EU's 4 May 2026 EUDR Package: What Malaysian and Indonesian Timber Exporters Must Do Now

Last updated: May 2026. This article reflects the European Commission's simplification package published 4 May 2026, including the Simplification Review Report, updated Guidance and FAQ Version 5, and the draft Delegated Act on product scope. The draft Delegated Act is open for public feedback until 1 June 2026 and is not yet adopted law. Enforcement timelines and core due diligence obligations remain as confirmed under Regulation (EU) 2025/2650. Verify current obligations with qualified legal or compliance counsel before acting.

Key takeaways

• The EUDR legislative text has not changed. The European Commission explicitly declined to reopen the core regulation — enforcement deadlines are fixed at 30 December 2026 for large and medium operators and 30 June 2027 for micro and small operators.
• Malaysia and Indonesia remain standard risk under Commission Implementing Regulation (EU) 2025/1093. Full due diligence, including plot-level GPS polygon data, is required for every shipment. The simplified declaration pathway is legally unavailable to you.
• The TRACES Information System reopens in June 2026. Your EU buyers begin live filing of Due Diligence Statements from that point — your Digital Data Passport infrastructure must be transmittable to their systems before they open their accounts, not before December 2026.
• The Commission's headline "75% cost reduction" claim does not apply to Malaysian or Indonesian exporters. It is driven almost entirely by simplifications for micro and small operators in low-risk countries — a category that excludes Southeast Asian timber supply chains.
• FAQ Version 5 contains new operational guidance on geolocation requirements, forest association submissions, and downstream operator obligations. It is the most practically useful document the Commission has published and warrants careful reading by every Malaysian SME exporter.
• The draft Delegated Act on product scope proposes adding soluble coffee and certain palm oil derivatives and removing leather and retreaded tyres. For timber and plywood exporters, product scope is unchanged.

---

Your EU buyer has already started preparing for June 2026. Their procurement team has a TRACES account in queue and a Due Diligence Statement workflow under construction. The question they will ask — in writing, soon — is whether your data is ready to feed into that workflow. If your answer is not an unambiguous yes, you are at risk of losing the shipment.

The European Commission published its EUDR simplification package on 4 May 2026, one week past the statutory deadline set by Regulation (EU) 2025/2650. The package was widely anticipated as a potential opportunity for further delays or legal softening. It was neither. What it confirmed, with unusual political directness, is that the regulation is not being reopened and that the December 2026 enforcement deadline will hold.

For Malaysian and Indonesian timber exporters, the most important thing the 4 May package says is what it does not say. It does not reduce your due diligence obligations. It does not extend your deadline. It does not reclassify Malaysia or Indonesia as low-risk. What it does do is close the door on waiting — and open a six-week window that determines whether your supply chain is ready when EU buyers go live.

Table of contents

• What the Commission actually published on 4 May 2026
• Why the "75% cost reduction" headline does not apply to you
• What standard-risk obligations still require from Malaysian and Indonesian exporters
• The TRACES window: why June 2026 is your real deadline
• What FAQ Version 5 changes in practice
• Product scope: what changed, what did not, and what is still a draft
• FAQ

---

What the Commission actually published on 4 May 2026

The 4 May 2026 package was not a discretionary communication — it was a legal obligation. Regulation (EU) 2025/2650 required the Commission to complete a simplification review by 30 April 2026. The package arrived one week late and contained four components.

The Simplification Review Report is addressed to the European Parliament and Council. It documents all simplification measures implemented since Regulation (EU) 2023/1115 entered into force in June 2023, and sets out those introduced in this package. Its central claim — a 75% reduction in annual compliance costs — is addressed in detail in the next section.

The updated Guidance Document and FAQ Version 5 is the document exporters and their compliance teams should read in full. It contains new and revised entries on downstream operator obligations, micro and small operator simplifications, trader obligations, e-commerce platforms, and geolocation requirements. It also confirms that the Commission will establish a website where third-country producer governments can publish national legislation repositories — a measure intended to help operators assemble legality evidence for shipments from markets where legal documentation is fragmented.

The draft Delegated Act on product scope proposes amendments to the products listed in Annex I of Regulation (EU) 2023/1115. The consultation period closes 1 June 2026. It is a draft — it is not yet law — and its implications for Malaysian and Indonesian exporters are addressed in the product scope section below.

The updated draft Implementing Act on the Information System sets out technical changes to TRACES, including a simplified declaration form for micro and small primary operators, updated automated application interfaces, and a voluntary grouping feature for aggregating shipments. Critically, it confirms that the TRACES Information System will reopen in June 2026.

