The EUDR SOP Framework

Updated for Regulation (EU) 2025/2650 and the Commission’s 2026 Simplification Review.

The EU Deforestation Regulation (EUDR) has moved from a theoretical compliance challenge to an operational reality.

Following Regulation (EU) 2025/2650 and the Commission’s 4 May 2026 Simplification Review, the compliance model has been structurally refined to reduce administrative duplication while preserving the core legal requirement: relevant commodities and products must be deforestation-free, produced in accordance with the relevant legislation of the country of production, and covered by the required due diligence or declaration process.

The practical implication is clear. EUDR compliance now requires more than data collection. It requires a controlled operating model that distinguishes between upstream operator obligations, micro or small primary operator pathways, and downstream operator or trader reliance obligations.

The updated Atoxor EUDR SOP Framework contains 12 Standard Operating Procedures redesigned to align with the amended legal framework, the 2026 Commission guidance and the latest operational interpretation of the Regulation.

1. Due Diligence System

The foundational SOP for EUDR compliance.

It establishes a transaction-specific workflow that routes each product through a structured Scope, Role and Route assessment. The workflow distinguishes between full due diligence, simplified due diligence for low-risk sourcing, and the simplified declaration route for qualifying micro or small primary operators.

The SOP ensures that Article 10 risk assessment and Article 11 risk mitigation activities are triggered only where required, while maintaining the core Article 3 requirement that products must not be placed on the market or exported unless they are compliant. The Commission’s 2026 guidance confirms that micro or small primary operators remain subject to due diligence, but generally operate through information collection rather than full risk assessment and mitigation, unless relevant risk information arises.

2. Geographic Information Management

This SOP defines how production-location data is collected, validated and retained.

For standard operator routes, it covers geolocation data for all relevant plots of land or cattle establishments. For qualifying micro or small primary operators, it incorporates the amended route allowing the use of postal address information where permitted and where it clearly corresponds to the relevant production location.

The procedure also defines evidence standards, mapping checks, data-quality controls and exception handling where plot information is incomplete, inconsistent or unsuitable for submission.

3. Supply Chain Mapping and Traceability

This SOP ensures that relevant products can be linked to the correct upstream compliance evidence.

It reflects the revised downstream model introduced by Regulation (EU) 2025/2650. Downstream operators and traders are generally not required to exercise due diligence themselves, submit a due diligence statement or prove that due diligence was exercised upstream. They must, however, collect and retain the information required under Article 5, including supplier and customer information and, where their direct supplier is an upstream operator, the relevant DDS reference number or declaration identifier.

The SOP therefore focuses on controlled retention, traceability, incoming-reference capture and substantiated-concern escalation rather than duplicating upstream due diligence.

4. Legal Compliance Documentation

This SOP governs how evidence is collected to demonstrate compliance with the relevant legislation of the country of production.

It covers land-use rights, environmental protection, forest-related rules, third-party rights, labour and human rights where applicable, tax, anti-corruption, trade and customs requirements where they are relevant to the EUDR objective.

The procedure includes a jurisdictional evidence matrix that can be updated as the Commission develops repositories of relevant national legislation and certification schemes. The Commission has indicated that these repositories are intended to support operators and competent authorities in assessing legality evidence.

5. Declaration Management

This SOP governs interaction with the EUDR Information System.

It covers the preparation, submission, review and retention of due diligence statements, simplified declarations, reference numbers and declaration identifiers. It also defines how these identifiers are passed to downstream parties where required.

The SOP includes specific controls for the one-time simplified declaration route for micro or small primary operators, including update triggers where declaration information changes. The Commission’s 2026 package confirms that Information System changes are being introduced to support simplified declarations, registration of new roles, API improvements and additional user functionality.

6. Stakeholder Engagement

This SOP supports the legality and risk-assessment components of EUDR compliance.

It covers documented engagement with suppliers, producers, local representatives and relevant stakeholders where evidence is needed to assess land rights, third-party rights, indigenous peoples’ rights or substantiated concerns.

The procedure includes a complaints and escalation mechanism and requires Free, Prior and Informed Consent evidence where this is relevant under the applicable legal framework and production context. This keeps the control aligned to EUDR legality requirements without overstating Article 3 itself.

