1 This request for a preliminary ruling concerns the interpretation of Article 4(2) and (3) and of Article 6(1) of Regulation (EU) No 995/2010 of the European Parliament and of the Council of 20 October 2010 laying down the obligations of operators who place timber and timber products on the market (OJ 2010 L 295, p. 23).
2 The request has been made in the context of a dispute between JYSK Kereskedelmi Kft. (‘JYSK’) and the Nemzeti Élelmiszerlánc-biztonsági Hivatal (National Food Chain Safety Office, Hungary) (‘the National Office’) concerning the conditions of use by that company of a due diligence system (a ‘DDS’) in its activity of marketing timber and timber products.
3 Recitals 16 to 18 and 31 of Regulation No 995/2010 are worded as follows: ‘(16) On the basis of a systemic approach, operators placing timber and timber products for the first time on the internal market should take the appropriate steps in order to ascertain that illegally harvested timber and timber products derived from such timber are not placed on the internal market. To that end, operators should exercise due diligence through a system of measures and procedures to minimise the risk of placing illegally harvested timber and timber products derived from such timber on the internal market. (17) The [DDS] includes three elements inherent to risk management: access to information, risk assessment and mitigation of the risk identified. The [DDS] should provide access to information about the sources and suppliers of the timber and timber products being placed on the internal market for the first time, including relevant information such as compliance with the applicable legislation, the country of harvest, species, quantity, and where applicable sub-national region and concession of harvest. On the basis of this information, operators should carry out a risk assessment. Where a risk is identified, operators should mitigate such risk in a manner proportionate to the risk identified, with a view to preventing illegally harvested timber and timber products derived from such timber from being placed on the internal market. (18) In order to avoid any unnecessary administrative burden, operators already using systems or procedures which comply with the requirements of this Regulation should not be required to set up new systems. … (31) Since the objective of this Regulation, namely the fight against illegal logging and related trade, cannot be achieved by the Member States individually and can therefore, by reason of its scale, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity …’
4 Article 2 of that regulation, entitled ‘Definitions’, provides: ‘For the purposes of this Regulation, the following definitions shall apply: … (c) “operator” means any natural or legal person that places timber or timber products on the market; …’
5 Article 4 of the said regulation, entitled ‘Obligations of operators’, provides: ‘1. The placing on the market of illegally harvested timber or timber products derived from such timber shall be prohibited. 2. Operators shall exercise due diligence when placing timber or timber products on the market. To that end, they shall use a framework of procedures and measures, hereinafter referred to as a [DDS], as set out in Article 6. 3. Each operator shall maintain and regularly evaluate the [DDS] which it uses, except where the operator makes use of a [DDS] established by a monitoring organisation referred to in Article 8. …’
6 Article 6 of the same regulation, entitled ‘Due diligence systems’, provides: ‘1. The [DDS] referred to in Article 4(2) shall contain the following elements: (a) measures and procedures providing access to the following information concerning the operator’s supply of timber or timber products placed on the market: - description, including the trade name and type of product as well as the common name of tree species and, where applicable, its full scientific name, - country of harvest, and where applicable: (i) sub-national region where the timber was harvested; and (ii) concession of harvest, - quantity (expressed in volume, weight or number of units), - name and address of the supplier to the operator, - name and address of the trader to whom the timber and timber products have been supplied, - documents or other information indicating compliance of those timber and timber products with the applicable legislation; (b) risk assessment procedures enabling the operator to analyse and evaluate the risk of illegally harvested timber or timber products derived from such timber being placed on the market. Such procedures shall take into account the information set out in point (a) as well as relevant risk assessment criteria, including: - assurance of compliance with applicable legislation, which may include certification or other third-party-verified schemes which cover compliance with applicable legislation, - prevalence of illegal harvesting of specific tree species, - prevalence of illegal harvesting or practices in the country of harvest and/or sub-national region where the timber was harvested, including consideration of the prevalence of armed conflict, - sanctions imposed by the UN Security Council or the Council of the European Union on timber imports or exports, - complexity of the supply chain of timber and timber products. (c) except where the risk identified in course of the risk assessment procedures referred to in point (b) is negligible, risk mitigation procedures which consist of a set of measures and procedures that are adequate and proportionate to minimise effectively that risk and which may include requiring additional information or documents and/or requiring third party verification. …’
