EUDR Risk Assessment and Country Benchmarking: Three Risk Levels and Simplified Due Diligence

Summary

Under Article 29 the Commission sorts countries, or parts of them, into low, standard and high risk. The level changes the due diligence you must do and the share of operators that authorities check each year. A list of countries was adopted in 2025 and can be revised.

Due diligence has three elements: collecting information, assessing risk and mitigating it. For products from low-risk countries an operator may apply a simplified regime in which the assessment and mitigation steps are not required. Collecting the data and filing the statement are still mandatory.

The Regulation does not prescribe how the risk assessment is done. Satellite evidence from Copernicus Sentinel-2 is a practical input for the cut-off date of 31 December 2020, and it supports but does not replace the operator's own judgement.

Three risk levels: high, standard, low

Implementing Regulation (EU) 2025/1093 of 22 May 2025 placed Belarus, North Korea, Myanmar and Russia in the high-risk category and a long list of countries in the low-risk category, among them the EU Member States including Croatia and Slovenia, and Albania, Bosnia and Herzegovina, Montenegro, North Macedonia and Serbia. All other countries are standard risk. The list is reviewed as often as necessary, so check the current text.

A country level is a starting point. A plot in a low-risk country can still be flagged by evidence, and a standard-risk country can contain regions with very different pressure on forests. The assessment is made per plot.

Simplified due diligence for low-risk regions

Where all the plots of a product lie in low-risk countries, the operator can skip the risk assessment and mitigation steps. The operator still collects the information, including geolocation, and files the statement.

If the operator learns of concerning information, for example a credible report of clearing on a plot, the full due diligence applies again. Keep a record of how you checked, so that the choice of the simplified regime can be defended.

Croatia and Slovenia are on the low-risk list. For a product whose commodities were all produced there, the operator may use simplified due diligence after the Article 13(1) assessment; the option is not automatic. For cattle the country that counts is where the animals were raised, so establishments in Croatia or Slovenia qualify, and they must still be geolocated and the statement filed. Authorities must check at least 1 % of operators sourcing from low-risk countries in each Member State, against 3 % for standard and 9 % for high risk. That is a national minimum and not a reduced rate for a single company.

What the risk assessment looks at

The operator weighs the complexity of the supply chain, the risk of circumvention and the risk of mixing with products of unknown origin, along with the country level and the evidence on the plot. The outcome is recorded with the statement.

In our platform each plot has a validation status and a deforestation risk score. The two are separate on purpose: a valid shape can still carry a high score, and a consultant can record a manual review with a note.

Satellite verification with Copernicus / Sentinel-2

Sentinel-2 imagery is free and has a resolution of ten metres. Comparing land cover around 31 December 2020 with later images shows whether tree cover was lost on the plot. This is screening, not proof, because shadows, clouds and seasonal change cause false flags.

Use satellite checks to decide where to look closer. A flagged plot should lead to a request for documents from the supplier, such as a land-use permit or a harvest record. Authorities may use Earth observation data such as that of the Copernicus programme in their own checks (Article 18(2)(d)).

What authorities check, and how often

Competent authorities check operators on a risk basis. Article 16(8) to (10) sets minimum annual levels: 9 % of operators and of the quantity of products from high-risk countries, 3 % of operators for standard-risk and 1 % for low-risk countries. A high-risk country therefore raises the chance of an inspection.

Risk levels at a glance

HS/CN codes and typical sourcing risk

Exemptions and simplifications

One simplification depends on the country level and one on the size of the operator.

• Simplified due diligence for products from low-risk countries: no risk assessment or mitigation steps, but collection and the statement remain.
• Micro and small primary operators file a one-time simplified declaration.

Frequently asked questions

What are the three country risk levels?

Low, standard and high, set by the Commission under Article 29. They decide whether simplified due diligence is possible and how often authorities check.

Does the EUDR require satellite checks?

The Regulation requires risk assessment based on the plot data; it does not name a satellite product. Authorities may use Earth observation data such as Copernicus in their checks (Article 18(2)(d)). Sentinel-2 screening is a practical tool, not a legal requirement.

Sources

• Regulation (EU) 2023/1115 of the European Parliament and of the Council of 31 May 2023 on deforestation-free products (EUDR), OJ L 150, 9.6.2023. Read in the Official Journal text on 10 November 2026.
• Regulation (EU) 2025/2650 amending Regulation (EU) 2023/1115 (application dates, downstream operators, simplified declaration, scope). Read in the Official Journal text on 10 November 2026.
• Commission Implementing Regulation (EU) 2025/1093 of 22 May 2025 laying down the list of countries presenting a low or high risk (Article 29(2) EUDR). Read in the Official Journal text.

Facts last checked against the Official Journal text on 10 November 2026.