EUDR legality requirement and legal production

The EUDR Legality Requirement: What "Legally Produced" Actually Means

Last updated · July 22, 2026

Most operators and traders have spent the last two years focused on geolocation - mapping plots, collecting coordinates, running satellite checks against the 31 December 2020 cut-off. That work matters. But it only satisfies half of the EUDR's core test.

The regulation sets two mandatory, co-equal conditions. A product must be deforestation-free and produced in accordance with the relevant legislation of the country of production. Miss either one and the product cannot legally be placed on the EU market or exported from it. There is no partial credit.

The deforestation-free test has attracted most of the attention. The legality requirement - what the regulation calls "legally produced" - has not. That gap is a compliance risk. In a live poll of EUDR practitioners, 59% said legality due diligence remains the most unclear area for their organisation - more than risk assessment, DDS submission, or operator classification.

This guide focuses squarely on legality: what it covers, why it is often the harder half, what evidence you need, and how it slots into the due diligence workflow.

Why Legality Is a Separate, Mandatory Test

The legal basis is Article 3(b) of the EUDR, read together with the definition in Article 2(40). Compliance with the relevant legislation of the country of production is not a sub-element of the deforestation-free test - it is a standalone obligation. A product grown on land that has been forest-free since 2020 can still fail the legality test if, for example, the producer holds no valid land-use permit, workers are not paid the statutory minimum wage, or indigenous communities were not consulted before the land was put into production.

The standard applied to both tests is the same: no more than negligible risk. Before submitting a Due Diligence Statement, operators must be able to demonstrate that the risk of illegal production is negligible - not zero, but negligible, assessed through the full three-step due diligence process under Articles 8-11.

Deforestation-free ≠ EUDR compliant. Both conditions — deforestation-free (Article 3(a)) and legally produced (Article 3(b)) — must be satisfied independently. A clean satellite overlay does not address legality.

The Seven Areas of Law Under Article 2(40)

Article 2(40) of the EUDR defines "relevant legislation of the country of production" as the national and subnational laws applicable in the country of production concerning the legal status of the area of production across seven distinct areas. Each area is a genuine compliance domain, not a box-ticking exercise.

1. Land-Use Rights

This is the most immediate legality question: does the producer have the legal right to use the land for commodity production? The answer is not always straightforward. In many producing countries, jurisdiction over land administration, resource allocation, and use-right permits sits at the subnational level - with provinces, districts, or local government authorities - rather than with the national government. Two neighbouring plots in the same country can have radically different legal standings.

Evidence to look for: land title deeds, land-use certificates, concession agreements, lease agreements, or official use-right permits issued by the competent authority at the relevant level of government.

2. Environmental Protection

This covers national and subnational environmental laws applicable to the production area - protected area designations, environmental impact assessment requirements, buffer zone rules, and restrictions on the use of certain inputs. A farm that sits outside a national park boundary may still be inside a protected buffer zone regulated at the provincial level.

Evidence to look for: environmental impact assessment approvals, permits from environmental agencies, documentation that the plot does not fall within legally protected areas, and records of compliance with any conditions attached to those permits.

3. Forest-Related Rules (Timber and Wood Only)

Under Article 2(40), compliance with forest-related rules - including forest management and biodiversity conservation - is only required where directly related to wood harvesting, and does not apply to the production of agricultural commodities such as cocoa, coffee, or soy. For timber and wood products, this area covers harvesting licences, forest management plans, and biodiversity conservation obligations attached to concessions.

Evidence to look for (wood/timber): valid harvesting licences, approved forest management plans, FLEGT licences where applicable, and documentation of compliance with any biodiversity conditions.

4. Third Parties' Rights

This area covers the rights of communities, individuals, and other parties who may have legal or customary interests in the land or resources used for production. It is broader than formal land title - it includes the rights of local communities who may have legally recognised access rights, grazing rights, or resource-use rights that co-exist with the producer's own tenure.

Evidence to look for: documentation of community consultations, records showing no unresolved land disputes, legal opinions on third-party claims, and - where applicable - FPIC records (see below).

5. Labour Rights

Producers must comply with the labour laws of the country of production. This includes minimum wage legislation, working-hours rules, occupational health and safety requirements, restrictions on child labour, and the right to organise. Assessing labour-law compliance in complex, fragmented supply chains - particularly where seasonal or informal workers are involved - is one of the most practically challenging aspects of the legality requirement.

Evidence to look for: employment contracts or records, payroll documentation, social security registration, health and safety inspection records, and any relevant certifications or audit reports covering labour conditions.

