EUDR Risk Assessment and Mitigation: How to Show 'No Risk or Only Negligible Risk' (Articles 10 and 11)

EUDR due diligence has three parts: collecting information, assessing risk, and mitigating any risk you find. Most guides spend their time on the first (geolocation, data collection) and the last output (the due diligence statement). The middle step, risk assessment and mitigation under Articles 10 and 11 of Regulation (EU) 2023/1115, is where audits tend to probe. This is a practical walkthrough. It is not legal advice, and you should check the regulation text and Commission guidance for exact wording.

Where this step fits

Information gathering (Article 9) tells you what you are buying and where it grew. Risk assessment asks whether that information shows a risk of non-compliance, meaning products that are not deforestation-free or not legally produced. Mitigation applies where the risk is more than negligible. Only when the conclusion is "no risk or only negligible risk" may you place the product on the market or export it, and file the DDS. Related reading: simplified due diligence under Article 13 and governance under Article 12.

Step 1: Assess the risk

Article 10 asks you to verify the information collected and to assess risk against a set of criteria. In practice, build your assessment around these questions:

• Country and region. What is the country's risk classification (low, standard or high)? See risk tiers.
• Forest presence and local conditions. Are there forests, and are there reports of deforestation or degradation in the producing area?
• Supplier and plot data. Is the geolocation complete, plausible and consistent with satellite checks? See geolocation verification.
• Legality. Is there evidence of compliance with the relevant laws of the country of production? See the legality requirement.
• Supply chain complexity. The more intermediaries, the harder it is to be sure.
• Circumvention and mixing. Is there a risk the product is mixed with goods of unknown origin? This is why mass balance does not work.
• Certification and third-party schemes. These can be an input, but they do not replace your assessment, see certification schemes.

Record the outcome for each supplier or product group, with the evidence behind it.

Step 2: Mitigate where risk is more than negligible

Article 11 requires risk mitigation measures that are adequate and proportionate. Typical options include requesting additional information or documents from the supplier, commissioning independent surveys or audits, and other measures such as supplier training or support for smallholder data collection. If you cannot get the risk to negligible, you must not place the product on the market.

A short worked example

Suppose you import green coffee from a standard-risk country via a cooperative. The geolocation file includes several plots near a mapped forest edge. Your assessment flags those plots. Mitigation: request satellite-based evidence of land use before 31 December 2020, ask the cooperative for field documentation, and if doubt remains, exclude those lots or commission an independent check. You document each step and the final conclusion before filing.

Evidence checklist

• Dated risk assessment per supplier or product group
• Criteria considered and the data source for each
• Mitigation measures chosen, with reasoning and results
• Final conclusion and sign-off
• Annual review, consistent with your Article 12 system

Timing

The regulation applies from 30 December 2026 to large and medium operators and traders, and from 30 June 2027 to micro and small operators. The Commission said in May 2026 it would not reopen the regulation text and estimated a 75% reduction in annual compliance costs from simplification measures (Global ELR summary). Simplification does not remove the need to assess and document risk.