7 Article 8 of Regulation No 995/2010, entitled ‘Monitoring organisations’, provides: ‘1. A monitoring organisation shall: (a) maintain and regularly evaluate a [DDS] as set out in Article 6 and grant operators the right to use it; (b) verify the proper use of its [DDS] by such operators; (c) take appropriate action in the event of failure by an operator to properly use its [DDS], including notification of competent authorities in the event of significant or repeated failure by the operator. 2. An organisation may apply for recognition as a monitoring organisation if it complies with the following requirements: (a) it has legal personality and is legally established within the Union; (b) it has appropriate expertise and the capacity to exercise the functions referred to in paragraph 1; and (c) it ensures the absence of any conflict of interest in carrying out its functions. 3. The Commission, after consulting the Member State(s) concerned, shall recognise as a monitoring organisation an applicant that fulfils the requirements set out in paragraph 2. The decision to grant recognition to a monitoring organisation shall be communicated by the Commission to the competent authorities of all the Member States. 4. The competent authorities shall carry out checks at regular intervals to verify that the monitoring organisations operating within the competent authorities’ jurisdiction continue to fulfil the functions laid down in paragraph 1 and comply with the requirements laid down in paragraph 2. … 5. If a competent authority determines that a monitoring organisation either no longer fulfils the functions laid down in paragraph 1 or no longer complies with the requirements laid down in paragraph 2, it shall without delay inform the Commission. 6. The Commission shall withdraw recognition of a monitoring organisation when, in particular on the basis of the information provided pursuant to paragraph 5, it has determined that the monitoring organisation no longer fulfils the functions laid down in paragraph 1 or the requirements laid down in paragraph 2. … …’
8 Article 10 of that regulation, entitled ‘Obligations of operators’, provides: ‘1. The competent authorities shall carry out checks to verify if operators comply with the requirements set out in Articles 4 and 6. … 3. The checks referred to in paragraph 1 may include, inter alia: (a) examination of the [DDS], including risk assessment and risk mitigation procedures; (b) examination of documentation and records that demonstrate the proper functioning of the due diligence system and procedures; (c) spot checks, including field audits. … 5. … where, following the checks referred to in paragraph 1, shortcomings have been detected, the competent authorities may issue a notice of remedial actions to be taken by the operator. …’
9 Article 4 of Commission Implementing Regulation (EU) No 607/2012 of 6 July 2012 on the detailed rules concerning the due diligence system and the frequency and nature of the checks on monitoring organisations as provided for in Regulation (EU) No 995/2010 of the European Parliament and of the Council of 20 October 2010 laying down the obligations of operators who place timber and timber products on the market (OJ 2012 L 177, p. 16), entitled ‘Risk assessment and mitigation’, provides: ‘Certification or other third-party verified schemes referred to in the first indent of the second paragraph of Article 6(1)(b) and in Article 6(1)(c) of Regulation [No 995/2010] may be taken into account in the risk assessment and risk mitigation procedures where they meet the following criteria: (a) they have established and made available for third-party use a publicly available system of requirements, which system shall at the least include all relevant requirements of the applicable legislation; (b) they specify that appropriate checks, including field-visits, are made by a third party at regular intervals no longer than 12 months to verify that the applicable legislation is complied with; (c) they include means, verified by a third party, to trace timber harvested in accordance with applicable legislation, and timber products derived from such timber, at any point in the supply chain before such timber or timber products are placed on the market; (d) they include controls, verified by a third party, to ensure that timber or timber products of unknown origin, or timber or timber products which have not been harvested in accordance with applicable legislation, do not enter the supply chain.’
