EUDR risk assessment: country risk and mitigation

What is the EUDR risk assessment?

It is the second step of due diligence, after collecting the Article 9 information. The operator verifies and analyses that information and decides whether there is a risk that the product is non-compliant: that it comes from land deforested after 31 December 2020 or was not produced legally. It may only place the product on the market or export it if the conclusion is that the risk is none or negligible (Art. 10(1)).

Negligible risk has its own definition (Art. 2(26)): after a full assessment of product-specific and general information, and after mitigation where needed, the product gives no cause for concern. It is not a feeling: it has to be explained with data. Risk assessments are documented, reviewed at least once a year and shown to the competent authority on request (Art. 10(4)).

Low, standard and high-risk countries

The Commission classifies countries in three tiers (Art. 29). The current list is in Implementing Regulation (EU) 2025/1093, in force since 26 May 2025. It classifies whole countries, not regions. Countries not listed in its Annex are standard risk (Art. 1(2)).

What counts is the country of production, not the country of shipment. An example with cocoa: Ghana is low risk and Côte d’Ivoire standard risk, so Ivorian cocoa shipped through a Ghanaian port is still standard risk. Article 13(3) tells authorities to act in exactly these cases. The list can be revised (Art. 29(2)): check EUR-Lex before each season.

Which Article 10(2) criteria to document

The assessment must take into account, in particular, these criteria. They will not all weigh the same for every shipment, but it pays to write down what you looked at for each one:

• Country: its risk level under Article 29, the presence of forests and the prevalence of deforestation or forest degradation (points a, b and f).
• Indigenous peoples: their presence, good-faith consultation and cooperation with them, and any duly reasoned claims over the land (points c, d and e).
• Quality of information: source, reliability and validity of the Article 9 data, starting with the geolocation of the plots (point g).
• Context: corruption, document falsification, lack of law enforcement, human rights violations, armed conflict or UN or EU sanctions (point h).
• Supply chain: its complexity, the stage of processing, how hard it is to link the product to the plot, and the risk of circumvention or mixing with product of unknown origin (points i and j).
• External signals: conclusions of Commission expert groups, substantiated concerns submitted by third parties, history of non-compliance in the chain and any other information pointing to a risk (points k, l and m).
• Complementary information, such as that from certification or third-party verification schemes, as long as it meets the Article 9 requirements (point n).

Article 10(4) requires you to show how these criteria were applied to the information gathered and how you arrived at the level of risk. A certificate helps, but it does not replace the assessment.

How to mitigate risk that is not negligible

If the assessment does not show none or negligible risk, the operator takes measures before placing on the market until it does (Art. 11(1)): requiring additional information, data or documents; carrying out independent surveys or audits; or other measures on the Article 9 information. It can also support its suppliers, smallholders in particular. In practice:

• Ask for land titles, harvesting permits or licences that prove legality.
• Commission an independent audit or a visit to the doubtful farms.
• Compare each plot with satellite imagery against the cut-off date. Sourevo’s satellite check crosses the plot with the EU 2020 forest map, the University of Maryland annual tree cover loss and Global Forest Watch alerts. A loss is a signal to review, not proof of deforestation: in plantations that already existed in 2020, harvesting also shows up as loss.
• Leave plots that cannot be cleared out of the batch, or change supplier.

The operator also needs risk management policies, controls and procedures (Art. 11(2)); if it is not an SME, with a compliance officer at management level and an independent audit of those procedures. Mitigation decisions are documented and reviewed at least once a year (Art. 11(3)). If the risk does not come down to negligible, the product cannot be placed on the market or exported.

Simplified due diligence for low-risk countries

If all the commodities and products were produced in low-risk countries, the operator does not have to comply with Articles 10 and 11 (Art. 13(1)). What it still does: collect all the Article 9 information, geolocation included, submit the DDS, and assess the complexity of the supply chain and the risk of circumvention or mixing with product from standard or high-risk countries. The documentation showing that this mixing risk is negligible is shown to the authority on request.

The simplification is lost as soon as information points to a risk, for example a substantiated concern from a third party: the operator must then apply Articles 10 and 11 in full and inform the competent authority immediately (Art. 13(2)).

How to record negligible risk and keep it for 5 years

For each DDS, the assessment should record: the conclusion (negligible from the start, or negligible after mitigation), the criteria reviewed, the evidence used with its date, the mitigation measures taken, and who decided and when. This documentation is kept for at least five years (Art. 12(5)), as is the record of each DDS from its submission (Art. 4(3)).

The assessment is not uploaded to TRACES: the DDS only contains the statement that due diligence was carried out and the risk is none or negligible. What goes in the DDS and what you keep separately is covered in what makes a valid DDS. In Sourevo a DDS cannot be submitted without first recording the risk conclusion and its justification, and on submission it is frozen in the record together with each plot’s satellite result and the documents used.

What changes when the country is high risk?

There is no simplified due diligence and the country level counts against you in the assessment (Art. 10(2)(a)). The most visible change is checks: each Member State must check every year at least 9% of the operators placing products from those countries on the market and 9% of the quantity of each product, against 3% for standard risk and 1% for low risk (Art. 16(8) to (10)). After the 2025 reform, those percentages include non-SME downstream operators and traders, and they apply separately to each commodity.

Who checks in Spain and what the penalties are: see EUDR penalties in Spain.

Frequently asked questions

Is Spain a low-risk country under the EUDR?

Yes. All Member States are on the low-risk list of Implementing Regulation 2025/1093. Spanish producers apply simplified due diligence, but they still need geolocation and a DDS.

Can I apply simplified due diligence to cocoa from Ghana?

Only if all the cocoa in the shipment was produced in Ghana and you can document that the risk of mixing with cocoa from standard-risk countries, such as Côte d’Ivoire, is negligible. If contrary information appears, you go back to full due diligence.

Does a certification replace the risk assessment?

No. Article 10(2)(n) accepts it as complementary information if it meets the Article 9 requirements, but the conclusion on risk remains the operator’s responsibility.

Is the risk assessment sent to TRACES?

No. The DDS carries the statement that the risk is none or negligible. The assessment and its evidence are kept for at least five years and shown to the competent authority on request.

How often must the assessment be reviewed?

At least once a year (Arts. 10(4) and 11(3)), and sooner if there is new information: a deforestation alert, a substantiated concern or a change in the country list.