data, assess country risk, or build a risk mitigation system for products that are already covered upstream.

The original EUDR was criticised for creating the impression that every company in the supply chain would need to carry out full due diligence anew. Regulation 2025/2650 corrects this by explicitly distinguishing between (primary) operators (first placement on the EU market) and downstream actors.

2. File their own Due Diligence Statement

Downstream operators, such as manufacturers and exporters using compliant inputs, now have significantly lighter obligations under EUDR Regulation 2025/2650. They no longer conduct due diligence or submit a DDS.

This is the biggest practical relief for most mid-chain businesses. You will not need a TRACES NT account for DDS submission, and you will not be filing declarations before each shipment.

3. Record DDS reference numbers redundantly throughout the chain

Only the first downstream operator or trader in the supply chain is required to collect and retain DDS reference numbers or simplified declaration IDs from its upstream supplier. Operators further along the supply chain do not need to pass them on, preventing cumulative administrative burdens.

This is a deliberate design choice to stop the Information System from being flooded with duplicate entries. A key simplification is that only the first downstream operator (or first downstream trader) is required to collect and retain the reference numbers of due diligence statements, or collect and retain the declaration identification numbers of simplified declarations.

If you are the second downstream operator in the chain - buying from another manufacturer who already collected the reference number from the importer - you do not need to record it again.

---

What Downstream Operators DO Still Have to Do

Being a downstream operator is not a compliance holiday. Although downstream operators are not required to conduct due diligence, they are not "exempt" from obligations. They must: collect information on their suppliers and customers; retain reference numbers or declaration IDs (only where their supplier is an operator); and act on substantiated concerns.

Here is the full list of active duties:

1. Collect and keep supplier and customer records You must maintain records of who you buy from and who you sell to. All information must be kept for five years.

2. Capture DDS reference numbers - if you are first in the downstream chain Downstream operators must record the master data of their direct suppliers and customers and, if they are first downstream operators - i.e. supplied directly by an upstream operator - they must also record the DDS reference numbers and assign them to the incoming delivery.

In practice, the reference number will typically appear on the commercial documents (invoice, delivery note, purchase order) your upstream operator sends you. You do not need a separate compliance system to hold it, but you must be able to produce it for an inspector.

3. Act when substantiated concerns arise Where substantiated concerns exist, stricter obligations apply to non-SME downstream operators and traders: they must verify that due diligence has been carried out and may only place the product on the market if the risk is found to be negligible.

New guidance clarifies what non-SME downstream operators must do when they become aware of a substantiated concern or information indicating non-compliance. The obligation is reactive; it does not require systematic monitoring, but once triggered, the non-SME downstream operator must verify that due diligence was exercised and must not continue to place the product on the market until satisfied that no or only negligible risk exists.

In other words: you do not need to proactively audit your supply chain. But if a credible concern lands on your desk - from a supplier, an NGO, a news report, or a competent authority - you must act on it.

4. Register in the Information System (non-SMEs only) Non-SME downstream operators must still register. Regulation (EU) 2025/2650 states they have a significant influence on supply chains and must remain registered in the Article 33 information system.

SMEs are exempt from the registration requirement. This is a meaningful distinction covered in the next section.

5. Cooperate with competent authorities Obligations are limited to traceability, record-keeping, notification of substantiated concerns and cooperation with authorities. If an inspector requests your records, you must be able to produce them.

---

The SME vs. Non-SME Distinction

Size determines one key obligation: registration in the EUDR Information System.

Where a downstream operator is not an SME, they must register in TRACES. Where a downstream operator is an SME, this registration is not required. This distinction applies only to EU downstream operators.

Under EU Recommendation 2003/361/EC, the standard SME thresholds are:

One important caveat: the relevant values - employees, turnover, balance sheet - of affiliated companies must be calculated on a consolidated basis, even across national borders. If the parent company or other affiliated companies are large, the subsidiary may lose its SME status. A small subsidiary of a large group is not automatically an SME for EUDR purposes.

For non-EU businesses, SME status is irrelevant. Whether a company is micro, small, medium or large has no impact on downstream obligations if the business is not established in the EU.

---

Are You a Downstream Operator? A Practical Checklist

Use this decision tool to confirm your classification before the application date.

---

The Application Dates

The downstream operator category applies on the same timeline as the rest of the regulation.

EUDR obligations apply from 30 December 2026 for large and medium-sized operators (and for micro/small operators already covered by the EU Timber Regulation), and from 30 June 2027 for other micro and small operators and natural persons.

The application date of the EUDR is postponed until 30 December 2026 for medium-sized and large operators and traders, and until 30 June 2027 for micro and small operators.

There is one open question worth flagging. An open question remains how downstream operators should deal with the period from 30 December 2026 to 30 June 2027, during which the EUDR already applies to downstream actors but not yet to micro and small primary operators. Further clarification appears warranted. If your upstream supplier is a micro or small primary operator, they will not yet be required to file a DDS during that window. Watch for Commission guidance on this point - we will update this page when it arrives.

---

One More Wrinkle: The Authorised Representative Route

Under Article 6(3) of Regulation EU 2025/2650, an upstream operator that is a natural person or microenterprise can mandate the next downstream operator or trader in their supply chain to act as their authorised representative. If you sit just below a very small primary supplier in a low-risk country, you may end up handling their declaration in the system on their behalf.

This is not a common scenario, but if you source directly from very small producers - in cocoa or coffee supply chains, for example - it is worth checking whether your supplier intends to use this mechanism.

---

What to Do Before the Deadline

The practical steps for most downstream operators are straightforward:

1. Confirm your classification. Work through the decision tree above. The key question is whether all your regulated inputs are covered by an upstream DDS.
2. Map your first-tier suppliers. Identify which of your suppliers are primary operators (importers, first placers) and which are themselves downstream operators or traders.
3. Update your purchase documentation. Ensure your contracts or purchase orders require suppliers to provide their DDS reference number or simplified declaration ID on commercial documents.
4. Register in the Information System (if non-SME). Non-SME downstream operators must register in the Article 33 system before placing products on the market or exporting. This is separate from filing a DDS.
5. Set up a substantiated-concerns escalation process. You need a simple internal procedure for what happens if a compliance concern is raised - who reviews it, what verification steps are taken, and when to notify competent authorities.
6. Retain records for five years. Supplier and customer information, transaction records, and any reference numbers you collect must be kept and producible on request.

The 2025 amendment does not dilute responsibility. It clarifies roles, redefines downstream obligations and places traceability systems at the centre of compliance. The lighter burden is real - but it is conditional on your inputs being genuinely covered upstream. If a gap exists in the chain above you, it becomes your problem.

---