Risk Assessment Under the EUDR: Country Benchmarking & Deforestation Analysis

The Role of Risk Assessment in EUDR Compliance

Risk assessment is the second pillar of the EUDR's three-step due diligence process. After collecting information about your supply chain, including geolocation data, supplier details, and product information, you must evaluate the risk that your products are linked to deforestation or illegal production.

The assessment must establish that there is no or only a negligible risk before products can be placed on the EU market or exported. The assessment evaluates risk; where the result is not no or negligible risk, appropriate mitigation measures must reduce that risk before the operator submits a Due Diligence Statement (DDS).

Understanding what "negligible risk" means in practice, and how to demonstrate it to a competent authority, is one of the most important compliance skills for EUDR operators.

The Three-Step Due Diligence Process

1. Information collection: gather geolocation data, supplier details, product documentation (see our complete EUDR overview)
2. Risk assessment: evaluate deforestation risk and legality of production (this article)
3. Risk mitigation: if risk is not negligible, take steps to reduce it before placing products on the market

These steps are sequential and interdependent. A risk assessment is only as good as the information it is based on. If your information collection step has gaps, such as missing geolocation data, unverified supplier claims, or incomplete documentation, your risk assessment will be unable to reach the negligible threshold.

What "Negligible Risk" Means

The regulation does not define an exact numerical threshold for "negligible risk." Instead, the European Commission's Guidance Document interprets it as follows:

• The operator has collected all required information
• The operator has assessed all relevant risk factors (listed in Article 10)
• No information collected raises a concern about deforestation or illegality
• The operator has verified the consistency and plausibility of the information
• Where concerns were identified, they have been adequately addressed through risk mitigation

In practice, this means your risk assessment must be documented, systematic, and repeatable. If a competent authority audits you, you must be able to show your methodology, the data you assessed, the conclusions you reached, and the reasoning behind them. A verbal assurance that you "checked and everything looks fine" is not sufficient.

What Factors Must Be Assessed?

According to Article 10 of the regulation, your risk assessment must consider a broad set of factors. In practice, these can be grouped into four working categories:

Country or Regional Risk

• Deforestation rates in the country or region of production: countries with high deforestation rates present higher risk
• Governance indicators: rule of law, corruption levels, enforcement capacity of local authorities. The World Bank's Governance Indicators and Transparency International's Corruption Perceptions Index are commonly used data sources.
• Land tenure security: are property rights clearly defined and enforced? In countries where land rights are contested or poorly documented, the risk of production on illegally occupied land increases.
• The EU's country benchmarking classification (low, standard, or high risk), which is the primary regulatory country-level risk signal

Supply Chain Complexity

• Number of intermediaries between producer and operator: more intermediaries mean more opportunities for mixing or misrepresentation
• Mixing or blending of products from different origins: if coffee from multiple farms is blended at a cooperative or export warehouse, each contributing plot must be traced and assessed
• Traceability gaps: can every unit of product be traced back to a specific plot? If any link in the chain cannot be verified, the risk assessment should flag this.

Product-Specific Risk

• Is the commodity commonly associated with deforestation in that region? The same commodity can have a different risk profile by country, region, production system, and supply-chain structure.
• Are there known issues with the specific HS code category? Some product categories have higher rates of compliance problems due to complex or opaque supply chains.

Verification of Information

• Consistency of geolocation data with known production areas: do the coordinates actually correspond to agricultural land in the claimed country and region?
• Remote-sensing analysis, where used: does satellite or other earth-observation data flag potential post-2020 forest conversion for review? This can be valuable supporting evidence, but the EUDR does not prescribe a specific satellite tool, dataset, or resolution for every plot.
• Third-party certifications: are they credible, current, and from recognized bodies? Certifications can support the assessment but cannot replace it.
• Contradictory information: do any data points conflict with each other? For example, a supplier claiming to source from a region that satellite data shows is not agricultural land.

