eudr.dev

Penalties and enforcement

The Regulation leaves penalty design to the Member States (Art. 27) but sets a floor: "effective, proportionate and dissuasive." In practice this means substantial fines, confiscation of the non-compliant consignment, and temporary exclusion from the EU market.

Member-State competence (Art. 27)

Each Member State designates a competent authority (Art. 14) to police compliance within its territory. The competent authority can:

• Inspect operators' due-diligence records (Art. 18).
• Demand corrective action (Art. 24).
• Withhold market placement of a non-compliant consignment (Art. 24).
• Impose penalties (Art. 27).

Penalty floor (Art. 27(2))

The Regulation lists the minimum penalty types Member States must include:

• Fines proportionate to environmental damage and economic gain. For legal persons the maximum amount of the fine must be at least 4 % of the operator's annual EU-wide turnover (Art. 27(2)(a)).
• Confiscation of the non-compliant products (Art. 27(2)(b)).
• Confiscation of the revenue derived from the transaction (Art. 27(2)(c)).
• Temporary exclusion from public-procurement processes and access to public funding (Art. 27(2)(d), for up to 12 months).
• Temporary prohibition of the placing or making available on the market of relevant products (Art. 27(2)(e), for up to 12 months from a serious infringement, longer on repeated infringement).
• Prohibition from exercising simplified due diligence for operators that repeatedly mis-classify low-risk sourcing (Art. 27(2)(f)).

Public registry of penalties (Art. 27(3))

Member States publish, by Member State, the final penalty decisions taken against legal persons under EUDR. The decisions are made public on the Member State's competent-authority website and remain available for at least 5 years.

Substantiated concerns (Art. 31)

Any natural or legal person can submit a "substantiated concern" to the competent authority alleging that a specific operator is failing the Regulation. The authority must investigate without undue delay; the complainant has a right to be informed of the outcome.

For NGOs and civil-society bodies this is the primary enforcement lever. It sidesteps the Member State's internal prioritisation and forces an investigation.

Check rates (Art. 16)

Member States must check a minimum percentage of operators sourcing from each country tier, per year:

Plus an obligation to check operators after every substantiated concern (Art. 31(5)).

What eudr.dev does and doesn't do for enforcement

The engine produces signed receipts that an operator can hand to a competent authority as evidence of due-diligence. The receipt is offline-verifiable (BLAKE3 + ed25519 + CIDv1). The regulator does not need to call our infrastructure to confirm authenticity. See verify offline.

The engine does not report operators to competent authorities, file substantiated concerns, or initiate any enforcement action. Those are competent-authority and complainant prerogatives respectively.

What an enforcement-friendly receipt contains

The signed receipt is designed to make a regulator's job easier:

• Every per-cell forest decision is backed by an emem.dev signed fact CID.
• The verdict logic (Hansen loss-year ≥ 2021 → flag; JRC GFC2020 disagreement → escalate) is documented in methodology.
• The receipt re-derives end-to-end with no trust in our infrastructure beyond DNS + TLS on eudr.dev (or whichever instance issued it).

A competent authority running an Art. 18 check can take the receipt, the operator's records, and re-verify the entire chain against emem.dev independently.

See also

• DDS anatomy + receipts
• Country benchmarking
• Verify a receipt offline
• Sources and references

Authoritative sources

• Reg. (EU) 2023/1115 Arts. 14, 16, 18, 24, 27, 31.
• Member-State competent-authority pages. List maintained by DG ENV at the deforestation portal.