10 Article 5 of that implementing regulation, entitled ‘Record keeping by operators’, provides: ‘1. Information concerning the operator’s supply as provided for in Article 6(1)(a) of Regulation [No 995/2010] and application of risk mitigation procedures shall be documented through adequate records, which shall be stored for five years and made available for checks by the competent authority. 2. In applying their due diligence system operators shall be able to demonstrate how the information gathered was checked against the risk criteria provided for in Article 6(1)(b) of Regulation [No 995/2010], how a decision on risk mitigation measures was taken and how the operator determined the degree of risk.’
11 It follows from the order for reference that JYSK is a company incorporated under Hungarian law which, in the course of its activity of marketing timber and timber products, imports timber and timber products from third countries. Its capital is wholly owned by the company LLG A/S (‘the parent company’), registered in Denmark.
12 In the course of 2023, the National Office, which is the competent authority responsible for enforcing Regulation No 995/2010 in Hungary, carried out a check of JYSK in order to verify, inter alia, whether JYSK had a DDS in accordance with the requirements of that regulation.
13 By decision of 26 May 2023, the National Office found, inter alia, that JYSK had infringed Regulation No 995/2010, imposed a fine on it and ordered it to create its own DDS on the ground that it did not have a DDS drawn up on its own behalf and created specifically for the activity that it carried out, or established by a monitoring organisation within the meaning of Article 8 of Regulation No 995/2010.
14 The National Office noted that JYSK was an operator within the meaning of Article 2(c) of Regulation No 995/2010 and that, in the context of exercising its commercial activity, JYSK used a DDS developed by its parent company and based on risk analyses carried out both by that company and by such an organisation.
15 JYSK is challenging that decision before the Fővárosi Törvényszék (Budapest High Court, Hungary), which is the referring court in this case, arguing that the DDS maintained by its parent undertaking can be considered as its own system, since Regulation No 995/2010 only lays down the obligation to use a DDS and not to create one. That company observes that the parent undertaking has numerous subsidiaries in Europe which all use the same DDS.
16 The National Office, however, submits that an operator within the meaning of Regulation No 995/2010 is obliged to maintain a DDS itself. In so far as the parent company allows its subsidiaries to act autonomously in relation to imports of timber and timber products, each of those subsidiaries must maintain its own DDS in accordance with that regulation.
17 In that context, the referring court questions whether Regulation No 995/2010 merely requires an operator to use a DDS in order to collect data, evaluate and, as the case may be, mitigate risks as regards the timber and timber products that it places on the market for the first time in the European Union or whether, on the contrary, such an operator must have a DDS established on its own behalf and specifically created for the activity it carries on. In addition, that court considers that, in view of JYSK’s activity, that company is itself, as an operator within the meaning of that regulation, subject to DDS obligations.
18 It is in those circumstances that the Fővárosi Törvényszék (Budapest High Court) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling: ‘Should Article 4(2) and (3) of Regulation [No 995/2010], read in conjunction with Article 6(1) of that regulation, be interpreted as meaning that it is consistent with those provisions for the operator to have access to the elements, referred to in Article 6(1) of the regulation, of the [DDS] maintained and evaluated by its parent undertaking or used by its parent undertaking and established by a monitoring organisation within the meaning of Article 8 [of that regulation]?’
19 By its question, the referring court asks, in essence, whether Article 4(2) and (3), first sentence, and Article 6(1) of Regulation No 995/2010 must be interpreted as meaning that, in order to comply with its obligations under those provisions, it is sufficient for an operator, within the meaning of Article 2(c) of that regulation, belonging to a group of companies to be able to access the elements of a DDS, referred to in that Article 6(1), which is either established, maintained and evaluated by the parent company of that group or is established by a monitoring organisation referred to in Article 8 of that regulation and used by that parent company.
