Introduction

The European Union’s Deforestation Regulation (EUDR) was adopted in 2023 and enters into application by the end of 2025. The EUDR is designed to stop products linked to deforestation from entering the EU market by requiring companies to trace their supply chains and prove legality and sustainability. 

To make this process more targeted, the EU introduced a risk benchmarking system that classifies countries as low, standard, or high risk based on deforestation levels and governance indicators. This classification directly influences the level of due diligence companies must perform. Products from low-risk countries are eligible for simplified due diligence, while those from standard-risk countries require a full due diligence process. In theory, high-risk countries would face even stricter requirements - but in practice, no high-risk country currently qualifies for legal imports under the EUDR, as all are subject to broader EU sanctions. This means companies are effectively dealing with either low- or standard-risk jurisdictions.

With the EU’s benchmarking list released in May 2025 and the application deadline fast approaching, companies must rapidly assess how these classifications affect their compliance strategy. This article breaks down EUDR due diligence for low-risk countries, clarifying what the ‘simplified’ due diligence involves, and what remains the same. It will explain differences for SMEs and non-SMEs, and address special cases such as mixed-origin goods. By the end, you will have a clear picture of how to adjust your EUDR compliance strategy to the risk benchmark of your source countries. 

What the EUDR regulates - at a glance

The EU Deforestation Regulation (EUDR) applies to a set of seven regulated commodities, whose production is strongly associated with deforestation. The regulation identifies seven primary commodities, as well as certain products that contain or are derived from them. These are referred to as the “relevant commodities”:

• Cattle (including beef, leather, and other by-products)
• Palm oil (including palm derivatives such as oleochemicals)
• Soy (used heavily in animal feed, as well as soy oil)
• Wood (logs, sawn wood, pulp, paper, furniture, etc.)
• Cocoa (used in chocolate and cocoa-based products)
• Coffee (green coffee beans, roasted coffee, instant coffee, coffee-based beverages)
• Rubber (only natural rubber from Hevea brasiliensis, or products derived from natural rubber are in scope - not synthetic rubber)

The full list of in-scope products can be found in Annex I of the regulation, and the EU may expand it over time. 

What EUDR aims to do, in essence, is prohibit the ability to place these products on the EU market - or export them - unless they are:

1. Proven to be “deforestation-free” and
2. Legally produced in line with the laws of the country of origin

It does so by requiring companies to complete due diligence for each of the relevant products that is imported into, traded within, or exported out of the EU. The due diligence process varies depending on the risk benchmark of the source country.

{{eudr-tool-injectable}}

Understanding the country risk benchmark

The EUDR’s country benchmarking system categorises each producer country as low-risk, standard-risk, or high-risk based on the likelihood that its commodities are associated with deforestation or illegal land use. The country benchmarking system is based upon data-driven criteria laid out in the official EUDR regulation.

The assessment criteria considers the current rate of deforestation in the country, the rate of expansion of agricultural land for relevant commodities, and production trends of relevant commodities. It supports this assessment with other factors such as local law enforcement, protections for indigenous peoples, and accordance with laws such as the Paris Agreement. This Commission Staff Working Document outlines the principles underlying the  methodology, aiming to ensure transparency, objectivity and consistency.

The risk-benchmark list has received widespread criticism since their release in May 2025, with environmental groups and NGOs criticizing the benchmarks for overlooking critical factors such as governance quality and corruption levels. For instance, countries like Brazil and the Democratic Republic of Congo, known for high deforestation rates, were not labeled as high risk. However, the Commission maintains their methodology is firmly rooted in a commitment to fairness, objectivity and transparency.

It’s important to note that the benchmarking list is dynamic. The Commission will review and update the list periodically – with the first review scheduled for 2026 once new global forest data has become available.

Why does the risk classification matter?

The risk level assigned to the source country adjusts how both companies and enforcement authorities allocate their due diligence efforts. The EUDR mandates that EU Member State authorities ramp up compliance checks for higher-risk origins and can dial them down for low-risk sources. This allows regulators to focus on shipments where problems are more likely, easing the administrative load for low-risk country imports.

