EUDR country risk: every country under Implementing Regulation (EU) 2025/1093

Your origin country's classification is the first number that decides how much work the regulation costs you. At low risk you may skip two of the most demanding steps; at high risk the minimum control rate is 9 % of companies plus 9 % of the quantity, against 3 % at standard and 1 % at low risk. Both depend on a list in two parts in the Annex to the Implementing Regulation.

This page carries both lists in the wording of the Official Journal, the consequences of each tier with the article references, a change log and all 197 countries in alphabetical order with ISO code, also as an Excel file. As of 18 October 2026.

The map shows the classification in the Annex; the text governs. The base map shows South Sudan (low risk) as part of Sudan (standard risk) and Kosovo (standard risk) as part of Serbia (low risk); 23 low-risk countries, among them Qatar and many island states, have no area of their own; grey marks ten territories that the Annex does not list separately, such as Greenland and Hong Kong. Open the map as SVG (790 KB). Map geometry from pygal_maps_world 1.0.2 (LGPL), fill colours according to the Annex to Implementing Regulation (EU) 2025/1093.

The three tiers and where they come from

Article 29(1) EUDR sets up a three-tier system. Countries or parts of countries are high risk where an exceptionally high risk is identified that commodities are produced there for which the relevant products are in breach of Article 3(a). They are low risk where there is sufficient assurance that such cases are exceptional. Everything in between is standard risk.

On 29 June 2023 all countries were assigned standard risk. The Commission had to establish the deviations in both directions by implementing act. That happened with Implementing Regulation (EU) 2025/1093 of 22 May 2025, published in the Official Journal series L on 23 May 2025 and, under its Article 2, in force on the third day after publication, that is 26 May 2025.

Under Article 29(3) and recital 4 of the Implementing Regulation the classification rests primarily on quantitative data, above all from the Global Forest Resources Assessment of the Food and Agriculture Organization of the United Nations; the criteria in Article 29(4) are also taken into account. Recital 4 also refers to the Commission Communication on the Strategic Framework for International Cooperation Engagement (OJ C/2024/6604), which mentions that a large majority of countries worldwide will be classified as low risk. That explains the distribution: 140 to 4.

Two points from the Regulation. First, under Article 29(1) the classification may also apply to parts of countries, but the Commission has not used that option in the current list. No country is classified differently by region. Second, under Article 29(2) the list is reviewed and updated as often as necessary. A change therefore does not arrive on a fixed date but as a new implementing act.

High-risk countries

Four entries, unchanged since 26 May 2025.

For these four countries simplified due diligence under Article 13 is ruled out, and the competent authorities are required to carry out enhanced scrutiny (recital 68 of the Regulation, implemented in Article 16(3), (5) and (9)). If you source timber, rubber or soy from any of them, check separately whether the import is permitted at all: for Belarus and the Russian Federation there are import restrictions under EU sanctions legislation, covering timber and wood products among other goods, independently of the EUDR. The EUDR does not lift or replace them. Check the current state of the sanctions each time.

Low-risk countries

140 countries, in the wording of the English Annex. The table carries every entry and reads alphabetically down each column. The German version of the same Annex contains 141 entries, because Syria appears there twice, once as “Syrien” and once as “Arabische Republik”, whereas the English version has a single entry, “Syrian Arab Republic”. That is one country, not two.

All 27 EU Member States are on this list. Timber from German, Austrian, Swedish or Finnish forests is therefore low risk, as is cattle from Ireland and timber from Ukraine.

Standard risk: every other country

There is no list of standard-risk countries; the Regulation only provides for lists of low-risk and high-risk countries (Article 29(2)). Article 1(2) of the Implementing Regulation says it in a single sentence: all countries not listed in the Annex continue to be considered standard risk. To establish that a country is standard risk you check an absence, not an entry.

Brazil, Indonesia, Malaysia and Côte d'Ivoire are among the standard-risk countries. The table below gives examples of countries of origin for each commodity with their tier. It does not replace checking the specific country of production; it only shows how uneven the picture is inside a single commodity.