Important: The Commission's Simplification Review Report states explicitly that the package does not alter the core legal text of Regulation (EU) 2023/1115. This was a deliberate political decision. Given that the regulation was delayed twice — in 2024 and again in 2025 — the Commission's refusal to reopen the text in May 2026 signals that no further legislative softening is coming. Treat the December 2026 deadline as fixed.

---

Why the "75% cost reduction" headline does not apply to you

The Commission's Simplification Review Report leads with the claim that combined simplification measures reduce annual compliance costs by approximately 75% compared to the original EUDR. This figure has already attracted significant media attention. It will not reduce your compliance burden by anything close to that amount.

The 75% figure is driven almost entirely by a single measure: the simplified one-time declaration pathway made available to micro and small operators in low-risk countries. Under this pathway, a qualifying operator in a country classified as low-risk submits a simplified declaration once per calendar year rather than a full Due Diligence Statement for every shipment. The administrative saving is substantial — and it explains why the aggregate cost reduction across all operators appears large.

You do not qualify for this pathway. Malaysia and Indonesia are classified as standard risk under Commission Implementing Regulation (EU) 2025/1093, which took effect on 30 June 2025. Standard-risk classification means the simplified one-time declaration is legally unavailable regardless of your company size. A micro-enterprise timber exporter in Sarawak faces the same full due diligence requirements as a large conglomerate — the same GPS polygon data, the same satellite verification, the same legality documentation, filed for every shipment.

The simplification measures that do apply across all operator categories — clarified guidance on downstream obligations, improved TRACES interfaces, voluntary shipment grouping — are operationally useful but do not reduce the substantive due diligence you must perform. They make the administration marginally less complex; they do not reduce what you must demonstrate.

The most significant benefit in the table above — the annual declaration — is available to your competitors in low-risk country markets. It is not available to you. Plan your compliance programme accordingly.

---

What standard-risk obligations still require from Malaysian and Indonesian exporters

Nothing in the 4 May 2026 package changes the substantive due diligence requirements that apply to shipments from Malaysia and Indonesia. These obligations flow directly from Regulation (EU) 2023/1115, Articles 8 through 10, and are unaffected by the simplification measures.

Click to expand

Geolocation requirements at harvest plot level

Regulation (EU) 2023/1115, Article 9(1)(d) requires operators to provide the geolocation of all plots of land where the relevant commodity or product was produced. For timber and wood products, this means GPS polygon data at harvest plot level — not a forest concession boundary, not a district, not a postal area. The Commission's own guidance has consistently confirmed that a concession-level polygon does not satisfy this requirement.

For plots smaller than 4 hectares, a single GPS point is acceptable. For plots of 4 hectares or larger, a polygon is required. Every harvest area that feeds into a shipment must be mapped — and that mapping must be retained as part of your due diligence record for a minimum of five years under Article 10(2).

FAQ Version 5 contains new guidance on how this requirement applies where individual forest owners lack the technical capacity to produce GeoJSON files independently. The practical implications of that guidance are discussed in the section on FAQ Version 5 below.

Legality evidence under Malaysian and Indonesian law

Regulation (EU) 2023/1115, Article 9(1)(g) requires operators to collect documentation demonstrating that the relevant commodity was produced in accordance with the legislation of the country of production. For Malaysian timber exporters, this means evidence of compliance with applicable licensing requirements under the National Forestry Act 1984, state forestry enactments, and where relevant, the Malaysian Timber Certification Scheme (MTCS) or the Timber Legality Assurance System (TLAS).

The Commission's confirmation that it will publish a national legislation repository website is relevant here. It does not replace your obligation to hold legality documentation — it creates a reference resource that your EU buyer's compliance team can use to verify that the documents you provide are consistent with the legislation of your jurisdiction.

The cut-off date remains 31 December 2020

Regulation (EU) 2023/1115, Article 3(1) prohibits the placing on the EU market of products derived from land that was deforested after 31 December 2020. This cut-off date is unaffected by the simplification package. Every harvest polygon you submit must be accompanied by satellite-verified evidence that the land was forested before 31 December 2020 and has not been subject to deforestation since.

---

The TRACES window: why June 2026 is your real deadline

The formal enforcement deadline for large and medium operators is 30 December 2026 under Regulation (EU) 2025/2650. But the practical deadline — the date by which your data infrastructure must be operational — is earlier, and it is determined not by the regulation but by your buyers.

