EUDR for Non-EU Suppliers | What Your EU Buyer Needs

EUDR for non-EU suppliers doesn’t work the way most people assume. The EU Deforestation Regulation does not apply to you directly — if your business sits outside the European Union, no EU authority will inspect your mill or fine your company.

That is where most suppliers stop reading, and it is the wrong conclusion.

The obligation lands on the EU operator who places your product on the market. They cannot meet it without data that only you hold. So the regulation reaches you through your contracts, not through enforcement — and commercially that is a sharper instrument. An authority might fine you. A buyer can simply stop ordering.

With EUDR applying from 30 December 2026 for large and medium operators, EU buyers are working backwards from that date now. Most want supplier data in place well before, because they need time to test it before their own liability begins.

What is legally required from your EU buyer

Your customer must submit a Due Diligence Statement through the EU Information System before your product enters the EU market. To do that lawfully they must have collected, for every consignment:

The country of production
Geolocation of the plots where the material was grown — GPS coordinates for each plot, and full polygon boundaries for any plot larger than 4 hectares
The date or time range of production
Evidence the material was produced legally under the laws of the producing country
Enough information to show the material is deforestation-free — no conversion of forest after 31 December 2020

They then assess risk, mitigate where risk is more than negligible, and file the statement.

When you re-read that list from your side of the transaction, you will notice that every activity is something that happens at your end of the supply chain. Your buyer cannot invent any of it.

What this means you have to produce

Plot-level traceability

This is the requirement that causes the trouble, and it is worth being blunt about why.

Most supply chains in the region were built to prove legality, not origin geometry. A mill can usually demonstrate that its material was legally harvested and legally transported. Far fewer can point at a map and say which specific plots a given container came from, and produce boundary coordinates for each.

If you buy from smallholders, traders or a mixed pool of suppliers, this is where the work is. It means going back up your chain, identifying every source, and capturing coordinates — plus polygons above 4 hectares. That is fieldwork and record-keeping, and it takes months rather than weeks.

Legality evidence under your national system

Your existing national documentation does much of this job:

Vietnam — VNTLAS documentation
Malaysia — MTCS certification and associated legality records
Elsewhere in the region, the equivalent national legality evidence

These systems were not designed for EUDR and do not map onto it perfectly, but they are the foundation. Do not rebuild what you already hold — establish what it covers, then fill the gaps.

A repeatable way to hand data over

A one-off spreadsheet assembled under pressure for one shipment is not a system. Your buyer needs this per consignment, indefinitely. Whatever you build has to survive staff turnover and scale to every order.

Does your risk category change any of this?

Partly — and there is a widespread misreading worth correcting.

Under the Commission’s country benchmarking, Vietnam and Thailand are low risk, Malaysia is standard risk, and Myanmar is high risk. Most of the world, over 140 countries, sits in the low-risk tier.

Low risk means simplified due diligence, not exemption. Your buyer still files a Due Diligence Statement. The information — including geolocation — must still be collected. What is reduced is the risk assessment and mitigation stage, and the share of operators authorities inspect drops to 1%.

So if you export from Vietnam or Thailand, your paperwork burden is genuinely lighter than a Malaysian competitor’s. It is not zero, and a buyer who is told “we’re low risk, so we don’t need to provide that” will find another supplier.

One caution: the classification is not permanent. Parliament objected to the benchmarking methodology in July 2025, and the Commission has committed to reviewing the list during 2026. Building a compliance system that only works while you remain low risk is a fragile plan.

Where PEFC and FSC certification fit

Certification and EUDR compliance are not the same thing, and conflating them is expensive.

A chain of custody certificate demonstrates that your material handling, claims and record keeping are controlled and independently audited. It does not, by itself, discharge your buyer’s due diligence obligation. No EU operator can file a compliant statement by pointing at your certificate alone.

What certification genuinely gives you:

Documented procedures, internal audit discipline and management review — the operational spine that EUDR data collection needs
Existing supplier records and traceability, which is a substantial head start on plot-level work
Credibility with buyers assessing which suppliers to keep

Both schemes have built an EUDR route on top of their existing standards, and both work the same way — a voluntary add-on requiring additional audit, not something your current certificate covers automatically.

The PEFC route

PEFC has published an EUDR Due Diligence System module, PEFC ST 2002-1:2024, designed to sit alongside chain of custody certification and address the regulation directly.

The FSC route

FSC offers the Regulatory Module, marketed as “FSC Aligned for EUDR” — a voluntary add-on for operators carrying the main EUDR burden or wanting to demonstrate readiness. Independent benchmarking by ASI has confirmed strong alignment with the regulation’s requirements. Separately, FSC has required that all material from FSC-certified management units meets deforestation-free requirements from 1 January 2026, which strengthens the baseline even without the module.

Which one

In practice, whichever scheme you already hold, the logic is the same: neither module is a shortcut to compliance, and neither removes your buyer’s obligation. What they give you is an audited, documented process a buyer can rely on, rather than a spreadsheet you assembled yourself.

One caution: FSC is currently consulting on updates to the Regulatory Module following the May 2026 amendments to the regulation. Check the current version before committing to an audit.

What to do between now and December

Ask your EU customers what they need, in writing. Their requirements will be more specific than the regulation, and they set the real deadline.
Map your supply base. List every source. Mark which you can already locate to plot level and which you cannot. The gaps are your project.
Start the geolocation work on the gaps. This can be a real challenge. Nothing else takes as long.
Audit your legality documentation against the EUDR information list rather than against your national scheme’s requirements.
Decide on the PEFC or FSC EUDR module — whether the certified route is worth it for your buyer relationships.
Build the handover process and test it on one real consignment before you need it.

Suppliers who start this in August have time to do it properly. Suppliers who start in November will be assembling evidence under pressure while their buyers are deciding who to keep.

Get TimberChain's EUDR Checklist

Where to start

If you are not certain whether your current records will satisfy your EU customers, a readiness review will tell you. I look at your supply chain, your existing certification and your documentation, and set out plainly what is missing and how long it will take to close.