The Signature Is the Product

A Search of the Larder

Every Monday morning our household holds what I can only describe as a cabinet meeting. A handful of retirees sit round a kitchen table in a cave in Andalucía, deciding who cooks on which night and where the supplies are coming from, with all the gravity of a war council and noticeably better biscuits. It is, I have come to realise, the most functional governance I have witnessed in sixty-odd years, and I have sat in rooms with Directors.

A few weeks ago, after reading about a European law that finally comes into force on the 30th of December, I did something I hadn’t done since my RAF Police days. I conducted a search. Not of a barrack block or a suspicious locker, but of our own larder, armed with a notebook and a list of seven words: cattle, cocoa, coffee, oil palm, rubber, soya and wood. These are the seven commodities the European Union has decided are chewing their way through the world’s forests. From the end of this month, any large company putting them on the European market has to prove they didn’t come from land cleared after the last day of 2020.

I expected to find a couple. I found them everywhere… The coffee, obviously, because nothing in this house happens before coffee. The bar of cooking chocolate. The beef in the freezer, earmarked for somebody’s Thursday. The kitchen table itself, the wellies by the door, and the sack of layers’ pellets in the outbuilding, which the chickens regard as the single most important object in Spain. Our cooking oil, I’m pleased to report, is olive, this being Andalucía, where using anything else is treated as a minor criminal offence.

Then the search got interesting, because the law doesn’t follow those seven words the way I’d assumed. The bar of chocolate is covered. A chocolate biscuit, apparently, is not. Soya bean meal is caught when it’s shipped into Europe, but once it has been blended into animal feed, the sack in our shed falls outside the rules altogether, and the eggs our hens lay were never in scope to begin with. A bar of soap made with palm oil is out. The beef is in.

None of that is a scandal on its own. Every law has to draw its line somewhere, and somebody sitting in Brussels with a customs code book has clearly had a long few years. But it was my first clue to what this piece is really about, which is that a law is not the same thing as the mark it leaves on the world. A law is a perimeter fence. What matters is who walks it, how often, and whether they’re allowed to look over the top.

Third Time Lucky

The law in question is the EU Deforestation Regulation, which the acronym-loving classes call the EUDR. The idea is simple enough to fit on a beer mat. If you want to sell cocoa, coffee, soya, palm oil, wood, rubber or beef into the European market, you have to show the stuff wasn’t grown on land cleared after 31 December 2020. You file a due diligence statement, you supply the geolocation of the plot it came from, you assess the risk, and you sign. No proof, no sale.

The Commission’s own impact assessment reckoned that without a law like this, European consumption and production alone would push deforestation up by roughly 248,000 hectares by 2030, an area not far off the size of Luxembourg. That’s the problem Brussels set out to solve. What it has spent the last three years doing, however, is postponing the solution.

The regulation entered into force in June 2023 and was due to apply from 30 December 2024. It was then pushed back a year to December 2025. In the autumn of 2025, the Commission blamed its own IT system, which is the bureaucratic equivalent of the dog eating your homework, and by December it had been pushed back again. It now applies to large and medium-sized companies from 30 December 2026, with micro and small operators getting until 30 June 2027. Each delay was sealed in December, weeks before the deadline, which tells you something about how much enthusiasm there was in the building.

The pressure came from everywhere. Nineteen EU governments asked for it to be simplified. Brazil, Indonesia, Malaysia, Colombia, Ghana and the United States all lobbied Brussels to think again, and the American ambassador to the EU, Andrew Puzder, dismissed it as over-regulation, protectionism and an unnecessary trade barrier. The December 2025 deal even ordered a “simplification review” by April 2026, before the law had been applied to a single shipment. The campaign group Earthsight pointed out, with admirable restraint, that decision-makers would have “no evidence of how it works in practice”.

That review landed on 4 May 2026. To the visible surprise of many, the Commission refused to reopen the text, confirmed there would be no further delay, and announced that its various simplifications had cut annual compliance costs by around 75 per cent. It tidied the product list, adding things like soluble coffee and certain palm oil derivatives, and proposed dropping leather. WWF called it a shift from political scaremongering to practical implementation, and for once I’m inclined to agree. On paper, the 30th of December is real.