Country Benchmarking System

The European Commission has published a benchmarking list classifying countries into three risk categories. This system directly affects the depth of due diligence required and the intensity of enforcement:

Low Risk Countries

• Simplified due diligence: information collection and generally a DDS are still required, while a qualifying micro or small primary operator uses a simplified declaration. The full Article 10 risk assessment and Article 11 mitigation workflow generally do not apply unless relevant information or a substantiated concern indicates risk
• Lower inspection rate: at least 1% of relevant actors checked by competent authorities
• Countries must demonstrate low deforestation rates, strong governance, and effective enforcement of environmental and land use laws

Standard Risk Countries

• Full due diligence required: all Article 10 risk factors must be assessed
• Regular inspection rate: at least 3% of relevant actors checked
• This is the default category for countries not listed as low or high risk

High Risk Countries

• Full due diligence required, with the same legal no-or-negligible-risk standard and stronger enforcement exposure
• Increased inspection rate: at least 9% of relevant actors and 9% of relevant product quantities checked
• Countries with high deforestation rates, poor governance, or significant concerns about illegal land use

Current status: The benchmarking list is published. Belarus, the Democratic People's Republic of Korea, Myanmar, and the Russian Federation are classified as high risk. Countries not listed as low or high risk are standard risk. For more on the timeline, see our key dates article.

The practical implication: operators should not rely on reputation or assumptions. The country classification sets the regulatory baseline, but plot evidence, legality evidence, and supply-chain traceability still determine whether a specific DDS can be defended.

Using Satellite Data in Deforestation Assessment

Remote-sensing data can be an important source of supporting evidence. Satellite imagery may flag potential post-2020 forest conversion or forest loss for review, but it is not a legally mandated method for every plot. Operators choose evidence appropriate to the risk and must interpret any remote-sensing result against the EUDR definitions and the rest of the supply-chain record.

One Possible Remote-Sensing Workflow

1. Plot identification: the geolocation data (Point or Polygon) identifies the production area to be analyzed
2. Historical evidence selection: suitable imagery or land-cover data representing the 31 December 2020 cutoff is compared with later evidence
3. Forest cover classification: algorithms classify land cover in both time periods, distinguishing forest from agricultural land, urban areas, and other land uses
4. Change detection: any significant reduction in forest cover between the two periods is flagged as potential deforestation
5. Evidence review: any result is assessed together with data quality, the legal forest and deforestation definitions, and other available evidence

Data Sources Commonly Used

• Global Forest Watch (Hansen et al., Science 2013): the most widely used global dataset for tree cover loss, updated annually at 30-meter resolution. Based on Landsat satellite imagery.
• Copernicus Sentinel-2: EU Earth observation satellites providing imagery at up to 10-meter spatial resolution with frequent revisit coverage.
• Landsat: NASA/USGS satellite imagery archive with data going back decades, providing the historical baseline for pre-2020 forest cover assessment. Resolution of 30 meters.
• Planet Labs: commercial satellite constellation providing daily 3-5 meter resolution imagery. Higher spatial resolution than free alternatives, but requires a paid subscription.

Interpreting Results

Limitations of Satellite Analysis

Satellite analysis is powerful but not infallible:

• Cloud cover can obscure tropical regions for months at a time, particularly in equatorial Africa and Southeast Asia during rainy seasons
• Small-scale, gradual deforestation may not be detected at 30-meter resolution, so high-resolution commercial imagery may be needed
• Regrowth and seasonal variation can be misclassified, and deciduous forests that lose leaves seasonally may trigger false positives
• The 2020 baseline requires reliable historical imagery, which may not be available for all locations at sufficient quality

When a remote-sensing result is inconclusive and the overall evidence does not establish no or negligible risk, the operator must obtain adequate additional evidence or mitigate the risk. Depending on the case, this may include ground verification, other imagery, land records, or documentation from competent local authorities.

