EU Regulation on Deforestation Free Products – more of the same due diligence obligations?

Introduction

On 29 June 2023, the Regulation entered into force. The Regulation provides for a transition period until 31 December 2024 and until 30 June 2025 for small and medium-sized enterprises ("SMEs").

The Regulation contains due diligence requirements in supply chains for operators or traders who place or make available certain commodities and/or products on the Union market, or export certain commodities or products typically linked to global deforestation. 

The objective of the Regulation is to curb deforestation and forest degradation to reduce greenhouse gas emissions and biodiversity loss.

Even though the Regulation's focus lies clearly on minimizing deforestation, there is a substantial overlap concerning compliance with human rights as protected by the German SCDDA and the Draft EU CSDDD.

Not only the EU is taking measures to combat deforestation, similar requirements have been introduced in the United States with the "Biden Administration's Forest Act". Additionally, the U.S. Department of Justice has recently formed the "Timber Interdiction Membership Board and Enforcement Resource Working Group", that focuses on investigating and prosecuting the illegal trade of timber around the world and the resulting deforestation. The Task Force will be working with government officials in countries adversely affected by deforestation and illegal trade.

Scope

The Regulation follows a product-based, not a turnover- or employee-based approach like the German SCDDA and the Draft EU CSDDD. Notably, there is no de minimis exemption under the Regulation.

The Regulation applies to the commodities cattle, cocoa, coffee, oil palm, rubber, soya and wood themselves and products containing, produced with the use of or fed with any of them. The relevant products are comprehensively listed in Annex I of the Regulation and contain for example chocolate, firewood, furniture or gloves.

Products that are not listed in Annex I and do not contain any of the relevant commodities are not subject to the Regulation (e.g., soap that contains oil from palm trees but is not listed in Annex I). The Commission will regularly assess whether the list of commodities and products needs to be enlarged. Thus, companies should closely monitor the developments going forward.

The Regulation imposes certain due diligence obligations on operators (Article 4) and traders (Article 5) within the supply chain, which are partially comparable with the requirements of the German SCDDA and the Draft EU CSDDD.

An operator is any natural or legal person who places the above commodities and/or products (i.e., makes them commercially available) on the Union market or exports them (Art. 2 (15) and (16)). This does not only include companies that act as manufacturer or importer, but also companies that transform these products (e.g., cocoa butter) into another product listed in Annex I (e.g., into chocolate).

A trader on the other hand is any person in the supply chain who, in the course of commercial activity, makes the above-mentioned products (not commodities) available on the market. 

For SMEs, the Regulation provides for certain reliefs on the due diligence obligations.

Prohibition

The mainstay of the Regulation is the prohibition for operators and traders to place or make available products on the Union market or export them, unless the commodities and/or products:

• are deforestation-free: this means that the manufacturing of the relevant products using relevant commodities is not related to the conversion of forests to agricultural use after 31 December 2020 and that the harvested wood has not induced structural changes to forests, 
• have been produced in compliance with the relevant legislation of the country of production, 
• are covered by a due diligence statement: This due diligence statement summarizes all relevant information (on the operator, product and commodities, country of production etc.) and contains the confirmation that due diligence in accordance with the Regulation was carried out and that no or negligible risk of non-compliance with the prohibition of Art. 3 was found (cf. Annex II).

Due Diligence Obligations

In order to comply with the Regulation, operators and traders are required to meet certain due diligence obligations prior to placing or making available relevant products on the Union market. These obligations do not apply to all companies to the same extent. Instead, the Regulation provides a tiered system of due diligence obligations in two respects, based on the new "country benchmarking system" and on the company’s position within the supply chain.

Before this tiered system is explained in more detail, the main due diligence obligations can be summarized as follows:

The due diligence program includes (i) collecting information, (ii) conducting risk assessments and (iii) implementing risk mitigation measures (in particular Art. 4, 5, 8 to 13). In order to do so, operators and traders are obliged to establish and keep up a due diligence system comprising procedures and measures to ensure that the relevant products comply with the Regulation. Operators and traders must report publicly on an annual basis. Relevant information must be kept for five years.

In essence, these due diligence obligations are comparable to the German SCDDA's and Draft EU CSDDD's due diligence obligations, but differ in detail. Most notably and in contrast to both the German SCDDA and the Draft EU CSDDD, the Regulation contains strict and far-reaching requirements concerning the traceability of commodities and products by means of geolocation.

After having carried out the due diligence, operators and traders must submit the due diligence statement to the competent national authorities (Art. 4 (2) and (3)). Exceeding the scope of both the German SCDDA and the Draft EU CSDDD, operators and traders are obliged to assist competent national authorities during the enforcement of the Regulation (Art. 4 (5) and (6)). This requires operators and traders to constantly monitor their products (and relevant commodities) for relevant new information on potential non-compliance. Moreover, they are obliged to communicate all necessary information further down the supply chain (Art. 4 (7)).

(a)  Collection of relevant data (Art. 9)

The starting point for the due diligence under the Regulation is the collection of relevant information (Art. 9). This includes information, among other things, a description of the relevant product, the quantity and the country of production including geolocation of all plots of land where the relevant commodities have been produced. This will likely be particular burdensome for operators and traders.