20 In that regard, it is important to recall that Article 4(2) and (3), first sentence, of Regulation No 995/2010 imposes on an operator, within the meaning of Article 2(c) of that regulation, two distinct obligations as regards the DDS. On the one hand, an operator must, when it places timber or timber products on the internal market for the first time, use a DDS established in accordance with Article 6(1) of the said regulation. On the other hand, the operator must maintain and regularly evaluate the DDS that it uses, unless it is using a DDS established by a monitoring organisation referred to in Article 8 of Regulation No 995/2010.
21 In the case at hand, it is apparent from the documents before the Court that, in order to enable JYSK to fulfil its obligation to use a DDS, its parent company allows it to access the various elements comprising a single DDS shared within a group of companies to which those two companies belong, the elements of which are determined either by the parent company itself or by a monitoring organisation within the meaning of Article 8 of Regulation No 995/2010. Moreover, it is common ground that JYSK does not itself maintain or evaluate the DDS to which it has access, its obligations in that regard being assumed by its parent company, if necessary by having recourse to such an organisation.
22 In order to provide a useful answer to the question referred, it is necessary to verify, first, whether an operator may fulfil its obligation to use a DDS by having access to the elements contained in a DDS which have been established by a third party and, second, whether, in order to comply with its obligation regularly to maintain and evaluate the DDS that it uses, it is sufficient that an operator have access to a DDS which is either established, maintained and regularly evaluated by a third party which is not a monitoring organisation within the meaning of Article 8 of Regulation No 995/2010, or is established by such an organisation but used by a third party.
23 In order to answer those questions, it should be recalled that, in accordance with settled case-law, in interpreting a provision of EU law, it is necessary to consider not only its wording, but also the context in which it occurs and the objectives pursued by the rules of which it is part (see, to that effect, judgments of 17 November 1983, Merck, 292/82, EU:C:1983:335, paragraph 12, and of 27 February 2025, Dun & Bradstreet Austria and Others, C‑203/22, EU:C:2025:117, paragraph 39 and the case-law cited).
24 As regards, in the first place, the literal interpretation of the provisions mentioned by the question referred for a preliminary ruling, the usual meaning in everyday language of the term ‘use’, which appears in both paragraph 2 and the first sentence of paragraph 3 of Article 4 of Regulation No 995/2010, does not allow for an unequivocal determination of the extent to which an operator may have recourse to a third party in order to fulfil its obligations under those provisions.
25 The fact remains that, first, as is clear from Article 4(2) of Regulation No 995/2010, an operator is obliged to use a DDS which obligatorily contains the elements specified in Article 6(1) of that regulation. Having regard to points (a) to (c) of the latter provision, read in the light of recitals 16 and 17 of the said regulation, the three elements thus required are, first of all, the measures and procedures providing access to information concerning the sources of supply and suppliers of timber and timber products placed on the internal market for the first time, next, the procedures enabling the operator, on the basis of that information, to analyse and evaluate the risk of illegally harvested timber and timber products derived from such timber being placed on that market and, last, where that risk proves to be non-negligible, the measures and procedures for mitigating it.
26 The obligation to use a DDS, however, implies active behaviour on the part of the operator in the sense that it is for it to adopt the appropriate measures to apply the DDS in order to prevent illegally harvested timber and timber products derived from such timber from being placed on the market. In addition, the three elements comprising the DDS must necessarily pertain to that operator’s own commercial activity giving rise to a placing of timber or timber products on the internal market and be adapted to the specific risk generated by that activity.
27 Second, it is apparent from the wording of Article 4(2) and (3), first sentence, and of Article 6(1)(b) of Regulation No 995/2010 that the obligation to use a DDS when placing timber or timber products on the internal market and, therefore, the obligation to apply a DDS in its three components referred to in Article 6(1) of that regulation, are placed on the operator alone. The said regulation does not provide for any possibility for an operator to entrust the fulfilment of its obligation to use a DDS to a third party, Article 4(3) thereof providing that only the maintenance and evaluation of the DDS used by the operator may be entrusted to a monitoring organisation within the meaning of Article 8 of that regulation where the operator makes use of a DDS established by such an organisation.