On paper. Hold that thought, because I spent a good part of my working life learning what paper is worth.

After the RAF, I spent years as an Operations Manager in civilian security, where I earned the nickname Mr Memo. It wasn’t affectionate. Whenever something mattered, a procedure changed, a risk was spotted, a corner was being cut, I wrote it down in an open memo and asked people to sign to say they’d read it. My colleagues thought I was being pedantic. Some of them probably still do.

What I learned, though, was something I hadn’t bargained for. Those memos were meant to change behaviour, and sometimes they did. But the people who valued them most were the Directors, and not for the reason I’d intended. When something went wrong, the first question in the boardroom wasn’t “what happened?” It was “did we tell them?” And there it would be, in a lever-arch file, signed and dated. The memo hadn’t prevented the problem. It had prevented the blame. Somewhere along the way, the signature had quietly become the product.

I think about that a lot when I read the EUDR, because the whole edifice rests on a document called the due diligence statement. The company gathers its information, assesses its risk, mitigates whatever it finds, and then submits a statement into an EU information system declaring the goods compliant. After the May review, the main responsibility sits with whoever first places the product on the European market, and the companies further down the chain take a more passive role. One signature at the door, and everyone behind it can relax.

To be fair to Brussels, this is how most modern regulation works, from food hygiene to anti-money laundering. You can’t station an inspector on every plantation in Borneo, so you make the company do the work and hold it accountable for what it declares. And the EUDR asks for far more than a signature. It demands the GPS coordinates of the actual plot of land, which is a genuine leap from the old world of vague assurances and glossy sustainability reports.

But a coordinate is still just a number on a form. It tells you where the company says the palm fruit came from. Whether that’s where it actually came from, whether it was mixed with fruit from somewhere else at the mill, whether the plot was cleared in 2019 or 2024, all of that depends on someone checking. A due diligence system that nobody tests isn’t a safeguard. It’s a very expensive lever-arch file, and I’ve seen what those are really for.

Exhibit A, Central Kalimantan

Which brings me to the story that set me off. At the end of October, three Indonesian environmental groups, WALHI Kalteng, TuK Indonesia and Sawit Watch, published the results of an investigation into palm oil from plantations in Central Kalimantan, the Indonesian part of Borneo. They traced the oil through the supply chain to some names you will find in almost every kitchen in Europe, including PepsiCo, Unilever, Ferrero, Mondelez and Procter & Gamble.

At one plantation, PT Karya Makmur Abadi, a subsidiary of the Malaysian group KLK, they found signs of forest clearance in 2024. That is four years after the EUDR’s cut-off date. If oil from land like that ends up in a European jar of something after the 30th of December, it is exactly what the law exists to stop.

I want to be careful here, partly because I was trained to be and partly because I’d rather not spend my pension on lawyers. The investigation shows a risk, not a crime. It doesn’t establish that any of those brands have broken the law, and it couldn’t, because the law hasn’t started yet. Supply chains are long and murky, and a company can buy from a supplier without buying from every one of that supplier’s plantations. But a risk is precisely what the EUDR asks companies to find and deal with, and here are campaigners on the ground handing it to them on a plate, with two months to spare.

Achmad Surambo of Sawit Watch put it bluntly, saying Europe’s biggest palm oil buyers had failed to police their own involvement in deforestation and calling for “immediate and strong enforcement”. Perrine Fournier of the forest campaign group Fern said Indonesia’s palm oil industry “remains tainted by illegality”, and that it’s now up to the enforcement authorities to act.

The backdrop matters. Indonesia is losing forest faster than almost anywhere on earth, to illegal logging, mining, slash-and-burn clearing and new oil palm plantations, and decades of that loss have left its landscapes primed for the fires that choke the region most years. Yet when the Commission sorted the world into risk categories in May 2025, Indonesia, Malaysia and Brazil all landed in the middle band, “standard risk”, alongside around fifty other countries. Only four countries made the high-risk list: Belarus, North Korea, Myanmar and Russia. I’m not sure how much palm oil North Korea exports, but I suspect it isn’t keeping anyone in Brussels awake at night.

