EUDR Palm Oil Rules: The Practical Guide for Operators, Refiners, and EU Buyers
Palm oil is one of the seven commodities at the heart of the EU Deforestation Regulation - and it presents the most operationally demanding compliance challenge of all of them. The supply chain runs from millions of smallholder plots through informal intermediaries, aggregating mills, and multi-origin refineries before it reaches an EU buyer. Every link in that chain now needs to be documented to plot level.
This guide focuses on what is palm-oil-specific: scope, the Annex I changes in progress, country risk, the RSPO question, and the practical steps that matter most before the deadline.
The basics: what is in scope today
Palm oil is one of the seven core EUDR commodities, alongside cattle, cocoa, coffee, rubber, soy, and wood. The regulation covers not just the raw commodity but a long list of derived products set out by CN code in Annex I. For palm oil, the current Annex I already captures crude palm oil, palm kernel oil, refined palm oil and its fractions, palm oilcake, and a range of palm-based oleochemicals.
The test is always the CN code, not the presence of palm oil as an ingredient. If a product's CN code appears in Annex I, it is in scope. If it does not, it is out of scope - even if palm oil is a significant input.
Annex I is changing: the May 2026 draft delegated act
This is the most time-sensitive development for the palm oil sector right now.
On 4 May 2026, the European Commission published a draft delegated act proposing to amend Annex I, with a public consultation that closed on 1 June 2026. The draft proposes adding 17 new CN codes, deleting 3, and clarifying 1. For palm oil, the expansion is the largest of any commodity in the draft.
Proposed additions for palm oil include:
- Soap made with palm oil (CN 3401 11 00 and 3401 20) - the most commercially significant addition for the cleaning and personal care sectors
- Partially or fully hydrogenated, interesterified, re-esterified, or elaidinized palm, palm-kernel, and babassu oils (HS 1516 20, 1518 00) - widely used in food manufacturing and oleochemicals
- Crude glycerol from palm processing (HS 1520 00)
- Palm-derived fatty alcohols - octanol, dodecan-1-ol (lauryl alcohol), hexadecan-1-ol (cetyl alcohol), octadecan-1-ol (stearyl alcohol) and certain esters (HS 2905 16, 2905 17, 2905 19) - used extensively in cosmetics and surfactants
- Certain acetic acid esters of palm origin (HS ex 2915 39)
This is a draft, not yet law. The delegated act must still be formally adopted by the Commission and pass a parliamentary scrutiny period (typically two months, extendable by two months) before it enters into force upon publication in the EU Official Journal. The final text may differ from the draft. Until then, the current Annex I remains the binding list.
However, the direction of travel is clear: if you import palm-derived fatty alcohols, hydrogenated palm oils, or palm-oil soap as standalone products, you should be mapping your supply chain now.
The draft also confirms several horizontal exemptions that benefit all commodities: waste, used and second-hand products, samples, single-use and reusable packaging materials, and marketing correspondence are all explicitly excluded.
The composite-product rule: a common source of confusion
A question that comes up constantly in the food, cosmetics, and cleaning sectors: if my product contains palm oil derivatives, does the EUDR apply to it?
The answer depends on how the product is classified in Annex I - not simply on whether palm oil is present.
Take chocolate (HS 1806). Chocolate is listed in Annex I as a product linked to cocoa. If you import chocolate, your due diligence obligation relates to the cocoa component, not to any palm oil derivatives the chocolate also contains - even if those palm oil derivatives would be in scope if imported on their own.
The rule is this: for a composite product, due diligence relates to the commodity that Annex I links to that product's CN code. Palm oil derivatives trigger EUDR obligations when they are imported as a relevant product in their own right - not when they appear as an ingredient inside another product whose Annex I entry is linked to a different commodity.
This distinction matters enormously for food manufacturers, cosmetics companies, and oleochemical buyers. If you are importing refined palm stearin as a raw material (in scope), that is different from importing a finished cream that happens to contain cetyl alcohol (not in scope under the current Annex I, though watch the draft).
Country risk: Indonesia and Malaysia are standard risk
The Commission published its first country benchmarking list in May 2025, classifying approximately 140 countries as low risk, around 50 as standard risk, and only four - Belarus, Myanmar, North Korea, and Russia - as high risk.
Indonesia and Malaysia, which together account for around 85% of global palm oil production, are both classified as standard risk. That means full due diligence applies: information collection, risk assessment, and risk mitigation. It does not mean high-risk checks - but it does mean you cannot use the simplified due diligence pathway available for low-risk origins.
