Online Sales, Substantiated Concerns, Exports, and Re-Imports
Key takeaway
The edges of the regulation
Most of the EUDR's day-to-day mechanics involve a manufacturer in country A shipping a relevant product to an EU importer in country B. But the regulation has more complicated edges. Who is responsible when an EU consumer buys cocoa-based cookies online from a non-EU website? What does an EU exporter shipping chocolate out of the EU have to do? What if a product previously exported is later re-imported back? And what is a "substantiated concern" that obliges a downstream operator to act? The V5 FAQ (April 2026) added or substantially clarified all of these. This lesson walks through them with practical examples.
The "Commercial Activity" Test
The EUDR applies to relevant products supplied "in the course of a commercial activity." This phrase, defined in Art. 2(19), determines whether the regulation applies at all. The test is straightforward: any supply that is part of a business operation is in scope, regardless of who the buyer is. Whether the customer is another business (B2B) or a private consumer (B2C) makes no difference (FAQ 3.16, V5).
What is not in scope is supply that is genuinely private and non-commercial. Examples from FAQ 3.16:
- A person bringing relevant products from a vacation outside the EU for their own use, in reasonable quantities and not for resale.
- A person in a third country sending products to a relative in the EU (parcels between family members).
If you cross from "private use" into "commercial activity" (e.g. you start selling those vacation chocolates online), the EUDR kicks in. Customs and Competent Authorities can check on a case-by-case basis whether a particular shipment is genuinely private, looking at quantity, frequency, and the surrounding circumstances.
Online Sales: B2B and B2C
The EUDR applies to all relevant products supplied via online or distance sales, exactly as it does to physical retail (FAQ 3.17, V5). Whether the buyer is another business or a private consumer does not change anything; whether the seller is in the EU or outside the EU does not change anything either. What matters is who actually places the product on the EU market.
Online distributors and retailers can fall into one of three roles depending on the specific transaction (FAQ 3.18, V5):
| Role | When it applies to an online seller |
|---|---|
| Operator | If the online sale results in import (release for free circulation) into the EU, OR if the seller offers a relevant product that has not previously been placed on the EU market |
| Downstream operator | If the seller re-imports or transforms a relevant product that is already covered by a DDS or SD |
| Trader | If the seller resells online a relevant product that has already been placed on the EU market by someone else |
Online marketplaces (Amazon-style platforms that connect sellers and buyers) are treated as intermediary service providers with no EUDR obligation, as long as they only facilitate the transaction without intervening in the actual supply (FAQ 3.18, V5). The EUDR obligations stay with whoever is actually selling the product on the platform. If a marketplace also operates fulfilment services or sells products in its own name, the picture changes and the marketplace can become an operator, downstream operator, or trader for those specific functions; it is assessed case-by-case.
The Consumer-As-Operator Edge Case
An EU consumer who buys a relevant product online from outside the EU is never an operator under the EUDR, even if they appear as the importer on the customs declaration (FAQ 3.19, V5). Placing on the market is done by the legal or natural person actually supplying the product to the consumer (the seller, the fulfilment service, or the marketplace acting in a non-intermediary role), not by the consumer.
Worked example
Three online-sale scenarios
Scenario 1 (B2B import): An EU furniture wholesaler buys teak panels online from a Vietnamese exporter. The shipment is released for free circulation in the EU. The Vietnamese exporter is an operator under Art. 7 EUDR; the EU wholesaler is also an operator (the first EU-established person making the product available on the market). Both must be in the EUDR IS picture.
Scenario 2 (B2C from EU seller): A French private individual buys a leather wallet through an EU-based online retailer's website. The retailer is the operator (or downstream operator if the wallet has already been placed on the EU market by an upstream supplier and the retailer re-imports or transforms it). The French consumer has no EUDR obligation.
Scenario 3 (B2C from outside the EU): A German private individual buys a leather wallet directly from a US-based small online seller. The seller (or its EU fulfilment provider, if it has one) is the EUDR operator. The German consumer is named as the importer on the customs paperwork but is NOT an operator under the EUDR. If the goods are genuinely for private use and in reasonable quantities, the customs check may also conclude that the import falls outside "commercial activity" altogether.
