EUDR risk assessment under Article 10: checking and documenting the 14 criteria, with a template (Excel) and a worked example

The due diligence statement ends with one sentence: the company has found no or only a negligible risk. The way there is the risk assessment under Article 10 of Regulation (EU) 2023/1115. It checks the information collected under Article 9 against 14 criteria, and the authority may ask to see how the company reached its result. There is no official template. This page explains the criteria, shows how they are checked and evidenced in practice, and provides an Excel template with all 14 criteria plus a completed, fictitious example.

Key facts

• A duty before placing on the market. Operators assess, on the basis of the information under Article 9, whether a product could breach the Regulation. It is placed on the market or exported only if no or a negligible risk remains (Article 10(1)).
• 14 criteria. Article 10(2), points (a) to (n), names among others the country risk, forests and indigenous peoples in the production area, deforestation, the quality of the information, corruption and sanctions, the complexity of the supply chain, circumvention and mixing, expert groups, substantiated concerns and certification. The list is not exhaustive.
• Negligible is the risk under Article 2(26) if, after a full assessment of product-specific and general information and, where necessary, after risk mitigation, there is no cause for concern that the product is not deforestation-free or not legally produced.
• Not negligible means risk mitigation under Article 11: additional information, independent surveys or audits, further measures, support for suppliers. If the risk remains, the product may not be placed on the market.
• Low country risk under Implementing Regulation (EU) 2025/1093 leads to simplified due diligence under Article 13: Articles 10 and 11 do not apply, only the complexity of the supply chain and the risk of circumvention and mixing are checked.
• Documentation. The assessment is documented, reviewed at least annually and presented to the authority on request; the company must be able to show how it checked the information against the criteria and how it determined the level of risk (Article 10(4)). All documents are kept for at least five years (Article 12(5)).

As at 17 October 2026. Legal basis: Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650, consolidated version of 18 September 2026; Implementing Regulation (EU) 2025/1093.

Legal basis: Articles 9 to 13 together

The risk assessment is the second of three steps of due diligence under Article 8: collect information (Article 9), assess risk (Article 10), mitigate risk (Article 11). Article 12 sets the framework of due diligence system, reporting and records, Article 13 provides the relief for low-risk countries. How due diligence is structured overall is in the EUDR guide; which version of the Regulation applies is on the status page.

What “negligible risk” means

The Regulation does not require certainty but a complete assessment. Article 2(26) describes negligible risk as the level of risk at which, after a full check of the product-specific information (plots, quantities, suppliers, evidence) and the general information (country, region, commodity, supply chain type) and, where necessary, after risk mitigation, there is no cause for concern that the product breaches Article 3, point (a) (deforestation-free since 31 December 2020) or point (b) (produced in accordance with the law of the country of production).

Three consequences follow. First: a single strong argument, such as a certificate or a low country risk, does not replace the assessment, because it has to be complete. Second: “no indication found” is a finding only if it is documented where you looked. Third: the rating is a decision of the company, which it must be able to justify under Article 10(4). The control authority does not check the tool but the operator; an inspector should be able to follow the path and ideally reach the same result (as the German authority BLE put it, see the software comparison).

The 14 criteria of Article 10(2) and how to check them

The criteria can be read in four groups: the country of production and its regions (a, b, c, f, h), the rights of indigenous peoples (c, d, e), your own supply chain and its data (g, i, j) and information from third parties (k, l, m, n). The table gives the practical check and the evidence that belongs in the file for each criterion. The wording is our own; the text of the Regulation is authoritative.

Two things apply to all 14 rows. The list is not exhaustive, Article 10(2) says “in particular”; anything else that points to a risk belongs under (m). And a criterion without indication is not an empty cell but a documented finding: checked, no indication, source, date. Whoever fills in only the criteria where something was found cannot show in a control that the assessment was complete.

Country risk: the first step

Article 29 classifies countries and parts of countries in three categories: low, standard and high risk. Since 29 June 2023 all countries have standard risk; with Implementing Regulation (EU) 2025/1093 of 22 May 2025 the Commission named the low-risk and high-risk countries, all others remain standard. Classified as high risk are Belarus, Myanmar, North Korea and Russia. The full list with category and consequences is in the EUDR country risk list; the categories of the main coffee and cocoa origins are explained in the industry article on coffee and cocoa.

The category decides the depth of the assessment, not its result. For low risk, simplified due diligence under Article 13 applies: criteria (a) to (n) do not have to be worked through; what has to be checked and evidenced is the complexity of the supply chain and the risk that products from standard-risk or high-risk countries or of unknown origin were mixed in. If the company obtains indications of a breach, the full duties apply and the authority must be informed without delay (Article 13(2)). For standard and high risk, all criteria have to be checked. The authorities check at least one percent of operators per year for low-risk countries, three percent for standard risk and nine percent for high risk (Article 16). Geolocation and the due diligence statement are mandatory in all three categories.

