The three risk tiers
Article 29 of Regulation (EU) 2023/1115 gives the Commission the mandate to establish a benchmarking system that assesses the deforestation and forest degradation risk of producing countries and regions. The assessment results in one of three classifications.
| Classification | Due diligence obligation | Authority check frequency |
|---|---|---|
| Low risk | Simplified due diligence (reduced information, no risk assessment) | At least 1% of operators checked annually |
| Standard risk | Full due diligence (all three steps) | At least 3% of operators checked annually |
| High risk | Full due diligence (enhanced scrutiny) | At least 9% of operators checked annually |
The check frequency percentages are minimum thresholds set by the regulation. Member state authorities may apply higher rates, and operators placing products from high-risk countries on the market should expect a substantially higher probability of being selected for a compliance check than those sourcing from low-risk countries.
How countries are assessed
The Commission assesses countries against criteria set out in Article 29(2). The criteria cover: the rate and trend of deforestation, the rate and trend of forest degradation, the trend of expansion of agricultural land, the existence and implementation of national forest-protection legislation, the country's international commitments on forests and deforestation, and the effectiveness of enforcement and compliance systems in the country.
The Commission consults with the country concerned before publishing a classification. Countries have the opportunity to provide information and to demonstrate that their legislative and enforcement frameworks are effective. A country that invests in forest protection legislation and demonstrably enforces it can improve its classification over time.
The assessment is country-level by default. For countries with significant internal variation in deforestation risk, the Commission can publish sub-national classifications, assigning different risk tiers to different regions within the same country. This allows operators sourcing from specific regions of a large country to benefit from a lower risk classification if the region where their commodity is produced has a different risk profile from the national average.
What simplified due diligence means in practice
For operators sourcing from low-risk countries, Article 13 provides that the information collection and risk assessment steps are reduced. Specifically, the operator does not need to carry out the full risk assessment (the second step of due diligence). Instead, the operator collects the information required and submits a DDS on that basis, without the risk assessment analysis that would normally sit between information collection and DDS submission.
Simplified due diligence is not an exemption from the EUDR. The operator must still collect the product information, country of production, and geolocation data required under Article 9. The DDS must still be submitted. The record-keeping obligation still applies for five years. The practical difference is in the time and resource cost of the risk assessment step, which is removed for low-risk sources.
Simplified due diligence applies at the country level, not the supply chain level. Even if the country of production is classified as low risk, if the operator has specific information suggesting that a particular supplier or plot of land may not be compliant, the operator must act on that information. Low-risk country status reduces the default obligation; it does not override specific evidence of non-compliance.
High-risk country implications
Sourcing from a country classified as high risk does not make EUDR compliance impossible, but it means more intensive due diligence and greater likelihood of authority scrutiny. Operators with high-risk supply chains should expect that their due diligence files will be reviewed more frequently and in more detail. The quality of the geolocation data, the rigor of the risk assessment, and the depth of the mitigation measures will all face closer examination.
For operators with a significant portion of their supply chain in high-risk countries, the practical implication is that the investment in data collection and documentation must be proportionally higher. A due diligence file that might be sufficient for a standard-risk supply chain may not withstand scrutiny for a high-risk one.
Monitoring classification changes
The Commission updates country classifications periodically, based on new data and changes in the countries' deforestation profiles and legislative frameworks. A country that was standard risk when you built your due diligence system may subsequently be reclassified as high risk. If that happens, operators sourcing from that country must update their procedures to meet the full due diligence standard, including the risk assessment step, from the date the new classification takes effect.
Building a monitoring step into your EUDR compliance calendar, at least annually and whenever a relevant Commission announcement is made, ensures that a reclassification does not create a period of inadvertent non-compliance. For the full overview of EUDR obligations and how the benchmarking system fits within the broader compliance picture, see our guide on EUDR compliance for EU importers.