EUDR and palm oil: obligations, traceability and supplier risk

Three workstreams follow for a food or cosmetics company: classify each product precisely by customs code, trace back to the oil palm plot of land, and document a supplier risk assessment. This guide applies these three workstreams to the palm sector and, for the general framework, refers to our guide to the EUDR.

In short

Scope: which palm oils, fractions and derivatives fall under the EUDR

The starting point is never an ingredient's trade name: it is its customs classification. The HS (Harmonized System) is the international nomenclature; in the EU, it is broken down into eight-digit CN (Combined Nomenclature) codes. It is this code, checked against Annex I of the regulation, that determines whether a product is in scope.

Crude palm oil and its fractions (heading 1511)

Heading 1511 covers “palm oil and its fractions, whether or not refined, but not chemically modified”. It therefore includes, under the same logic:

• crude palm oil (CPO, crude palm oil), obtained by pressing fruit bunches;
• refined, bleached and deodorised palm oil;
• the fractions separated from it: palm olein (liquid, widely used in frying and industrial cooking) and palm stearin (solid, for fats and soaps).

Note that the wording “whether or not refined” rules out from the outset the argument “my product is processed, so it is out of scope”.

Palm kernel: a second material within the same sector

The oil palm produces two distinct fats, which follow different supply routes:

The operational stakes are real: a company may have mapped its palm oil and discover that its palm kernel expeller, palm kernel oil or oilcake also fall under Annex I, with an origin sometimes documented by other suppliers.

Derivatives: glycerol, fatty acids, fatty alcohols

This is the point that most surprises Purchasing and R&D teams, particularly in cosmetics and hygiene products. Several derivatives are already listed in Annex I, regardless of their end use:

The 2026 extension: new derivatives applicable from 30 December 2027

Delegated act (EU) 2026/2102, published in the Official Journal of the European Union in September 2026, amends Annex I. For the palm sector, it adds several oleochemical derivatives, notably under customs headings 2905, 2915, 2916, 2921, 2923, 2924, 3401, 3823, 3824 and 3907 - fatty alcohols, acids, esters, soaps, amines, polyethers - where they are derived from oil palm. The prefix “ex” means that only the part of the code corresponding to these products is covered.

Two important clarifications:

• these new lines only apply from 30 December 2027, to give supply chains time to prepare;
• the same act creates explicit exclusions, including palm derivatives used in the manufacture of medicinal products for human or veterinary use, waste and second-hand products, samples intended for testing or analysis, and packaging used solely to contain, protect or transport other products.

The six-digit code and “ex” trap

A six-digit HS code is almost always insufficient. The Annex I wording is read at the level of the eight-digit CN code, and sometimes at the level of a subset marked “ex”. In practice:

• a finished product containing palm oil is not automatically in scope: its code must also be listed in Annex I;
• the “ex” mention requires comparing the goods with the precise description of the entry, not just with its heading;
• the classification must be confirmed in writing with the customs team, product by product, with the justification kept for audit.

“Palm oil and its fractions, whether or not refined, but not chemically modified”Regulation (EU) 2023/1115, Annex I, heading 1511 · consolidated text, EUR-Lex

Deforestation and palm oil: why the sector is at the heart of the regulation

What the data shows

Deforestation and palm oil are linked by a simple mechanism: planting palms requires converting land, sometimes forest land. The orders of magnitude published by the FAO (Food and Agriculture Organization of the United Nations) shed light on the context:

• over 2000-2018, cropland expansion was the leading driver of global deforestation, accounting for nearly 50 % of the total;
• palm oil alone is estimated to account for around 7 % of that deforestation, i.e. some 11 million hectares over the period;
• tropical forests account for more than 90 % of global deforestation over the same period.

On the production side, a scientific study based on FAOSTAT data estimates that around 28 million hectares were planted with oil palm in 2019, with Indonesia and Malaysia accounting for around 52 % and 18 % respectively. These figures describe areas and shares of deforestation: they are neither the same indicators nor the same periods, and must not be confused.

The EUDR rule: an enforceable date, not a global average

The regulation does not ask you to compare a sector with an average: it requires verification plot by plot. For palm oil, the question is whether the land on which the palms were planted was forest after 31 December 2020 - in which case the commodity is non-compliant, whatever the supplier's average performance.

Two useful legal clarifications:

1. In the regulation, the forest degradation criterion only applies to wood products. For palm, the test concerns deforestation in the sense of converting forest to agricultural use.
2. Compliance also requires the legality of production in the country of production: land rights, environmental law, labour law, tax and customs obligations, rights of local communities.