Substantiated Concerns: The Trigger for Reactive Verification
A substantiated concern is a defined legal trigger that obliges downstream operators, traders, and Competent Authorities to act. It is defined in Art. 2(31) EUDR (FAQ 4.15, V5) as a "duly reasoned claim based on objective and verifiable information regarding non-compliance with this Regulation and which could require the intervention of competent authorities."
Two elements must be present for a claim to qualify as a substantiated concern:
- Duly reasoned. The claim must be justified through transparent, concrete, and defensible reasoning. The recipient should be able to reconstruct how the conclusion was reached.
- Objective and verifiable information. The claim must be supported by evidence (e.g. photos, audit reports, witness statements, satellite imagery analysis, or information from credible NGOs or public authorities).
A general statement like "there is illegal harvesting somewhere in country X" is not a substantiated concern. It must clearly identify who, how, and when a possible non-compliance is occurring, and link it to the specific operator, downstream operator, or trader being notified.
What Substantiated Concerns Trigger
When a substantiated concern reaches a downstream operator or trader, three things happen:
- Immediate notification. All downstream operators and traders, regardless of size, must immediately inform the Competent Authority of the Member State where they placed the product on the market. They must also inform the supply chain actors to whom they have already supplied the product (Art. 5(5) EUDR).
- Verification (non-SMEs only). Non-SME downstream operators and traders must verify that due diligence was actually exercised by their upstream supplier, and that no or only negligible risk was found. This can include cross-checking DDS reference numbers, reading the upstream operator's annual report, or asking for supplier audit results (Art. 5(6) EUDR).
- Stop the flow. If verification cannot confirm that due diligence was properly exercised, the non-SME downstream operator or trader must stop placing or making available the affected product until either their own checks or the Competent Authority's review concludes that the risk is no more than negligible.
A "company should be considered as being aware" of a substantiated concern as soon as it reaches them via email, in a meeting with employees, in correspondence from the Commission or a national authority, from another private entity, or from the media (FAQ 3.6.2, V5). Wilful ignorance is not a defence.
Analogy
Substantiated concerns are like a credible product safety alert
In product safety law, a manufacturer who receives credible reports that a specific batch of their product is harming consumers cannot simply ignore the reports. They must investigate, notify authorities, and if necessary recall the product. The substantiated concern mechanism in the EUDR works the same way: it is a reactive obligation triggered by credible third-party information, not a proactive obligation to constantly audit upstream suppliers. Routine non-receipt of any such concern is the normal state. But once a credible signal arrives, the downstream operator or trader has to act on it.
Exports: TARIC Codes and the Downstream-Operator Shortcut
The EUDR applies to exports out of the EU as well as to imports into the EU. The exporter is either an operator (if they also placed the product on the EU market) or a downstream operator (if the product was already placed on the EU market by someone else upstream).
Under FAQ 5.6.1 (V5), the practical mechanics differ depending on the role:
- Operator-exporter. Standard obligations apply, including providing the DDS reference number or declaration identifier to customs at export under Art. 26(4) EUDR.
- Downstream-operator-exporter. No reference number needs to be provided to customs at export. Instead, a dedicated TARIC certificate code can be used, exempting downstream operators from providing reference numbers at export. This is a substantial paperwork reduction for companies that buy already-cleared products on the EU market and export them.
Worked example
Two exporter examples (FAQ 5.6.1, V5)
Example 1: Company A buys coffee beans on the EU market from supplier S (the upstream operator) and exports them to Switzerland. Because S already submitted the DDS, A is a downstream operator. A does not need to provide a DDS reference at export; it can use the dedicated TARIC certificate code instead.
