EUDR country risk classification: which obligations change, tier by tier

When the first country benchmarking list appeared in May 2025 with roughly 140 countries classified as low risk, a reasonable-sounding conclusion spread quickly: most sourcing is low risk, low risk means simplified due diligence, so most of the work goes away.

The first two steps of that reasoning are correct. The third is where it breaks. Simplified due diligence is a real and worthwhile reduction, but it removes two of the four things you have to do — and it only becomes available once three separate conditions hold, of which the country classification is merely the first.

What follows is the complete matrix, and then the parts of it that are routinely misread.

The matrix

The row most summaries leave out

Look at the second row. Article 12 applies at every tier — the obligation to establish, maintain and keep up to date a due diligence system with documented policies, controls and procedures, and to review it annually.

Simplified due diligence switches off Articles 10 and 11. It does not switch off Article 12. An operator sourcing exclusively from low-risk countries still needs a documented system, still needs to be able to show how it works, and still needs to review it.

This is the single most common gap we see in otherwise well-prepared low-risk programmes. Teams read "simplified" as "informal", collect the plot data diligently, and have nothing written down describing the process that produced it. The data survives an inspection; the absence of a system does not.

Simplification has three conditions, not one

Article 13 does not say that low-risk origin entitles you to simplified due diligence. It says you may apply it once you have ascertained that the risk of circumvention and the risk of mixing with material of unknown origin or from standard or high-risk countries are no more than negligible.

The framing matters. Mixing is not a penalty applied after the fact; it is a precondition you have to have positively assessed and evidenced before relying on simplification at all. "We had no reason to think anything was mixed" is not the same statement as "we ascertained the risk of mixing was negligible", and only the second one is what the article asks for.

What is identical at every tier

Reading down the matrix, four things are constant regardless of classification:

1. 1.Plot-level geolocation, with the date or time range of production, for every plot the commodity came from.
2. 2.Evidence that the commodity is deforestation-free against the 31 December 2020 cut-off and was legally produced.
3. 3.A due diligence statement, submitted before the goods are placed on the market or exported.
4. 4.Retention of the supporting records for five years.

That first item is the one that determines project timelines, and it is unaffected by benchmarking. Collecting geometry from a dispersed supplier base takes seasons rather than weeks, depends on people outside your organisation, and cannot be compressed at the end by spending more. A low-risk classification changes how much analysis you perform on that data. It does not change whether you need it.

How a substantiated concern resets the position

Under Article 31, any natural or legal person can submit a substantiated concern — a duly reasoned claim based on objective and verifiable information — either to a competent authority directly or to the operator itself. Where it goes to the operator, the operator is expected to inform the authority of the concern and of any mitigation taken in response.

The asymmetry across tiers is worth noticing. For standard and high-risk sourcing, a concern changes nothing about your obligations, because you were already performing full due diligence; it changes the likelihood of a check. For low-risk sourcing it is a step change: the simplified route closes, and risk assessment and mitigation become mandatory for the affected goods.

That is why a programme built to operate only in simplified mode is fragile. Concerns arrive on someone else's timetable, frequently from an NGO with imagery and a supplier list, and the capability to respond has to pre-exist the trigger.

What the check rates really tell you

The 1%, 3% and 9% figures in the final row are minimum annual coverage of operators, with high-risk sourcing carrying an additional requirement covering 9% of the quantity placed on the market. They are floors, not targets, and member states are free to check more.

They are also not the only route to being checked. Authorities carry out checks whenever they obtain relevant information about potential non-compliance, including through substantiated concerns. A 1% statistical exposure describes routine sampling and says nothing about the probability of being checked because somebody looked at your supply chain and filed a report.

Operationalising the matrix

1. 1

   Store the tier as data on the country of production

   A field that a classification update can be applied to mechanically, not a statement in a policy document that someone has to remember to revise.

2. 2

   Record the mixing assessment, not just its conclusion

   Article 13 asks you to have ascertained something. The evidence for that determination is what an authority will want, and it is not produced retrospectively.

3. 3

   Write the due diligence system down regardless of tier

   Article 12 does not bend for low-risk sourcing, and this is where low-risk programmes most often fall short.

4. 4

   Keep the full-diligence path warm

   A tier change or a substantiated concern moves you onto it without notice, and for goods you have already contracted for.

5. 5

   Collect geolocation everywhere, always

   It is the constant across the whole matrix and the longest-lead item in the programme.

The benchmarking system is a genuine and deliberate reduction in effort for the majority of supply chains. It is simply a narrower one than the headline number suggests: two steps out of four, conditional on two further tests, and reversible the moment someone raises a credible question. For how the classifications themselves are produced and how likely they are to move, see country benchmarking: what the risk tiers change, and what they don't.

Published August 12, 2026 · Last reviewed August 12, 2026 against the sources listed above.