The rubber row shows the pattern most clearly: Thailand, the largest supplier to the EU, as well as Vietnam, India and Sri Lanka are low risk, Indonesia, Malaysia and Côte d'Ivoire are standard risk, Myanmar is high risk. Anyone filling from a mixed stock loses the simplification for the entire batch. The same applies to cocoa, where Ghana is low risk and neighbouring Côte d'Ivoire is standard.

How this plays out per commodity is shown in the sector articles on coffee and cocoa, timber, rubber, palm oil, paper and furniture imports. Which products belong to the seven commodities is set out in Annex I to the Regulation with its CN codes.

What the tier actually changes

Simplified due diligence under Article 13

This is the reason the list is worth money. An operator sourcing exclusively from low-risk countries does not have to fulfil the obligations in Article 10 (risk assessment) and Article 11 (risk mitigation). Those are the two most demanding steps of due diligence.

What remains (for the special rule for micro and small primary operators, see below):

• Information gathering under Articles 8 and 9, including geolocation of the plots of land: at least six decimal digits, and a polygon for plots of more than four hectares (other than for cattle).
• The legality check against the law of the country of production.
• The due diligence system under Article 12, meaning the documented procedure inside the company.
• The due diligence statement in the information system and the reference number.
• The prohibition in Article 3. Deforestation also happens in low-risk countries, and a product from a plot deforested after 31 December 2020 is not compliant; for wood, also where it was harvested with forest degradation after that date.

The simplification is also tied to an assessment of its own. Under Article 13 you may omit Articles 10 and 11 only where, having assessed the complexity of the supply chain and the risk of circumvention or of mixing with products of unknown origin or originating in standard-risk or high-risk countries, you have ascertained that all commodities were produced exclusively in low-risk countries. That ascertainment is itself a work step, and it has to be documented. The Commission Guidelines confirm what Article 13(2) provides: if you later become aware of relevant new information pointing to a risk, the simplification falls away, Articles 10 and 11 apply again and the competent authority has to be informed without delay.

Micro and small primary operators are a special case. By definition they are established in a low-risk country and produce there themselves (Article 2(15a)); that need not be an EU Member State. Under Article 4a they submit a one-off simplified declaration instead of a due diligence statement and may give a postal address instead of geolocation. According to the Commission Guidelines (chapter 4(c) and (e)) they are generally not required to carry out risk assessment and risk mitigation; this changes as soon as they receive information pointing to a non-negligible risk.

Control rates under Article 16

The tier determines how many companies the authorities of a Member State must check each year. The rates are minimums, not ceilings.

Three details that matter in practice. First, the quantity rate applies only to high risk. For standard and low risk, counting is by number of companies, not by volume. Second, under Article 16(11) the targets have to be met for each commodity separately and are calculated on the total number of operators, non-SME downstream operators and non-SME traders in the previous year and, where applicable, on the quantity. Third, the German Federal Government bill implementing the Regulation (Bundestag printed paper 21/8278) takes over these figures in section 5.

Risk assessment under Article 10

Even where the simplification is unavailable, the list still helps. Under Article 10(2)(a) the classification of the country of production is one criterion of the risk assessment, and recital 6 of the Implementing Regulation states that it is to be taken into account there. In practice the tier is one line in your assessment, not the result of it. Standard risk does not become low risk because you attach a certificate, and low risk does not carry the assessment on its own.

Four confusions that get expensive

Congo is not the Democratic Republic of the Congo. The Republic of the Congo (capital Brazzaville) appears in the Annex as “Congo” and is low risk. The Democratic Republic of the Congo (capital Kinshasa) is not in the Annex and is standard risk. Both export timber. The ISO codes are unambiguous: CG for the Republic of the Congo, CD for the Democratic Republic of the Congo.

Republic of Korea is not the Democratic People’s Republic of Korea. South Korea is low risk, North Korea is high risk. The regulation uses the official long form in both cases.

