EUDR risk assessment and mitigation: what a competent authority expects to see

Risk assessment and mitigation are the two steps between collecting supply-chain information under Article 9 and filing a due diligence statement. Article 10 requires you to judge whether your product carries a risk of non-compliance; Article 11 requires you to take measures that bring any risk down to negligible before you place the product on the market or export it. Only Article 13, for products sourced entirely from low-risk countries, lets you skip both.

What the risk assessment under Article 10 actually has to establish

A risk assessment is not a form you fill in once and file away. It is a documented judgement, made for each relevant product before it is placed on the market, about whether there is a risk — beyond negligible — that the product is linked to deforestation, forest degradation, or production that did not comply with the relevant law of the country of production.

Article 10 lists the factors you have to weigh, not a checklist you tick off:

Factor	What you are actually assessing
Country or regional risk	Whether the country or region is benchmarked low, standard or high risk, and the prevalence of deforestation or forest degradation there
Presence of forests	Whether the area of production sits in or near forest, and how that overlaps with the specific commodity
Indigenous peoples and local communities	Whether their rights, including free, prior and informed consent, are affected or at risk in the area of production
Substantiated concerns	Complaints, documented evidence, or information submitted by third parties under Article 31 pointing to non-compliance in this specific supply chain
Supply chain complexity and traceability	How many intermediaries sit between the plot and your business, and how far you can actually trace the product back to a specific plot
Risk of mixing	Whether the product could have mixed with material of unknown origin, or origin that is not deforestation-free, at any point before it reached you
Governance and corruption indicators	Prevalence of corruption, weak law enforcement, armed conflict, or widespread falsification of documents in the country or region of production

None of these is decisive on its own. A low-risk country rating does not clear a supply chain with a credible, documented complaint against a specific supplier, and a short, direct supply chain does not offset production inside a protected forest area. The assessment has to weigh the factors together and reach a view on whether the combined risk is negligible or not.

When you can skip it: Article 13 and low-risk sourcing

Article 13 is the one exemption from this process, and it depends entirely on where the product comes from, not on the size of your business. If every country of production for a relevant product is benchmarked low risk under the implementing regulation covered in EUDR country benchmarking explained: low, standard and high risk, you are not required to carry out the Article 10 risk assessment or the Article 11 mitigation measures for that product.

Simplified due diligence is not a free pass, though. You still have to:

• Collect the full set of information Article 9 requires — product, quantity, supplier, plot-level geolocation, and proof the product was legally produced.
• Check whether there is a substantiated concern about this specific supply chain, regardless of country rating.
• Satisfy yourself there is no risk the product has mixed with output from an unknown or higher-risk origin.
• File a due diligence statement, or the simplified declaration if you separately qualify as a micro or small primary operator.

A country moving from low to standard or high risk removes this exemption going forward. Product already placed on the market under the exemption is not retrospectively affected, but anything placed after the reclassification needs the full risk assessment.

Risk mitigation under Article 11: what "adequate measures" means in practice

If the Article 10 assessment finds anything beyond negligible risk, Article 11 requires you to adopt mitigation procedures and measures adequate to bring that risk down to negligible before the product is placed on the market or exported. There is no fixed list of required measures — the regulation describes the standard the measures have to meet, not the specific steps, and leaves the choice to the operator because the right measure depends on what the risk actually is.

In practice, mitigation typically means one or more of:

• Requiring additional information, data or documents from the supplier beyond the Article 9 minimum — a more detailed chain-of-custody record, for instance, or evidence tracing a mixed consignment back to individual plots.
• Commissioning an independent survey or audit of the supplier or the area of production, rather than relying on the supplier's own documentation.
• Strengthening your own monitoring and sampling of the specific supply chain, so that a problem shows up before the next consignment rather than after an inspection.
• Engaging directly with the supplier or the relevant local or national authority to resolve a substantiated concern before continuing to source from that plot.

Negligible risk is the standard you are mitigating toward, not an administrative formality: if, after mitigation, you cannot reasonably conclude the risk is negligible, the product should not be placed on the market. There is no provision that lets you file a due diligence statement while a known, unmitigated risk remains open.

How often you have to do this, and what to keep

The due diligence system as a whole — which includes your risk assessment and mitigation procedures — has to be reviewed at least once a year, and updated sooner if something changes that affects the risk picture: a new supplier, a plot that was not previously assessed, a country's risk tier changing, or a new substantiated concern. A risk assessment carried out eighteen months ago on a supply chain that has since changed supplier is not evidence of compliance for product placed on the market today.

Documentation of the risk assessment and the mitigation measures taken has to be kept for at least five years from the date the due diligence statement was submitted, and produced to a competent authority on request. What EUDR records must you keep, and for how long sets out what else falls under that same retention period. Keeping the risk assessment itself, rather than just the conclusion you reached, matters: an authority asking you to justify a negligible-risk finding is asking to see the reasoning, not just the result.

What the 2025–2026 enforcement dry runs show authorities actually check

Ahead of the December 2026 application date, competent authorities in Germany, Belgium, France and the Netherlands ran pilot inspections and dry-run checks, facilitated by the European Forest Institute, to work out how they would actually review a due diligence system once the obligation went live. The Dutch Food and Consumer Product Safety Authority (NVWA) published its own findings from pilot inspections of twenty operators across several sectors.

Two problems came up repeatedly, and they both sit squarely inside Article 10 and Article 11, not the paperwork around them:

• Geospatial traceability. Authorities wanted to see a plot-level chain of custody — geolocation points or polygons that actually connect the product in front of them to a specific area of production, not a supplier's general assurance that its sourcing is deforestation-free. EUDR geolocation requirements: polygons, points and the 4-hectare rule covers the mechanics most due diligence statements fail on.
• A systemic, evidenced process rather than an ad hoc one. Inspectors distinguished between operators who could produce a documented risk assessment specific to the supply chain in question, reviewed on a set schedule, and operators relying on a generic supplier declaration or certificate presented as if it closed the question on its own. A supplier's assurance is an input to the Article 10 assessment; it is not the assessment, and it does not substitute for the legality evidence Article 9(1)(h) requires.

Inspections under Article 18 can be unannounced, and authorities can request access to premises, systems and records as part of a check. A due diligence system that exists only as a set of supplier certificates, without a dated, reasoned assessment behind it, is the specific gap these dry runs found most often.

Risk tier still decides how often you get checked

Country risk benchmarking does not change what counts as an infringement, but it does set the minimum rate at which competent authorities have to check operators and traders each year:

Country risk tier	Minimum annual check rate
Low	1% of relevant operators and trade volume
Standard	3% of relevant operators and trade volume
High	9% of relevant operators and trade volume

A standard- or high-risk supply chain is simply more likely to be the one an authority picks. EUDR penalties: what non-compliance actually costs covers what follows if a check finds the due diligence statement does not hold up.

Getting this right before you need to

The practical failure mode is not usually a deliberately false risk assessment — it is a generic one, done once, that does not actually reflect the specific supply chain it is supposed to cover, or a mitigation step that was discussed but never documented. Both fail in exactly the same way an inspector described above: there is nothing concrete behind the negligible-risk conclusion.

If you are not yet sure which products trigger an Article 10 assessment for your business, or whether your sourcing countries currently qualify for the Article 13 exemption, check your actual EUDR obligations rather than assuming the general rule applies to your specific supply chain.