The updated draft Implementing Act on the Information System confirms that the TRACES Information System will reopen in June 2026. From that point, large EU importers will begin testing their Due Diligence Statement workflows. By mid-to-late Q3 2026, the leading EU timber importers will be executing live DDS filings for incoming shipments.

A Due Diligence Statement filed in TRACES references the supplier's geolocation data, legality documentation, and deforestation verification. The EU importer assembles that statement from data provided by you. If your Digital Data Passport — the structured, API-transmittable record containing your GPS polygon data, satellite verification, and legality evidence — is not ready to flow into your buyer's TRACES workflow, your buyer faces a binary choice: delay the shipment or substitute a supplier whose data is ready.

Example: Kota Kinabalu-based plywood mill Rimba Panels supplies a Dutch timber importer with three container loads of plywood per month. The Dutch importer opens its TRACES account in late June 2026 and begins constructing its DDS workflow. It requests Rimba Panels' Digital Data Passport — GPS polygons for the harvest plots feeding the shipment, MTCS chain-of-custody documentation, and satellite deforestation verification. Rimba Panels has not yet completed its geolocation mapping for one of its two timber concessions. The Dutch importer delays the August shipment while waiting for the data. In September, the importer sources a portion of its volume from a Finnish supplier whose data is already integrated. Rimba Panels does not recover that volume in the 2026 calendar year.

The window to build, test, and integrate your Data Passport infrastructure is the six weeks between the date of this article and the TRACES reopening in June 2026. That is not a comfortable runway. It is, however, still workable — if you begin now.

---

What FAQ Version 5 changes in practice

The updated Guidance Document and FAQ Version 5 is the most operationally substantive document in the 4 May 2026 package. While the full document was published alongside the package, several sections warrant specific attention from Malaysian and Indonesian exporters.

Forest association aggregated submissions

FAQ Version 5 contains new guidance on how forest associations can aggregate and submit geolocation data on behalf of individual forest owners. This is directly relevant to Sabah and Sarawak supply chains, where smallholder and communal forest operations are common and where individual plot owners frequently lack the technical capacity to produce GeoJSON files independently.

Under the new guidance, a forest association or industry body can consolidate plot-level geolocation data from its members and submit that data as part of a collective traceability record. The association assumes responsibility for the accuracy of the data submitted. This does not reduce the substantive requirement — plot-level polygons are still required — but it creates a viable pathway for smallholder-linked supply chains to meet the requirement through intermediary institutions rather than requiring each individual owner to engage independently with geospatial mapping tools.

Malaysian timber industry associations, particularly those operating in Sabah and Sarawak, should review this guidance and assess whether a collective submission model is operationally feasible for their membership before the TRACES system goes live.

Downstream operator obligations

FAQ Version 5 clarifies that downstream processors — companies that purchase timber from a primary operator and process it further before sale — are responsible for ensuring that the traceability chain in their Due Diligence Statement reaches back to the harvest plot, not merely to their immediate supplier. A downstream processor cannot discharge its EUDR obligation by holding only its immediate supplier's invoice and forest certification number. It must hold, or have access to, the underlying geolocation and deforestation verification data from the harvest origin.

This has direct implications for Malaysian and Indonesian exporters selling to EU-based processors rather than directly to EU retailers or importers. Your downstream EU buyer — the processor — will require your full Digital Data Passport as a condition of purchase, because they cannot complete their own DDS without it.

Geolocation requirements: additional clarifications

FAQ Version 5 addresses several recurring questions about geolocation compliance that Malaysian SMEs have raised through trade associations and legal counsel. The confirmed positions include:

• A single GPS point satisfies the geolocation requirement for plots under 4 hectares; a polygon is required at 4 hectares and above
• Geolocation data must reflect the actual harvest plot, not the forest management unit, concession, or licence area
• Where multiple harvest plots are aggregated into a single shipment, geolocation data for each contributing plot must be retained and must be available for regulatory inspection

The third point is particularly significant for mixed-source plywood and timber products, where a single shipment may draw on multiple harvest plots across different concessions or even different states.

---

Product scope: what changed, what did not, and what is still a draft

The draft Delegated Act on product scope proposes amendments to Annex I of Regulation (EU) 2023/1115. These are proposals, not confirmed law. The consultation period closes 1 June 2026, after which the Commission will review submissions before adopting the act.