Country of supply is not country of production. The tier attaches to the country where the commodity was produced, grown or harvested, not to the country your shipment comes from and not to your supplier's seat. A container from Rotterdam carrying Indonesian palm oil is standard risk. The Regulation requires geolocation under Article 9 regardless of the tier.

Low risk is not an exemption. Neither the due diligence statement nor the geolocation data nor the prohibition in Article 3 falls away; only micro and small primary operators have a special rule under Article 4a. Two articles out of many fall away, and only on one condition.

What the European Parliament's rejection means

On 9 July 2025 the European Parliament adopted a plenary resolution objecting to the methodology and the results of the country benchmarking. In it, Parliament states that the Implementing Regulation exceeds the implementing powers and calls for its repeal. The vote was 373 in favour, 289 against, 26 abstentions. The main criticism concerned the data basis and how traceable the classification is.

Legally, the resolution does not change the list. It does not bind the Commission. Implementing Regulation (EU) 2025/1093 was already in force at that point, it was adopted under the examination procedure in Article 36(2) EUDR, and Parliament has no veto over implementing acts. The Commission is not obliged to withdraw the list. It has not withdrawn it.

EUR-Lex shows that the list applies: as of 18 October 2026 the Implementing Regulation is listed there as in force, with no amending act. The Commission Guidelines, published in the Official Journal series C on 20 July 2026, also refer to it in footnote 11: “Latest iteration of the list of countries is provided for in the Commission Implementing Regulation (EU) 2025/1093.”

What remains is political pressure and a plan: in its Communication on the Strategic Framework for International Cooperation Engagement (OJ C/2024/6604, Annex) the Commission envisages a first review of the country classification in 2026, triggered by new FAO data, which become available every five years. A review is not a change. As long as no new implementing act appears in the Official Journal, the list applies in this version. Basing a risk assessment on a hoped-for downgrade means building on an expectation instead of on the law in force.

Change log

Reclassifications are announced in advance: before changing a country's risk category the Commission formally notifies the country concerned of its intention, states the reasons and informs the competent authorities (Article 29(6)); with countries classified as high risk or at risk of such classification it engages in a dialogue (Article 29(5)). Set a reminder for your main origins so that a reclassification does not surface at the next customs clearance; the EUDR status page tracks the ongoing legal changes.

Every country in alphabetical order with ISO code

The two lists above reproduce the wording of the Annex. For looking up, this table lists all 197 countries with their common name, ISO code and tier, including the 53 standard-risk countries that do not appear in the Annex: the 193 member states of the United Nations, the observer states Palestine (listed in the Annex) and Vatican City, and Kosovo and Taiwan, which appear as separate countries in EU customs procedures. Where the Annex uses a different designation, its wording is shown in the note. The ISO code is the two-letter code under ISO 3166-1, as used by the Information System for the country of production. Use your browser's search function (Ctrl+F or Cmd+F) to find a country.

How to read the column “Basis in the legal act”: “Annex” means the country is named in the respective list of the Annex; “Art. 1(2)” means the country is not listed and therefore has standard risk.

Download: the list as Excel

The Excel file contains every country with ISO code and tier with autofilter (sheet “Country list”), the three tiers with due diligence, check rate and legal basis (sheet “Levels and consequences”) and notes on source, status, coverage and country names (sheet “Notes”). It may be used freely and imported into your own systems; the legal act in the Official Journal prevails.

• Download: EUDR country risk, every country under Implementing Regulation (EU) 2025/1093, as of 18 Oct 2026 (XLSX)
• Download: German version of the list (XLSX)

How Polygon One helps

In Polygon One the risk level of the country of production comes from the EU benchmarking under Implementing Regulation (EU) 2025/1093; it sits next to the satellite comparison of every plot with its state on 31 December 2020 and the evidence that an AI reads and matches to the right supplier, country and commodity, for each delivery. Which role and which depth of due diligence applies to you is shown by the EUDR check in two minutes; what the software covers overall is on the EUDR product page. To see it in action, book a demo.