The practical implications of the check-rate structure:
| Risk tier | Palm oil examples | Due diligence required | Annual check rate |
|---|---|---|---|
| Low risk | Thailand, Vietnam, Papua New Guinea (check current list) | Simplified — information collection only, no risk assessment unless concerns arise | 1% of operators/traders |
| Standard risk | Indonesia, Malaysia, Brazil | Full — information collection + risk assessment + risk mitigation | 3% of operators/traders |
| High risk | Belarus, Myanmar, North Korea, Russia | Full + enhanced scrutiny | 9% of operators/traders |
One important caveat: the benchmarking list is dynamic, with the first review scheduled for 2026. A country's classification can move up or down. If a supplier country moves from standard to high risk after you have built your compliance programme around standard-risk assumptions, you will need to upgrade your due diligence quickly.
Also note: if a consignment mixes material from a standard-risk and a low-risk origin, the entire batch is treated as standard risk. Blending does not average down the risk level.
Why palm oil is the hardest commodity to trace
Palm oil's compliance challenge is structural, not just administrative. Three features make it uniquely difficult.
1. The mill aggregation problem
A typical palm oil mill receives fresh fruit bunches (FFBs) from dozens or hundreds of individual plots - a mix of estate land and independent smallholders. The EUDR requires geolocation data traceable to each of those plots. But historically, mills have not needed to know the exact location of every supplying farm. They received fruit, weighed it, and paid for it. Plot-level documentation was not part of the transaction.
This means the compliance gap is not at the refinery or the EU importer - it is at the mill gate, where the chain of custody either exists or it does not.
2. Smallholder geolocation
Smallholders produce approximately 40% of global palm oil. Many are independent growers who sell FFBs through informal intermediaries, often with no formal land title and no digital farm map. The EUDR requires precise coordinates: a single point is acceptable for plots up to 4 hectares; polygons are required for plots above 4 hectares; and all coordinates must be accurate to at least 6 decimal places.
For a mill sourcing from 500 independent smallholders, collecting, verifying, and maintaining that data is a significant programme - not a form-filling exercise.
3. Refinery blending
Refineries typically blend crude palm oil from multiple mills and multiple origins. Once blended, the ability to attribute a specific volume of refined product to a specific set of plots is lost unless the supply chain has been managed as segregated from the outset. Mass balance accounting - where volumes are tracked but physical separation is not maintained - does not satisfy the EUDR's physical traceability requirement.
RSPO certification: useful, but not a substitute
RSPO is the leading sustainability standard for palm oil, and it is genuinely useful for EUDR compliance - but it does not replace the due diligence system (DDS) requirement.
Here is where RSPO helps and where it falls short:
Where RSPO helps:
- The 2024 RSPO Principles & Criteria now require geolocation data collection for both certified and non-certified FFBs, using at least six decimal places - directly aligned with EUDR's geolocation standard.
- RSPO's legality requirements cover seven of the nine EUDR legality criteria.
- RSPO certification can be uploaded as supporting evidence in a risk assessment and may influence how national competent authorities allocate their inspection resources.
Where RSPO is not enough:
- RSPO's Book & Claim supply chain model does not satisfy the EUDR's physical traceability requirement. Book & Claim allows a buyer to purchase sustainability credits without receiving physically certified material. The EUDR requires the product itself to be traceable to deforestation-free plots - a credit transfer does not establish that.
- Even RSPO Segregated (SG) and Identity Preserved (IP) models, which do maintain physical traceability, still require a separate DDS submission. RSPO certification is not a DDS.
- The RSPO and EUDR use different definitions of "forest." RSPO uses a qualitative HCS-HCV methodology; the EUDR uses the FAO quantitative definition (≥0.5 ha, ≥5 m height, ≥10% canopy cover). An area can be permissible under RSPO but still constitute "forest" under the EUDR.
The practical conclusion: RSPO Segregated or Identity Preserved is a strong foundation for EUDR compliance because it maintains physical traceability. But you still need to collect plot-level geolocation data, run a risk assessment against the 31 December 2020 cut-off, and file a DDS. RSPO is a tool in the compliance toolkit, not the toolkit itself.
Deadlines and what they mean for palm oil supply chains
The EUDR application date for large and medium operators and traders is 30 December 2026. For micro and small enterprises, it is 30 June 2027. The Commission has confirmed it will not reopen the EUDR text, and a third postponement is not on the table.
For palm oil specifically, these deadlines have a supply-chain implication that is easy to underestimate. Building a compliant supply chain - collecting geolocation data from hundreds of smallholders, establishing mill-level traceability, verifying the 31 December 2020 deforestation cut-off - takes months of upstream engagement. The deadline is when you need to be ready to file a DDS, not when you start the work.
If you are an EU importer of crude or refined palm oil, your Indonesian or Malaysian supplier needs to have plot-level geolocation data for every farm in your supply chain before your first post-deadline shipment. That data collection programme is happening now - or it is not happening in time.
What to do now: a practical checklist
List every palm oil or palm-derived product you import or trade. Check each CN code against the current Annex I of Regulation (EU) 2023/1115. Use our scope checker if you are unsure of your obligations.
