EUDR for Micro and Small Businesses: Your Deadline, Your Lighter Path, Your Real Risks
If your first reaction to the EU Deforestation Regulation was "this was written for Nestlé, not for us" - you're not entirely wrong. The regulation's full due diligence machinery does look like it was designed with large commodity traders in mind. But the EUDR applies to every business that places in-scope products on the EU market or exports them, regardless of headcount or turnover. What the law does do is calibrate the burden to your size. This guide explains exactly what that means in practice.
Your Deadline Is 30 June 2027 - Not an Exemption
Large and medium operators must comply by 30 December 2026. Micro and small operators have until 30 June 2027. These dates were set by EUDR Regulation 2025/2650, which entered into force on 26 December 2025.
That six-month gap is meaningful breathing room. It is not, however, a pass. SMEs are not exempt from the EUDR - the regulation adjusts requirements based on company size. The obligations kick in fully on 30 June 2027, and from that date you are held to the same enforcement standards as everyone else.
One practical wrinkle worth knowing: between 30 December 2026 and 30 June 2027, large and medium downstream operators will need to collect declaration identifiers - something that micro and small primary operators do not yet have to submit because the EUDR will not apply to them until June 2027. If your buyers are large companies, expect them to start asking questions well before your own deadline arrives.
The 30 June 2027 deadline applies to micro and small enterprises that were already established as micro or small by 31 December 2024. If your company grew past those thresholds after that date, the earlier 30 December 2026 deadline may apply to you. Check your classification carefully.
What "Micro or Small" Actually Means Here
The EUDR tracks the standard EU definitions of micro and small undertakings - the same thresholds used across EU company law. You don't need to do anything special to claim the category; if your business already qualifies as micro or small under EU rules, the lighter EUDR regime applies automatically.
There is one additional condition that unlocks the most significant simplification: you must be a primary operator established in a low-risk country. More on that below.
The Simplified Declaration Path
This is the headline relief for qualifying SMEs. Micro and small primary operators in low-risk countries now qualify for a simplified, one-time declaration. Under the December 2025 amendments, these operators submit a simplified declaration through the Information System (per the new Annex III) and receive a declaration identifier. This identifier serves as sufficient proof of compliance for traceability purposes, with updates required only if material changes occur.
To qualify, you must meet three conditions simultaneously:
- Size: micro or small undertaking
- Role: primary operator - meaning you grow, harvest, obtain, or raise the commodity yourself and place it on the market or export it
- Country: established in a country classified as low-risk under the EUDR benchmarking system
The regulation creates this new category of "micro and small primary operators" as natural persons or micro- or small-sized undertakings, regardless of legal form, that are established in a country classified as low risk and that place on the market or export relevant products that they themselves have grown, harvested, obtained or raised.
If you tick all three boxes, you are no longer required to submit a full due diligence statement. Instead, you submit a one-time simplified declaration in the information system to obtain a declaration identifier, which is then passed on with all relevant products you place on the market or export to ensure traceability.
There is also a practical concession on geolocation: for primary producers in low-risk countries, providing a postal address instead of geolocation coordinates will suffice. That removes one of the most technically demanding steps in the standard process.
What the Simplified Path Saves You
| Obligation | Standard Primary Operator | Micro/Small Primary Operator (Low-Risk Country) |
|---|---|---|
| Due diligence statement (DDS) | Required for every shipment | Not required — replaced by one-time simplified declaration |
| Full risk assessment | Required | Not required (low-risk country sourcing) |
| Risk mitigation measures | Required | Not required |
| Geolocation data | Plot-level GPS coordinates | Verifiable postal address acceptable |
| Annual due diligence report | Required (large operators) | Not required |
| Declaration update frequency | Per shipment | Only when material changes occur |
| Record-keeping (5 years) | Required | Required |
What SMEs Still Must Do
The simplified path is real, but it is not a blank cheque. Regardless of size, all operators must collect and retain - for five years - data of the operators, downstream operators or traders who have supplied them with relevant products, and details of downstream operators or traders to whom they have supplied relevant products.
If you are a downstream operator (you process or re-export products already covered by someone else's declaration), your obligations are lighter still: you no longer conduct due diligence or submit a DDS. Instead, your responsibilities are limited to collecting and retaining DDS reference numbers or simplified declaration identifiers from upstream suppliers, maintaining traceability and transaction records for at least five years, notifying competent authorities if you encounter substantiated concerns about a product's compliance, and cooperating with competent authorities during inspections.
One important exception: SMEs acting as importers or placing goods on the EU market for the first time are still treated as operators and must carry out full due diligence. If you are the first link in the EU chain - importing raw cocoa, for example - size does not reduce your core obligations.
What SMEs Can Skip
Micro and small companies do not need to publish annual due diligence reports. This is a meaningful administrative saving. Large operators face a public reporting obligation; you do not.
