Current developments in ESG obligations in the EU: Omnibus Regulation and EU Deforestation Regulation

In the EU, the new year brings on the one hand hope for relief regarding ESG reporting and disclosure obligations (I. below). On the other hand, the EU Deforestation Regulation (EUDR)[1] will create new burdens for many companies (II. below)

I. Omnibus regulation on the standardization of ESG reporting obligations and revision of SFDR disclosure requirements

At the turn of the year, important developments are emerging at EU level in the area of ESG reporting and disclosure obligations.

After the European Council called for the launch of a “simplification revolution” to reduce ESG reporting requirements by at least 25 percent[2], the EU Commission announced the draft of a so-called “Omnibus Regulation” to standardize the reporting obligations of the CSRD[3] (see MoFo client alert), CSDDD[4] (see MoFo client alert) and EU Taxonomy Regulation.[5][6] An Omnibus Regulation would combine amendments to these regulatory areas in one legal act. The EU Commission has announced a draft of the “Omnibus simplification package” for the end of February 2025.[7]

In addition, the EU Commission will revise the ESG disclosure requirements in accordance with the Sustainable Finance Disclosure Regulation (“SFDR”).[8] It is also expected that the negotiations on the Green Claims Directive and the Waste-Framework Directive 2008/98/EC will be concluded in the course of 2025.

II. Applicability of the EUDR from December 30, 2025

The EUDR will be applicable as of December 30, 2025.[9]

With the EUDR, the EU is pursuing the goal of minimizing deforestation worldwide. This is to be achieved by ensuring that the commodities cattle, cocoa, coffee, oil palm, rubber, soy, and wood (“relevant commodities”) or products made from them (“relevant products”) may only be imported or exported to or from the EU if they have been obtained deforestation-free and in compliance with local legislation. This is based on the consideration that the extraction of relevant commodities is often accompanied by the irreversible deforestation of large areas, which has a negative impact on the climate, biodiversity, and the living conditions of the local population. To prevent this, the EUDR obliges operators and traders to collect information on the origin of the relevant commodities and relevant products, to check this information and to publish it once a year. The requirements are high: commodities and products must be traced back to the region of production. There is no minimum threshold in terms of quantity and value. Special regulations apply to small companies to ease their bureaucratic burden. Violations of the EUDR can result in penalties of four percent of the EU-wide annual turnover, a trade ban, and the confiscation of the corresponding products.

In detail:

III. Scope of EUDR

1. Relevant commodities and relevant products

The EUDR is product focused. Its scope of application includes the relevant commodities mentioned and the relevant products listed in Annex I EUDR[10]. These are, for example, leather gloves, beef, wood, charcoal, soybean flour and meal, books, or chocolate. These commodities or products may only be imported into or exported from the EU if the requirements of the EUDR are met. Companies can compare their product range with Annex I to check which of their products are affected.

2. Obligated companies

The regulation is aimed at companies and natural persons who import the relevant commodities or relevant products into the EU, distribute them there or export them from there. This applies regardless of the size and turnover of the company. However, there are simplifications for small and medium-sized enterprises (SMEs) (see 9. below). The EUDR distinguishes between operators and traders. In principle, they are subject to the similar obligations, Art. 5 (1) EUDR[11]. Anyone who imports or exports a relevant product commercially to the EU market or from it for the first time is an operator within the meaning of the EUDR. A trader is anyone in the supply chain other than the operator who, during a commercial activity, makes relevant products available on the market. Due to the product‑based approach, the same company can be both an operator and a trader for different products.

Non-EU companies are—at least indirectly—affected by the EUDR if they want to import a relevant commodity or a relevant product into the EU market and the import is prohibited by the authorities.

3. Timeline

In principle, the EUDR must be complied with from December 30, 2025.[12] Even if there is still some time left until this deadline, companies should check whether their products fall within the scope of the EUDR and—in light of the sanction risks—align their processes with the new requirements. Upstream supply chains will need to be examined. Suppliers will need to be instructed on the new requirements to be able to fulfill the comprehensive documentation and verification obligations. In many cases, purchasing and quality assurance processes will probably need to be adapted.

