EUDR risk assessment 2026/2027 – articles 10 and 11 step by step
Short answer: When the EU Deforestation Regulation (EUDR, Regulation (EU) 2023/1115) requires full due diligence, the operator must collect and verify information according to Article 9, assess the risk of non-compliance according to Article 10, and, if necessary, mitigate the risk according to Article 11 before relevant products are placed on the EU market or exported. The starting point is concrete product and supply chain documentation – not filling out a general risk score.
Last legally reviewed: October 19, 2026 · Legal status: consolidated Regulation (EU) 2023/1115 of September 18, 2026, and the Commission's guidance from July 2026. The guide concerns companies and products within the scope of the EUDR.
- First, assess CN code, commodity, operator role, and application date. Not all operators are required to perform a full, independent Article 10–11 assessment.
- The assessment covers country risk, production site, documentation, land rights, supply chain, and risk of mixing.
- Simplified due diligence from low-risk countries according to Article 13 may mean that Articles 10–11 do not generally need to be implemented, but only when the conditions are truly met.
- If the risk is not zero or negligible, the product must not be placed on the market or exported until adequate measures have reduced the risk to that level.
- Document assessments and decisions; Articles 10.4 and 11.3, respectively, require review at least annually where these articles apply.
Who needs to perform a risk assessment under EUDR 2026/2027?
The EUDR does not automatically apply to all companies importing or selling wood, coffee, or cocoa. It is the relevant products listed in Annex I and their actual CN codes that determine the product scope. The legal role, in turn, determines the obligations. Therefore, start with the overview of which companies the EUDR covers and the difference between an operator, a downstream actor, and a trader.
For the operator who must apply full due diligence, Articles 8–11 involve three interconnected steps: information collection, risk assessment, and – if necessary – risk mitigation. Downstream operators and traders are covered by a different obligation model following Amendment Regulation (EU) 2025/2650; they are not generally required to submit a new, independent DDS or repeat the original operator's full due diligence for the same product.
Article 10 – how to perform a correct risk assessment?
Article 10.1 requires affected operators to verify and analyze the information collected under Article 9 and other relevant documentation. The result must show whether the product risks failing to comply with Article 3, i.e., the requirements regarding deforestation-free status, legal production, and proper due diligence. The risk assessment must be specific to the product, the production, and the actual supply chain.
Which risk factors should be examined?
- Country risk and forest situation: the official classification according to Article 29, the presence of forests, deforestation, and forest degradation, as well as local conditions.
- Production site and legality: geolocation, time data, land use rights, and sufficiently verifiable evidence of legal production.
- Indigenous peoples and local communities: presence, relevant rights, consultations, and any substantiated claims or disputes.
- Supply chain complexity: number of intermediaries, countries of production, processing steps, the ability to trace each source, and any information gaps.
- Mixing and circumvention: risk of products of unknown origin, from other risk classes, or with inconsistent batch data.
- Reliability: quality of documentation and geodata, previous non-compliance, substantiated concerns, and relevant third-party information. -
This is a practical grouping of the risk criteria in Article 10.2, not a new, separate statutory list. The significance of the criteria varies between, for example, coffee from many small farms and wood from a traceable production facility. The European Commission emphasizes that every relevant origin or production area must be assessed when raw materials come from multiple locations.
What is zero or negligible risk?
According to the regulation's definition and the Commission's guidance, a conclusion of negligible risk assumes that the overall documentation provides no cause for concern that the product is illegally produced or not deforestation-free. A risk score such as "2 out of 5" is not in itself a statutory clearance. It must be linked to verifiable sources and a comprehensible justification. If a relevant risk remains that is more than negligible, the product must not be placed on the market or exported based on the current documentation.
Practical EUDR risk matrix: from evidence to decision
An internal matrix can make the verification consistent. The columns below are a working proposal – the EUDR does not prescribe this scoring model or these headings.
| Check point | Example of documentation | Decision to be documented |
|---|---|---|
| Product scope | CN code, Annex I, product description | In scope/not in scope – justification |
| Origin and geodata | Country of production, geolocation, production date | All relevant sources traced? |
| Deforestation-free | Historical land data, verification of site and production process | Evidence sufficient and verifiable? |
| Legal production | Relevant permits, land rights, local legal documentation | Legal ambiguities and measures |
| Supply chain | Batch ID, supplier tiers, separation, and traceability data | Mixing risk or information gap? |
| Other signals | Substantiated concerns, past incidents, third-party sources | Overall assessment of remaining risk |
For every relevant product or batch, document which source was checked, the date, the result, the responsible assessor, any deviations, and what decision was made. See also our separate guide to geolocation and polygons according to Article 9.
