Standard, Low, and High Risk Categories
Why this matters
Knowing which risk category applies to each of your sourcing origins is the starting point for every due diligence workflow under the EUDR. The three risk categories create fundamentally different compliance obligations, and misidentifying a country's tier can expose operators to significant legal and commercial risk.
The Three Tiers at a Glance
The EUDR benchmarking system divides all sourcing countries into three risk tiers. Each tier triggers a different due diligence regime for operators and a different enforcement intensity from competent authorities. The following table summarizes the key differences:
| Feature | Low Risk | Standard Risk | High Risk |
|---|---|---|---|
| Who qualifies | Strong governance, low deforestation rates, robust monitoring | Default category; all others | High deforestation, weak governance, known compliance issues |
| Operator due diligence | Simplified: collect information, no detailed risk assessment required | Full: information, risk assessment, and risk mitigation if needed | Full due diligence, plus enhanced checks by authorities |
| Minimum check rate | 1% of operators and products | 3% of operators and products | 9% of operators and products |
| Default status | No (must be positively designated) | Yes (applies to all undesignated countries) | No (must be positively designated) |
Standard Risk: The Default Position
Standard risk is the baseline classification that applies to all countries that the Commission has not positively designated as either low or high risk. At the time of writing, most of the world's commodity-producing countries fall into the standard risk category, because the Commission has adopted a cautious approach to low-risk designations and has reserved high-risk designations for situations where strong evidence supports elevated concern.
For operators sourcing from standard-risk countries, the full three-step due diligence process applies. They must collect the required information, conduct a risk assessment weighing all relevant factors, and take risk mitigation measures if the assessment reveals a non-negligible risk of non-compliance. Only when they can conclude that risk is negligible may they submit a due diligence statement.
Analogy: Innocent Until Proven Low-Risk
The EUDR's default-to-standard logic is similar to a regulatory presumption of risk rather than a presumption of safety. Countries must earn their low-risk designation through demonstrated governance quality and forest protection. This places the burden on demonstrating safety rather than on proving danger, consistent with the precautionary principle that underpins EU environmental law.
Low Risk: Earning the Simplified Pathway
A low-risk designation is a significant designation that the Commission grants only where a country can demonstrate, through reliable data, that its forest governance is strong, that deforestation rates are low and stable or declining, and that its regulatory frameworks protect forests effectively. Countries may engage in bilateral dialogues with the Commission to present evidence supporting a low-risk request.
For operators sourcing from low-risk countries, simplified due diligence applies under Article 10. This means that operators must still collect and maintain all the information required under Article 9 (including geolocation coordinates of production plots), but they do not need to conduct a full risk assessment before concluding that products are deforestation-free. The information collection itself, combined with confirmation of low-risk origin, is sufficient to support a due diligence statement.
Example: What Simplified Due Diligence Looks Like
A timber importer sourcing certified wood products from a country that the Commission has designated as low risk still needs to collect: the product description, quantity, country of production, geolocation data for all production plots, the date range of harvest, and supplier and customer details. What they do not need to do is evaluate each of the risk factors listed in Article 10(2) (governance quality, corruption prevalence, supply chain complexity, etc.) to reach a risk conclusion. The information collection is the compliance, rather than a gateway to a separate risk assessment exercise.
High Risk: Enhanced Scrutiny on Both Sides
A high-risk designation is the most consequential outcome for operators and for producer countries. The Commission designates a country as high risk where evidence shows elevated deforestation rates, weak forest governance, high levels of corruption, or a documented pattern of non-compliance with environmental or land-use law.
For operators sourcing from high-risk countries, the full due diligence process applies, but with additional scrutiny from enforcement authorities. Competent authorities must inspect at least 9% of operators and relevant products from high-risk countries each year. This means that a company sourcing from a high-risk country has a much higher probability of receiving a formal compliance inspection, which in turn means that any weaknesses in the due diligence system are more likely to be discovered and sanctioned.
Dynamic Classifications: How They Change
The benchmarking system is not static. Article 29 empowers the Commission to revise country classifications at any time based on new information. Several scenarios can trigger a reclassification:
- Improved governance: A country that invests in forest monitoring, strengthens its legal framework, and reduces deforestation rates may be upgraded from standard to low risk.
- Deteriorating conditions: A country experiencing surging deforestation, governance breakdown, or weakened enforcement may be downgraded from standard to high risk or from low to standard risk.
- Country requests: Producer countries can formally request a classification review, submitting evidence to support their case.
- Third-party complaints: NGOs, civil society organizations, or other operators can submit evidence of conditions that would support a reclassification.
Critical Point: Certification Does Not Change Risk Classification
A common misconception is that products certified by schemes such as RSPO (palm oil), FSC (timber), or Rainforest Alliance (coffee, cocoa) automatically qualify for simplified due diligence. They do not. Certification may provide useful evidence within a due diligence process, but the country risk classification is determined by the Commission, not by the presence or absence of product certification. An operator importing certified products from a standard-risk country must still conduct a full risk assessment.
The Practical Impact on EU Trade Flows
The benchmarking system creates powerful commercial incentives that extend well beyond individual compliance decisions. Importers, retailers, and consumer goods companies facing higher compliance costs for standard-risk or high-risk origins may rationally choose to source from low-risk countries even when prices are comparable. Over time, this preference can shift trade flows, rewarding countries that invest in forest governance with access to EU markets on more favorable terms.
For producer countries, this creates a tangible diplomatic and economic case for forest protection: improved governance is not only an environmental priority but a market access strategy. Countries that successfully achieve low-risk designation gain a competitive advantage in EU commodity markets, which can help offset the political costs of tighter domestic forest regulation.
Country classifications under Article 29 are published through implementing acts adopted by the Commission under the examination procedure. These acts are subject to review by a committee of Member State representatives. The Commission is also required to maintain an information system that makes current country classifications publicly accessible so that operators can verify their sourcing origins. When classifications change, operators who were already exercising simplified due diligence based on a low-risk designation must reassess their supply chains and may need to perform full due diligence until the situation stabilizes. This creates a need for ongoing monitoring of benchmark updates, not just a one-time compliance check at the start of a sourcing relationship.
Key Takeaways
- 1Standard risk is the default: all countries not positively designated as low or high risk are treated as standard risk
- 2Low-risk designation allows simplified due diligence (information collection without a detailed risk assessment) but does not eliminate the need to collect geolocation and other required data
- 3High-risk designation triggers 9% minimum enforcement check rates, compared to 3% for standard and 1% for low risk
- 4Classifications are dynamic and can be revised at any time based on new satellite data, governance changes, or country requests
- 5Product certification (FSC, RSPO, Rainforest Alliance) does not substitute for or automatically confer a low-risk country designation