Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Every country that produces cattle, cocoa, coffee, palm oil, rubber, soy, or wood is classified as low, standard, or high deforestation risk. Sourcing from a low-risk country, where the risk of circumvention or of mixing with products from other countries is negligible, lets you skip risk assessment and mitigation steps and use simplified due diligence. Sourcing from standard- or high-risk countries requires full due diligence, including risk assessment and mitigation measures. As of 2026, only four countries – Belarus, Myanmar, North Korea, and Russia – are classified high risk. Every operator must still submit a due diligence statement (DDS), regardless of risk tier; micro and small primary operators may instead submit a one-time simplified declaration. Downstream operators and traders do not submit their own.
Operators must comply from 30 December 2026. Micro and small operators established as such by 31 December 2024, and natural persons, have until 30 June 2027, except for timber products listed in the Annex to the EU Timber Regulation. Downstream operators and traders of any size must comply from 30 December 2026.
What is the EUDR country risk classification system?
The EUDR requires the European Commission to score every country of production on its deforestation and forest degradation risk. The system exists to scale due diligence effort to actual risk: companies sourcing from places with a strong track record on forest protection shouldn’t face the same paperwork burden as those sourcing from active deforestation hotspots.
The Commission published the first official country risk list on 22 May 2025, following Commission Implementing Regulation (EU) 2025/1093. It sorts countries into three tiers.
The three EUDR risk tiers, compared
Tier | Due diligence required | Inspection rate | Example countries |
|---|---|---|---|
Low risk | Simplified - collect information, no formal risk assessment or mitigation required | At least 1% of operators annually | EU member states, US, China, and 140+ others |
Standard risk | Full - risk assessment and mitigation measures required | At least 3% of operators annually | Brazil, Indonesia, Democratic Republic of Congo, Malaysia |
High risk | Full - same due diligence as for standard risk, with a higher check rate | At least 9% of operators annually | Belarus, Myanmar, North Korea, Russia |
What does “simplified due diligence” actually mean?
This is the detail most guidance skips over. Per the Commission’s updated Guidance Document (3rd edition, 13 July 2026), operators sourcing from low-risk countries are not required to:
- Carry out in-depth data collection for each individual plot
- Collect specific document types such as individual land titles
- Compile an exhaustive list of every applicable local law
…as long as an initial examination doesn’t turn up anything indicating a higher risk of non-compliance. You still need to collect all the information required by Article 9, including geolocation, and submit a due diligence statement – simplified doesn’t mean exempt.
Why the high-risk list is so short
Only four countries made the high-risk list: Belarus, Myanmar, North Korea, and Russia. Together, they account for roughly 0.07% of EUDR-covered imports into the EU – all four are also under existing international sanctions.
Meanwhile, some of the world’s largest deforestation hotspots – Brazil, Indonesia, the Democratic Republic of Congo, and Malaysia – landed in the standard-risk tier rather than high-risk. This produced significant political pushback: in July 2025, the European Parliament passed a resolution objecting to the list’s methodology, citing a lack of transparency in the underlying data. The European Commission proceeded with the classification as adopted, and it remains the operative framework.
Low risk doesn't mean no risk
A common misreading of the tier system is treating “low risk” as “no obligation.” It isn’t. Every operator placing regulated commodities on the EU market must still submit a due diligence statement (or, for micro and small primary operators, a one-time simplified declaration), regardless of country classification. If there’s a risk of your low-risk-origin product mixing with material from a non-low-risk source, or if a third party raises a substantiated concern, full due diligence kicks back in immediately.
Country classifications also aren’t permanent. The Commission has committed to a periodic review process, incorporating updated Food and Agriculture Organization (FAO) deforestation data. A country’s tier – and your due diligence burden – can shift.
EUDR enforcement timeline: key 2026 and 2027 dates
The EUDR’s application date has moved twice. As it stands after the December 2025 amendment (Regulation (EU) 2025/2650, published in the Official Journal on 23 December 2025):
- 30 December 2026 – main obligations apply to operators, and to downstream operators and traders of any size
- 30 June 2027 – start date for micro and small operators established as such by 31 December 2024, and natural persons, except for timber products listed in the Annex to the EU Timber Regulation
- 4 May 2026 – the Commission published its simplification review (COM(2026) 191), which may lead to further legislative proposals
Because the framework has shifted before, treat these dates as the current legally binding timeline rather than a permanent fixture – and build your compliance process to flex if they move again.
Practical checklist: what to prepare by risk tier
If you source from a low-risk country:
- Collect and retain all the information required by Article 9 (product, quantity, country of production, geolocation)
- Confirm no red flags exist that would escalate you to full due diligence
- Submit your due diligence statement (DDS) before placing goods on the EU market
If you source from a standard-risk country:
- Map your supply chain to the plot level
- Collect geolocation data for production plots
- Conduct a documented risk assessment
- Implement and record risk mitigation measures
- Submit a DDS with full supporting documentation
If you source from a high-risk country:
- All standard-risk requirements, plus
- Prepare for a materially higher chance of inspection (checks on at least 9% of operators, and of non-SME downstream operators and traders, versus at least 1% or 3%)
- Expect heightened scrutiny of mitigation evidence
Frequently asked questions
As of 2026, only four countries are classified high risk: Belarus, Myanmar, North Korea, and Russia. Together they represent about 0.07% of EU imports covered by the regulation.
Yes. Low-risk classification simplifies what you need to collect and skips formal risk assessment and mitigation - it does not remove the operator's requirement to submit a due diligence statement (micro and small primary operators may instead submit a one-time simplified declaration). Downstream operators and traders do not submit their own.
Operators must comply from 30 December 2026. Micro and small operators established as such by 31 December 2024, and natural persons, have until 30 June 2027, except for timber products listed in the Annex to the EU Timber Regulation. Downstream operators and traders of any size must comply from 30 December 2026.
Yes. The European Commission reviews classifications periodically using updated FAO deforestation data, so a country's tier - and your obligations - can shift over time.
In July 2025, Parliament passed a resolution criticizing the list's methodology and lack of transparency in the underlying data. The Commission proceeded with the classification as adopted regardless, and it remains in force today.
Sources: Commission Implementing Regulation (EU) 2025/1093; EUDR Guidance Document, 3rd edition (13 July 2026, OJ C/2026/3896); Commission simplification review, COM(2026) 191; Regulation (EU) 2025/2650.
Want to stop tracking risk tiers in a spreadsheet? Trusty’s EUDR Passport automates supplier traceability, risk checks, and DDS generation across all three tiers.
Related reading: why one geolocation point is not enough for cattle, whether you are an operator or a trader, and nine everyday products inside EUDR scope.
Looking for EUDR software? EUDR Passport collects your supplier data, runs the risk assessment and files unlimited due diligence statements, from €90 per product profile per year.
30 DECEMBER 2026
FREE EUDR Obligations Checker: Answer a few simple questions and get an instant assessment of your EUDR obligations.