EUDR for Shopify Sellers: Operator, Trader or Neither

A supplier sends a questionnaire asking which plots of land your coffee was grown on. A wholesale customer in Rotterdam wants a reference number for a statement you have never filed. Somewhere behind both is the EU Deforestation Regulation, and the useful first answer is that the heavy version of it is probably not your job.

Regulation (EU) 2023/1115 covers seven commodities and the products made from them. What you owe depends entirely on where you sit in the chain, and that is the part the EU rewrote in December 2025 by creating a third role, so a great deal of what was published about this Regulation in 2024 describes a rulebook with one fewer role than the current text has. This guide answers three questions: which lane you are in, what that lane requires, and which of the two dates is yours.

The Quick Verdict

Find your chain in the left column. Everything after this table is the reasoning underneath it.

What the EU Deforestation Regulation Actually Regulates

The Regulation attaches to an act rather than to a company. Placing a product on the market, making it available there and exporting it are the three moments it governs, and every obligation on this page hangs off which of those you actually perform. That is why two merchants selling the identical bag of coffee beans can owe completely different things.

It is also worth being clear about what it does not do. There is no EUDR fee and no threshold of order value below which it stops applying.

There is, however, a customs step: the person lodging the customs declaration has to make the due diligence statement reference number — or the declaration identifier, for a micro or small primary operator — available to customs authorities before a relevant product is released for free circulation or exported — a step Article 26(4) switches off for the export of a relevant product by a downstream operator. The consequence of getting the Regulation wrong is that the goods are not supposed to be on the market at all, which is a different kind of problem from an unexpected bill.

The Seven Commodities, and What They Look Like in a Catalogue

Read the left column as a materials list rather than a product list. The question the Regulation asks is what the item is made of, and the answer is usually in your supplier specification rather than in your product title.

The right-hand column is what settles it: Article 1(1) applies the Regulation to relevant products “as listed in Annex I” that “contain, have been fed with or have been made using” one of the seven commodities. Both halves have to hold: the commodity has to be in the item, and the item has to carry a CN line of its own in Annex I.

Commodities and derived-product examples as named by the European Commission; CN codes as listed in Annex I to Regulation (EU) 2023/1115. Read September 2026.

If you read all seven rows and recognised nothing in your own catalogue, the commodity gate has closed the question rather than deferred it: with no covered commodity there is nothing for the rest of this Regulation to attach to. The second gate matters only for catalogues that did recognise something, and it is set out in the section immediately below on the EU market itself.

One line came out of Annex I in December 2025. The amending regulation deletes “ex 49 Printed books, newspapers, pictures and other products of the printing industry, manuscripts, typescripts and plans, of paper” from the Annex I table. Only that printed-matter line was removed; the pulp and paper entries it sat beside stayed, so a paper product is not automatically out.

When the Regulation Does Not Reach You at All

The commodity gate is the one that excuses most Shopify catalogues outright. A store selling phone accessories, software, jewellery without leather, or printed apparel simply never meets a covered material, and no amount of EU volume changes that.

The market gate is the one that non-EU sellers ask about most, and the Commission answers it in one sentence on its own implementation pages.

There is a second half to that page worth knowing before you reply to anyone: non-EU producers and companies may still be asked to provide information, such as where products were grown, harvested or raised, so that EU-based companies can meet their own requirements. Being outside the Regulation does not make you outside your customer's paperwork.

It Is the Product, Not the Box It Ships In

The cardboard your order travels in is a different regulation with a different register. If the question in your head is whether the mailer, the void fill and the tape create an obligation, that belongs to packaging extended producer responsibility, and our guide to EU packaging rules for Shopify sellers answers it directly. The EUDR looks past the packaging at the material the product itself is made of.

Operator, Downstream Operator, Trader: the Test in the Text

The reason this topic reads as harder than it is comes down to vocabulary. Three of the four answers below are legal terms with precise definitions, and the definitions were rewritten in December 2025, so a 2024 article and the current text can describe the same merchant differently.

The newest of the three is the one worth reading twice, because its definition contains its own eligibility test. A downstream operator is not simply someone further along the chain; it is someone whose inputs are all already covered.

The same amendment rewrote the trader definition to match, so it now reads “any person in the supply chain other than the operator or downstream operator” who makes relevant products available on the market. Trader is therefore the residual role: if you are neither of the first two, and the commodity gate and the EU gate are both crossed, that is what you are.

When You Become an Operator

The definition is mechanical rather than commercial. It does not ask how big you are, whether you own a warehouse or how many of the goods you sell — only who first made them available inside the Union. A small brand importing two pallets of green coffee is an operator; a much larger retailer buying the roasted result from a Dutch wholesaler is not.

