The EUDR and the food industry – cocoa, coffee and palm oil under the microscope of the new regulations

Chocolate, pralines, ground coffee, margarine, crisps, energy bars and even some dietary supplements – these are just some of the food products which, from 30 December 2026 (and for micro and small businesses from 30 June 2027), will be required to have documented, ‘clean’ origins for their raw materials. The EUDR Regulation (EU 2023/1115) is no longer solely a matter for the timber or furniture industries – it is one of the most pressing compliance challenges facing the entire FMCG and food processing sectors in the coming months.

In this article, we answer the questions we most frequently hear from food importers and manufacturers: which CN codes are covered by the regulations, what specific obligations your company faces, how to verify a supplier from Côte d’Ivoire or Indonesia, and what to do about contracts signed before the regulations came into force.

Which foodstuffs are covered by the EUDR?

The Regulation identifies seven groups of ‘relevant’ goods – three of these are key for the food industry:

Cocoa – cocoa beans, cocoa husks, cocoa paste, cocoa butter and cocoa fat, cocoa powder, chocolate and other food products containing cocoa.

Coffee – roasted and unroasted coffee, decaffeinated coffee, coffee husks and chaff, and coffee substitutes containing coffee in any proportion.

Palm oil – palm nuts and kernels, palm oil, oilcake and extraction residues, as well as derivatives used in food processing, such as glycerine and fatty acids.

Added to this is soya (soya meal, soya oil, lecithin) – a raw material that is easily overlooked, yet which is found in a great many bakery and confectionery products, as well as animal feed.

How to check whether your product is covered by the regulations

The mere fact that a product contains cocoa or palm oil does not automatically mean it is covered by the EUDR – the decisive factor is the CN code specified in Annex I to the Regulation. If the product code is not listed in the annex, there is no formal obligation, even if the raw material is physically present in the composition. Therefore, the first step should be a thorough tariff classification of the entire product portfolio, rather than a rough assessment based on the list of ingredients.

It is also worth bearing in mind that the list of CN codes covered by the EUDR is not permanently fixed – following the amendment of December 2025 (Regulation 2025/2650), the European Commission may amend Annex I by means of a delegated act, without going through the full legislative procedure. Work is already underway to bring products such as instant coffee within the scope of the regulation, which until now has been a loophole resulting from an error in customs classification. Food industry companies should therefore monitor changes to the annex at least once a quarter.

Specific obligations of food importers

For an operator placing a food product containing cocoa, coffee or palm oil on the EU market for the first time, the EUDR entails, in practice, three categories of obligations.

1. Gathering information on the product and its origin. In accordance with Article 9 of the Regulation, the following information must be collected for each consignment: a description of the product (trade name and full name of the raw material), the quantity expressed as net weight in kg, the country of production, and, most importantly, the geolocation of the plots on which the raw material was grown or harvested – GPS coordinates for plots up to 4 ha, and a polygon (outline) for larger plots. This is the requirement that, in practice, causes the most difficulty for the food industry, as cocoa and coffee supply chains tend to be fragmented and multi-stage (smallholder farmers → purchasing intermediary → exporter → trader → processor).
2. Risk assessment. It must be determined whether there is a risk that the raw material originates from land deforested after 31 December 2020. The assessment takes into account, amongst other things, the country’s risk classification (the Commission categorises countries as low, standard or high risk), the supplier’s compliance history, the complexity of the supply chain and the availability of reliable documentation.
3. Mitigating risk and submitting a Due Diligence Statement (DDS). If the risk is assessed as higher than negligible, it must be mitigated – for example, through an additional supplier audit or independent verification of data – before the goods are placed on the market. Only after this stage can a Due Diligence Statement be submitted via the TRACES system.

In Poland, the competent authority for cocoa, coffee, palm oil and soya is the Agricultural and Food Quality Inspection Authority (IJHARS). It is IJHARS that will carry out inspections and impose sanctions on food companies that fail to fulfil their obligations.

The DDS reference number must accompany the goods as early as the customs declaration stage – we discuss in more detail how the EUDR is changing customs clearance and trade procedures in the article ‘EUDR, logistics and customs – what is changing in the trade of goods?’.

How to vet suppliers from high-risk countries

Most cocoa beans are imported into Europe from Côte d’Ivoire and Ghana; coffee from Brazil, Vietnam and Colombia; and palm oil from Indonesia and Malaysia. The Commission classifies some of these countries as ‘standard risk’, whilst certain regions within them are classified as ‘high risk’. This classification may change and can even vary between regions within a single country, which is why verification cannot be a one-off exercise.

In practice, it is advisable to:

• Request geolocation data at plot level from the supplier, rather than just the general address of the purchasing company or transhipment port – this is the most common error in initial declarations.
• Check the consistency of documents – ensure that the geolocation data matches the invoices, certificates of origin and quantity declarations.
• Build a supplier register with risk assessments, updated at least once a year or whenever there is a significant change in the supply chain.
• Include EUDR clauses in commercial contracts – obliging the supplier to provide geolocation data, to update this information when production plots change, and to accept liability for false declarations.
• Bear in mind that a certificate (e.g. Rainforest Alliance, UTZ, RSPO) facilitates risk assessment but does not replace it – you still need to have your own geolocation data and your own due diligence documentation.

What to do about existing supply contracts

Many food importers have annual or multi-year contracts for the supply of cocoa, coffee or palm oil, which do not include any EUDR obligations. This poses a real business risk: a lack of geolocation data from the current supplier may, in practice, prevent the goods from being placed on the EU market once the regulation comes into force, regardless of the commercial terms of the contract.

Recommended actions:

1. Review (audit) existing contracts to ascertain whether the supplier is at all able to provide geolocation data and a declaration of no deforestation.
2. Negotiate addenda introducing an obligation to provide EUDR data with every delivery, specifying a clear deadline and format for submission (e.g. geoJSON file, table of coordinates).
3. Draw up a contingency plan for high-risk suppliers – if a supplier is unable or unwilling to provide the required data, it is advisable to identify alternative EUDR-compliant sources of raw materials now, to avoid a disruption in the supply chain just before the regulations come into force.
4. Determine who in the supply chain is the ‘first operator to place the product on the market’ – following the amendment in December 2025, it is this operator who submits the DDS; operators further down the supply chain (downstream) may rely on the supplier’s declaration, which effectively reduces the administrative burden for some food businesses.

Frequently asked questions

Is chocolate produced in Poland from imported cocoa subject to the EUDR?
Yes, if the CN code of the finished product is listed in Annex I and the product contains cocoa or its derivatives – regardless of the fact that processing takes place within the EU.

Is instant coffee covered by the EUDR?
Work is currently underway to formally include it within the scope of the regulation – its previous omission from the list was due to an error in the classification of CN codes. It is worth keeping an eye on updates to Annex I, as the Commission may introduce changes by means of a delegated act.

What is the penalty for non-compliance with the EUDR?
Sanctions are determined by the Member States – they may include financial penalties of up to 4 per cent of a company’s annual turnover in the EU, confiscation of goods, a temporary ban on placing products on the market, and exclusion from public procurement.