Certification and audits: an aid, not a substitute

Article 10(2), point (n), expressly admits information from certification and other third-party verified schemes, on condition that it meets the requirements of Article 9. The Commission clarifies in FAQ 5.7 that certification is an aid in the risk assessment insofar as it covers the necessary information; it replaces neither geolocation nor the statement, and certificates on a mass balance basis do not meet the segregation requirement. In practice this means: the certificate is checked like any other source (validity, farms and plots covered, handling of mixing) and provides findings for individual criteria, mostly (b), (f) and (j). The rating remains the company's decision.

The Regulation knows one exception: wood products with a valid FLEGT licence are considered legally produced under Article 10(3). This concerns only legality under Article 3, point (b), not deforestation-free status. Independent surveys and audits, by contrast, are a means of risk mitigation under Article 11(1): they are used when the assessment has found a risk that is not negligible, and their result feeds into the renewed assessment.

Recording and documenting the result

Article 10(4) describes what the file has to deliver: it shows how the collected information was checked against the criteria and how the company determined the level of risk. A table with seven columns per criterion covers this: question to check, evidence or source with date, finding, risk rating, mitigation measure, responsible person, date. Below it come the overall result before and after risk mitigation, the reasoning, the date of the due diligence statement and the sign-off. The rating per criterion (low, medium, high, not applicable) is a working aid; legally the overall result counts: negligible or not.

Three deadlines hang on it. The assessment must be reviewed at least annually (Article 10(4)), as must the risk mitigation decisions (Article 11(3)) and the due diligence system, which has to be updated as soon as new developments arise (Article 12(2)). New plots, new suppliers, a new harvest or new information trigger a renewed check before the deadline. All documents must be kept for at least five years and presented to the authority on request (Article 12(5)). Operators that are not SMEs also report publicly every year on their due diligence system, including the conclusions of the risk assessment and the measures taken (Article 12(3) and (4)). What is examined in a control is in the article on enforcement and penalties in Germany.

The template (Excel)

The template has three sheets. Sheet 1 “Instructions” explains the procedure, the rating and the legal basis. Sheet 2 “Assessment” contains the header (product, country of production, country risk, supplier, batch, harvest period, plots) and the 14 criteria (a) to (n) as rows with the columns question to check, evidence or source, finding, risk rating (drop-down list), mitigation measure, responsible and date; below it an automatic count of the ratings and the fields for overall result, reasoning, statement, sign-off and next review. Sheet 3 “Example (fictitious)” shows the same table completed. One assessment per product and supply chain, one per country where there are several countries of production.

• Download: EUDR risk assessment under Article 10, template with instructions, assessment sheet (a) to (n) and fictitious example (XLSX)
• Download: worked example of a risk assessment, fictitious coffee import from Honduras (PDF)
• Download: German version of the template (XLSX)

The template is a working aid, not an official form; the Regulation prescribes no format. It may be used and adapted freely within your own company. The preparation sheet for the due diligence statement itself is in the article on the due diligence statement.

Example: completed risk assessment (fictitious)

Musterfirma Kaffee Import GmbH in Hamburg imports 19,200 kg of green coffee (0901 11 00, washed Arabica, harvest November 2025 to February 2026) from Honduras. The supplier is an exporter, the producers are four member farms of a cooperative with four plots of 3.1 to 6.2 hectares, all supplied as polygons. Honduras has standard risk, so full due diligence applies. The assessment is set in January 2027, after the date of application on 30 December 2026. Company, cooperative, plots, sources and findings are invented; the example shows the structure of an evidenced assessment, not real results. The same example is in sheet 3 of the template and as a PDF download.

How to read the example: the country criteria (a), (f) and (h) give a medium risk that cannot be checked away but determines the depth of the rest of the check. Decisive were (i) and (j), because the cooperative also accepts coffee from non-members. Only the segregation clause, separate storage, the quantity check and the spot check brought the risk down to a negligible level; before that, the statement could not have been submitted.

