Palm oil has the deepest derivative tree of any EUDR commodity: the regulation follows it from the plantation into oleochemistry. Food manufacturers, cosmetics brands and chemical distributors who have never thought about deforestation compliance are in scope through fatty acids and glycerol. Deadlines are the same as everyone's: 30 December 2026, or 30 June 2027 for micro and small enterprises.
Scope: oil and the derivatives that follow it
1207.10- palm nuts and kernels1511- palm oil, crude and refined1513- palm kernel and babassu oil2306.60- oilcake from palm nuts or kernels2905.45- glycerol3823- industrial fatty acids, acid oils and fatty alcohols
The last two lines are the trap. Glycerol and the 3823 family go into soaps, surfactants, lubricants and food emulsifiers; if you import them from outside the EU, you file a DDS traced to oil-palm plots - even though your product looks nothing like palm oil. Fractions and blends containing in-scope oils follow the in-scope content. Meanwhile some processed products you might expect to be covered (finished cosmetics, most food preparations that merely contain palm oil) are not in Annex I; scope runs on HS codes, not ingredients lists.
The mill is the pivot of palm traceability
Fresh fruit bunches must be processed within roughly 24 hours of harvest, so every plantation and smallholder delivers to a mill nearby. This makes the mill the natural unit of supply-chain mapping - the industry has published mill lists for a decade - but EUDR deliberately goes one level deeper: mill lists are not geolocation. The DDS needs the plots. A mill's supply base typically mixes company estates (large polygons, well mapped) with hundreds of independent smallholders (under 4 ha, declarable as points, patchily mapped). Your data request to a refiner or trader is: per shipment, the plot file for the contributing mills' supply bases - estate polygons plus smallholder points.
Certification helps, but does not file for you
RSPO segregated or identity-preserved supply chains already carry much of the traceability EUDR needs, and RSPO has added EUDR-aligned geolocation modules. Use that data - but be precise about what certification is: evidence you may weigh in your risk assessment, not a substitute for it. The regulation still requires your own DDS with plot geolocation, your own screening conclusion, and your own five-year evidence file. "It was certified" is an input, not a defence.
Screening oil-palm landscapes
Indonesia and Malaysia produce around 85% of the world's palm oil, and both have extensive plantation and concession mapping. Screening compares each plot against tree-cover loss, plantation extent and post-2020 alert datasets using convergence of evidence (the open WHISP methodology) - mature oil palm reads as tree cover in naive datasets, and replanting cycles read as loss, so commodity-specific layers matter more here than in any other supply chain. What must not appear is forest converted to oil palm after 31 December 2020. Peatland development, a major regional issue, also shows up in legality: EUDR requires production compliant with the origin country's laws, including environmental ones.
Buying from EU refiners versus importing directly
Most SME users of palm ingredients never import from origin - they buy from European refiners and distributors. If that is you, your compliance question changes shape: the refiner (or whoever first placed the oil on the EU market) filed the DDS, and your job is to obtain and retain those reference and verification numbers with each delivery, passing them on if you resell. Ask for them on the commercial documents as a standing requirement. The moment you import anything yourself - a drum of specialty fractionation from Malaysia, an emulsifier from a non-EU blender - you cross into operator territory for that flow and the full obligation lands on you. Many companies will discover they are both: downstream for their main supply, operator for the side purchases nobody told compliance about. Inventory the side purchases first; that is where surprises live.
One structural risk to manage either way: smallholder exclusion. If EU-facing chains simply drop unmapped smallholders to simplify compliance, supply concentrates and prices rise. The buyers handling this well fund mapping in their supply base - cheaper than re-sourcing, and it converts a risk into secured volume.
Country risk and inspection exposure
The major palm origins sit in the standard tier of the country benchmark (3% inspection target, full due diligence cycle). Derivative importers should note that the country of production is where the palm was grown, not where the fatty alcohol plant sits - a drum of surfactant from a European distributor may still trace to standard-risk plots, and the DDS reference chain is what proves it was already handled.
Sequence for palm and derivative importers
- Run your import list against the Annex I codes above - include the chemistry, not just the oil.
- For each supplier, establish whether goods were already placed on the EU market with a DDS (then you reference it - see the DDS field guide) or you are the first placer (then you file).
- Contract for plot files at mill-supply-base granularity; accept estate polygons plus smallholder points.
- Screen on receipt, resolve flags with the supplier, file in TRACES, archive for five years.
The two producing countries behave differently enough to warrant their own guides: palm oil from Indonesia (smallholder mapping gap, peat legality) and palm oil from Malaysia (mandatory MSPO, estate-dominated supply, the oleochemical connection). If the operator-versus-downstream split above left you unsure of your role, the roles guide settles it. Related: soy for the other bulk-oil scope logic, rubber for the same smallholder-aggregation pattern, and cocoa for how derivatives (chocolate) pull finished-goods importers into scope.