The chain that breaks this rule of thumb is the direct parcel. When a supplier outside the EU ships each order straight to the buyer, the answer depends on who is named as importer of record on the customs entry, and that is a decision your delivery terms already made. If you do not know whether your EU orders run DDP or DDU, that is the fact to establish first, and our guide to the two EU delivery models sets out the difference.

What Your Lane Actually Requires

Reading the table below in one direction is the point of this article. Find your lane in the verdict above, then read that column top to bottom; the other column tells you what you are being spared, which is useful mainly for answering a supplier who assumes you owe it.

Article 5 as replaced by Regulation (EU) 2025/2650; the operator column reflects the due diligence structure the European Commission describes. Read September 2026.

The Article 5 File: What a Trader or Downstream Operator Keeps

The text is unusually concrete about what an identity block contains, which makes this the rare compliance job you can finish rather than interpret.

1. Who supplied you. The name, registered trade name or registered trade mark, the postal address, the email address and, if available, a web address of the operators, downstream operators or traders who supplied the relevant products to you.
2. The statement reference, conditionally. The reference numbers of the due diligence statements or the declaration identifiers associated with those products — but the text asks for this only in the event that your supplier is an operator, which is why establishing your supplier's own role is part of the job.
3. Who you supplied. The same identity block for the downstream operators and traders you sold to. Article 5(3)(b) names those two roles, so a business buying for its own use is not on this list, and neither is a consumer order.
4. Five years, and on request. The information is kept for at least five years from the date of the placing or making available on the market or export, and provided to the competent authorities when they ask for it.

A further duty sits beside the file and is easy to miss because it is not a record at all. Where you obtain or are made aware of new information — including a substantiated concern — suggesting a product you have already placed or made available is at risk of non-compliance, you inform the competent authorities of the member states concerned immediately, and the businesses you supplied it to.

What Full Due Diligence Means — and Where This Guide Stops

This article deliberately stops at naming the lane and the destination. Walking a merchant through geolocation data, plot boundaries and risk-mitigation measures is legal work with real consequences, and a blog post is the wrong instrument for it.

Where the statement is filed is a plain fact worth having, because most guidance names a system without saying what it is. It is not a new portal: the EUDR information system is described by the Commission as a specialised online tool of the TRACES platform, which allows operators and their authorised representatives to create due diligence statements and simplified declarations.

Two Narrow Lanes That Make It Lighter

The first lane comes out of the country benchmarking system. An operator sourcing relevant products from countries classified as low risk may conduct simplified due diligence where it is certain that all of the products were produced in low-risk countries and have not been mixed with high-risk, standard-risk or unknown-origin products. That operator still collects information demonstrating compliance; what it does not need is a full risk assessment or risk mitigation measures.

We name no countries here, because the classification is set by its own implementing act and we did not verify the list.

The second lane is narrower than its name suggests. A micro or small primary operator is a natural person or a micro or small undertaking established in a low-risk country that places on the market products it grew, harvested, obtained from or raised itself. A merchant who buys and resells does not qualify, however small the business is, because the definition is about production rather than size.

The Two Dates, and Who Each One Is For

Article 38 of the amended text carries both dates in the same place. Read the table by finding the row that describes you rather than the row with the date you would prefer — the row is what decides when your own obligations begin.

Article 38(2) and 38(3) of Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650. Read September 2026.

The European Commission publishes the same two dates in plainer words: large and medium operators from 30 December 2026, micro and small operators from 30 June 2027, and micro and small operators already covered by the EU Timber Regulation from 30 December 2026. That third line is the same carve-out the legal text expresses as an exception for products in the annex to the old Timber Regulation.

Which Date Is Yours, in the Words of the Text

It is worth reading the two paragraphs next to each other, because almost every summary of this Regulation collapses them into a single sentence about company size.

“2. Subject to paragraph 3 of this Article, Articles 3 to 13, Articles 16 to 24 and Articles 26, 31 and 32 shall apply from 30 December 2026. 3. Except as regards the products covered by the Annex to Regulation (EU) No 995/2010, for operators, whether natural persons or micro- or small undertakings within the meaning of Article 3(1) or Article 3(2), first subparagraph, respectively, of Directive 2013/34/EU, irrespective of their legal form, who were established as such by 31 December 2024, the Articles referred to in paragraph 2 of this Article shall apply from 30 June 2027.”

Article 5 — the whole of the light lane — sits inside “Articles 3 to 13”. So the record set described above becomes binding on 30 December 2026 for a trader of any size, and the later date in paragraph 3 is written for operators.

