The EUDR sorts countries into three risk categories — low, standard and high — and the current classification comes from Commission Implementing Regulation (EU) 2025/1093, which has applied since 26 May 2025. Its Annex names 140 countries as low risk and 4 as high risk. Every country not named in that Annex is standard risk.
That last sentence is the one that catches people out. Standard risk isn’t a middle band you get assigned to — it’s what you fall to when your country appears on neither list. Brazil, Indonesia and Côte d’Ivoire are all standard risk, and none of them appear on any list at all. They’re standard because they’re absent.
What are the three EUDR country risk categories?
| Category | How many countries | How you get there |
|---|---|---|
| Low risk | 140 | Named in the Annex to Regulation (EU) 2025/1093 |
| Standard risk | Everything else | Not named in the Annex. This is the default |
| High risk | 4 | Named in the Annex to Regulation (EU) 2025/1093 |
The classification comes from the benchmarking system in Article 29 of Regulation (EU) 2023/1115. The Commission describes what it measures in one sentence on its own classification page: “The benchmarking system classifies countries according to the level of risk of producing commodities covered by the scope of EUDR that are not deforestation-free.”
Which countries are high risk?
Four: Belarus, North Korea, Myanmar and Russia.
That’s the whole list. It is short enough that most importers can rule it out in a second, which is why the high-risk category gets far more attention than it deserves and the standard-risk default gets far less.
Which countries are standard risk?
Every valid country that isn’t in the Annex. The current classification names these 50 among them:
Angola, Argentina, Burkina Faso, Benin, Bolivia, Brazil, Botswana, Belize, Democratic Republic of the Congo, Côte d’Ivoire, Cameroon, Colombia, Ecuador, Eritrea, Ethiopia, Gambia, Guinea, Equatorial Guinea, Guatemala, Guinea-Bissau, Honduras, Haiti, Indonesia, Israel, Cambodia, Liberia, Mauritania, Malawi, Mexico, Malaysia, Mozambique, Namibia, Niger, Nigeria, Nicaragua, Panama, Peru, Pakistan, Paraguay, Sudan, Sierra Leone, Senegal, Somalia, El Salvador, Chad, Tanzania, Uganda, Venezuela, Zambia, Zimbabwe.
Read that list next to what you actually import and the picture usually changes. A cocoa buyer sourcing from Côte d’Ivoire is standard risk. A coffee buyer sourcing from Brazil, Colombia or Peru is standard risk. A palm oil buyer sourcing from Indonesia or Malaysia is standard risk. Not being on the high-risk list feels like good news, and it isn’t news at all — it’s the normal case, and it carries the full workload.
One detail that matters when you’re preparing files rather than reading law: the standard-risk default applies to a valid ISO 3166-1 alpha-2 country code. A missing or malformed country code in your plot data is not a country classified as standard risk. It’s a gap, and Clearlane treats it as one rather than quietly filling it in.
Check your plot data free — it runs in your browser, needs no account, and tells you which plots are missing a production country before that becomes a filing problem.
Which countries are low risk?
These 140, as named in the Annex:
Andorra, United Arab Emirates, Afghanistan, Antigua and Barbuda, Albania, Armenia, Austria, Australia, Azerbaijan, Bosnia and Herzegovina, Barbados, Bangladesh, Belgium, Bulgaria, Bahrain, Burundi, Brunei, Bahamas, Bhutan, Canada, Central African Republic, Republic of the Congo, Switzerland, Chile, China, Costa Rica, Cuba, Cabo Verde, Cyprus, Czechia, Germany, Djibouti, Denmark, Dominica, Dominican Republic, Algeria, Estonia, Egypt, Spain, Finland, Fiji, Micronesia, France, Gabon, United Kingdom, Grenada, Georgia, Ghana, Greece, Guyana, Croatia, Hungary, Ireland, India, Iraq, Iran, Iceland, Italy, Jamaica, Jordan, Japan, Kenya, Kyrgyzstan, Kiribati, Comoros, Saint Kitts and Nevis, South Korea, Kuwait, Kazakhstan, Laos, Lebanon, Saint Lucia, Liechtenstein, Sri Lanka, Lesotho, Lithuania, Luxembourg, Latvia, Libya, Morocco, Monaco, Moldova, Montenegro, Madagascar, Marshall Islands, North Macedonia, Mali, Mongolia, Malta, Mauritius, Maldives, Netherlands, Norway, Nepal, Nauru, New Zealand, Oman, Papua New Guinea, Philippines, Poland, State of Palestine, Portugal, Palau, Qatar, Romania, Serbia, Rwanda, Saudi Arabia, Solomon Islands, Seychelles, Sweden, Singapore, Slovenia, Slovakia, San Marino, Suriname, South Sudan, São Tomé and Príncipe, Syria, Eswatini, Togo, Thailand, Tajikistan, Timor-Leste, Turkmenistan, Tunisia, Tonga, Türkiye, Trinidad and Tobago, Tuvalu, Ukraine, United States, Uruguay, Uzbekistan, Saint Vincent and the Grenadines, Vietnam, Vanuatu, Samoa, Yemen, South Africa.