6. Human Rights Protected Under International Law

The EUDR requires compliance with domestic laws that implement or give effect to internationally recognised human rights. This includes laws ratifying ILO conventions, constitutional human rights protections, and domestic legislation implementing international human rights treaties. The regulation's reference to "international law" means that where a producing country has ratified relevant international instruments, those obligations - as implemented in domestic law - are in scope.

Evidence to look for: documentation that the producer operates within the applicable human rights legal framework, records of any human rights due diligence conducted at the production level, and absence of credible allegations or findings of human rights violations linked to the production area.

7. Free, Prior and Informed Consent (FPIC)

The EUDR explicitly includes the principle of free, prior and informed consent (FPIC), including as set out in the UN Declaration on the Rights of Indigenous Peoples, within the definition of relevant legislation in Article 2(40). FPIC applies where indigenous peoples or local communities have rights - formal or customary - over land or resources used in production. It requires that those communities are consulted, that consent is freely given before production begins, and that consent is maintained over time if land use changes.

FPIC is widely acknowledged as one of the most challenging areas to assess. Determining whether FPIC has been meaningfully respected - rather than merely formally documented - requires deep local knowledge and, often, direct community engagement.

Evidence to look for: records of community consultations, signed consent agreements with affected communities, documentation of the process by which consent was sought and given, and evidence that consent has been maintained if production conditions have changed.

Plus: Tax, Anti-Corruption, Trade and Customs Regulations

Article 2(40) also covers tax obligations, anti-corruption laws, and trade and customs regulations applicable to the production and export of the commodity. Unlike the other areas, these rules may apply beyond the production area itself - covering the commercial and administrative chain through which the product moves from farm to export.

Evidence to look for: tax registration and payment records, export licences and customs declarations, and documentation that the producer and exporter are operating within the applicable regulatory framework.

The National and Subnational Dimension

One of the most underestimated aspects of the legality requirement is its geographic scope. The EUDR makes no distinction between national and subnational laws - laws applicable at both levels may apply if they fall within the scope of Article 2(40). In many producing countries, critical areas such as land administration, environmental permits, and business licensing are regulated at the provincial, district, or local government level, not centrally.

This means that a country-level legal review is not sufficient. Operators sourcing from multiple regions within a single country may need to understand different legal frameworks for each sourcing area. The EUDR does not list specific laws - because those laws vary by country and commodity - so operators must identify the applicable legal framework for each production context.

Isometric diagram showing a commodity supply chain flowing from a farm plot through a cooperative and exporter to an EU importer, with document icons representing land title, labour records, and FPIC consent at the farm level, and a compliance checklist at the EU entry point

Legality in the Due Diligence Workflow

The legality requirement does not sit outside the due diligence process - it runs through all three steps.

Step 1 - Information collection (Article 9): Alongside geolocation data, operators must collect evidence of legal production. This means requesting documents from suppliers that cover the applicable areas of law for the relevant commodity and country of production. The EUDR requires this information to be "adequately conclusive and verifiable."

Step 2 - Risk assessment (Article 10): Operators must assess the risk that the product was produced illegally. This involves evaluating the reliability of the documents collected, checking for inconsistencies or signs of falsification, and considering country- and commodity-level risk factors - including governance quality, enforcement capacity, and the prevalence of land disputes or labour violations in the sourcing region.

Step 3 - Risk mitigation (Article 11): Where the risk of illegal production is assessed as more than negligible, operators must take mitigation measures before proceeding. This might include requesting additional documentation, commissioning independent verification, or - in cases where risk cannot be reduced to negligible - declining to source from that supplier.

All legality evidence must be retained. The EUDR requires documentation to be kept for a minimum of five years and to be accessible during regulatory inspections.

For a detailed walkthrough of the risk assessment and mitigation steps, see our guide to Articles 10 and 11.

Practical Legality Evidence Checklist

Use this as a starting point when requesting legality documentation from suppliers. The specific documents required will depend on the commodity, the country of production, and the applicable legal framework.

The Role and Limits of Certification Schemes

Voluntary sustainability certifications - FSC, RSPO, Rainforest Alliance, ISCC, and others - are frequently cited as a route to EUDR compliance. Their role is real but limited.

The European Commission does not recognise any certification scheme as a substitute for a Due Diligence Statement, and no certification automatically satisfies EUDR requirements. Certification can support the risk assessment process as one piece of evidence, but it does not replace the obligation to collect legality documentation, conduct a risk assessment, and submit a compliant DDS.