From a company’s perspective, the goal of the benchmarking system is to reward sustainable sourcing countries with a lighter tough, whilst pushing others to improve. In theory, if a producer country improves its deforestation track record, it may earn low-risk status (making life easier for importers sourcing there). Article 30 of the EUDR documentation also highlights how the EU and interested Member States will work proactively with producer countries to help them meet EUDR standards and improve their risk classification over time. This cooperative approach is crucial, especially for countries with large smallholder populations or limited technical capacity, ensuring they are not excluded from EU markets due to systemic challenges.

However, this does not mean there is total exemption from due diligence for those sourcing from low-risk countries. The reduction in due diligence exempts those sourcing from low-risk countries from completing a risk assessment (Article 10) or risk mitigation (Article 11) steps. That is, provided there have been no ‘substantiated concerns’ of deforestation or illegality. Those sourcing from low-risk countries are still required to provide product traceability information and legality checks. 

Another factor that the risk benchmark impacts is the compliance checks - an inspection conducted to verify that an operator/trader has fulfilled their legal obligations under the EUDR. These checks will cover at least 9% of the relevant products placed on or exported from the market that originate in high-risk countries, 3% for standard-risk countries, and 1% for low-risk countries. It is important to note the unit being checked is the operator/trader, not the production plot itself, however it may include indirect validation of plot data.

A compliance check focuses on verifying the due diligence of a company. This may include: reviewing the submitted due diligence statement, auditing documentation, checking traceability, verifying claims and inspecting shipments. 

What simplified due diligence actually looks like

One of the biggest perks of sourcing from an EUDR low-risk country is access to a simplified due diligence procedure. However, this does not mean no due diligence procedure, as many of the basic obligations remain.

Under EUDR, for each batch or shipment, you must gather key data regardless of source country risk benchmark. This includes:

• Geolocation coordinates of the farm/plot
• Basic information of suppliers (names, address etc.)
• The commodity type and quantity
• Proof of no deforestation
• Proof of legality
• Submitting a due diligence statement (DDS)

In short, for every batch or shipment, information listed under Article 9 of the official EUDR documentation must be collected, and kept for 5 years.

However, the major change for low-risk country imports is that the EUDR does not require you to conduct a formal risk assessment (Article 10) or take proactive risk mitigation (Article 11) measures. In other words, if all components of a product come from low-risk areas, you are not obliged to actively assess or address risks - unless you receive new information that suggests a potential problem. Under the regulation, companies normally must analyze factors like recent deforestation rates, corruption, supply chain complexity and enforcement in the origin country and determine if there’s more than a negligible risk their goods came from deforested land. If the country is officially low-risk, this step is essentially bypassed: the EU has pre-judged the risk to be minimal.

Some exceptions from simplified due diligence

There are a couple of circumstances in which simplified due diligence is not applicable, even when the product is sourced from a low-risk country. For example, if you receive a ‘substantiated concern’ - a formal alert or complaint alleging that a company may be violating the EUDR’s requirements - you must respond and reassess the risk of deforestation through a full risk assessment and, if needed, apply mitigation measures. In short, even when sourcing from a low-risk country, a substantiated concern overrides the simplified due diligence path.

Another instance where simplified due diligence does not apply is when there is a risk that products from a low-risk country are mixed with those from standard- or high-risk countries. For example, if you are sourcing bulk rubber or cocoa that has passed through a shared storage or aggregation point, and you are unable to definitively trace which portion came from which country, then you must treat the entire batch as if it came from the highest-risk source. In these cases, full due diligence requirements apply to the whole shipment.

Who qualifies - and what roles are affected

​The EUDR applies to both SME and non-SME companies, but responsibilities vary depending on your role in the supply chain. 

For operators, whether SME or not, full due diligence is required if you are first-in-line (upstream). This includes data collection, traceability, and submission of a due diligence statement (DDS). If sourcing from a low-risk country, operators can skip the risk assessment and mitigation steps - but they still need to collect all required information and submit the DDS. 

