Penalties and enforcement
The Regulation leaves penalty design to the Member States (Art. 25(1)) but sets a floor: "effective, proportionate and dissuasive." In practice this means substantial fines, confiscation of the non-compliant consignment, and temporary exclusion from the EU market.
Member-State competence (Art. 14 to 25)
Each Member State designates a competent authority (Art. 14) to police compliance within its territory. The competent authority can:
- Check operators (Art. 18) and downstream operators and traders (Art. 19), on a risk-based plan (Art. 16).
- Take interim measures, such as seizing or suspending products, while a check runs (Art. 23).
- Require corrective action, including withdrawing or recalling a non-compliant product (Art. 24).
- Impose penalties (Art. 25).
Penalty floor (Art. 25(2))
The Regulation lists the minimum penalty types Member States must include:
- Fines proportionate to the environmental damage and the value of the products, set so they deprive those responsible of the economic benefit, and rising for repeated infringements. For a legal person the maximum fine must be at least 4 % of the operator's, downstream operator's or trader's total annual Union-wide turnover in the financial year before the fining decision (Art. 25(2)(a)).
- Confiscation of the relevant products (Art. 25(2)(b)).
- Confiscation of the revenue gained from a transaction with those products (Art. 25(2)(c)).
- Temporary exclusion, for a maximum of 12 months, from public procurement and from access to public funding (Art. 25(2)(d)).
- Temporary prohibition from placing or making available on the market or exporting, in the event of a serious or repeated infringement (Art. 25(2)(e)). The Regulation sets no period for this one.
- Prohibition from using simplified due diligence under Article 13, in the event of a serious or repeated infringement (Art. 25(2)(f)).
Public list of judgments (Art. 25(3))
Member States notify the Commission of final judgments against legal persons for infringing the Regulation, and the penalties imposed, within 30 days of the judgment becoming final. The Commission publishes a list of those judgments on its website: the name of the legal person, the date of the judgment, a summary of the infringing activities, and the nature and (where financial) the amount of the penalty.
Substantiated concerns (Art. 31)
Any natural or legal person can submit a "substantiated concern" to a competent authority when they consider that an operator, downstream operator or trader is not complying (Art. 31(1)). The authority must assess it without undue delay, diligently and impartially (Art. 31(2)), and, unless national law says otherwise, tell the submitter within 30 days what follow-up it gave and why (Art. 31(3)).
For NGOs and civil-society bodies this is the primary enforcement lever. It sidesteps the Member State's internal prioritisation and forces an investigation.
Check rates (Art. 16)
Member States must check a minimum percentage of operators sourcing from each country tier, per year:
| Country tier | Minimum check rate |
|---|---|
| Low risk | 1 % of operators |
| Standard risk | 3 % of operators |
| High risk | 9 % of operators AND 9 % of the quantity of each relevant commodity. |
Plus an obligation to check operators after every substantiated concern (Art. 16(12)).
What eudr.dev does and doesn't do for enforcement
The engine produces signed receipts that an operator can hand to a competent authority as evidence of due-diligence. The receipt is offline-verifiable (BLAKE3 + ed25519 + CIDv1). The regulator does not need to call our infrastructure to confirm authenticity. See verify offline.
The engine does not report operators to competent authorities, file substantiated concerns, or initiate any enforcement action. Those are competent-authority and complainant prerogatives respectively.
What an enforcement-friendly receipt contains
The signed receipt is designed to make a regulator's job easier:
- Every per-cell forest decision is backed by an emem.dev signed fact CID.
- The verdict logic (Hansen loss-year ≥ 2021 → flag; JRC GFC2020 disagreement → escalate) is documented in methodology.
- The receipt re-derives end-to-end with no trust in our infrastructure beyond DNS + TLS on
eudr.dev(or whichever instance issued it).
A competent authority running an Art. 18 check can take the receipt, the operator's records, and re-verify the entire chain against emem.dev independently.
See also
Authoritative sources
- Reg. (EU) 2023/1115 Arts. 14, 16, 18, 24, 27, 31.
- Member-State competent-authority pages. List maintained by DG ENV at the deforestation portal.
This page last changed on . It describes the Regulation as it stood then; where a date or a code matters to a decision, check it against the EUR-Lex text it cites.