Is Your Product in Scope? EUDR Derived Products and CN/HS Codes Explained

Scope is decided by the Combined Nomenclature (CN) code, the EU's eight-digit customs classification. CN codes are built on the international six-digit Harmonised System (HS) code. Annex I lists relevant products by CN code, and the due diligence statement reports the classification at the HS level.

The relationship is simple once separated. The HS code is the first six digits, shared globally. The CN code adds two digits for EU-specific detail. TARIC then adds a further two digits at import, carrying the customs measures and the document codes that show how the EUDR obligation was met. Scope comes from Annex I. Customs codes carry the proof through the declaration.

One detail causes more errors than any other: the prefix "ex" in front of a code. It does not mean the product is excluded. It means only part of that code is covered, specifically the goods derived from a regulated commodity. A code marked "ex" requires a second check on whether the item is actually made from cattle, cocoa, coffee, oil palm, rubber, soya, or wood.

How to get started: find the codes your goods enter and leave the EU on, then check them against Annex I. Where you see "ex," confirm the material, not just the code.

Four situations catch teams out. Each turns a clean lookup into a judgment call, and each needs a documented rationale.

Composite products are classified under a single code, set by the product's primary component or function. Chocolate is classified under one code where cocoa is the linked commodity, so due diligence attaches to the cocoa, not automatically to every other listed ingredient inside it. Whether a palm oil derivative in that product carries its own obligation depends on whether it enters the market as a relevant product in its own right or as part of the composite.

Recycled and waste materials are treated differently from virgin inputs. Fully recycled or waste-derived content is generally out of scope, while the non-recycled portion of a mixed product remains in scope. Used and second-hand goods, and product samples, are also handled as specific cases rather than by default.

Packaging is a frequent surprise. Packaging that is itself a listed product can be in scope, while packaging that only accompanies and protects another good, and is not sold in its own right, is generally treated differently. The finished-versus-input distinction matters here. A finished item can be out of scope while a listed input used to make it is in scope, and the reverse can also be true.

How to get started: map scope at the component level, not only the finished SKU, and write down the reason for every in or out decision.

Annex I is not fixed. A 2026 delegated act revising Annex I changed which derived products are listed. The seven commodities did not change, and the core application dates did not move. The product list did.

The revision removed several entries, including cattle hides, skins, and leather, re-treaded tyres, certain articles of vulcanised rubber such as conveyor and transmission belts, aircraft and motor vehicle seats, and soybeans for sowing. It added others, applying from 30 December 2027, including soluble coffee, a range of palm oil derivatives and soap made using oil palm, and frozen cattle tongues. It also confirmed exemptions for waste, used goods, samples, and certain packaging, and clarified the "ex" codes.

For a manufacturer, the practical message is twofold. Teams that already mapped leather or vulcanised rubber articles can now retire some of that effort, with a documented rationale. Teams sourcing soluble coffee or palm oil derivatives have new work arriving on a later clock. Because the list moves, a one-time scoping spreadsheet becomes a liability the moment the next delegated act lands.

How to get started: re-run your product scoping against the current consolidated Annex I, and treat scoping as a process you repeat, not a task you finish.

Checking one product against Annex I takes minutes. Checking an enterprise catalogue of tens of thousands of SKUs, across thousands of suppliers and multiple tiers, is a different exercise. This is where most EUDR programmes stall, and it is a data problem before it is a compliance problem.

Three things make it hard at scale. First, classification data is scattered. CN and HS codes live in customs records, ERP material masters, procurement systems, and PLM, and they frequently disagree. Second, scope attaches inside the bill of materials, so the question is not only "is this finished product listed" but "does any listed input sit beneath it." Third, the answer must be auditable. Competent authorities assess your system and your reasoning, not a single statement, so every in-scope and out-of-scope call needs evidence you can retrieve.

Manual lookup does not survive this. Nor does a naive shortcut, since customs classification is exactly the kind of detail where guessing produces confident, wrong answers. The reliable path is to match your real transactional data against the regulatory list with explainable logic, which is what a transactional data foundation is built to do. It connects ERP, procurement, and BOM data so scope can be tested at the SKU and component level, not sampled.

The scale is real. In one enterprise programme, carbmee helped Galp analyse roughly 40,000 items from more than 2,000 suppliers across 140 categories, and build the baseline without contacting a single supplier first. At the component level, ZEISS built 90 product carbon footprints from 12 foundational component models spanning more than 200 components and 50 suppliers. The same logic that resolves emissions at component level resolves EUDR scope at component level.

A defensible scoping process is repeatable and documented. It answers not only what is in scope today, but why, and it can be re-run when Annex I changes. Six steps make it auditable.

1. Extract the CN and HS codes for every product and input from your customs, ERP, procurement, and PLM systems, and reconcile the conflicts.
2. Match each code against the current Annex I, treating "ex" codes as a second check on the underlying material.
3. Explode composites and bills of materials, so listed inputs beneath a finished product are caught.
4. Classify your role for each in-scope product as operator, trader, or downstream actor, because the role sets the obligation.
5. Flag exemptions, such as recycled content, packaging, used goods, and samples, and record the rationale for each.
6. Re-run the whole process whenever a delegated act revises Annex I, and keep the version history.

How to get started: build this as a workflow with an audit trail, not a spreadsheet, so the next scope change is a re-run rather than a rebuild.

Knowing what is in scope is step one. The harder work is collecting producer-level evidence and filing a defensible due diligence statement, on time, across a global supplier base. carbmee EIS™, built on the Carbontology™ data foundation, is designed to carry a team from scope detection through to audit-ready DDS without building a new process from scratch.

EUDR forces three questions you must answer with evidence. Who is responsible, which depends on each actor's role across importer, operator, supplier, and producer. What data is required, which goes beyond a supplier declaration to commodity-level traceability, producer confirmation, geolocation, harvest or crop timing, and legal land-use documentation. And where the product came from, traced back to the producer across complex multi-tier chains. If you cannot answer quickly, with proof, you are exposed.

carbmee EIS™ operationalises those answers in four moves. It identifies who must respond by segmenting suppliers, producers, and reporting entities by role and by DDS scenario. It collects what matters through targeted questionnaires that gather producer confirmation, commodity data, and documentation with less manual follow-up. It verifies where products originate by capturing and validating structured geolocation inputs. And it prepares submission with confidence, generating audit-ready records with the supporting evidence already connected and easy to retrieve. Because the same supplier engagement model and data foundation also serve CBAM and CSRD, EUDR does not become a fourth siloed project that re-collects the same supplier data.

Timing is the constraint that catches teams. Readiness depends on supplier participation and documentation that take months to collect and validate. Companies without structured workflows get pushed into manual outreach and last-minute risk decisions as the deadline nears. The return justifies acting early: an independent Verdantix study found a 345% operational ROI and a four-month break-even for carbmee EIS™. At enterprise scale, carbmee integrated more than one million annual transactions for Heraeus and completed its data integration in months, replacing spreadsheet-based work. That is the difference between defensible EUDR readiness and a December scramble.

Three points decide EUDR scope. First, scope follows the code, not the commodity name, so EUDR derived products can pull you in even when you never buy a raw commodity. Second, Annex I is the only source of truth, and the "ex" codes and composite rules turn scoping into documented judgment. Third, the exercise only becomes manageable when you run it against your own transactional data, at portfolio scale, with an audit trail.

The teams that treat scoping as a repeatable, data-driven process will be ready for 30 December 2026, and for the next revision of Annex I after it. The teams that rely on a one-time spreadsheet will not.

Find out exactly which of your products are in scope. Request a free EUDR scope and exposure check with carbmee's compliance experts.