That classification isn’t just a label. It decides how hard the authorities are obliged to look, which is where my old trade comes in.

A Copper’s View

The first thing they teach you in any police service, military or civilian, is that a rule nobody enforces isn’t a rule. It’s a suggestion with a letterhead. The second thing, usually learned the hard way, is that people behave according to the odds of getting caught, not the severity of the punishment written in the manual.

The EUDR hands enforcement to what it calls “competent authorities” in each member state. Each year they must check a minimum share of the companies sourcing from each risk category: 1 per cent for low-risk countries, 3 per cent for standard-risk and 9 per cent for high-risk. So a company importing palm oil from Indonesia, standard risk, has a minimum 3 per cent chance of being examined in any given year. Put another way, the law only obliges the authorities to look at three in every hundred. Of course they can do more, and they can act on substantiated concerns, like the ones that have just landed from Kalimantan. But anyone who has run a security operation on a budget knows the minimum has a funny habit of becoming the target.

Here in Spain, the job falls to the Ministry for the Ecological Transition, through its Directorate-General for Biodiversity, Forests and Desertification. It will coordinate with the regional authorities of the autonomous communities and with customs, which, if you have ever tried to get two Spanish administrations to agree on anything, should fill you with a certain foreboding. Madrid began formal work on the national law to apply the regulation, including its penalties and powers of confiscation, back in June 2025. I’d love to tell you how many inspectors will be walking that particular beat on New Year’s Eve. I couldn’t find the number, and I suspect I’m not the only one.

The penalties, at least, have teeth. The regulation requires member states to set maximum fines of at least 4 per cent of a company’s annual turnover in the EU, alongside confiscation of goods and profits and exclusion from public contracts, on paper that’s enough to make a boardroom sit up. But a fine nobody ever imposes frightens nobody, and the size of the stick matters far less than whether anyone is actually holding it.

I’ve written before about what happens when policing gets thinned out and quietly handed to whoever is cheapest. The EUDR is a different animal, but the instinct is the same. Write the law, publish the penalties, and then hope whoever patrols the perimeter has the people, the money and the nerve to do it properly.

Between Christmas and New Year

There’s something almost poetic about the date. The 30th of December sits in that strange dead week between Christmas and New Year, when offices are empty, newsrooms are running on interns and leftover turkey, and nobody is paying attention to anything. If you wanted to launch a law with as little fuss as possible, you couldn’t pick a better day. I’m sure it’s a coincidence. Most things are, right up until they aren’t.

I’ll be here, in the cave, almost certainly still arguing about who’s cooking on New Year’s Eve, a question our Monday meeting will have spectacularly failed to settle. The chickens will be out in the yard eating pellets made, in all likelihood, partly from soya grown somewhere I’ll never see. Somewhere on the far side of the world a bulldozer may or may not be pushing back the edge of a forest, and somewhere in Madrid an official may or may not be opening a file about it.

I’d like to tell you the law will work. It might. It’s a genuinely ambitious piece of legislation; it has survived three years of lobbying from some of the most powerful governments and companies on the planet, and the Commission deserves some credit for finally refusing to blink. If it’s enforced with even half the energy that went into trying to delay it, the forests of Borneo will be better off for it.

But I spent too many years watching signed memos disappear into lever-arch files to mistake paperwork for protection. A law is a promise, and a due diligence statement is a promise about a promise. What turns either of them into something real is a person, with the time, the training and the authority to go and look. Whether Europe has bothered to pay for enough of those people is the question nobody seems keen to answer, and on the 30th of December, with everyone looking the other way, I suspect nobody will be asking it.

So I’ll ask it here, from a cave in Andalucía, with a chicken watching me suspiciously from the doorway. Who, exactly, is going to check?