# Risk assessment (EUDR) > Under the EUDR, risk assessment is the second step of due diligence: the operator analyses the information collected against the criteria of Article 10 to establish whether a product risks being non-compliant. Products may be placed only if the risk is none or negligible. Also known as: Article 10 risk assessment ## Why does it matter? Risk assessment is where collected data becomes a decision. Under Article 10 of the [EUDR](/glossary/eudr/), operators must be able to show how the information gathered was checked against the criteria and how they determined the degree of risk. ## What criteria apply? Article 10(2) lists criteria including: - the [country risk classification](/glossary/country-benchmarking/) and the presence of forests; - the presence of indigenous peoples and claims over land use or ownership; - the prevalence of deforestation or forest degradation; - the source, reliability and validity of the information; - corruption, document falsification, weak law enforcement, human rights violations, armed conflict or sanctions; - supply chain complexity and difficulty linking products to plots; - the risk of circumvention or of mixing with products of unknown origin; - substantiated concerns and non-compliance history; - complementary information, such as from certification or third-party verified schemes. ## How does it work at the first mile? Plot-level signals (forest overlap, post-2020 alerts, [protected areas](/glossary/protected-areas/), [overlapping plots](/glossary/overlapping-plots/), implausible yields) are combined with supply-chain signals such as [side-selling](/glossary/side-selling/) or duplicated farmer records. ## Common pitfalls - Relying on certification as a substitute for assessment; it is complementary information. - Assessing the country, not the plot. - Ignoring data reliability, which is itself a criterion. Farmer1st surfaces plot-level risk signals and data-integrity checks through its [fraud detection](/services/fraud-detection/) and [geo and polygons](/services/geo-polygons/) services. ## Frequently asked questions ### Is risk assessment required when sourcing from low-risk countries? Under simplified due diligence (Article 13), operators sourcing only from low-risk countries are not required to carry out risk assessment and mitigation, unless they obtain information pointing to a risk of non-compliance or circumvention. ### How often must risk assessments be reviewed? Operators must document and review their risk assessments at least annually and make them available to competent authorities on request (Article 10(4)). ## Sources - [Regulation (EU) 2023/1115 (EUDR), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2023/1115/oj/eng) - [European Commission, EUDR simplification review, COM(2026) 191](https://environment.ec.europa.eu/document/download/a3c5c3a0-232e-43c4-b0b8-1eecb1df45c7_en?filename=Report+from+the+Commission+to+the+Council+and+Parliament+on+the+EUDR.pdf)