Four Conditions Hide Inside the Later Date

The cost of reading this wrong is six months of preparation, so the conditions are worth listing separately rather than as one long sentence. They are cumulative, not alternatives.

1. You are an operator. The derogation says “for operators”. A trader or a downstream operator is not addressed by it, whatever their size.
2. You are a natural person, a micro undertaking or a small undertaking within the meaning of Article 3(1) or Article 3(2), first subparagraph, of Directive 2013/34/EU. Those two subparagraphs carry the harmonised figures — and the amendment tied the Regulation's own SME definition to the same “first subparagraph” wording, so a national threshold raised above them does not widen this door.
3. You were established as such by 31 December 2024. This is a test about the past, not about your size today. A business that started trading in 2025 or 2026 does not qualify however small it is.
4. Your products are not covered by the Annex to Regulation (EU) No 995/2010 — the old EU Timber Regulation list. Wood products carried by that annex keep the December 2026 date even for a micro operator.

The Date Has Already Moved Twice

The history matters for one practical reason: it explains why so much of the advice you will find online quotes a date that has already been superseded, and why a 2024 explainer can describe two roles where the text now has three.

Whether it moves a third time is not something this page will predict. What can be said precisely is the mechanism: only a further regulation of the European Parliament and of the Council can change these dates, which is exactly how both previous moves happened, and both are recorded against the Regulation on EUR-Lex.

Find Your Lane and Your Date

The verdict table at the top answers by chain: you recognise your situation in one row and take the answer. This quiz answers by combination instead, and it adds the axis a table row cannot carry — it returns your date as well as your role, because the date depends on four things crossed at once.

Five questions, and the first two are gates rather than scoring: answer either of them the wrong way and the Regulation stops there.

Build the File Your Lane Needs

Steps one to three are the same in every lane, because even an operator has to know which products are involved and who supplied them. Step four is where the lanes separate: a trader files nothing, while an operator turns the same information into a statement. Do step one before you buy any tooling — it is the step that tells you whether this is a spreadsheet job or a product-data project.

What Shopify Does — and Does Not Do — About the EUDR

It is worth being precise here rather than categorical, because a platform can ship a feature the week after an article is published. What we can report is what we read, and when.

The page closest to the topic is the Managed Markets overview, and reading it carefully is what shows the boundary. It says Managed Markets complies with local laws for cross-border products, restricts certain products to specific destinations, and creates commercial invoices and remits them where they are needed — a customs, tax and restricted-goods description. None of it speaks to whether a hide you bought as material came from land deforested after the cut-off date, which is the question this Regulation asks.

The practical consequence is that your EUDR file lives in your product data. That is not a complaint about Shopify: the information the Regulation wants is about your suppliers and your materials, and no storefront platform holds it by default. What it does mean is that nobody will build the file for you as a side effect of anything you already pay for.

Can an App Do This for You?

Three listings mentioned EUDR functionality when we looked on 1 September 2026: EU Compliance, which is the closest fit and links suppliers and land parcels to SKUs; PassoNext, a broader digital product passport tool that covers the EUDR among several regulations; and EAS EU & UK Compliance, which is primarily a VAT service where the EUDR is one item among many. App Store search renders in the browser, so treat that as a dated snapshot rather than a complete market.

We are deliberately not ranking them or quoting their prices. The useful test is the same for all three: an app is a filing cabinet for the Article 5 file, and buying one before you know whether you are a trader or an operator solves the wrong problem.

Other EU Rules People Confuse With This One

They arrive in the same inbox, usually in the same month, and they get merged in merchants' minds. Keeping them on separate tracks is cheaper than untangling them later.

Product safety is the neighbour most often merged with this one, because both attach to the item rather than to the box. The difference is the question: GPSR asks whether the product is safe and who inside the EU answers for it, while the EUDR asks where the material came from. If what you actually need to know is whether product safety covers your range, our guide to what GPSR covers answers that in one section.

The fourth row is there because 2026 has been a heavy year for EU rules that reach a Shopify store from different directions. The EU AI Act can arrive twice: through the AI you use to write product copy or answer customers, and through AI that is itself part of what you sell. The Act is a separate regime, and our EU AI Act guide for Shopify sellers is where it lives.

The Bottom Line

The reason this Regulation feels heavier than it is comes from where the answer sits. Most coverage is written for the importers of soy and timber it was designed around, in the vocabulary of a legal text that changed its own role structure in December 2025. Translated into a merchant's terms it is one question about your chain, and then either a file or a legal process.

Frequently Asked Questions