(b)  Risk assessment (Art. 10)

Based on this information, operators and traders conduct a risk assessment to determine whether relevant goods and products are potentially non-compliant with the prohibition set out in Art. 3 (Art. 10 (1)). Under the Regulation, operators and traders are only allowed to place the relevant product on the Union market or export them if no or only a negligible risk of non-compliance is revealed (Art. 10 (1)).

The Regulation follows a novel approach providing various risk factors as well as counter-indicators to be considered in the risk assessment (Art. 10 (2)). For example, it enlists concerns in relation to the country of production as a risk factor and the presence of forests in the country of production as a counter-indicator. In this respect, the approach differs from the German SCDDA and the Draft EU CSDDD, which are more generic. The general obligation for risk assessment, however, is already known from the German SCDDA.

(c)  Risk mitigation (Art. 11)

Finally, procedures and systems must be established to mitigate identified risks and ensure compliance with the Regulation if the analysis reveals a non-negligible risk (Art. 11).

This requires operators and traders to implement a risk management system or to adapt their existing ones. This comprises adequate and proportionate procedures and (preventive) measures including policies and controls (Art. 11 (1) and (2)), such as

• model risk management, internal control and compliance management;
• reporting;
• record-keeping;
• internal controls;
• appointing a compliance manager at management level (not SMEs); and
• independent audits.

Most of these measures are similar to those in the German SCDDA and the Draft EU CSDDD.

Like under the German SCDDA and the Draft EU CSDDD, the measures must be documented and reviewed at least annually (Art. 12 (2) and (3)).

The extent of the obligation of risk assessment and mitigation depends on the classification of the country under the "country benchmarking system" (Art. 13). This three-tier system is to be established by the EU Commission and classifies countries in "high risk", "low risk" and "standard risk" (Art. 29). Operators who obtain products or commodities from a low risk country – and have ascertained their origin – are exempt from the obligation to assess and mitigate risks. Nevertheless, they still have to collect the relevant data and assess the risk of circumvention of the Regulation.

(d)  Tiered due diligence program based on the company’s position in the supply chain

The Regulation's due diligence obligations don’t apply to operators, traders and SME’s to the same extent. Instead, they differ based on the company’s position within the supply chain:

Operators, that place the product or commodity on the Union market for the first time, are obligated to fulfil the entire obligation program and must submit the first due diligence statement.

Reduced obligations apply to operators and traders, if the company further up the supply chain has already submitted a due diligence statement. In this case, the operators and traders can refer to this statement after having ascertained that the company has fulfilled the due diligence catalogue of the Regulation (Art. 4 (9), 5 (1)). 

The obligations can be further reduced for SMEs. SME-traders must only collect and keep information on their suppliers and on the companies they supply (Art. 5 (3)). SME-operators can also refer to an existing due diligence statement without being obligated to ascertain, whether the company has fulfilled due diligence (Art. 4 (8)). If no statement exists, SME-operators have to fulfil the entire obligation program.

Consequences of non-compliance

Non-compliance with the Regulation may lead to severe consequences. The Regulation provides for a public enforcement though competent national authorities.

The national authority is empowered to take interim measures and require operators and traders to take corrective measures. These measures include – inter alia – rectifying formal violations, preventing the relevant product from being placed on the market, immediate product recall, and even the possibility of destroying or donating the non-compliant product.

The maximum amount of fines shall be at least 4 % of the operator’s or trader’s total annual Union-wide turnover in case of non-compliance. In addition, authorities shall have the power to, inter alia, 

• confiscate non-compliant products and revenues gained from the non-compliant products;
• debar operators and traders from accessing public procurement processes for 12 months; and
• temporarily prohibit the placing or making available on the Union market (Art. 25 (2)).

Furthermore, the Commission will publish final decisions on infringements, including information on the company involved. This "naming and shaming" can have intangible consequences, such as damage to reputation and loss of customer confidence. The provision in Art. 25 (3) is in line with Article 20 of the Draft EU CSDDD. The German SCDDA does not contain such a provision. 

Conclusion and next steps

The Regulation imposes far-reaching due diligence obligations on operators and traders who place relevant commodities and products on the EU market or export them from the EU. For affected companies, these due diligence obligations mean new compliance obligations, increased documentation requirements, and a host of new liability risks. It is important for companies to implement compliance processes with distinct responsibilities and competencies to reduce liability risks.

Against the background that the transition period is already running, prompt integration of the new due diligence obligations into the compliance management system is paramount. To maintain uninterrupted trade and avoid sanctions, it is crucial to diligently prepare and timely submit the required due diligence statement. 

Since the due diligence requirements of the Regulation are similar to those of the German SCDDA, it is possible to build on – if established - the risk management system already developed to comply with it. Companies should strive to establish uniform processes for compliance with the related due diligence requirements of the German SCDDA and the Regulation. In many parts, existing provisions based on the German SCDDA can be adapted to meet the additional specifics of the Regulation.

However, it must be taken into account that the requirements of the Regulation go beyond the German SCDDA’s and the Draft CSDDD’s specifications in some respects. In particular, the requirements concerning the traceability of commodities and products as well as the extensive duty to cooperate with and assist national authorities exceed the scope of the German SCDDA and the Draft CSDDD. These areas require the implementation of new measures within the risk management system. In this regard, the already published guidelines (FAQ) by the EU Commission can provide helpful guidance.
 

Authored by Sebastian Gräler, Christian Ritz, Felix Werner and Gernot Dederichs.