Risk assessment (EUDR)
Under the EUDR, risk assessment is the second step of due diligence: the operator analyses the information collected against the criteria of Article 10 to establish whether a product risks being non-compliant. Products may be placed only if the risk is none or negligible.
Also known as: Article 10 risk assessment
Why does it matter?
Risk assessment is where collected data becomes a decision. Under Article 10 of the EUDR, operators must be able to show how the information gathered was checked against the criteria and how they determined the degree of risk.
What criteria apply?
Article 10(2) lists criteria including:
- the country risk classification and the presence of forests;
- the presence of indigenous peoples and claims over land use or ownership;
- the prevalence of deforestation or forest degradation;
- the source, reliability and validity of the information;
- corruption, document falsification, weak law enforcement, human rights violations, armed conflict or sanctions;
- supply chain complexity and difficulty linking products to plots;
- the risk of circumvention or of mixing with products of unknown origin;
- substantiated concerns and non-compliance history;
- complementary information, such as from certification or third-party verified schemes.
How does it work at the first mile?
Plot-level signals (forest overlap, post-2020 alerts, protected areas, overlapping plots, implausible yields) are combined with supply-chain signals such as side-selling or duplicated farmer records.
Common pitfalls
- Relying on certification as a substitute for assessment; it is complementary information.
- Assessing the country, not the plot.
- Ignoring data reliability, which is itself a criterion.
Farmer1st surfaces plot-level risk signals and data-integrity checks through its fraud detection and geo and polygons services.
Frequently asked questions
Is risk assessment required when sourcing from low-risk countries?
Under simplified due diligence (Article 13), operators sourcing only from low-risk countries are not required to carry out risk assessment and mitigation, unless they obtain information pointing to a risk of non-compliance or circumvention.
How often must risk assessments be reviewed?
Operators must document and review their risk assessments at least annually and make them available to competent authorities on request (Article 10(4)).
Tell us about your supply chain.
Ten minutes with our scoping assistant. We come back with a first sketch of your service.