The EUDR will not apply to micro and small enterprises until June 30, 2026.[13] Micro enterprises are those that meet the limits of at least two of the following three size criteria on the balance sheet date: (i) 450,000 euros in total assets, (ii) 900,000 euros in net sales, (iii) 10 employees; for small enterprises, the relevant thresholds are: (i) 5 million euros in total assets, (ii) 10 million euros in net sales, (iii) 50 employees. Member States may set higher thresholds.[14]

The EUDR does not apply to products produced before December 30, 2025. For timber products, the provisions of the Timber Regulation (EUTR, Regulation (EU) 995/2010) remain temporarily applicable.

[15]

4. What obligations apply?

According to Art. 3, relevant commodities and products may only be imported into or exported from the EU or distributed in the EU if they:

1. are deforestation-free,
2. have been produced in accordance with the relevant legislation of the country of production and
3. are covered by a so-called due diligence statement.

If one of these requirements is not met or cannot be proven, the product in question may not be traded on the EU market.

4.1 What does deforestation-free mean?

Relevant commodities must not have been produced on land that was deforested, i.e., converted to agricultural land, after December 31, 2020, Art. 2 no. 13. In addition, wood harvested from forests must not have led to forest degradation.

4.2 Which regulations of the countries of origin must be observed?

The regulations are defined in Art. 2 no. 40. They include provisions on environmental protection, land use, anti-corruption, and human and labor rights. With regard to indigenous peoples, the principle of free, prior and informed consent (FPIC) must also be upheld.

4.3 What needs to be declared in the due diligence statement?

The due diligence statement certifies compliance with the due diligence obligations (see 5.). The required information is listed in Annex II.

In the due diligence statement, the company assumes responsibility for ensuring that the relevant products meet the requirements of the EUDR. The due diligence statement is submitted to the EU information system, which companies have been able to register for since November 2024.[16] By submitting the due diligence statement, companies receive a reference number that they need in order to import relevant products into the EU or export them from the EU. The competent national authority may inspect the due diligence statement for control purposes.

5. Three-stages of due diligence, Art. 8

The EUDR establishes a due diligence process of three stages.

5.1 Collection of information, Art. 9

Relevant information about the products must be collected. This includes the trade name and product composition, but also information on geolocation. The location of all plots of land on which commodities are extracted must be determined. Furthermore, evidence of compliance with local legislation must be collected. Close cooperation with local suppliers is recommended for this purpose.

5.2 Risk assessment, Art. 10

The next step is to carry out a risk assessment based on the information collected to determine the conformity of the products concerned. Relevant criteria will result from the benchmark system for the countries of origin of the relevant commodities and products which is yet to be published by the EU Commission. The benchmark system will distinguish between high, normal, and low risk countries. In accordance with its announced methodology for the risk assessment, the EU Commission is likely to ascribe a low risk to most countries.[17] Furthermore, Art. 10 (2) lists non-exhaustive criteria such as the risk of deforestation or corruption in the country of production, which must be taken into account for the risk assessment. Companies can use certification systems from external providers for the risk assessment.

5.3 Risk mitigation, Art. 11

Only if the risk assessment concludes that the products do not comply with the provisions of the EUDR or that there is a non-negligible risk of non-compliance, risk mitigation measures must be taken. For this purpose, further information can be requested, or audits can be carried out.

6. Simplified due diligence, Art. 13

A simplified due diligence obligation applies to commodities and products from countries with a low-risk status. In view of the benchmarking method chosen by the EU, this could apply to a large number of countries. In this case, only the information on absence from deforestation needs to be collected. The risk assessment and mitigation are not required if there are no indications that the products are non-compliant.

7. What due diligence obligations apply along the supply chain?

Along the supply chain, it must be checked whether the due diligence obligations have been complied with for the upstream product, Art. 4 (9). For this purpose, it may be sufficient to submit a separate due diligence statement in which reference is made to the previous due diligence statement of the upstream operator. However, operators and traders who refer to an upstream due diligence statement remain responsible for ensuring that the relevant product is compliant, Art. 4 (10).

8. Documentation and reporting obligation, Art. 12

In order to comply with the due diligence obligations, operators and traders must establish a framework for documentation, evaluation, verification, and reporting, which must be reviewed annually. Companies must also report annually on the measures taken to comply with the due diligence obligations in a way that is publicly accessible and available on the internet, Art. 12 (3). The report must contain an overview of the compliance with the criteria from Art. 3, as well as conclusions of the risk assessment and, if applicable, any measures taken to mitigate risks.

Companies that are required to report under CSRD or CSDDD can integrate EUDR reporting into these reports. However, CSRD or CSDDD reporting does not exempt from reporting under the EUDR. In view of the Omnibus Regulation announced by the EU Commission (see I.), adjustments are also to be expected here.