7. Verification Systems

This SOP defines how compliance evidence is tested.

It includes internal audit, sample-based checks, satellite or geospatial review where appropriate, field verification triggers and escalation routes for inconsistent or high-risk evidence.

For non-SME operators, the SOP includes Article 11 controls covering compliance management and an independent audit function. These controls are risk-based and proportionate, recognising that the Regulation requires a defensible due diligence system rather than the same verification method for every supply chain.

8. Information System and Records Management

This SOP aligns the framework to the 5-year record-retention requirement.

It defines how EUDR records are stored, version-controlled, retrievable and audit-ready. This includes due diligence records, simplified declaration records, supplier/customer information, reference numbers, declaration identifiers, assessment evidence, decision logs and system-review updates.

The Commission’s 2026 FAQ also clarifies that downstream operators and traders must be able to retrieve and compile required information within a reasonable period, but are not necessarily required to store it in a specific database or system.

9. Commodity-Specific Requirements

This SOP provides commodity-specific controls for the seven relevant commodities: cattle, cocoa, coffee, oil palm, rubber, soya and wood.

It incorporates confirmed scope changes, including the removal of printed paper / HS Chapter 49 from the current EUDR scope, and maintains a separate control log for proposed product-scope changes under the 2026 draft Delegated Act.

This distinction is important. The Commission’s 2026 package proposes further additions and exclusions, including soluble coffee, certain palm oil derivatives and frozen cattle tongues as possible additions, and retreaded tyres, cattle skins and hides as proposed removals. These should be managed as draft or pending changes until formally adopted.

10. Continuous Improvement

This SOP establishes the annual due diligence system review.

It defines how organisations review the effectiveness of their procedures, controls, evidence standards, supplier performance, exception handling and governance arrangements. It also requires corrective actions to be tracked to closure.

The process is aligned to Article 12, which requires operators to review their due diligence system at least once a year, update it where required and retain records of updates for five years.

11. Environmental Impact Monitoring

This SOP defines the monitoring controls used to detect deforestation, forest degradation and other indicators of non-compliance.

It may include satellite analysis, geospatial checks, supplier evidence review, certification checks and third-party alerts. The use of AI or satellite monitoring is treated as an enhanced control, not as a universal legal requirement.

The SOP sets thresholds for risk escalation and product-release blocks where evidence indicates more than a negligible risk of non-compliance.

12. Crisis Management Protocol

This is the “break glass” procedure for suspected or confirmed non-compliance.

It defines the immediate response where a product is found, or suspected, to be non-compliant after being placed on the market, made available or exported. The procedure includes product blocking, evidence preservation, root cause analysis, competent-authority notification, downstream communication and corrective action.

It also links to substantiated-concern handling, recognising that downstream operators and traders must inform competent authorities and downstream parties where they become aware of relevant new information indicating a risk of non-compliance.

Implementation and Integration

These twelve SOPs are not just templates. They form a practical operating model for converting the revised EUDR framework into day-to-day execution.

The next phase is the deployment of the Atoxor Reference Architecture, which maps the SOP framework into existing ERP, supplier management, traceability and document-control platforms.

By moving from manual tracking to a controlled operating model, organisations can reduce duplication, retain the right evidence, manage downstream reliance properly and maintain an auditable response to EUDR requirements.

The full SOP Framework and individual templates are available now in our shop.

Key 2026 Updates Included

Downstream Reliance Logic

Controls for downstream operators and traders to retain the required business-partner information, DDS reference numbers and declaration identifiers without duplicating upstream due diligence.

Micro or Small Primary Operator Pathways

Simplified declaration routes for qualifying primary operators, including postal-address alternatives where permitted and update triggers where declaration information changes.

Scope and HS Code Controls

Confirmed removal of printed paper / HS Chapter 49, with a separate tracker for draft product-scope changes proposed under the 2026 Delegated Act.

Governance and Oversight

Integrated Article 11 and Article 12 controls covering compliance ownership, independent audit where required, annual due diligence system review and 5-year evidence retention.