EUDR Risk Assessment: The Article 10 Criteria, Country Risk Tiers and Mitigation

An EUDR risk assessment is the stage of EU Deforestation Regulation due diligence where you decide whether a commodity carries a more-than-negligible risk of being linked to deforestation or illegal production. It weighs 11 criteria set out in Article 10 of Regulation (EU) 2023/1115, together with the country risk classification, and either clears the batch or triggers mitigation under Article 11 before a Due Diligence Statement (DDS) can be filed.

Updated September 2026. Reflects the December 2025 amendment (Regulation (EU) 2025/2650) and the 2026 simplification package. Application dates are confirmed: 30 December 2026 for large and medium operators, 30 June 2027 for micro and small enterprises. The 31 December 2020 deforestation cut-off is unchanged.

Key takeaways

• It is the middle stage of due diligence — Collect information, then run the risk assessment, then mitigate, then file the DDS.
• Risk is judged against 11 Article 10 criteria — Plus the country risk classification: low, standard or high.
• The bar is negligible risk — Low-risk sourcing unlocks simplified due diligence; standard and high require full assessment and mitigation.
• Non-compliance is costly — Fines of at least 4% of EU-wide annual turnover, product confiscation and market exclusion.

What is an EUDR risk assessment, and where does it fit?

An EUDR risk assessment is the middle stage of the regulation’s three-part due diligence system, sitting between information gathering and risk mitigation. Its legal basis is Article 10 of Regulation (EU) 2023/1115. The question it answers is simple: is there a more-than-negligible risk that these commodities are linked to deforestation or illegal production? Its inputs are geolocation coordinates, the country risk classification, supplier data and the 11 criteria. Its output is a documented risk conclusion that either clears the product or triggers mitigation.

Looking for the step-by-step how-to? This page is the regulatory reference for the criteria and classification. For the operational workflow, satellite screening and software comparison, see our guide: how to run a deforestation risk assessment.

Who needs an EUDR risk assessment, and when?

Liability follows the product, not just the producer, so the assessment applies more widely than many expect. You are in scope if you:

• Place covered commodities on the EU market (cattle, cocoa, coffee, oil palm, rubber, soya and wood, plus derived products such as leather, chocolate, furniture, paper and tyres).
• Trade them within the EU as a non-SME trader, carrying the same due diligence duties as operators.
• Export them from the EU. The obligation runs in both directions.

The deadlines are 30 December 2026 for large and medium operators and 30 June 2027 for micro and small enterprises, under the December 2025 amendment.

The Article 10 criteria

These are the specific factors you must weigh to decide whether risk is negligible. Run every commodity batch through all eleven and record the conclusion.

1. Country or region risk classification assigned by the European Commission.
2. Presence of forests in the production area.
3. Presence and rights of indigenous peoples and local communities.
4. Credible claims or evidence of deforestation or forest degradation.
5. Prevalence of deforestation or forest degradation in the country or region.
6. Source and reliability of the information, and the geolocation data.
7. Concerns about the country of production or origin, such as corruption levels.
8. Complexity of the supply chain and the processing stage involved.
9. Risk of mixing with products of unknown or non-compliant origin.
10. Conclusions from the European Commission expert group and enforcement findings.
11. Complementary information on compliance, including certification or third-party verification.

Learn what Article 10 requires, which risk criteria operators need to consider, and how to build a documented, audit-ready risk assessment process.

→ Read Our Guide: EUDR Article 10

EUDR risk assessment by country risk classification

Your workload scales with the Commission’s country benchmark. Each sourcing country is classified low, standard or high, which sets the depth of due diligence required.

Sourcing from a low-risk country does not by itself make you compliant: you still confirm the classification, verify the data and watch for the risk of mixing. See our guide to EUDR country risk classifications for detail.

Learn how EUDR country risk classification works, what the different risk levels mean, and how businesses can incorporate country risk into their broader due diligence process.

→ Read Our Guide: EUDR Country Risk Classification

The 5-step risk assessment workflow

These five steps map to what auditors expect to see documented. For the detailed operational how-to, including satellite screening and geolocation capture, follow the deforestation risk assessment hub.

1. Map the supply chain and collect geolocation for every plot, with polygons for larger plots and points for smaller ones.
2. Apply the country risk classification to set your baseline level of scrutiny.
3. Score against the 11 Article 10 criteria and reach a conclusion: negligible or non-negligible.
4. Mitigate any non-negligible risk and reassess until the residual risk is negligible.
5. Document and file the DDS in the EU Information System, and retain records for at least five years.

Risk mitigation under Article 11: what to do when risk is not negligible

If the assessment concludes the risk is more than negligible, you cannot place the product on the market until you mitigate it and a reassessment brings the residual risk down to negligible. Article 11 sets out this obligation. Negligible does not mean zero: it means risk has been assessed and mitigated to a defensible level you can show an auditor.

Typical mitigation measures

• Collect additional or higher-quality data (better geolocation, missing legality documents).
• Commission independent surveys, audits or third-party verification.
• Engage or, where necessary, substitute suppliers that cannot provide adequate evidence.
• Apply ongoing satellite monitoring of the sourcing region for new forest loss.

Then reassess

After mitigation, run the assessment again. Only a post-mitigation negligible conclusion clears the batch. Document every mitigation step and the reassessment, because that record is what an auditor will ask for. All documentation must be retained for at least five years.

Understand what EUDR Article 11 requires, which mitigation measures businesses can consider, and how to document actions taken to reduce identified risks.

→ Read Our Guide: EUDR Article 11

EUDR risk assessment software vs manual: which should you buy?

Most teams start in spreadsheets and hit a wall once geolocation volumes, supplier counts and audit demands grow. Here is how the two approaches compare for a buyer.

TraceX EUDR Solutions provide a staged, explainable risk-assessment workflow that evaluates supplier geolocations across satellite and Earth-observation datasets, assessing risk across five explicit dimensions. Its five-stage reasoning chain produces an auditor-defensible risk verdict for each plot, rather than relying on a single threshold-based flag. This is complemented by a Geometry Validator that performs approximately 13 automated integrity checks on every GeoJSON, with safe auto-correction where possible and rejection when geometry cannot be validated. Together, these capabilities help businesses move from fragmented geolocation data to validated, evidence-backed, plot-level EUDR risk assessment and audit readiness.

EUDR risk assessment checklist

Use this as a final pre-filing review for every batch:

• Geolocation coordinates captured for all plots, with polygons where required.
• Country risk classification applied to each sourcing origin.
• All 11 Article 10 criteria assessed and a risk conclusion recorded.
• Non-negligible risks mitigated and reassessed to negligible.
• Supplier evidence and certifications attached.

Frequently asked questions