EUDR Country Risk Classification: What "High Risk" and "Low Risk" Actually Change for Your Due Diligence

The EUDR sorts every country, or part of a country, into low, standard or high risk. Under Implementing Regulation (EU) 2025/1093, only Belarus, North Korea, Myanmar and Russia are high risk; a long list of countries, including the United States, is low risk; every country not listed is standard risk. Low risk unlocks simplified due diligence: no formal risk assessment or mitigation. It does not remove the duty to collect information, assess supply-chain complexity and mixing risk, or file a due diligence statement.

How the three-tier system works

Article 29 of the consolidated EUDR creates the benchmarking system. Its definitions are narrower than many people assume: the tiers measure the risk of producing commodities that are not deforestation-free (Article 3, point (a)), not legality in general.

• High risk: the assessment identifies a high risk of producing, in that country or part of it, commodities whose products do not comply with Article 3(a).
• Low risk: there is "sufficient assurance" that such production is exceptional.
• Standard risk: everything that is neither high nor low. All countries were assigned standard risk on 29 June 2023.

The classification relies primarily on three criteria: the rate of deforestation and forest degradation, the rate of expansion of agricultural land for relevant commodities, and production trends (Article 29(3)). The Commission may also weigh information from the country and stakeholders, agreements with the EU, national laws and enforcement, data transparency and human-rights protections, and UN or EU sanctions (Article 29(4)). Recital 4 of Implementing Regulation (EU) 2025/1093 adds that the data come mainly from the FAO's Global Forest Resources Assessment.

The current list (Implementing Regulation (EU) 2025/1093)

The list was adopted on 22 May 2025 and published on 23 May 2025. The Commission's guidance of 20 July 2026 still refers to it as the latest iteration. Article 29(2) requires the list to be reviewed and updated "as often as necessary in light of new evidence", so check for amendments before relying on a classification; any later update is not among the indexed sources.

What actually changes between tiers

The check rates come from Article 16(8) to (10) and are calculated separately for each commodity. Authorities must also systematically include risk criteria for high-risk countries in their annual check plans (Article 16(5)(a)), and the Commission must hold a specific dialogue with countries that are, or risk becoming, high risk (Article 29(5)).

The tier is also one input in the authorities' wider risk-based targeting. Article 16(3) tells competent authorities to consider the commodity, the length and complexity of supply chains (including whether products are mixed), the processing stage, whether plots are adjacent to forests, the country classification "paying special attention" to high-risk countries, and the compliance history of the companies involved. A low-risk origin lowers the minimum check rate; it does not take a shipment off the authorities' radar.

Simplified due diligence: the conditions in Article 13

An operator may skip Articles 10 and 11 only after it has assessed the complexity of the supply chain and the risk of circumvention or of mixing with products of unknown origin or from standard- or high-risk countries, and has ascertained that all relevant commodities and products were produced in low-risk countries or parts thereof. It must be able to show authorities, on request, documentation demonstrating that this risk of circumvention or mixing is negligible (Article 13(1)).

Two triggers switch the full regime back on. If the operator obtains any information, including substantiated concerns, pointing to non-compliance or circumvention, it must carry out Articles 10 and 11 in full and immediately inform the competent authority (Article 13(2)). And authorities must act immediately on signs of circumvention, explicitly including commodities from standard- or high-risk countries processed in a low-risk country before entering the EU market (Article 13(3)).

The common mistake: "low risk means no due diligence"

The guidance is unambiguous: all operators, including those benefiting from simplified due diligence, must exercise due diligence under Article 8, meet the information requirements of Article 9 and maintain a due diligence system under Article 12. Low-risk sourcing removes the risk assessment and mitigation steps, not the evidence file. Recital 2 of Implementing Regulation (EU) 2025/1093 itself describes low-risk sourcing as subject to "simplified due diligence obligations".

• Geolocation is still mandatory for every plot, under the same point and polygon rules.
• Legality evidence is still required under Article 9(1)(h). The guidance notes the country classification can inform the initial examination of legality risk, together with sources such as the World Bank's Worldwide Governance Indicators.
• Deforestation-free still means after 31 December 2020; a low-risk label does not certify any specific plot.
• Penalties can remove the shortcut: Article 25(2)(f) allows Member States to prohibit an operator from using simplified due diligence after serious or repeated infringements.

Building a supplier risk map for standard- and high-risk origins

Outside low-risk origins, the risk assessment must address every criterion in Article 10(2), including:

1. the country's risk tier, forest presence and prevalence of deforestation or degradation;
2. the presence of indigenous peoples, consultation with them and their substantiated claims;
3. corruption, document falsification, weak law enforcement, human-rights violations, armed conflict or sanctions;
4. supply-chain complexity and processing stage, and the risk of circumvention or mixing;
5. substantiated concerns and the compliance history of actors in the chain;
6. complementary information from certification or third-party schemes, provided it meets Article 9.

The guidance adds that where products come from several sources or geolocations, the risk must be assessed for each of them, and that any criterion revealing a non-negligible risk means the product cannot be placed on the market. Certification can support the analysis but, in the guidance's words, does not imply a "green lane".

To check a specific origin or obligation, ask the EUDR knowledge base, for example: "Does sourcing from a low-risk country exempt us from doing a risk assessment at all?" The obligations apply from 30 December 2026, or 30 June 2027 for qualifying micro and small undertakings.