Two of those are worth pausing on if you buy cocoa or coffee: Ghana and Vietnam are both low risk, while Côte d’Ivoire next door to Ghana is standard. The classification doesn’t follow commodity, region or income. It follows the Annex.
What does a low-risk classification actually change?
It opens the door to Article 13 of Regulation (EU) 2023/1115, simplified due diligence — where you’ve established that all the relevant commodities and products were produced in countries classified as low risk, you are not required to fulfil the obligations under Article 10 (risk assessment) and Article 11 (risk mitigation).
The word doing the work there is all. One standard-risk plot in the consignment and the relief is gone — the Article 10 risk assessment and the Article 11 risk mitigation apply as normal, exactly as they do for anything sourced from a high-risk country. And the relief is narrow even when you qualify: you still exercise due diligence, you still submit a due diligence statement, and you still have to be able to show the assessment that got you there.
We’ve written that route up in full: when EUDR simplified due diligence applies, and when it doesn’t. For what the full assessment asks of you when the relief doesn’t apply, see the negligible-risk test in Article 10.
Is it the country you buy from, or the country it was grown in?
The country of production — where the commodity was actually grown, raised or harvested.
This is worth checking against how your paperwork is organised, because purchase records tend to be arranged around the supplier and the port. Cocoa bought from a trader in Rotterdam and grown in Côte d’Ivoire is standard risk. The Netherlands is low risk and it is not the relevant country. Every plot in your data carries its own production country, and that is the value the classification attaches to.
What the classification does not tell you
A country’s risk category is one input to the EUDR risk framework. It is not a finding that a plot, a product or a shipment is deforestation-free, legally produced, or compliant.
Low risk does not mean your goods are fine. It means one specific part of the process may be lighter, if you can establish that every plot qualifies. The Article 3 conditions — deforestation-free, produced in accordance with the relevant legislation of the country of production, and covered by a due diligence statement or a simplified declaration — are the same in all three categories, and they are the conditions that decide whether the goods can move.
Before you rely on any category
Check the Commission’s current country classification list rather than a copy of it, including this one. The classification is set by an implementing regulation and can be revised, and the classification that governs your due diligence is the one in force when you do it.
The lists on this page reflect the classification recorded in Clearlane’s cited profile, last checked against the authentic EUR-Lex text on 8 August 2026.
What this means in practice
If your origins sit on the standard list above, the honest summary is short: the classification won’t rescue you, and the work is evidentiary rather than interpretive.
That work is plot-level. Every plot located to the precision the regulation requires, tied to the right production country and production period, with valid geometry. Teams rarely get stuck deciding what risk category applies — they get stuck when the coordinates don’t validate and the country column is half empty, two weeks before a shipment.
That part can be checked mechanically, in a minute, before anything else depends on it.
Validate your plot data free — no account, nothing uploaded to us, and it names exactly what fails and where.
Related reading: when simplified due diligence applies, the negligible-risk test in Article 10, what the geolocation rules require, and the EUDR compliance checklist.
Sources
- Commission Implementing Regulation (EU) 2025/1093 — country benchmarking under Article 29; the Annex supplies the low- and high-risk lists. Adopted 22 May 2025, published in the Official Journal on 23 May 2025, in force on the third day following, 26 May 2025
- Regulation (EU) 2023/1115, consolidated text of 26 December 2025 — Articles 3, 10, 11, 13, 29
- European Commission country classification list — the live list, and the benchmarking definition quoted above
This article explains the regulation. It is not legal advice, and your competent authority is the authority on your specific case.