EUDR Risk Assessment: Key Steps for Due Diligence

An EUDR risk assessment is the step in EU Deforestation Regulation due diligence where a company evaluates whether commodities like coffee, cocoa, soy, palm oil, cattle, rubber or wood carry a risk of being linked to deforestation or illegal production. It scores risk using geolocation data, country risk classification and 11 legal criteria, then triggers mitigation before products reach the EU market.

EUDR risk assessment is the part of EU Deforestation Regulation compliance that decides whether the products you import or sell can legally enter the EU market and getting it wrong is now a financial and operational risk, not a paperwork formality. In plain language: it is a structured check that proves the commodities in your supply chain were not grown on land deforested after 31 December 2020 and were produced legally in their country of origin.

If you are a compliance lead, sustainability manager or procurement head trying to work out how to actually run an EUDR risk assessment and whether to do it on spreadsheets or buy a platform this guide gives you the criteria, a 5-step workflow, the country risk tiers, a comparison of your options and a downloadable checklist.

Key takeaways

• An EUDR risk assessment is mandatory for any operator or trader placing the 7 covered commodities (or their derived products) on, or exporting from, the EU market.
• Risk is judged against 11 Article 10 criteria plus the country risk classification (low / standard / high).
• Low-risk sourcing unlocks simplified due diligence; standard and high risk require full assessment and mitigation.
• Non-compliance can mean fines of at least 4% of EU-wide annual turnover, product confiscation and market exclusion.
• Use the 5-step workflow and checklist below to operationalise it.

What an EUDR Risk Assessment Is

An EUDR risk assessment is the middle stage of the regulation’s three-part due diligence system, sitting between information gathering and risk mitigation. At a glance, it covers:

• The legal basis — Article 10 of Regulation (EU) 2023/1115, the EU Deforestation Regulation (EUDR).
• The question it answers — is there a more-than-negligible risk that these commodities are non-compliant (linked to deforestation or illegal production)?
• The inputs — geolocation coordinates of the plots of land, country risk classification, supplier data and the 11 risk criteria.
• The output — a documented risk conclusion that either clears the product or triggers mitigation before a due diligence statement is filed.

Where it fits: collect information → run the risk assessment → mitigate any non-negligible risk → submit the due diligence statement.

EUDR Risk Assessment: Who Needs One and When

An EUDR risk assessment applies to far more businesses than people expect, because liability follows the product, not just the producer. You are in scope if you:

• Place covered commodities on the EU market — cattle, cocoa, coffee, oil palm, rubber, soya and wood, plus derived products (leather, chocolate, furniture, paper, tyres, and more).
• Trade them within the EU — non-SME traders carry the same due diligence duties as operators.
• Export them from the EU — the obligation runs in both directions.

⏱ Timeline note: EUDR application dates have been amended since the regulation entered into force, with separate deadlines for large/medium operators and for micro & small enterprises. Confirm the current applicable date for your business size against the official EUR-Lex text before publishing.

Due diligence is the foundation of EUDR compliance.

Read our complete guide to understand the due diligence process, required documentation, risk assessment, and the steps needed to place compliant products on the EU market.

EUDR Risk Assessment Criteria: The 11 Article 10 Factors

EUDR risk assessment criteria are the specific factors you must weigh to decide whether risk is negligible. Run every commodity batch through all eleven:

1. Country (or region) risk classification assigned by the European Commission.
2. Presence of forests in the production area.
3. Presence and rights of indigenous peoples and local communities.
4. Credible claims or evidence of deforestation or forest degradation.
5. Prevalence of deforestation or forest degradation in the country/region.
6. Source and reliability of the information and geolocation data.
7. Concerns about the country of production and origin, e.g. corruption levels.
8. Complexity of the relevant supply chain and processing stage.
9. Risk of mixing with products of unknown or non-compliant origin.
10. Conclusions from European Commission expert group / enforcement findings.
11. Complementary information on compliance with the regulation, including certification or third-party verification.

EUDR Risk Assessment Process: A 5-Step Workflow

The EUDR risk assessment process turns raw supplier data into a defensible compliance decision. These five steps map directly to what auditors expect to see documented:

Step 1 — Map the supply chain and collect geolocation data

Capture the geolocation coordinates of every plot of land where the commodity was produced, plus supplier, country and quantity data. Polygon data is expected for larger plots; precise points for smaller ones.

Step 2 — Apply the country risk classification

Pull the Commission’s low / standard / high benchmark for each sourcing country to set your baseline level of scrutiny.

Step 3 — Score against the 11 risk criteria

Assess each batch across the Article 10 factors above and reach a risk conclusion: negligible, or non-negligible.

Step 4 — Mitigate any non-negligible risk

Where risk is more than negligible, gather additional information, commission independent surveys or audits, and re-assess until risk is negligible. Products cannot proceed otherwise.

Step 5 — Document and file the due diligence statement

Record the assessment, evidence and conclusion, then submit the due diligence statement in the EU information system before placing the product on the market. Retain records for at least five years.

EUDR risk assessment by the numbers

• 7 commodities are in scope — cattle, cocoa, coffee, oil palm, rubber, soya and wood — plus their derived products.
• 31 Dec 2020 is the deforestation-free cut-off date; production on land deforested after it is non-compliant.
• 3 country risk tiers — low, standard and high — determine how much due diligence is required.
• ≥4% of total EU-wide annual turnover is the minimum maximum fine for serious non-compliance, alongside confiscation and market exclusion.
• ~10% of global deforestation has historically been linked to EU consumption — the rationale behind the regulation.

EUDR Risk Assessment by Country Risk Classification

Your EUDR risk assessment obligations scale with the Commission’s country benchmark. The table below shows what each tier means for your workload:

Does sourcing from a low-risk country mean you’re EUDR compliant? Not necessarily.

Read our guide to understand how EUDR country risk classifications work, what they mean for your business, and why due diligence is still essential.

EUDR Risk Assessment Software vs Manual: Which Should You Buy?

Most teams start an EUDR risk assessment in spreadsheets and hit a wall once geolocation volumes, supplier counts and audit demands grow. Here is how the two approaches compare for a buyer:

TraceX EUDR Solutions helps businesses build a defensible, audit-ready deforestation risk assessment process by combining geolocation data, satellite imagery, AI-powered crop identification, supplier documentation, and traceability into a single platform. Instead of relying on a single satellite alert, TraceX analyzes multiple evidence layers to identify potential deforestation risks, validate supplier information, and distinguish genuine risks from false positives caused by seasonal changes or natural events. The platform enables organizations to automate risk assessments, maintain complete audit trails, collaborate with suppliers to close data gaps, and generate the evidence required to support EUDR due diligence. With real-time risk visibility and AI-driven insights, TraceX empowers businesses to make informed sourcing decisions, strengthen compliance, and confidently demonstrate that their commodities meet the EU Deforestation Regulation’s requirements.

EUDR Risk Assessment Checklist

Use this EUDR risk assessment checklist as a final pre-filing review for every batch:

• Geolocation coordinates captured for all plots (polygons where required).
• Country risk classification applied to each sourcing origin.
• All 11 Article 10 criteria assessed and a risk conclusion recorded.
• Non-negligible risks mitigated and re-assessed to negligible.
• Supplier evidence and certifications attached.
• Due diligence statement prepared for the EU information system.
• Records stored for the 5-year retention requirement.

Frequently Asked Questions (FAQ’s)