Article 11 – when are risk mitigation measures required?
If the Article 10 assessment does not show zero or only negligible risk, the operator must, before placing on the market or exporting, take adequate risk mitigation measures. According to Article 11.1, such measures can include requesting additional information and documentation, conducting independent investigations or audits, and taking other measures necessary to verify the information required under Article 9.
Other business-tailored measures could be addressing unclear geodata, segregating different goods flows, checking affected production areas further, or supporting suppliers with competence and controls. The decisive factor is not how many checks have been conducted, but whether they have actually reduced the identified risk.
Internal controls, responsibilities, and independent audit
Article 11.2 prescribes adequate and proportionate routines for risk management and internal control. The provision contains specific organizational requirements for operators that are not small or medium-sized enterprises, including compliance responsibility at the management level and an independent audit function. These specific functions are therefore not automatically identical requirements for every individual micro-enterprise.
Decisions on risk mitigation must, according to Article 11.3, be documented, reviewed at least annually, and be capable of being presented to the competent authority. Also, maintain traceability between the identified risk, the chosen measure, and the conclusion after the measure.
Article 13 – does low-risk country mean the risk assessment can be skipped?
Not without checks. For operators meeting the conditions in Article 13, obligations under Articles 10 and 11 may normally be waived if all relevant raw materials/products have been produced in a low-risk country or area and the company has assessed the complexity of the supply chain as well as the risk of circumvention or mixing with products from unknown origins or from standard/high-risk countries.
The company must still meet the applicable information requirements under Article 9, have a due diligence system, and be able to demonstrate that the conditions for the simplification are actually met. New or known information regarding the risk of non-compliance may necessitate a full risk assessment and risk mitigation. It is therefore incorrect to state that all deliveries from, for example, Sweden are automatically exempt from the EUDR.
| Country classification | Significance for Articles 10–11 |
|---|---|
| Low risk | Simplified due diligence can be used if conditions in Article 13 are met; Article 9 and other applicable requirements remain. |
| Standard risk | No general Article 13 simplification; full risk assessment and, if necessary, risk mitigation for applicable operators. |
| High risk | No general Article 13 simplification; risk level and documentation must be carefully examined according to relevant provisions. |
According to the Commission's Implementing Regulation (EU) 2025/1093, Belarus, North Korea, Myanmar, and Russia, among others, are classified as high-risk countries. Countries not listed in the regulation's annex as low or high risk are treated as standard risk. Always check the latest applicable classification when performing a real risk assessment; this is not a complete list of countries.
Article 4a is not the same as Article 13
Certain micro and small primary operators are covered by a specific simplified declaration procedure in Article 4a. It should not be confused with the risk-based simplification in Article 13 or used as a general exemption for small import companies. Read our guide on DDS and simplified declaration for a separate examination of the operator role.
Two practical examples of risk assessment
Example 1: Cocoa from multiple production areas
A company imports a relevant cocoa product from a supplier that gathers raw materials from many farms. The supplier shows an overarching sustainability certificate but has not ensured the link between the actual batch and all production areas. Here, it is not sufficient to mark the supplier as "approved." The operator must investigate the lack of traceability and risk of mixing, and if necessary, demand additional documentation before assessing whether the risk has been reduced to the permitted level.
Example 2: Wood from a low-risk country
An operator with wood products from an official low-risk country has full Article 9 information and a simple, unbroken supply chain. An assessment according to Article 13 can show that simplified due diligence may be used. If information later points to illegal logging, circumvention, or unknown origin, the operator needs to take that information seriously and apply relevant additional obligations. Low-risk classification is not a guarantee.
Checklist for EUDR risk assessment
- Verify the product's CN code against the current Annex I and determine the operator role.
- Check the company's current application date and whether Article 4a or 13 may be relevant.