Smallholders, mills and intermediaries: where the proof is won or lost

A significant share of the world's oil palm area is farmed by smallholders - available mapping work puts them at around a quarter to a third of planted area, depending on definitions and reference years. Their inclusion is as much a compliance issue as a sustainability one: without mapping of their plots of land, proof cannot be established, and the risk of these producers being excluded from supply chains serving the EU is documented by players in the sector.

On top of this comes a multi-tier industrial structure: fresh fruit bunches (FFB, fresh fruit bunches) pass through collectors and collection centres, then through a mill that produces crude oil, before refining, fractionation and, where applicable, oleochemical processing. Each step is a potential break point in the link between a batch and its plots of origin.

Due diligence obligations for palm oil buyers

First: what is your role?

The first question is not “what do I need to provide?” but “who am I?”. The regulation distinguishes three situations.

For a manufacturer, the most common situation is that of downstream operator when buying from a European importer, and operator when importing the commodity itself. The same company can hold both roles depending on the product.

Information to collect (Article 9)

For each relevant product, precise and verifiable information must be gathered:

• product description, trade name and type;
• commodities used in manufacture;
• quantity;
• country of production, and where applicable region;
• geolocation of all plots of land of production;
• date or time range of production;
• identification and contact details of suppliers;
• identification and contact details of business customers, where applicable;
• information proving deforestation-free status and legal compliance.

Assess, mitigate, declare

Once the information has been gathered, the operator assesses the risk (Article 10), concludes that there is no or only negligible risk, or implements risk mitigation measures (Article 11). As long as the risk has not been reduced to a no or negligible level, the product cannot be placed on the market.

Next comes the DDS (Due Diligence Statement, due diligence statement). It is submitted to the EUDR information system, hosted in TRACES (TRAde Control and Expert System, the Commission's trade control system). The system assigns a reference number to be linked to the products. The statement and its supporting documents must be kept for at least five years.

Which deadlines should you remember?

It is the national competent authorities that check compliance with the regulation; in France, they are designated within the ministries responsible for Ecological Transition and Agriculture, with customs intervening at the border. Member States set their penalties, with a maximum fine of at least 4 % of total annual EU turnover for legal persons, as well as possible additional measures (confiscation, exclusion from public procurement, temporary prohibition of activity).

Upstream traceability: from plot of land to derivative

What needs to be linked

The traceability required is not “knowing your mill”: it is being able to link the product to all contributing plots of land. Schematically, the chain to document is as follows:

1. Oil palm plot of land → geographical coordinates and identification of the farm.
2. Fresh fruit bunches delivered to the mill → delivery / plot association.
3. Mill → processing into crude palm oil, by batch.
4. Refinery and fractionation → refined oil, olein, stearin.
5. Oleochemistry → glycerol, fatty acids, fatty alcohols, esters.
6. Finished product → batch marketed and statement reference number.

The palm kernel route adds a parallel branch: nuts and kernels, palm kernel oil, oilcake for animal feed.

Geolocation: polygon or point?

Four technical requirements come up systematically in specifications and in rejected submissions:

• coordinates in decimal degrees, with at least six decimal places;
• longitude, latitude order - not the other way round;
• closed polygons without self-intersection, with each polygon describing a single plot of land;
• an exchange format such as GeoJSON (RFC 7946), in WGS 84 / EPSG:4326.

A general farm map, or a single point at the centre of a block of plots, does not replace the geolocation of each plot of origin.

Three chain of custody models, only one useful requirement

This is a distinction to bear in mind in commercial negotiations: a volume of “credits” does not make compliant a material whose origin is unknown.

The four most common break points

1. Unmapped plots of land upstream, particularly among smallholders and their collectors.
2. Mixing in tanks, ports and refineries, between materials of different origins or statuses.
3. Break in the batch ↔ plot link when the unit or container changes.
4. Conversion of units and references between supplier documents and internal systems (tonnes, litres, cubic metres, different batch numbers).

RSPO, ISCC certifications and the EUDR: what they cover, and their limits

RSPO

The RSPO (Roundtable on Sustainable Palm Oil) is the main sustainability standard in the palm sector. Its system is recognised by the market, but it does not constitute official recognition of compliance with the European regulation.

The gap analysis published by the RSPO identifies several structural gaps:

ISCC

ISCC (International Sustainability and Carbon Certification) is a certification system used in particular for sustainability chains of agricultural commodities. For palm oil, the relevant combination is ISCC EU + EUDR add-on: the add-on includes controls on traceability down to the plots of land, deforestation analysis, legality and risk management.

One point of method matters: within this framework, physical segregation is required to distinguish covered products from non-covered products. An ISCC chain based on simple mass balance is therefore not enough on its own to establish alignment with the EUDR.

What to ask a certified supplier for

• The valid certificate, with its exact scope (site, products, materials).
• The explicit presence of the EUDR add-on or equivalent, depending on the system.
• The geolocation data of the contributing plots of land, in the expected format.
• Proof of physical segregation at mixing points (mills, tanks, ports).
• The statement reference number or the applicable upstream due diligence information.

