The number people quote is 4% of turnover. It is real, it comes from Regulation (EU) 2023/1115 Article 25(2)(a), and it is almost always quoted slightly wrong.
Article 25 does not say the fine is 4%. It says that for a legal person, “the maximum amount of such a fine shall be at least 4 % of the operator’s, downstream operator’s or trader’s total annual Union-wide turnover in the financial year preceding the fining decision”. That is a floor under the ceiling. Member States must make their maximum fine at least that large; nothing stops them going higher, and the same paragraph requires the fine to be “increased, where necessary, to exceed the potential economic benefit gained”.
So 4% is not the worst case. It is the smallest worst case the EU will accept.
Who sets the penalties?
Not the regulation. Article 25(1) puts that on Member States: they “shall lay down rules on penalties applicable to infringements of this Regulation by operators, downstream operators and traders”, take the measures needed to implement them, and notify the Commission of those rules and any later amendments.
What the regulation does instead is set the floor. Article 25(2) requires penalties to be “effective, proportionate and dissuasive” and then names six things they must include. That list is the useful part, because it is the same in every Member State.
The six penalties Article 25(2) requires
| What Article 25(2) requires | |
|---|---|
| (a) | Fines proportionate to the environmental damage and to the value of the commodities or products, calculated so they “effectively deprive those responsible of the economic benefits derived from their infringements”, rising for repeated infringements. For a legal person, a maximum of at least 4% of total annual Union-wide turnover. |
| (b) | Confiscation of the products concerned. |
| (c) | Confiscation of the revenues gained from a transaction with those products. |
| (d) | Exclusion from public procurement and public funding — tendering, grants and concessions — for up to 12 months. |
| (e) | Temporary prohibition from placing on the market, making available or exporting, for a serious infringement or repeated infringements. |
| (f) | Loss of the simplified due diligence route in Article 13, for a serious infringement or repeated infringements. |
Read (b) and (c) together. Losing the goods and losing what you were paid for them are separate penalties, and both sit alongside the fine rather than instead of it.
The one that is easiest to underestimate
Point (f) removes the Article 13 simplified due diligence route.
If you source entirely from low-risk countries, Article 13 lets you skip the Article 10 risk assessment and Article 11 mitigation for those goods. It is the single largest reduction in workload the regulation offers. Losing it does not fine you anything — it just means every consignment now needs the full assessment, permanently, while your competitors keep the shortcut.
For a business built around that exemption, (f) can cost more over a year than (a) does once.
What can happen before any of that
This is the part that surprises people, because it does not require a finding against you.
Article 23 requires Member States to give competent authorities the power to take immediate interim measures — including “the seizure of the relevant commodities or relevant products, or the suspension of the placing or making available on the market or the export” — when potential non-compliance has been detected.
Potential. Not proven. The triggers named are:
- examination of evidence or other information, including substantiated concerns submitted under Article 31
- the checks under Articles 18 and 19
- risks identified by the information system in Article 33
So a substantiated concern from a third party, or a risk flag raised by the EU information system, can stop a shipment while the question is still open. That is a commercial event long before it is a legal one.
They can also bill you for the investigation
Article 20 lets Member States authorise their competent authorities to reclaim from operators, downstream operators or traders “the totality of the costs of their activities with respect to instances of non-compliance” — testing, storage and the rest.
And the checks themselves are not limited to reading your paperwork. Article 18 allows “anatomical, chemical or DNA analysis” to establish species or place of production, Earth observation data including Copernicus, and spot checks with field audits — in third countries too, where those countries agree.
If your file says one thing and the wood says another, they have a method for finding out.
The public list
Article 25(3) is short and does something the rest of the article does not.
Member States must notify the Commission of final judgments against legal persons within 30 days of the judgment becoming final. The Commission then publishes a list on its website containing the name of the legal person, the date, a summary of the activities that infringed the regulation, and the nature and amount of the penalty.
There is no fine attached to that paragraph. It is simply a matter of public record, searchable, with your customers’ procurement teams as its most attentive readers.
What this means in practice
Almost none of this turns on intent. The penalties attach to placing non-compliant products on the market, and the interim measures attach to the possibility that you have. What decides your exposure is whether your evidence survives contact with someone checking it.
In practice that comes down to unglamorous things: whether every plot is located to the precision Article 9 requires, whether the geometry is valid, whether the production dates and countries line up with what you actually bought, and whether you can show the reasoning that took you from that evidence to your conclusion.
None of that is expensive to check. It is only expensive to discover late.
Validate your plot data free — it runs in your browser, needs no account, and tells you exactly what fails and where.
Related reading: the negligible-risk test in Article 10, when simplified due diligence applies, what the geolocation rules require, and the EUDR compliance checklist.
Sources
- Regulation (EU) 2023/1115, consolidated text of 26 December 2025 — Articles 13, 18, 19, 20, 23, 25(1), 25(2), 25(3), 31, 33
This article explains the regulation. It is not legal advice, and the penalty rules that apply to you are the ones your Member State has laid down under Article 25(1).