Frequently asked questions

Does the list still apply after the European Parliament rejected it?

Yes. The resolution of 9 July 2025 does not bind the Commission, and Parliament has no veto over implementing acts. Implementing Regulation (EU) 2025/1093 applies unchanged, and in footnote 11 the Commission Guidelines of 20 July 2026 refer to it as the latest iteration of the list of countries.

My supplier is in the Netherlands, the timber comes from Brazil. Which tier applies?

Standard risk. What counts is the country where the commodity was produced, not the supplier's seat and not the country of dispatch. Simplified due diligence under Article 13 is therefore unavailable.

Can I use Article 13 if only a small share of the batch comes from a standard-risk country?

No. Article 13 requires that all commodities were produced exclusively in low-risk countries. Even a share from a standard-risk country rules out the simplification for that batch. Separately, in FAQ 1.4 the Commission rules out mass balance models that mix products of known, deforestation-free origin with products of unknown origin.

Does “Congo” mean the Republic of the Congo or the Democratic Republic of the Congo?

The Annex says “Congo”, which means the Republic of the Congo, low risk. The Democratic Republic of the Congo is not in the Annex and is standard risk.

Why does Syria appear twice in the German version?

The German version of the Annex contains 141 entries because Syria is listed once as “Syrien” and once as “Arabische Republik”. The English version has one entry at that point, “Syrian Arab Republic”, and comes to 140. Either way it is one low-risk country.

Are any countries classified differently by region?

No. Article 29(1) allows parts of countries to be classified, but the Commission has not used that option in the current list. Every entry covers a whole country. Territories such as Hong Kong or Greenland are not listed separately in the Annex; the legal act classifies countries and does not say whether such a territory shares the tier of its parent country. Clarify such cases with the competent authority. French Guiana, by contrast, is part of France and of the EU as an outermost region; the Regulation currently applies there unchanged. The Commission has proposed removing it from the scope (COM(2026) 661).

When will the list change?

Under Article 29(2) it is reviewed and updated as often as necessary, so there is no fixed date. In Communication C/2024/6604 the Commission envisages a first review in 2026. A change takes legal effect only once a new implementing act is published in the Official Journal.

Does the due diligence statement fall away at low risk?

No. It remains mandatory, as do the geolocation data and the due diligence system. Only the risk assessment and risk mitigation can fall away, and only after your own assessment of supply chain complexity and of the risk of circumvention and mixing. Only micro and small primary operators submit a one-off simplified declaration under Article 4a instead of a due diligence statement and may give a postal address instead of geolocation.

Sources and status: Commission Implementing Regulation (EU) 2025/1093 of 22 May 2025 (OJ L of 23 May 2025), recitals 4 to 6, Articles 1 and 2 and Annex (English and German versions, retrieved 17 October 2026; status on EUR-Lex checked on 18 October 2026). Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650 (consolidated version of 18 September 2026), Article 2(13), (15a) and (28), Articles 3, 4a, 8 to 13, Article 16(3), (5) and (8) to (11), Articles 29 and 36(2), recital 68. Commission Guidelines, OJ C/2026/3896 of 20 July 2026, chapter 4(c) and (e) and footnote 11. Commission FAQ on EUDR implementation, version 5 (April 2026, revised 21 August 2026), question 1.4. German Federal Government bill on the reorganisation of the law on deforestation-free products, Bundestag printed paper 21/8278 of 30 September 2026, section 5 and explanatory memorandum. European Parliament resolution of 9 July 2025 on Implementing Regulation (EU) 2025/1093 (P10_TA(2025)0149). Commission Communication on the Strategic Framework for International Cooperation Engagement in the context of Regulation (EU) 2023/1115, OJ C/2024/6604 of 7 November 2024, Annex. As of 18 October 2026, checked against the wording of the Official Journal. Next check once the Commission presents the planned review of the country classification. This article is not legal advice.