Country benchmarking: what the risk tiers change, and what they don't

When the Commission published the first country benchmarking list in May 2025, a lot of compliance programmes quietly slowed down. The headline number was striking: only four countries classified as high risk, and the overwhelming majority — roughly 140 — classified as low. If almost everywhere is low risk, the reasoning went, how much of this really applies to us?

More than that reading suggests. The benchmarking system is real and it does reduce work, but it reduces a specific and quite narrow part of it.

How the tiers work

Commission Implementing Regulation (EU) 2025/1093, adopted on 22 May 2025, assigns every country a risk classification for the commodities in scope. The classification drives two things: the depth of due diligence expected of you, and how often competent authorities are required to check operators sourcing from there.

The list itself

One structural point decides how to read this, and most reproductions of the list get it wrong. The Annex to the implementing regulation names the low-risk and the high-risk countries only. Standard risk is the residual category: it is assigned to every country the Annex does not mention.

So the low and high-risk lists below are complete and authoritative. The standard-risk entries are the principal producing countries for the seven commodities — useful, but a selection rather than the whole set. If a country you source from appears nowhere, that absence is itself the answer.

How a classification is decided

The assessment is quantitative first and qualitative second. The primary inputs are the rate of deforestation and forest degradation in a country, and the rate of expansion of agricultural land used for the commodities in scope — drawn largely from international datasets rather than from national self-reporting.

Beyond those headline measures, the regulation allows a range of further considerations to be taken into account, including the existence and enforcement of laws protecting forests, the presence of agreements between the country and the EU, and whether the country has made and is implementing commitments on deforestation and forest degradation.

What a low-risk classification actually buys you

Sourcing from a low-risk country gives access to simplified due diligence. Concretely, that means the risk assessment and risk mitigation steps are not required — provided you have no information pointing to non-compliance, and no substantiated concern has been raised.

That is a genuine saving. Risk assessment and mitigation are the analytically demanding parts of the exercise, and being able to stand them down across most of a supplier base is material.

What it does not touch is the information-collection duty. You still collect the geolocation of every plot. You still file a due diligence statement. You still keep records for five years. Simplified due diligence is a reduction in analysis, not an exemption from evidence — the full obligation-by-obligation comparison is set out in the tier-by-tier matrix.

The conditions attached

Simplified due diligence is conditional, and the conditions are not passive. Before relying on it you must have ascertained that there is no reason for concern, which means an initial examination rather than an assumption. And it lapses the moment you become aware of any information pointing at risk of non-compliance.

The trigger is a substantiated concern — in the Commission's framing, a duly reasoned claim based on objective and verifiable information. Once one exists, the simplified route closes and full due diligence resumes, retrospectively as far as the affected goods are concerned.

This is worth designing for rather than reacting to. A programme that can only operate in simplified mode has no gear to change into when an NGO report names one of its sourcing regions.

The Parliament objection, and why it changed nothing

In July 2025 the European Parliament adopted a resolution objecting to the benchmarking methodology and its results, citing concerns about data quality, methodological robustness and transparency. It was widely reported, and frequently reported as the list being rejected.

It was not. The resolution was a political signal rather than a legal act with the effect of annulling the implementing regulation, and the classifications remained in force throughout. Any compliance decision taken in 2025 on the basis that the tiers had been struck down was taken on a misreading.

What the objection did do is make revision more likely, and the Commission had already committed to revisiting the benchmarks in 2026 on updated data.

Tiers move, so treat them as a feed

A classification is a snapshot of a methodology applied to a dataset at a point in time. Both change. A country moving from low to standard reinstates the full risk assessment obligation for everything you source from it — with no transition period built into your own processes unless you built one.

1. 1

   Store the tier as data, not as a policy statement

   It belongs next to the country of production in your systems, where a change can be applied mechanically rather than discovered in a meeting.

2. 2

   Keep collecting plot geometry everywhere

   It is required at every tier, and it is the thing that makes a tier change survivable rather than catastrophic.

3. 3

   Have a full-diligence path ready even where you use the simplified one

   Substantiated concerns arrive without notice. The capability has to pre-exist the trigger.

4. 4

   Watch the 2026 review

   A revised list is the single most likely event to change the shape of your obligations in the next year.

The benchmarking system is best understood as a calibration of effort rather than a filter on obligation. It tells you how hard to look. It never tells you that you may stop looking.

A note on countries in the middle

One detail worth holding on to: the risk assessment considers the classification of the country of production and of any country the commodity passed through on its way to you. Those are frequently not the same place, and the second is easy to overlook when procurement records name only the immediate supplier.

A commodity grown in a low-risk country, processed and re-exported through a standard-risk one, does not simply inherit the classification of wherever it started. Where a route introduces opportunities for mixing with material of unknown origin, that is precisely the kind of supply chain complexity the assessment is meant to weigh — and the tier of the country of production alone will not tell you about it.

Published August 8, 2026 · Updated August 12, 2026 · Last reviewed August 12, 2026 against the sources listed above.