28 It is true that EU law does not preclude an operator from being assisted by a third party when determining the various elements contained in a DDS under Article 6(1)(a) to (c) of Regulation No 995/2010. Thus, Article 4 of Implementing Regulation No 607/2012 expressly provides that certification or other third-party verification schemes referred to in the first indent of the second subparagraph of Article 6(1)(b) and in Article 6(1)(c) of Regulation No 995/2010 may, in principle, be taken into account in the procedures for assessing and mitigating the risk of illegally harvested timber or timber products being placed on the market.
29 It nevertheless follows from the foregoing that it is the operator which is, in principle, required to establish the DDS, a task which, as is apparent from Article 4(3) of Regulation No 995/2010, may also be performed by a monitoring organisation, and to adopt the appropriate measures to apply that DDS in order to prevent illegally harvested timber and timber products from being placed on the market.
30 Third, Article 4(3) of Regulation No 995/2010 unequivocally limits the possibility for an operator to absolve itself of its obligation to maintain and evaluate the DDS solely to the case of a DDS established by a monitoring organisation referred to in Article 8 of that regulation, the former provision stipulating that it must then be the DDS used by that operator.
31 In those circumstances, it may be inferred from the wording of the combined provisions of Article 4(2) and (3), first sentence, and of Article 6(1) of Regulation No 995/2010, on the one hand, that the mere access, by an operator, to the elements contained in a DDS in accordance with the latter provision originating not from itself, but from a third party which is not a monitoring organisation, such as the parent company of the group of companies to which it belongs, does not satisfy the requirement of active conduct which is incumbent on that operator by virtue of its obligation to use a DDS when it places timber or timber products on the internal market. On the other hand, that same operator may entrust to a third party the fulfilment of its obligation to maintain and regularly evaluate a DDS only in a situation in which it is using such a DDS. Such an option is, in any event, conceivable only in cases where the DDS, used by the operator, is established by a monitoring organisation within the meaning of Article 8 of that regulation.
32 The interpretation contained in the preceding paragraph is supported both by the context in which the provisions whose interpretation is sought appear and by the objective pursued by Regulation No 995/2010.
33 As regards, in the second place, the contextual interpretation of those provisions, it must be recalled that, under Article 10(1) and (3)(a) and (b) of Regulation No 995/2010, the competent authorities are to carry out checks to verify whether operators comply with the requirements set out in Articles 4 and 6 of that regulation, the purpose of those checks being, inter alia, to examine the DDS, including the procedures for assessing and mitigating the risk of illegally harvested timber or timber products being placed on the market, as well as to examine documentation and records that demonstrate the proper functioning of the DDS and procedures.
34 In that regard, Article 5(1) of Implementing Regulation No 607/2012 provides for the obligation, for operators, to keep a register of information concerning the supply of timber or timber products placed on the market, referred to in Article 6(1)(a) of Regulation No 995/2010, and for the application of procedures for mitigating the risk of illegally harvested timber or timber products being placed on the market. Article 5(2) of Implementing Regulation No 607/2012 states that operators are to be able to demonstrate how a decision on risk mitigation measures was taken and how they determined the degree of risk.
35 In view of the obligations thus imposed on an operator in respect of the use, maintenance and regular evaluation of a DDS in accordance with Articles 4 and 6 of Regulation No 995/2010, it must be pointed out that the effectiveness of the checks carried out by the competent authorities in the context of an operator’s commercial activity under Article 10(1) of Regulation No 995/2010 could not be fully guaranteed if, subject to the exception provided for in Article 4(3) of that regulation, that operator were able simply to share with those authorities its access to the elements contained in a DDS established by a third party. The fact that, as may be the case, that third party is the parent company of a group of companies to which the operator belongs and carries on a commercial activity similar - if not identical - to that of that operator and that those two entities have recourse to the same supply chains is irrelevant.