Risk Mitigation Strategies

If your risk assessment identifies non-negligible risk for any factor, you must not submit the DDS until you have implemented adequate mitigation measures:

Additional Information Gathering

• Request more detailed geolocation data from suppliers, for example polygon boundaries instead of point coordinates
• Obtain independent satellite analysis from a second data provider to confirm or challenge the initial results
• Conduct on-the-ground verification or field audits, sometimes the only way to resolve ambiguous satellite results
• Request land title documents or government-issued proof of legal land use

Supply Chain Adjustments

• Switch to suppliers with verified deforestation-free plots if the current supply chain cannot provide adequate evidence
• Require third-party certification (e.g., Rainforest Alliance, UTZ) as an additional assurance layer. Certification does not replace due diligence, but it can strengthen the overall evidence base.
• Implement physical segregation to prevent mixing of compliant and non-compliant origins at export warehouses, dry mills, or shipping points

Monitoring and Auditing

• Consider ongoing monitoring proportionate to the risk profile. Satellite monitoring is one option, not a universal legal requirement.
• Conduct periodic supplier audits to verify that the information they provide is consistent with on-the-ground reality
• Maintain detailed records of all risk assessment activities, findings, and mitigation measures taken. These records must be available for competent authority inspection for five years.

Documenting Your Risk Assessment

The Guidance Document emphasizes that risk assessments must be documented in a way that competent authorities can review. At minimum, your documentation should include:

• The methodology used: what data sources did you consult? How did you weight different risk factors?
• The specific data assessed: which geolocation, governance, supply-chain, and, where used, remote-sensing datasets?
• The conclusions reached: for each risk factor, what was the assessed level of risk?
• The reasoning: why did you conclude that risk was negligible? What evidence supports this conclusion?
• Any mitigation measures: if risk was initially non-negligible, what steps did you take to reduce it?

A well-documented risk assessment is essential in the event of an audit. The legal threshold is not merely a good-faith effort: before placing or exporting the product, the operator must conclude on the basis of the required evidence that there is no or only a negligible risk.

Bosqio's risk record is designed around that audit question: each alert links back to the dataset layer, version or hash, plot, producer evidence, mitigation step, and final decision.

Frequently Asked Questions

Can I use aggregated deforestation data instead of plot-level analysis?

Not by itself. Country-level or regional deforestation statistics can inform the assessment, but they cannot replace the product- and plot-specific evidence required to link the relevant product to its production plots and evaluate the applicable risks. Satellite imagery may support that evaluation, but the EUDR does not require every plot to be assessed with a particular satellite method.

How often must I update my risk assessment?

The regulation requires risk assessments to be updated when new information becomes available that could affect the assessment. In practice, this means reassessing when you receive new geolocation data from suppliers, when satellite monitoring detects changes, when country classifications are updated, or when media reports or NGO publications raise concerns about specific regions.

What if my satellite analysis gives an inconclusive result?

An inconclusive satellite result is not automatically decisive because satellite analysis is only one possible form of evidence. Review the complete record. If the available information as a whole does not establish no or negligible risk, obtain adequate additional evidence or apply mitigation before submitting a DDS.

Can certifications like Rainforest Alliance replace a risk assessment?

No. Article 10 allows certification or other third-party-verified schemes to be considered where they meet the relevant information requirements. The Commission Guidance explains that their use is voluntary and that they provide complementary information; they do not replace the operator's own assessment and responsibility.

What does "forest degradation" mean and how does it differ from "deforestation"?

Deforestation is the conversion of forest to agricultural use. Forest degradation is a separate concept mainly relevant to wood products and covers specific structural changes in forest cover, such as conversion of primary or naturally regenerating forest into plantation forest or other wooded land.

Sources

• Consolidated Regulation (EU) 2023/1115, Articles 10-11: Risk assessment and mitigation requirements
• Commission Implementing Regulation (EU) 2025/1093: Country benchmarking classification
• European Commission Guidance Document (2026): Current risk-assessment and certification guidance
• European Commission: FAQ on EUDR Implementation: Clarifications on satellite tools, evidence, and current obligations
• Global Forest Watch: Hansen et al. deforestation monitoring data
• Copernicus Land Monitoring Service: EU satellite data for land cover analysis
• World Bank: Worldwide Governance Indicators: Country governance data for risk assessment