For Malaysian and Indonesian timber and plywood exporters, the product scope proposals in the draft Delegated Act are operationally irrelevant. Wood products covered by HS Chapters 44, 47, and 48 are not proposed for any change — they remain fully in scope under Regulation (EU) 2023/1115, Article 1 and Annex I.

The proposed inclusion of additional palm oil derivatives may be relevant to Malaysian and Indonesian exporters with diversified commodity portfolios. Those exporters should monitor the consultation outcome and assess whether their palm-derived products fall within the expanded scope once the act is adopted.

The most important implication of this table is what it does not contain: timber and plywood are not proposed for any simplification, exclusion, or scope change — confirming that the full EUDR framework applies to every wood product shipment from Malaysia and Indonesia without modification.

---

FAQ

Does the 4 May 2026 simplification package mean there will be another delay to the EUDR deadline?

No. The Commission's report explicitly states that the package does not alter the core legal text of Regulation (EU) 2023/1115. The enforcement deadlines confirmed by Regulation (EU) 2025/2650 — 30 December 2026 for large and medium operators, 30 June 2027 for micro and small operators — remain in force. The Commission's decision not to reopen the legislative text, after two previous delays, signals clearly that no further legislative extension is being considered.

Can Malaysian or Indonesian timber exporters use the simplified annual declaration introduced in the package?

No. The simplified one-time annual declaration is available only to micro and small primary operators in countries classified as low risk under Commission Implementing Regulation (EU) 2025/1093. Malaysia and Indonesia are classified as standard risk. Regardless of company size, Malaysian and Indonesian exporters must file a full Due Diligence Statement for every shipment under Regulation (EU) 2023/1115, Article 8.

My EU buyer says they will handle the Due Diligence Statement — does that mean I do not need to prepare geolocation data?

Your EU buyer, as the operator placing goods on the EU market, is responsible for filing the Due Diligence Statement in TRACES. But they cannot file that statement without the geolocation data, legality documentation, and deforestation verification that you as the supplier must provide. Under FAQ Version 5, downstream operators are explicitly responsible for ensuring their DDS references data traceable to the harvest plot. If you do not provide that data, your buyer cannot complete their filing — and they will source from a supplier who can. Your obligation to hold and transmit this data is not reduced because your buyer files the DDS.

What is a Digital Data Passport and is it a legal requirement?

A Digital Data Passport is not a term used in Regulation (EU) 2023/1115 — it describes the structured, transmittable data record that satisfies the information requirements of Article 9(1)(a)–(h) for a given shipment. The legal requirement is to collect and hold that information; the Digital Data Passport is the practical format in which it is assembled and transmitted to your EU buyer's DDS workflow. Whether you call it a data passport, a compliance dossier, or something else, the underlying legal obligation is the same: you must hold and be able to transmit GPS polygon data, satellite deforestation verification, and legality documentation for every shipment, retained for a minimum of five years under Article 10(2).

Does MTCS or TLAS certification satisfy EUDR legality requirements?

Certification under the Malaysian Timber Certification Scheme (MTCS) or the Timber Legality Assurance System (TLAS) provides strong evidence of legality under Malaysian law — which is one component of the due diligence information required by Regulation (EU) 2023/1115, Article 9(1)(g). However, certification alone does not satisfy the full due diligence requirement. You must also provide geolocation data at harvest plot level and satellite-verified evidence that the land was not deforested after 31 December 2020. Certification and geolocation are complementary, not interchangeable.

---

Next step

If your geolocation mapping is incomplete or your Digital Data Passport is not yet structured for transmission into a TRACES workflow, the six weeks before the Information System reopens in June 2026 is the window that matters. GreenThread's EUDR Advisory service works with Malaysian and Indonesian SME exporters to assess current data readiness, identify gaps in geolocation coverage and legality documentation, and build the transmittable compliance records your EU buyers will require. Book a consultation before the TRACES system goes live.

---

Further Reading

If you are new to EUDR or want to build a complete picture before acting on this update, the four earlier articles in this series take you from orientation to the Data Custodian mandate in sequence:

• EUDR Is Confirmed. Here Is Where Every Malaysian and Indonesian Wood Exporter Should Start.
• Malaysia Is Standard Risk. No Shortcuts, No Simplified Declarations — Here Is What That Means for Your Timber Business.
• Your FSC or RSPO Certificate Will Not Satisfy EUDR. Here Is Exactly What Is Still Missing.
• You Are Not Filing the EU Declaration. Your Job Is to Build the Data Passport That Makes Your Buyer's Filing Possible.