36 A similar line of reasoning applies with regard to the first sentence of Article 10(5) of Regulation No 995/2010, by virtue of which, where the competent authorities detect shortcomings during the checks that they carry out, those authorities may issue a notice of remedial actions to be taken by the operator. The rapid and effective implementation of such measures by the operator would not be guaranteed if it were not in a position to take action itself in respect of the various elements contained in the DDS concerned.
37 As regards, in the third place, the teleological interpretation of the provisions referred to by the question, it must be borne in mind that the objective pursued by Regulation No 995/2010, as is apparent from recital 31 thereof, is to fight against illegal logging and related trade (see, to that effect, judgment of 21 November 2024, Mesto Rimavská Sobota, C‑370/23, EU:C:2024:972, paragraph 36). In addition, it may be inferred from recital 16 of that regulation that applying a DDS is intended to minimise the risk of placing illegally harvested timber and timber products derived from such timber on the internal market.
38 Only the operator itself, which is under a duty of diligence when placing timber or timber products on the internal market under Article 4(2) of Regulation No 995/2010, is in a position to carry out satisfactorily the provision of relevant information regarding its commercial activity and the assessment and management of the risk associated with that activity and thereby to ensure the implementation of the DDS established by that regulation in conformity with the objectives recalled in the preceding paragraph of the present judgment. As the Advocate General observed, in essence, in points 58 and 59 of his Opinion, the operator’s simply having access to a DDS whose implementing measures originate not from the operator itself or from a monitoring organisation, but from a third party, such as its parent company, does not make it possible to guarantee that those objectives can be achieved in an equivalent manner.
39 In that regard, the operator’s obligations under Article 4(2) and (3), first sentence, and Article 6(1) of Regulation No 995/2010 cannot be deemed fulfilled merely because an operator is in a position to establish that it has access to the elements contained in a DDS established by a third party and because, in the course of its commercial activity, it has not placed illegally harvested timber and timber products on the internal market. Such an approach, after all, would not take sufficient account of the fact that Regulation No 995/2010 aims to lay down requirements for that same operator which impose on it active conduct prior to any placing on the internal market of timber or timber products.
40 It is true that, as is apparent from recital 18 of Regulation No 995/2010, that regulation takes account of the need to avoid unnecessary administrative burdens on operators. It cannot be ruled out that using, maintaining and regularly evaluating a DDS adapted to the specific commercial activity of each subsidiary of a group of companies may represent a financial challenge for both the parent company and the subsidiaries.
41 However, such considerations relating to the advantages linked to the existence of one and the same DDS within a group of companies cannot absolve operators of the obligation to exercise due diligence in accordance with the requirements set out in Regulation No 995/2010.
42 It is also worth adding that the possibility for an operator to comply with its obligation to maintain and regularly evaluate the DDS through the use of a DDS established by a monitoring organisation within the meaning of Article 8 of Regulation No 995/2010 cannot, in any event, be extended to the situation in which that DDS has been established, is maintained and evaluated by another third party, such as the parent company of that operator. Such an approach would constitute a circumvention of the provisions governing the organisation, functions and supervision of monitoring organisations in accordance with paragraphs 1 to 6 of that Article 8 and thus risk undermining the objectives recalled in paragraph 37 of the present judgment.
43 In the light of all the foregoing considerations, the answer to the question referred is that Article 4(2) and (3), first sentence, and Article 6(1) of Regulation No 995/2010 must be interpreted as meaning that, in order to comply with its obligations under those provisions, it is not sufficient for an operator, within the meaning of Article 2(c) of that regulation, belonging to a group of companies to be able to access the elements of a DDS, referred to in that Article 6(1), which is either established, maintained and evaluated by the parent company of that group or is established by a monitoring organisation referred to in Article 8 of that regulation and used by that parent company.
44 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.