That said, well-designed certification schemes can genuinely help. Some schemes have incorporated legality requirements into their standards and audit processes. FSC, for example, has embedded FPIC directly into its principles and criteria, making it a mandatory part of certification audits. Schemes that systematically verify compliance with local laws - and whose auditors are trained to assess legal compliance in a consistent and credible manner - can provide useful supporting documentation.

The key word is supporting. Certification records can corroborate other evidence, flag areas of risk, and reduce the burden of independent verification. They cannot substitute for it. Operators remain legally accountable for the accuracy of every DDS they submit.

Using certification evidence effectively: Collect the original underlying documents (land title, permits, labour records) alongside any certification. Cross-reference the certificate's coverage, timing, and supply chain integrity against EUDR requirements. Many certifications do not align fully with EUDR criteria on cut-off dates or legal scope — verify before relying on them.

Why Legality Is Often the Harder Half

The deforestation-free test, while technically demanding, has a clear binary logic: was the land forested after 31 December 2020? Satellite imagery, remote sensing tools, and geolocation data can answer that question with reasonable precision.

The legality test has no equivalent shortcut. It requires operators to understand the specific legal framework applicable in each country and subnational region of production, identify which laws are relevant to each commodity, collect documentary evidence that those laws have been complied with, assess the reliability of that evidence, and - where gaps or risks exist - take proportionate mitigation action.

The complexity is compounded in high-risk origins. Producing countries may have conflicting, unclear, or overlapping legislation. Customary land-use rights - where communities have traditional ownership or use rights that lack formal documentation - create particular difficulty. Smallholder-dominated supply chains add further challenge: in Thailand, for example, roughly 20% of rubber-producing smallholders lack formal documentation to prove the legality of their plantations, with land use often managed through informal arrangements with government agencies.

None of this makes legality compliance impossible. It does mean that operators who treat legality as an afterthought - or assume that a clean deforestation check covers their obligations - are taking a significant compliance risk.

FAQ

help_outlineDoes the legality requirement apply to all seven EUDR commodities equally?expand_more

Yes, with one important distinction. The forest-related rules area (covering forest management and biodiversity conservation) applies only where directly related to wood harvesting — it does not apply to agricultural commodities such as cocoa, coffee, soy, palm oil, rubber, or cattle. All other areas of law under Article 2(40) apply across all in-scope commodities.

help_outlineWhat does 'negligible risk' mean for legality?expand_more

The EUDR applies the same negligible-risk threshold to both the deforestation-free and legality tests. Operators must demonstrate, through their due diligence process, that the risk of illegal production is negligible — not zero, but negligible. This is a risk-based standard, not an absolute guarantee. The strength of the evidence collected, the reliability of suppliers, and the governance context of the sourcing country all feed into this assessment.

help_outlineDo subnational laws count?expand_more

Yes. The EUDR makes no distinction between national and subnational laws. If a relevant law is enacted at the provincial, district, or local government level — covering land administration, environmental permits, business licensing, or any other area within Article 2(40) — it is in scope. This is particularly important in countries where key regulatory functions are decentralised.

help_outlineCan I rely on a supplier's self-declaration of legal compliance?expand_more

No. The EUDR requires 'adequately conclusive and verifiable' evidence of legal production. A supplier's self-declaration is not sufficient on its own. Operators must collect documentary evidence — permits, licences, tax records, FPIC agreements — and assess its reliability as part of the risk assessment process. Where documents cannot be verified or gaps exist, risk mitigation measures are required.

help_outlineDoes FPIC apply to every supply chain?expand_more

FPIC applies where indigenous peoples or local communities have rights — formal or customary — over land or resources used in production. It is not a universal requirement for every farm, but operators must assess whether it is applicable in their sourcing contexts. In many tropical commodity-producing regions, FPIC is highly relevant and is one of the most challenging areas to assess and document.

help_outlineDoes certification replace legality due diligence?expand_more

No. No certification scheme — FSC, RSPO, Rainforest Alliance, ISCC, or any other — is recognised by the European Commission as a substitute for a Due Diligence Statement or for the underlying legality evidence. Certification can support your risk assessment as one piece of evidence, but operators remain legally responsible for demonstrating compliance with all EUDR requirements.

help_outlineHow long must legality evidence be retained?expand_more

All EUDR documentation — including legality evidence — must be retained for a minimum of five years and must be accessible during regulatory inspections. Generic supplier-level documentation is not sufficient; evidence must be traceable to specific lots, shipments, or production areas.

The EUDR is a fast-moving regulation. The guidance on legality - including the European Commission's October 2024 non-binding guidance document - continues to evolve, and member state competent authorities will develop their own approaches to enforcement. We update our content promptly when material changes occur.