Who is responsible under the EUDR: importer, trader, broker, or supplier?

Most timber importers in the EU already know the headline point of the EUDR. If you place timber or timber products on the EU market, you need a due diligence system. The harder part is working out who actually carries the legal responsibility when several companies sit between the forest and the customs entry. In practice we see confusion around importers, traders, brokers, agents, and overseas suppliers. The answer depends on the role each company plays under Regulation (EU) 2023/1115 and on who places the product on the EU market.

Start with the operator versus trader split

The EUDR uses two main categories for companies inside the EU market:

Operators: companies that place relevant products on the EU market for the first time, or export them from the EU.
Traders: companies that buy or sell relevant products already placed on the EU market.

For timber imports, the importer of record is often the operator. That company normally carries the main compliance burden. The operator must run due diligence, collect the required information, assess risk, reduce risk where needed, and submit a due diligence statement in TRACES before the goods are placed on the market.

A trader further down the chain has lighter obligations in some cases, but not always. Large traders still have material recordkeeping and traceability duties. Small and medium-sized traders have fewer obligations, though timber does not get the delayed implementation period that some SME operators in other sectors receive. For timber products, the main application date remains 30 December 2026.

What about brokers and agents

Many timber supply chains use brokers, sourcing agents, or commission traders. Under the EUDR, those commercial labels matter less than the actual legal role in the transaction.

If a broker introduces buyer and seller but never takes ownership and never acts as importer of record, the broker is usually not the operator under the regulation. The legal responsibility stays with the company placing the goods on the EU market.

That said, brokers still affect compliance in practice. They often control document flow, supplier communication, harvest data, and species declarations. A weak broker can break an otherwise workable due diligence process.

We see one common mistake repeatedly. An EU importer assumes the overseas exporter or broker is “handling EUDR”. Legally that does not transfer the operator obligation. The EU operator remains responsible for the due diligence statement and for proving negligible risk.

The overseas supplier is important but usually not legally liable under EUDR

Suppliers outside the EU often believe they are directly regulated by the EUDR. Usually they are not. The regulation applies to companies placing products on the EU market or exporting from it.

The overseas mill, forest concession, or exporter still matters because the operator depends on upstream information. Without reliable supplier data, the operator cannot complete due diligence properly.

At minimum, operators need supplier information on:

Product description and HS code
Species names, including scientific names where required
Country of harvest
Geolocation of harvest plots
Quantity
Evidence of legal harvest
Supply chain details sufficient for risk assessment

For timber, geolocation detail matters. Plots above 4 hectares require polygon coordinates. For plots under 4 hectares, a single geolocation point is permitted. Operators should check whether the coordinates actually match the harvest area and whether plot references stay consistent across invoices, harvest permits, and transport documents.

Importer responsibility in practical terms

The importer acting as operator carries the core legal exposure. That includes cases where sourcing is outsourced to an agent or where the supplier promises compliance contractually.

In practical terms, the operator must:

Collect required supply chain information.
Assess the risk that products are linked to deforestation or illegality.
Reduce risk where the initial assessment is not negligible.
Submit the due diligence statement in TRACES before placing goods on the EU market.
Keep records and evidence for at least 5 years.

The regulation also ties risk assessment to wider context. Country benchmarking will matter once fully operational. The EU system classifies countries by risk level. Operators must still perform due diligence regardless of country category, but the depth of assessment changes.

The free JRC Global Forest Cover map is expected to become a common reference point for checking forest cover and deforestation risk. Most import managers will end up using it alongside commercial GIS tools and supplier maps.

When traders inherit responsibility

Some traders assume the upstream due diligence statement fully protects them. That is too simple.

If a trader imports timber directly from outside the EU, that trader becomes the operator. The responsibility sits with the importer placing goods on the market for the first time.

If a trader buys timber already placed on the EU market by another operator, the trader usually relies on the existing due diligence statement reference. The trader still needs traceability records showing from whom the products were purchased and to whom they were sold.

Large traders face additional obligations closer to those of operators. Company size therefore matters. Groups with multiple EU entities should check carefully which entity legally imports the goods and which entity invoices onward sales.

We have already seen structures where purchasing, customs clearance, warehousing, and invoicing sit in different companies. Those setups can create uncertainty over who actually placed the product on the market. Customs documents alone do not always settle the issue cleanly.

Liability cannot simply be pushed upstream by contract

Commercial contracts still matter. Suppliers should provide warranties, indemnities, harvest evidence, and audit access. None of that removes the operator obligation under the EUDR.

An importer cannot defend a weak due diligence system by pointing to supplier promises alone. Competent authorities will look at whether the operator's own process was adequate.

For higher-risk origins, operators should expect to verify supplier information independently. That may include satellite review, concession checks, legality reviews, harvest volume analysis, or third-party field audits.

Certification can support the assessment, but certification alone does not automatically prove compliance with the regulation.

What enforcement exposure looks like

The regulation gives member states significant enforcement powers. Penalties must be effective, proportionate, and dissuasive.

Possible measures include:

Fines of up to at least 4% of EU annual turnover
Confiscation of products
Confiscation of revenues gained from the products
Temporary exclusion from public procurement
Temporary prohibition from placing products on the market

For timber importers, operational disruption may become the bigger concern before fines do. If customs clearance, due diligence references, species declarations, and geolocation data do not line up properly, shipments can stall quickly.

How most import managers should approach this

The cleanest approach is to identify one responsible operator entity per flow of goods and build the due diligence system around that entity. Avoid situations where everyone assumes another party is handling compliance.

In most timber chains, we recommend documenting four points clearly:

Who acts as operator for each shipment
Who files the due diligence statement in TRACES
Who owns supplier verification
Who retains records for the mandatory 5-year period

Once those points are fixed, the rest becomes more manageable. Species lists, GIS data, harvest documents, supplier onboarding, and shipment matching all fit underneath that structure.

For companies importing mixed tropical hardwoods through traders and agents, this work takes longer than expected. Species naming inconsistencies, changing concessions, and subcontracted harvesting create gaps quickly. It is better to test the process shipment by shipment before the deadline rather than attempt a full rebuild at the end of 2026.

goEUDR provides a managed filing service for timber companies that need help with due diligence statement workflows, supplier document handling, and TRACES submissions. This article is general information only and does not constitute legal advice.