- Collect complete, verifiable Article 9 data on products, suppliers, and production areas.
- Check the current official country benchmarking and local risk factors.
- Analyze deforestation-free status, legality, land use rights, and relevant information about affected communities.
- Document traceability through all supply chain tiers and assess the risk of mixing and circumvention.
- Summarize the risk assessment with sources, assessment date, responsible person, and justification.
- If the remaining risk is not zero or negligible: take documented and proportionate Article 11 measures.
- Test the effect of the measures and withhold placing on the market/export if the risk has not been reduced to the permitted level.
- Secure decision log, relevant DDS process, and annual review, and retain documentation according to applicable rules.
What EUDR documentation should the company keep?
A practical audit folder contains identified product and CN code, suppliers, production sites, and geodata, facts about deforestation-free status and legality, applicable risk criteria, verification sources, risk assessment protocols, action plan, re-evaluation after measures, responsible decision-makers, and details on DDS or applicable simplified declaration. Article 12.5 specifies at least five years of retention for due diligence documentation; other provisions may specify their own reference dates for specific data.
It is important to distinguish between the legal requirement for relevant documentation and voluntary working methods such as color-coded risk matrices, Excel dashboards, or internal KPIs. Such tools are aids for traceability, not proof of legal compliance in themselves.
EUDR risk register and document templates in Word, PDF, and Excel
The template store's EUDR Due Diligence package contains structured documentation for role assessment, information collection, geolocation, risk assessment, risk mitigation, DDS, and downstream traceability. The documents help the company organize the control work but do not replace an actual legal assessment of the product.
Related guides
- EUDR: which companies and products are covered?
- Geolocation and polygons according to Article 9
- DDS or simplified declaration – roles and traceability
- Supplier agreements and responsibility in the supply chain
Common questions about EUDR risk assessment
Must all companies perform a risk assessment according to Article 10?
No. The obligation depends on product scope, the actor's role, and applicable exemptions/simplifications, particularly Article 13 and the revised downstream model.
Is a supplier certificate sufficient?
Not automatically. Certification can provide relevant supplementary information according to Article 10.2 n, but it does not, in itself, exempt the operator from the applicable obligations under the EUDR. Coverage and traceability must be assessed.
Is risk mitigation according to Article 11 always mandatory?
No. It becomes relevant when an applicable Article 10 assessment does not show zero or only negligible risk. The measures must then actually reduce the risk before placing on the market or export.
What happens if a supplier lacks full geolocation?
The absence can mean that the Article 9 documentation is insufficient and complicate the risk assessment. Request supplementation and assess the legal consequences. A certificate or an overview map does not automatically replace the required data.
How often should the risk assessment be updated?
For assessments covered by Article 10, a review at least annually is required according to Article 10.4. In the event of new supply conditions or new risk information, previous documentation may also become insufficient sooner than that.
Can goods from low-risk countries be sold without any control?
No. Article 13 may simplify the obligations under Articles 10–11, but information requirements and the verification of the conditions for the simplification remain.
Legal sources and official guidance
- EUDR, Regulation (EU) 2023/1115 – consolidated as of September 18, 2026 (specifically Articles 3, 8–13, and 29).
- Regulation (EU) 2025/2650 – amended operator roles and application.
- Commission Implementing Regulation (EU) 2025/1093 – country benchmarking.
- European Commission EUDR guidance of 20 July 2026 (guidance, not an independent binding legal act).
- European Commission – Understand Due Diligence.
Templates in this article
Explore the topic
Business guides – contracts, HR, AI & complianceEUDR 2026/2027 – which companies are affected and how is due diligence conducted?
EUDR Guide 2026/2027 with current deadlines, product scope, roles, geolocation, risk assessment, risk mitigation, and due diligence statement.
Business guides – contracts, HR, AI & complianceEUDR: DDS or simplified declaration 2026/2027? Roles and traceability
EUDR 2026/2027: learn who must submit a DDS, who is permitted to use a simplified declaration under Article 4a, and what information downstream ope...
Business guides – contracts, HR, AI & complianceEUDR geolocation 2026/2027 – polygons and Article 9
EUDR Article 9: when are polygons required, when are GPS coordinates sufficient, and which exemptions apply? A practical guide to geolocation, prod...