Example 2: Company B imports cocoa, processes it into chocolate, and exports the chocolate to Japan. At the point of export, B is a downstream operator (because the cocoa was already covered by B's own import DDS, and the chocolate is a transformed Annex I product made from already-cleared cocoa). Same shortcut: B uses the TARIC certificate code at export instead of providing the DDS reference number.
Re-Imports: The Returning-Product Edge Case
A product is exported from the EU, then later comes back. Does the importer have to redo full due diligence? Generally yes, but FAQ 5.4 (V5) provides a narrow downstream-operator route for genuine re-imports.
If the importer can demonstrate that the relevant product (or all relevant components within it) was previously placed on the EU market and was the subject of due diligence at that time, and is now being released for free circulation again, the re-importer can be considered a downstream operator. In that case, no new DDS is needed. The re-importer's only obligation is to keep evidence demonstrating that the product was previously on the EU market.
Examples of acceptable evidence include:
- Customs declarations for the original export.
- Contracts (between other parties or involving the re-importer).
- Shipping documents: bill of lading, CMR, air waybill, delivery notes.
- Invoices and any other credible documentation that links directly to the specific product.
At customs, the re-importer either provides the DDS reference number(s) received from suppliers, or, if no reference number is available, uses a conventional reference number communicated by the Commission specifically for re-imports. This signals to Competent Authorities that the import is a re-import and may be subject to verification. Without such evidence, the product is treated as a first-time import and full DDS is required.
FAQ 5.4 (V5) extends the re-import logic one step further. If cocoa beans were exported from the EU to a third country, processed there into chocolate, and the chocolate is then released for free circulation back in the EU, the re-importer can still rely on the downstream-operator route — but only for the parts of the chocolate that originated from the previously cleared cocoa. Any other relevant components added during the third-country processing (e.g. palm oil, sugar from a deforestation-relevant origin) that have not previously been the subject of due diligence must be covered by a fresh DDS.
This is a narrow but useful pathway for circular supply chains where toll processors abroad transform EU-originating commodities and ship the finished goods back. The key compliance burden is the audit trail: documentation must clearly link the imported chocolate batch to the original exported cocoa batch.
Key Takeaways
- The EUDR applies to all supply 'in the course of a commercial activity', including online B2B and B2C sales. Genuine private use (e.g. vacation purchases in reasonable quantities, parcels between relatives) is outside the scope
- Online marketplaces that only facilitate transactions are intermediary service providers with no EUDR obligation. The obligations sit with whoever actually supplies the product. If a marketplace also fulfils or sells in its own name, it can become an operator, downstream operator, or trader for those functions
- An EU consumer who buys a relevant product online from outside the EU for private use is never an operator under the EUDR, even if listed as importer on customs paperwork
- A substantiated concern is a duly-reasoned claim based on objective and verifiable information about a specific possible non-compliance. General sector-wide allegations do not qualify
- Any downstream operator or trader, of any size, must immediately notify the Competent Authority on receiving a substantiated concern. Non-SME downstream operators and traders must additionally verify upstream due diligence and stop the flow if verification fails
- Exports out of the EU follow the same regime as placing on the market. Operators must provide the DDS reference at customs; downstream-operator exporters can use a dedicated TARIC certificate code instead, removing the need to communicate reference numbers at export
- Re-imported products previously placed on the EU market and subject to due diligence can flow under a downstream-operator regime instead of a fresh DDS, provided the re-importer keeps documentary evidence of the original placing. A conventional reference number can be used at customs where no original DDS reference is available
Knowledge Check
Test what you just learned
5 questions · check each one as you go
A German private individual buys a leather wallet online from a US-based small seller for their own use. Who is the operator under the EUDR?
Which of the following qualifies as a 'substantiated concern' under Art. 2(31) EUDR?
A non-SME downstream operator receives an email from a credible NGO that meets the substantiated concern definition. What must the downstream operator do?
A downstream operator buys EU-cleared cocoa, processes it into chocolate, and exports the chocolate to Japan. What does it have to do at customs at the point of export?
A company exported cocoa from the EU to a third country. Years later, it is re-imported. What is required at the EU customs border?