An EUDR risk assessment is the middle step of due diligence, and it works as a gate, not a score. Regulation (EU) 2023/1115 Article 10(1) says you “shall not place the relevant products on the market or export them, except where the risk assessment reveals no or only a negligible risk that the relevant products are non-compliant.”
Read that again, because it’s stricter than most compliance tests you’ll have met. Not “acceptable risk”. Not “managed risk”. No risk, or negligible risk. Anything above that and the goods do not move until you’ve fixed it.
Where it sits in the process
Article 8 breaks due diligence into three steps, and they run in order:
- Collect the information — Article 9. Product, quantity, country of production, the geolocation of every plot, your suppliers and customers, and evidence of the legal right to use the land.
- Assess the risk — Article 10. What you’re reading about now.
- Mitigate the risk — Article 11. Only needed if step 2 didn’t land at negligible.
You cannot do step 2 properly without step 1. That’s the practical reason geolocation data matters so much: the risk assessment is largely an assessment of the plots, and if you don’t know where they are, there’s nothing to assess.
What Article 10 actually asks you to weigh
Article 10(2) sets out the criteria. In plain terms, you have to take account of:
About the place
- The country’s risk classification under Article 29 — and the specific region within it
- Whether there is forest in the production area
- Whether Indigenous peoples are present
- Whether there was consultation with those Indigenous peoples, conducted in good faith
- Whether there are duly reasoned claims by Indigenous peoples about land use or ownership
- How widespread deforestation or forest degradation is in that area
About your information
- The source, reliability and validity of what you hold, and how it links to other documentation
- Concerns about corruption, falsification of documents, weak enforcement, armed conflict or sanctions
About your supply chain
- How complex it is, and what stage of processing the goods are at
- The risk of circumvention, or of mixing with products of unknown origin
- Conclusions from the Commission’s expert group
- Substantiated concerns raised, and any history of non-compliance
- Information from third-party verified schemes, where those meet the Article 9 requirements
The pattern is worth noticing. Roughly half of these are about the land. The other half are about how much you can trust your own paperwork. A perfect-looking document from a place with known falsification problems is not a clean result — Article 10(2) asks you to weigh exactly that combination.
One shortcut the regulation grants
Article 10(3) says wood products within the scope of Regulation (EC) No 2173/2005 that carry a valid FLEGT licence from an operational licensing scheme are deemed to comply with Article 3(b) — the legality limb.
Note precisely what that covers. It’s the legality condition, not the deforestation-free condition. The plots still have to be deforestation-free after the 31 December 2020 cut-off in Article 2(13), and you still file a statement.
When can you skip the risk assessment entirely?
This is the part worth knowing about, because it can remove a large amount of work.
Article 13(1) says operators are not required to fulfil the obligations under Articles 10 and 11 where, having assessed supply-chain complexity and the risk of circumvention or of mixing with products of unknown origin or from high- or standard-risk countries, they have established that all the commodities and products were produced in countries classified as low risk under Article 29.
Three conditions, all of which must hold:
- Everything is from low-risk countries. Not most of it.
- You have genuinely assessed how complex your chain is.
- You have genuinely assessed the risk of circumvention or mixing.
Points 2 and 3 are not a formality — they’re the work that earns you the exemption, and you should be able to show it. And the relief ends the moment you come across information suggesting non-compliance.
Which countries are low risk?
Country classification comes from Article 29, implemented by Commission Implementing Regulation (EU) 2025/1093, applicable from 26 June 2025.
| Class | How many | Notes |
|---|---|---|
| Low risk | 140 countries | Listed in the Annex. Opens the Article 13 simplified route |
| High risk | 4 — Belarus, North Korea, Myanmar, Russia | Enhanced scrutiny from competent authorities |
| Standard risk | Everything not listed | This is the default |
The default is the one to internalise. A country that isn’t on either list is standard risk, and standard risk means the full Article 10 assessment. Not being on the high-risk list is not good news — it’s the normal case.
Before relying on any classification, check the Commission’s current country classification list. It can be revised, and your assessment has to reflect the classification in force.
What if the risk isn’t negligible?
Then Article 11 applies. You adopt procedures and measures adequate to bring the risk down to no more than negligible — which may mean requesting further information or documents, running audits, or supporting your supplier in coming into compliance.
Two structural duties land on operators that are not SMEs: a compliance officer at management level, and an independent audit function to check the due diligence policies.
And if the risk cannot be brought down to negligible? Then the goods stay put. Article 10(1) doesn’t leave a route around it, and Article 11 isn’t an alternative to the standard — it’s the way you reach it.
What this means in practice
Most of the difficulty isn’t judgement. It’s evidence.
You need every plot located, to the precision the regulation demands, tied to the right country and production period, with the legal-right-to-use evidence attached — before any of the Article 10 criteria can be applied to it. Teams that struggle with EUDR usually aren’t stuck on interpreting risk. They’re stuck assembling plots from spreadsheets and supplier emails, and finding the coordinates don’t validate.
That part can be checked mechanically, and it’s worth doing early rather than the week before shipping.
Validate your plot data free — see what fails and exactly where, before it becomes a filing problem.
Related reading: what the geolocation rules require, operator vs trader — which one you are, and the EUDR compliance checklist.
Sources
- Regulation (EU) 2023/1115, consolidated text of 26 December 2025 — Articles 2(13), 8, 9, 10, 11, 13, 29
- Commission Implementing Regulation (EU) 2025/1093 — country benchmarking, applicable 26 June 2025
- European Commission country classification list — the live list
This article explains the regulation. It is not legal advice, and your competent authority is the authority on your specific case.