If you import hydrogenated palm oils, palm-derived fatty alcohols, palm-oil soap, or palm-based esters, track the delegated act through the Commission's legislative process. It is not yet law, but the direction is clear. Prepare your supply chain data now so you are not scrambling after publication in the Official Journal.
Most EU importers can name their refinery suppliers. Fewer can name the mills those refineries source from. Fewer still have plot-level geolocation for the farms supplying those mills. Work backwards from your refinery to the mill gate, and from the mill gate to the farm. This is where the compliance gap lives.
Coordinates must be accurate to at least 6 decimal places. Plots up to 4 hectares: a single point is acceptable. Plots above 4 hectares: a polygon is required. Verify that your supplier's data meets this standard — not just that they have 'GPS data'.
Every plot in your supply chain must be shown to have been free from deforestation after 31 December 2020. For plots established before that date, you need land-use history evidence. For any plot where the history is unclear, that is a risk that must be assessed and mitigated or the supply excluded.
If you rely on Book & Claim, you need to upgrade to Segregated or Identity Preserved to maintain physical traceability. If you already use Segregated, confirm that your supplier's RSPO data includes the geolocation and cut-off documentation the EUDR requires — RSPO certification alone is not a DDS.
You need a documented due diligence system before you can file a DDS. Use our supplier data templates to structure your data requests, and our DDS guide to understand the TRACES NT submission process.
Stay current as the rules evolve
The Annex I delegated act is still moving through the legislative process. Country benchmarking classifications are due for review in 2026. The EUDR Information System is being updated ahead of the application date. For palm oil operators, refiners, and EU buyers, the regulatory picture will keep shifting between now and December.
Frequently asked questions
Does the EUDR apply to palm oil used as an ingredient in food products like biscuits or margarine?
It depends on how the product is classified. If you are importing a finished food product (e.g. biscuits, margarine) whose CN code appears in Annex I linked to palm oil, then yes — due diligence relates to the palm oil component. If the product's CN code is linked to a different commodity (e.g. chocolate linked to cocoa), due diligence relates to that commodity, not to any palm oil derivatives it also contains. If the product's CN code does not appear in Annex I at all, it is out of scope regardless of its palm oil content.
Does RSPO Book & Claim satisfy the EUDR?
No. Book & Claim allows buyers to purchase sustainability credits without receiving physically certified material. The EUDR requires the product itself to be physically traceable to deforestation-free plots. A credit transfer does not establish that physical link. RSPO Segregated or Identity Preserved models maintain physical traceability and are a much stronger foundation for EUDR compliance, but even these require a separate DDS submission.
Indonesia and Malaysia are standard risk — does that mean I need to do less due diligence than for a high-risk country?
Standard risk means full due diligence: information collection, risk assessment, and risk mitigation. It is less intensive than high risk (which carries a 9% annual check rate versus 3% for standard), but it is not simplified due diligence. You cannot skip the risk assessment step simply because your origin is not high risk.
What geolocation format does the EUDR require for palm oil plots?
Coordinates must be accurate to at least 6 decimal places. For plots up to 4 hectares, a single latitude/longitude point is acceptable. For plots above 4 hectares, a polygon defining the plot boundary is required. Village names, administrative regions, or mill coordinates are not sufficient.
When does the Annex I delegated act adding palm oil derivatives take effect?
It is not yet in force. The draft was published on 4 May 2026 and the public consultation closed on 1 June 2026. The Commission must formally adopt it, and the European Parliament and Council then have a scrutiny period (typically two months, extendable by two months) before it can be published in the Official Journal. Only upon that publication does it enter into force. Monitor the Commission's legislative tracker for updates.
I am a non-EU palm oil exporter. Does the EUDR apply to me directly?
Not directly — the legal obligations sit with EU operators and traders. But in practice, your EU buyers cannot comply without geolocation data, deforestation-free evidence, and legality documentation from you. If you cannot provide that data, your EU buyers cannot file a DDS, and they cannot legally import your product. The EUDR effectively reaches upstream to non-EU suppliers through contractual requirements.
Related reading
The EUDR Cut-Off Date Explained: Why 31 December 2020 Matters More Than Any Deadline
Everyone watches the 30 December 2026 application deadline. But the date that actually determines whether your land is EUDR-compliant is 31 December 2020 - and it never moved.
EUDR and Soy: The Practical Compliance Guide for Importers, Crushers, and Feed Producers
Soy is the hardest EUDR commodity to trace. This plain-English guide covers scope, the blending problem, due diligence steps, Brazil/Argentina risk, and what to do before 30 December 2026.
The EUDR Information System Relaunch: What's New and What It Means for How You File
The EUDR Information System relaunches in June 2026 with four major changes: voluntary grouping, a shorter form for micro/small primary operators, refreshed API specs, and an outage contingency plan. Here's what's new.