EUDR Risk Assessment Requirements and Risk Mitigation Implementation Practice
ENFORCEMENT TIMELINE
Regulation entered into force on June 29, 2023 (phased application for large operators expected from December 30, 2026)
Overview
This card focuses on the specific criteria and operational practice for 'risk assessment' and 'risk mitigation' under Articles 9 and 10 of the EU Deforestation Regulation (EUDR: Regulation (EU) 2023/1115).
In the risk assessment step — the second step of due diligence under EUDR — operators must rigorously assess, based on the geolocation and sourcing data they have collected, whether there is no or only a negligible risk that the relevant product is linked to deforestation, or that it was produced in violation of the laws of the country of production (covering matters such as land use rights, human rights, labor rights, tax law, and anti-corruption law). Where a risk is found not to be negligible, the operator must carry out risk mitigation measures — the third step — such as gathering additional data, commissioning independent third-party audits, or conducting on-the-ground investigations of suppliers, and is prohibited from submitting a DDS or placing the product on the market until the risk has been reduced to a negligible level.
Enforcement Timeline
June 29, 2023: EUDR enters into force, legally establishing the risk assessment and mitigation standards under Articles 9 and 10.
December 30, 2026: Large and medium-sized operators become obligated to operate risk assessment and risk mitigation schemes.
June 30, 2027: Risk assessment procedures begin to apply to small and micro operators (micro and small operators already covered by the EU Timber Regulation: December 30, 2026).
Annual review: Operators are required to periodically audit and update their overall risk assessment scheme each year.
Business Impact
Operators must build a quantitative and qualitative risk-assessment scoring model covering a wide range of criteria, including the extent of deforestation in the sourcing country or region, risks to indigenous land rights and human rights, the strength of local law enforcement, corruption perception indices, and the complexity of the supply chain and risk of misrepresentation. Holding an international third-party certification such as FSC or PEFC alone does not provide legal exemption under EUDR; certification functions only as one supplementary element of the risk assessment.
Where a non-negligible risk is identified, operators must carry out risk mitigation measures — such as requesting additional documentation from suppliers, commissioning independent scientific testing (such as DNA or isotope analysis to verify origin), or conducting on-site audits — and must record and retain the results as detailed reports. Placing products on the EU market without adequate risk mitigation measures exposes operators to strict legal consequences, including corrective orders from authorities, customs holds, and fines.