EU Timber Regulations - How Robust Are Your Due Diligence Systems?

by Allen & Overy LLP

Whilst the European Timber Regulation dates back to 2010, it only took direct effect in Member States last year. Amongst other things, it requires operators to ensure they have due diligence systems in place to properly manage the risks of acquiring timber (or products derived from timber) which has been illegally harvested.

A mixed picture is emerging as companies affected seek to put in place due diligence systems to address complex supply chain risks. As the regime is bedding down across Europe, now is a good time to ask whether you have a due diligence system in place that fully meets the requirements of the Regulation and addresses the specific risks arising for your supply chains.

Whilst the European Timber Regulation dates back to 2010, it only took direct effect in Member States last year. Amongst other things, it requires operators to ensure they have due diligence systems in place to properly manage the risks of acquiring timber (or products derived from timber) which has been illegally harvested.

A mixed picture is emerging as companies affected seek to put in place due diligence systems to address complex supply chain risks. As the regime is bedding down across Europe, now is a good time to ask whether you have a due diligence system in place that fully meets the requirements of the Regulation and addresses the specific risks arising for your supply chains.

EUTR overview

The European Timber Regulation (995/2010) (EUTR) forms a cornerstone in the EU’s policy to tackle illegal logging and associated trades. It aims to develop greater supply chain transparency and more responsible trading practices in order to reduce illegal deforestation.

The EUTR imposes a:

• general prohibition on any person placing illegally harvested timber and timber products on the EU market;
• duty on anyone placing timber products on the EU market for the first time (Operators) to have and implement a due diligence system; and
• duty on anyone trading timber products that are already on the EU market (Traders) to keep information to enable the traceability of products back through the supply chain.
Whether or not timber is illegally harvested is judged in accordance with the applicable legislation of the country of harvest.

It is important that all businesses that use, import or trade in timber products (which includes packaging) are:
• aware of their EUTR obligations and the potential implications of non-compliance;
• continually reviewing the content and implementation of their due diligence and document management systems to ensure that they are up to European Commission and Member State expectations; and
• aware of upcoming changes to the EUTR, including expansions of its scope to include a broader range of timber and paper products.

What timber products are caught?

The EUTR’s general prohibition applies to certain listed “timber and timber products”. The due diligence and traceability duties will similarly fall on any person trading in such “timber and timber products”. The list of timber and timber products is extensive and relies on specific product code classifications but as a general rule will include:

• rough or shaped wood, including building, joinery and wooden furniture;
• sheets for veneering and laminated wood;
• particle board, fibreboard, and plywood;
• certain pulp and paper products;
• packaging products including packing cases, boxes, crates and pallets but excluding packaging supporting/protecting another product; and
• fuel wood (including wood chips, logs and sawdust).

Timber and timber products which have been recovered and/or recycled from waste in accordance with European waste law are out of scope. The EUTR also specifically provides that timber products that are covered by certain licences and permits (namely, FLEGT Licences and CITES Certificates) are considered to be legally harvested and therefore meet the requirements of the EUTR.

Your Due Diligence Systems

The EUTR imposes an obligation on Operators (being entities who place timber or timber products on the European market for the first time) to have and implement a formal due diligence system (DDS). There are three basic elements of a DDS prescribed by the EUTR:

1. Access to information procedures:

The DDS should include documented procedures for collection and recording of key information. The key information required to be obtained is listed in the EUTR and includes not only specific information related to the timber itself (such as a description of the species and geographic region of harvest), but also more general information to provide a context for assessing the product.

2. Risk assessment procedures:

The DDS must contain measures and procedures to determine the risk of timber products containing illegally harvested timber. The EUTR does not prescribe a risk assessment procedure and the factors relevant to any assessment will vary from case to case. Certain key factors in a risk assessment include the prevalence of illegal harvesting in the source country level of governance in that country and the complexity of the supply chain. The ultimate outcome of the assessment is to determine whether there is a ‘negligible’ or more than negligible risk that the product may comprise illegally harvested timber. The risk will only be negligible where no cause for concern is revealed on the basis of the key information gathered.

3. Risk mitigation procedures:

Where the risk assessment procedure results in a more than negligible risk assessment, adequate and proportionate risk mitigation measures are required to be taken to minimise the risk of illegally harvested timber being placed on the EU market. Appropriate risk mitigation measures will depend on the particular case but may include obtaining further information about a supplier or seeking third party verification.

All Operators should have a DDS, in compliance with the above, in place. The exact formulation of a DDS is left to the operator although further rules on the DDS are set out in the European Commission’s Implementing Regulation . Alternatively, Operators may choose to utilise the services of an approved ‘monitoring organisation’ that provides a DDS and verifies its proper use by Operators. Such monitoring organisations are also required to take action in the event of failure by an operator to properly use the DDS provided by the monitoring organisation, that may include the notification of such failures to the competent authority.

However, the EUTR obligations do not stop at the implementation of the DDS. Operators must maintain and regularly evaluate the DDS. The European Commission has issued guidance stating that good practice dictates that this review and evaluation process should be undertaken annually by a party who is independent from the implementation of the DDS and should identify weaknesses and failures of the DDS together with deadlines for the correction of such issues. The European Commission has further suggested that the review should not only include an assessment of the DDS procedures but also the actual implementation of the DDS and the knowledge of those persons responsible for the implementation of, and compliance, with the DDS.

Traders’ duties: traceability

If you buy or sell timber or timber products already placed on the EU market you will be classified as a Trader under the EUTR. There is no limit to how far down the supply chain these obligations apply. Therefore, any person trading in timber or timber products will be a Trader.

Traders are required to identify:

• the operators or traders who have supplied the timber and timber products to them; and

• where applicable, other persons (who will also be Traders) to whom they supply timber and timber products.
Traders must keep such information for at least five years. There is no specific obligation for Traders to undertake any diligence into the timber products they work with (that obligation sits with the person who brings the product into the EU). As a matter of their broader compliance programmes, Traders may want to go further in requesting confirmation from their suppliers of compliance with the main restrictions in the EUTR.

Upcoming revision of the EUTR

The European Commission is required to undertake regular reviews of the EUTR. The first such review must take place by 3 December 2015. In the 2015 review the European Commission must:

• consider Member States’ reporting on and experience with the application of the EUTR;

• review the functioning and effectiveness of the EUTR, including in preventing illegally harvested timber or timber products derived from such timber being placed on the EU market;

• consider the administrative consequences for small and medium-sized enterprises; and

• consider extending the coverage of the EUTR to other timber products (including, specifically, printed books, newspapers, brochures, commercial catalogues, leaflets and similar printed matter or products of the printing industry).

The European Commission is in the process of preparing consultation materials to support a consultation process regarding the 2015 review.


A mixed picture is emerging as to how businesses caught by the EUTR have implemented the DDS requirements. Now that the regime has had time to bed-down, and in light of the on-going obligations to monitor, it is a good time to consider:

• Whether your due diligence systems are in place?

• How any DDS is working in practice – who is responsible for implementation and is its effectiveness being monitored?

• Whether you are receiving the right level of information from suppliers? If not, what mitigation measures are in place (including contractual representations as to product sourcing)?

• Whether it is sufficient to simply rely on FLEGT and/or CITES certificates?

The 2015 review should also be carefully monitored. It is possible that the scope of the regime will be widened to include other timber-based products. A significant step would be to include packaging containing other products although it’s too early to say whether this will be adopted. However, the direction of travel is clear.



DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Allen & Overy LLP | Attorney Advertising

Written by:

Allen & Overy LLP

Allen & Overy LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.