Common mistakes

• Country risk as the only criterion. The category under Article 29 is criterion (a) of 14. For standard risk it is the start of the check, not its result.
• Certificate as a substitute. Certification is an aid (point (n), FAQ 5.7); mass balance certificates do not prove segregation.
• Too many plots. Whoever registers more plots as a precaution than actually delivered must fulfil due diligence for all of them, assess the risk and take criteria (i) and (j) into account; details in the article on the due diligence statement.
• Findings without source and date. “Checked, nothing unusual” without a reference cannot be followed in a control.
• Empty rows. A criterion without an entry looks like a criterion that was not checked.
• Mitigation without a new assessment. After a measure under Article 11 the result has to be determined anew and the decision documented (Article 11(3)).
• No review date. The assessment ages with every harvest, every change of supplier and every new report; at least annually is mandatory.
• Simplified due diligence without a mixing check. Even with low country risk, Article 13 requires the check of complexity and mixing and the documents for it.

A practical procedure in six steps

1. Determine the country risk. Look up the country and region of every plot in the list, note the date. Low: Article 13, continue with step 3 only for complexity and mixing. Standard or high: all criteria.
2. Complete the information. Compile geodata, quantities, harvest period, suppliers and legality evidence under Article 9; gaps are findings under criterion (g).
3. Go through the criteria. Per criterion evidence with date, finding in one sentence, rating. Leave nothing out.
4. Determine the overall result. Negligible or not, with a reasoning how the level of risk was determined.
5. Mitigate and reassess where needed. Additional information, audits, contractual commitments, support for suppliers; then repeat step 3 for the criteria concerned. If the risk remains, no placing on the market.
6. Sign off, declare, review. Sign-off with name and date, then submit the due diligence statement; review at the latest after twelve months, earlier on changes; keep the file for five years.

How Polygon One helps

Polygon One delivers the findings for the criteria that can be derived from data: every plot is screened by satellite against its state on 31 December 2020, the risk level of the country of production comes from the EU benchmarking under Implementing Regulation (EU) 2025/1093, and certificates and other evidence are read by an AI and assigned to the right supplier, country and commodity. Suppliers enter their plots through a portal without a login. From this data the due diligence statement is generated and goes directly to TRACES. The rating per criterion and the overall result remain the decision and responsibility of the operator; that is exactly what the template on this page is for. How the EUDR software works.

Frequently asked questions

Do I have to redo the risk assessment for every due diligence statement?

The Regulation does not say so expressly, and we are not aware of a Commission statement on the point. Our reading of Article 10(1) and (4): the assessment refers to the products placed on the market, so to the plots, the harvest period and the supply chain of a delivery. If these stay the same, the existing assessment can be relied on and confirmed with a date. New plots, new suppliers, a new harvest or new information require a renewed check; in any case the assessment has to be reviewed at least annually (Article 10(4)).

Is the country risk enough as a risk assessment?

No. The category under Article 29 is only criterion (a). For standard and high risk, all criteria have to be checked. For low risk, simplified due diligence under Article 13 applies, but even then the complexity of the supply chain and the risk of circumvention and mixing have to be checked and evidenced on request.

Does an FSC, PEFC or Rainforest Alliance certificate replace the risk assessment?

No. Under Article 10(2), point (n), and Commission FAQ 5.7, certification is an aid insofar as it covers the necessary information. It replaces neither geolocation nor the statement, and mass balance certificates do not meet the segregation requirement. Only a valid FLEGT licence counts under Article 10(3) as evidence of the legality of wood products.

What happens if the risk is not negligible?

Then risk mitigation measures under Article 11 have to be applied before placing on the market: additional information, independent surveys or audits, further measures, support for suppliers. After that, the assessment is repeated. If the risk remains not negligible, the product may be neither placed on the market nor exported, and no due diligence statement may be submitted.

How long do I have to keep the risk assessment, and who may see it?

All due diligence documents must be kept for at least five years (Article 12(5)). The assessment and the risk mitigation decisions must be presented to the competent authority on request (Article 10(4), Article 11(3)). Operators that are not SMEs report publicly every year on their due diligence system including the conclusions of the risk assessment (Article 12(3) and (4)).

Do I need a risk assessment for products from the EU?

All EU Member States are classified as low-risk countries. Simplified due diligence under Article 13 applies to them: the criteria of Article 10 do not have to be worked through; what has to be checked and evidenced is the complexity of the supply chain and the risk of mixing with products from other countries or of unknown origin. Geolocation and the due diligence statement remain mandatory.

Sources and status: Regulation (EU) 2023/1115 as amended by Regulation (EU) 2025/2650 (consolidated version of 18 September 2026, EUR-Lex), Article 2(26), Articles 8 to 13, 16 and 29. Implementing Regulation (EU) 2025/1093 of 22 May 2025 (country benchmarking). Commission FAQ on the EUDR, version 5 (April 2026, revised 21 August 2026), question 5.7. As at 17 October 2026. The example is fictitious. This article is not legal advice.