Deforestation Risk Assessment for EUDR: Steps, Negligible Risk and Software

A deforestation risk assessment is the part of EUDR compliance that decides whether your coffee, cocoa, soy, palm oil, rubber, cattle or timber reaches the EU market or is held at the border. It is a structured, plot-level evaluation that confirms the commodity was not grown on land deforested after 31 December 2020, was produced legally, and can be traced to precise geolocation. Its conclusion, that risk is negligible, is what you file in your Due Diligence Statement (DDS).

Updated September 2026. Reflects the December 2025 amendment (Regulation (EU) 2025/2650) and the 2026 simplification package. Application dates are confirmed: 30 December 2026 for large and medium operators, 30 June 2027 for micro and small enterprises. The 31 December 2020 deforestation cut-off is unchanged.

Key takeaways

• Negligible risk is the bar — You must show deforestation risk is negligible for every plot, assessed and mitigated to a level you can defend to an auditor.
• It is plot-specific and time-stamped — Geolocation (polygons for plots over 4 ha), satellite verification against the 2020 cut-off, and legality evidence.
• No assessment, no DDS, no market access — The risk assessment is the factual backbone of the DDS you file in the EU Information System.
• Manual does not scale — Spreadsheets are the leading source of rejected DDS submissions; automation is now the practical default.

What is a deforestation risk assessment under EUDR?

Under EUDR (Regulation (EU) 2023/1115), a deforestation risk assessment is a mandatory, evidence-based process, not a sustainability report or a one-time audit. For every batch you place on the EU market it must demonstrate three things:

• Deforestation-free. The commodity was produced on land not deforested or degraded after 31 December 2020.
• Legally produced. Production complied with the laws of the country of origin: land use, tenure, environmental and labour rules.
• Traceable to the plot. Every batch links back to specific geolocated coordinates, not a region or a country.

What makes EUDR different from older sustainability claims is the standard of proof. You must conclude that the risk of deforestation is negligible, and that conclusion flows directly into your DDS.

What counts as negligible risk?

Negligible risk does not mean zero risk. It means that, after assessing all available information and applying any mitigation, the risk of the commodity being non-compliant is so small it can be considered insignificant, and you can show an auditor how you reached that conclusion. A colour-coded spreadsheet cell is not a methodology; a documented, reproducible risk score is. Only a post-mitigation negligible conclusion clears a batch for the EU market.

The 6 steps of a defensible deforestation risk assessment

Whether you run it manually or on a platform, a compliant assessment moves through the same six steps. Each is a point where the process either holds up under audit or quietly fails.

1. How do you map every plot to precise geolocation?

Collect GPS coordinates for each plot where the commodity was produced. Single points may pass for very small plots, but polygon boundaries are required for plots over 4 hectares and are strongly preferred everywhere, because they are what satellite checks are run against. Incomplete or incorrect geolocation is the leading reason DDS submissions fail validation.

Learn what EUDR geolocation requirements mean for points, polygons, GeoJSON, coordinate accuracy, plot-level data, and validation, and how to build a reliable geolocation process across your supplier network.

→ Read Our Guide: EUDR Geolocation Requirements

2. How do you screen plots against satellite data?

Cross-reference each plot against global forest datasets (Sentinel-2, Landsat, Hansen GFC, JRC) to confirm no forest was cleared after 31 December 2020. This is the evidence that the land is deforestation-free.

Learn how satellite monitoring can support plot-level deforestation checks, geolocation verification, risk assessment, and ongoing EUDR compliance across your supply chain.

→ Read Our Guide: Satellite Monitoring in EUDR

3. How do you verify legality beyond the land title?

Confirm production complied with local law: land-use rights, tenure, environmental and labour rules. A valid title alone does not satisfy EUDR’s legality requirement.

4. How do you score and prioritise risk?

Combine plot-level signals (proximity to protected forest, post-2020 change) with macro signals (country and region benchmarking) to classify each plot. Your scoring directly shapes the scrutiny you face: inspection rates are tiered by country risk.

5. How do you mitigate risk that is not negligible?

Where risk cannot be ruled out, take documented mitigation action (additional data collection, supplier engagement, independent verification), then reassess. Only a post-mitigation negligible conclusion clears the batch for market.

6. How do you produce an audit-ready DDS?

Feed the assessment into a Due Diligence Statement with plot geocoordinates, product details and your negligible-risk declaration, file it in the EU Information System, and retain all supporting records for five years.

Why deforestation risk assessment breaks down in spreadsheets

Most teams start the way they run everything else: spreadsheets, shared drives and supplier emails. It works until volume and scrutiny arrive, and then the cracks show up where they cost the most.

• Geolocation gaps. Smallholder plots arrive as a town name or a single pin when EUDR needs polygons. This is the leading reason submissions fail validation.
• Manual satellite checks. Cross-referencing each plot against Hansen, Sentinel-2 or JRC by hand does not scale past a few dozen plots, and one missed overlap is a non-compliant batch.
• No defensible risk score. Auditors want to see how you reached negligible. A colour-coded cell is not a methodology.
• Five-year audit exposure. Records must be reproducible for five years. Loose files do not survive staff turnover or an audit request.

Up to 4% of annual EU turnover is the minimum fine EUDR sets for serious violations, on top of blocked shipments and product bans.

Manual vs platform-led deforestation risk assessment

The real question is not whether to run a deforestation risk assessment, it is how. Here is how the common approaches compare on the things that decide whether a DDS clears.

How TraceX automates deforestation risk assessment

TraceX’s EUDR solution runs the whole assessment as one connected workflow, so evidence is captured once and flows straight into a defensible DDS.

• Farm-level geolocation mapping with offline polygon capture and geometry validation before a plot ever reaches a risk check.
• Satellite-based screening against Sentinel-2, Landsat, Hansen and JRC layers, with alerts when a sourcing region shows new forest loss.
• Agentic AI risk scoring that surfaces the high-risk plots needing mitigation first.
• Mitigation workflows and an automated, TRACES-ready DDS with all records centralised for the five-year window.

What to look for in deforestation risk assessment software

• Offline polygon capture for remote smallholder plots, with built-in geometry validation.
• Native satellite integration (Sentinel-2, Landsat, Hansen, JRC) with continuous monitoring, not a one-time check.
• EUDR-specific risk scoring and mitigation logging, not a generic GIS or ESG module.
• Direct TRACES-ready DDS generation with EORI, HS codes and plot geocoordinates.
• A centralised five-year audit trail, and proven scale across thousands of smallholders.

Frequently asked questions