9. Facilitation for SMEs

If the relevant commodities and products have already undergone a full due diligence investigation, SME operators may refer to the existing due diligence statements and are not required to exercise their own due diligence, Art. 4 (8). The EUDR defines SMEs as companies that are neither micro enterprises nor large enterprises within the meaning of Directive 2013/34/EU. Large enterprises are those that exceed at least two of the following three size criteria on the balance sheet date: (i) 25 million euros in total assets; (ii) 50 million euros in net sales; (iii) 250 employees.

SME traders do not have to fulfill the due diligence obligations mentioned above (see 5.). They only must collect relevant information (name, address, reference numbers of the assigned due diligence declarations) of the supplier or the corporate customer and store it for five years, Art. 5 (3, 4).

The following applies with regard to the obligations: 

IV. Penalties

As an EU regulation, the EUDR is directly applicable. However, the member states are responsible for its enforcement. In Germany, the Federal Agency for Agriculture and Food (Bundesanstalt für Landwirtschaft und Ernährung, BLE) is expected to be responsible for monitoring compliance with the EUDR requirements. Its checks will be risk-based and by chance.

Violations may result in (i) fines (maximum amount of at least four percent of the EU-wide net annual turnover), (ii) confiscation of the products and revenues concerned, (iii) temporary exclusion from public procurement processes, and (iv) a temporary prohibition of the respective business activity (Art. 25).

In addition, the EU Commission will publish final judgements against companies, stating the company, the penalty, and the violation.

V. Practical significance

Companies should use the coming months of 2025 to familiarize themselves with the requirements of the EUDR and, if necessary, take measures to ensure that their products are deforestation-free. In particular, the following measures can be considered:

• Screening of product range: Companies should check whether and, if so, which products or product parts are covered by the EUDR.
• Collection of data: Collecting (geolocation) data on relevant commodities can be time‑consuming. Companies should start collecting data now and contact local producers at an early stage if necessary.
• Observation of local regulations: Relevant products and goods must be produced in compliance with certain local regulations. Globally active companies should familiarize themselves with the relevant social and environmental laws in the countries of production.
• Registration for the EU information system: Affected companies have been able to register for the EU information system since November 2024.
• Review of the EU country benchmark system: The EU Commission plans to publish its country benchmark system in June 2025. Companies will then be able to check how regions of origin are classified and may benefit from simplified due diligence measures.
• Familiarization with application notes: Companies should use the time to familiarize themselves with the Q&A catalog and the current guidelines of the EU Commission and national authorities on the application of the EUDR.
• Usage of synergies: Overlaps with other ESG requirements can be utilized. Existing risk management systems for the supply chain can be used for this purpose. In addition, the upcoming EUDR reporting obligation can be integrated into existing ESG reporting obligations.
• Monitoring of the legislative process: Companies should monitor further developments in the area of ESG. Following implementation of the CSRD, certain companies will have to prepare a sustainability report for the year 2025. It remains to be seen what impact the announced Omnibus Regulation will have in this respect.

Research assistant, Janik Meyer, has contributed to this client alert.

[1] Regulation (EU) 2023/115.

[2] Point 4 of the Budapest Declaration on the New Deal for European Competitiveness of November 8, 2024

[3] Corporate Sustainability Reporting Directive, Directive (EU) 2022/2464, (see also our Client Alert).

[4] Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760, (see also our Client Alert).

[5] Regulation (EU) 2020/852.

[6] See the Commission’s press conference from Budapest, minutes 28:25 - 29:30. 

[7] See the register of Commission documents, “Tentative agenda for forthcoming Commission meeting”. 

[8] Categorisation of products under the SFDR: Proposal of the Platform on Sustainable Finance

[9] EU deforestation law: Council and Parliament agree on its targeted amendment

[10] In the following text, references to annexes always refer to the EUDR.

[11] Article designations refer to the EUDR.

[12] See Regulation 2024/3234 amending the EUDR with regard to the provisions on the date of application.

[13] See Regulation 2024/3234 amending the EUDR with regard to the provisions on the date of application.

[14] The thresholds for small and micro-enterprises are set out in Directive 2013/34/EU.

[15] Own illustration.

[16] https://eudr.webcloud.ec.europa.eu/tracesnt/login .

[17] https://ec.europa.eu/commission/presscorner/detail/de/ip_24_5009.

[18] Own illustration.