The Penalties Section: Read This Carefully
Lighter obligations do not mean lighter consequences for getting it wrong. Liability for non-compliance ultimately lies with companies which are non-compliant. Even SMEs, while they have fewer due diligence obligations and do not need to carry out reporting, are not exempt from the consequences of non-compliance.
The regulation sets a floor, not a ceiling, on what Member States must impose. Article 25 of the regulation requires, at a minimum: fines proportionate to damage and value, with the maximum at least 4% of the company's total EU-wide annual turnover in the preceding financial year (and higher if needed to remove economic benefit); confiscation of products and of revenues; temporary exclusion of up to 12 months from public procurement and public funding; temporary prohibitions on placing or exporting relevant products in cases of serious or repeated infringements; and loss of access to simplified due diligence.
Fines are scaled based on environmental harm, financial benefit, and prior violations. Authorities can seize both products and profits from non-compliant goods. Operators may be barred from selling regulated commodities or from participating in public tenders for up to 12 months.
For a small business, a 4% turnover fine is proportionally the same hit as it is for a large one. And losing access to simplified due diligence - one of the specific penalties listed - would force you onto the full compliance track.
Losing your simplified declaration status is itself a penalty. If you are found non-compliant, authorities can strip your access to the simplified regime, meaning you would need to run full due diligence going forward — a significantly heavier burden.
How Enforcement Actually Works
Enforcement starts at customs, backed by Competent Authorities that can audit, seize, or suspend shipments. Inspections are risk-based, targeting high-risk commodities, countries, or operators.
In practical terms, this means a small coffee importer sourcing from a standard-risk country faces a different inspection probability than one sourcing from a low-risk EU member state. The benchmarking system directly shapes how often your shipments are scrutinised.
Enforcement is not limited to scheduled inspections. Substantiated concerns from NGOs or the public can trigger investigations outside regular inspections. Natural or legal persons, including NGOs, may submit substantiated concerns to competent authorities when they consider that one or more operators or traders are not complying with the regulation. Competent authorities must assess these concerns. If found credible, they are obligated to take action to investigate the claim and the operator against whom the claim was filed.
NGOs and watchdog organisations are actively monitoring supply chains using real-time satellite data, shipment records, and supply chain mapping. Some NGOs focus on risk assessments, while others are already compiling and preparing cases against companies they believe to be non-compliant. Being small does not make you invisible to this kind of scrutiny - particularly if your commodity or sourcing region is already on watchlists.
A Practical Starter Checklist for SMEs
Use this to get oriented before your 30 June 2027 deadline. It is not a substitute for reading the regulation or taking legal advice, but it will tell you where to focus first.
Check whether your products appear in Annex I of the EUDR (cattle, cocoa, coffee, palm oil, rubber, soy, wood, and a wide range of derived products). If they do, you are in scope regardless of size.
Are you a primary operator (first to place the product on the EU market or export it), a downstream operator (working with products already covered by a declaration), or a trader? Your role determines your obligations more than your size does.
If you are a primary operator, find out whether your country of establishment is classified as low-risk under the EUDR benchmarking system. Low-risk status is the gateway to the simplified declaration path.
You qualify if you are micro or small, a primary operator, and established in a low-risk country. If all three apply, you need a one-time Annex III declaration — not a full DDS.
Regardless of which path you take, you must retain records of your supply chain partners and transactions for five years. Build that habit before your deadline, not after.
Large and medium buyers must comply from 30 December 2026. They will need your declaration identifier before your own deadline. Engage them early so their compliance timeline does not create pressure on yours.
Not Sure Which Path Applies to You?
The single most common source of confusion for SMEs is not knowing whether they are a primary operator, a downstream operator, or something in between. The answer changes everything - from whether you need a full DDS to whether the simplified declaration is even available to you.
The Bottom Line
The EUDR was not designed to put small businesses out of the commodity trade. The December 2025 amendments - confirmed by Regulation (EU) 2025/2650 - made a genuine effort to reduce the burden on micro and small operators, particularly those sourcing from low-risk countries. The simplified declaration, the postal-address concession, and the exemption from annual reporting are real reliefs.
But the regulation is still law, the penalties are real, and the enforcement machinery starts running from your deadline date. The time between now and 30 June 2027 is not a grace period - it is your preparation window.
Use it.
Related reading
EUDR Operator vs. Trader: How Your Role in the Supply Chain Determines Your Obligations
Are you an EUDR operator or a trader? Your role - not just your size - determines what you must do and when. A plain-English guide to role classification, DDS duties, and the 2025 changes.
EUDR Risk Assessment and Mitigation: How to Complete Articles 10 and 11
Collecting supplier data is step one. Articles 10 and 11 of the EUDR require you to assess that data and mitigate any non-negligible risk before you can legally place products on the EU market.
EUDR Coffee Compliance: The Complete Guide for Importers and Roasters
Coffee importers and roasters placing product on the EU market must prove deforestation-free sourcing, collect plot geolocation, and file a DDS before the 30 December 2026 deadline. Here's exactly what that means in practice.