In other words: RSPO or ISCC certification helps structure the proof, but never exempts the buyer from exercising its own due diligence. This finding matches what we see in other sectors: a sustainability standard and a traceability regulation do not produce the same proof.

Supplier risk assessment: a 5-step method

Step 1 - Country risk

The Commission classifies countries according to their deforestation risk: low, standard or high risk. This country benchmarking, set by an implementing regulation, determines the intensity of due diligence: the simplified procedure is only possible if the product comes exclusively from a low-risk country, without mixing with other origins. The main palm oil producing countries are not, at this stage, in the low-risk category.

Step 2 - Product risk

Three questions are often enough to qualify exposure: is the CN code listed in Annex I on the date of placing on the market? Is it a line added in 2026 and therefore applicable from 30 December 2027? Does the product fall under an explicit exclusion (pharmaceutical use, samples, waste, supporting packaging)?

Step 3 - Supply chain risk

The more tiers the chain has, the harder it is to prove origin: collectors, collection centres, mills, traders, refineries, ports. Three useful indicators: the number of intermediaries between the plot of land and you, the visibility you have over the mills and their supply bases, and the chain of custody model used (IP, segregation, mass balance).

Step 4 - Documentary risk

The quality of the proof matters as much as its existence. Four simple checks:

• is the geometry provided usable (longitude/latitude, six decimal places, closed polygon)?
• are the declared quantities consistent with the volumes purchased and the batches delivered?
• do the country and date of production match the delivery notes?
• are the legality documents valid and versioned?

Step 5 - Decide and mitigate

Warning signs to watch for

• A supplier that does not identify its upstream mills.
• Identical geolocations for distinct plots of land, or overlapping polygons.
• An origin declared as a “low-risk country” when the absence of mixing has not been demonstrated.
• Traceability based exclusively on mass balance.
• A certificate presented as equivalent to EUDR compliance, without proof at plot level.

A useful reminder: the authorities check a minimum percentage of operators, proportionate to the country's risk (around 1 % for low risk, 3 % for standard risk and 9 % for high risk). A file that can be reconstructed in a few minutes is better than an overloaded one.

Common mistakes

1. Believing that palm stops at crude oil. Fractions, palm kernel oil, oilcake, glycerol, fatty acids and fatty alcohols can all fall under Annex I.
2. Working with the six-digit HS code. The Annex I wording is read at the level of the eight-digit CN, sometimes on a subset marked “ex”.
3. Ignoring the 2026 delegated act. New derivatives come into scope on 30 December 2027: the risk portfolio must be updated before, not after.
4. Accepting a point for a plot of land of more than 4 hectares. A polygon is required, and a central point with a radius is not a polygon.
5. Settling for an RSPO or ISCC certificate. The cut-off dates and chain of custody models do not map onto the EUDR requirements.
6. Confusing mass balance with traceability. “Offset” volumes never demonstrate the origin of a specific batch.
7. Collecting geometries without linking them to a batch. A coordinate not linked to a delivered batch produces no enforceable proof.
8. Skipping the “who am I?” step. A downstream operator and an importer do not have the same obligations, nor the same preparation timeline.

Operational checklist for palm oil buyers

• Scope and roles
• All products containing palm or palm kernel are listed, including cosmetic derivatives.
• Each product has an eight-digit CN code confirmed in writing.
• Each product is assessed against Annex I on its date of placing on the market, including the 2026 extensions.
• The role (operator, downstream operator, trader) is documented, product by product.

• Data and traceability
• Direct and indirect suppliers are mapped down to the mills.
• Contributing plots of land are identified, with a polygon for those of more than 4 hectares.
• Coordinates comply with the expected format (six decimal places, longitude then latitude, GeoJSON in WGS 84).
• The batch ↔ plot ↔ supplier link is verified on a sample of real batches.
• The chain of custody model (IP, segregation, mass balance) is documented for each origin.

• Certifications and legality
• RSPO and ISCC certificates are verified (validity, scope, presence of an EUDR add-on).
• Legality documents from the country of production are collected and up to date.
• A due diligence statement reference number is obtained or passed on for products already placed on the market.

• Management
• A supplier risk grid is applied (country, product, chain, documentary quality).
• Gaps trigger a dated action plan, with an owner.
• A proof file is tested on the most exposed product, ahead of any inspection.
• Data and supporting documents are archived for at least five years.

Going further

The difficulty of EUDR for palm oil is neither legal nor documentary in the traditional sense: it lies in the consistency between what your suppliers declare, what your product master data contains and what your batches actually consumed. A portfolio of oleochemical derivatives whose scope changes in 2027 adds a constraint: anticipate rather than react.