For downstream operators, a helpful allowance has been made. If an operator is further down the supply chain and due diligence has already been completed, the downstream operator is allowed to pass on the reference number of a previous DDS, instead of exercising due diligence themselves. For SMEs, they are able to pass along an existing DDS, whilst non-SMEs must confirm that DD was exercised correctly (through a supplier maturity assessment) before referencing the DDS. Find more detail on this here. 

Traders’ responsibilities also vary with their size, and position in the supply chain. Non-SME traders are effectively treated as a non-SME operator. They too must collect due diligence and submit a DDS. If the non-SME trader is downstream, they may reference the upstream DDS if they can ascertain the upstream supplier has conducted proper due diligence. This due diligence, if the product is coming from a low-risk country, will include only general information, not the risk assessment and mitigation. 

For SME traders, there are lighter obligations; they can rely on the upstream operators DDS and simply maintain a record of it. 

Upstream roles (first placers) carry the highest burden, especially when sourcing from standard- or high-risk regions. Traders may have simpler obligations, but must still maintain traceability and ensure they don’t handle non-compliant goods.

Grey zones and special cases to watch for

EUDR compliance becomes more complex when products originate from mixed-risk regions. If a batch or shipment includes commodities sourced from both low-risk and standard- or high-risk countries, each component must be treated according to the risk classification of its origin. For example, in a shipment of coffee-flavoured chocolate bars where the coffee comes from a low-risk country and the cocoa from a standard-risk country, each ingredient must be assessed separately: the coffee is eligible for simplified due diligence, while the cocoa must undergo full due diligence including risk assessment and mitigation.

A further grey zone arises when the origin of the raw materials cannot be disaggregated. For instance, a factory may aggregate palm fruit from multiple countries in large collection bins, making it impossible to distinguish between low- and high-risk origins. In such cases, companies must either change their operational practices to enable traceability - such as segregating sources - or, more realistically, treat the entire shipment as if it were from a higher-risk origin. This means conducting full due diligence on the entire batch and potentially over-declaring risk in order to remain compliant.

Another complexity is the dynamic nature of the EU’s benchmarking system. Country risk classifications are not static; a country may be downgraded from low-risk to standard- or high-risk if new deforestation or governance data emerges. When such reclassifications occur, all future imports from that country must follow the updated, more stringent due diligence requirements. Companies should therefore regularly monitor EU updates and be prepared to rapidly adjust their compliance procedures.

Finally, re-exported goods can raise traceability issues. If a commodity is shipped from a low-risk country but produced elsewhere, its risk status depends on the original country of production, not the country of export. You must be able to trace the product back to its actual point of origin - not just the last place it was handled. These special cases make it essential to maintain clear, verifiable documentation throughout the entire supply chain.

What this means for your compliance plan

Sourcing from a low-risk country may simplify your EUDR obligations, but it’s not a shortcut to compliance. You’re still responsible for collecting full supply chain data, including geolocation, production dates, proof of the plot being deforestation-free and legality documents. Low-risk status only removes the need to conduct formal risk assessments and mitigation - but does not eliminate traceability, documentation, or DDS requirements.

his means you still need to coordinate closely with suppliers to ensure they can provide the required information at the product or plot level. If you’re working with multiple suppliers or mixed-origin batches, make sure your compliance team can track which inputs qualify for simplified due diligence and which do not.

It’s important to remember that you remain legally responsible if a compliance violation occurs - regardless of whether the product was sourced from a low-risk or standard-risk country. It is always safer to adopt a proactive, conservative approach to due diligence than to be caught unprepared by a non-compliance finding.

Coolset’s EUDR product for supply chain compliance

Coolset’s EUDR product helps streamline this process. Our platform helps companies collect the right data, check for deforestation risk, and file Due Diligence Statements without chasing suppliers or working in complex spreadsheets.

With Coolset, companies can import product and order data from your ERP, request documents from suppliers, and track everything in one place. The system flags missing or at-risk shipments and generates audit-ready DDS files that follow the mandatory EU TRACES format. You’ll always know what level of compliance is required and what information is missing.

The product launches in August 2025. Join the waitlist here.

In short: low-risk means fewer steps, not less responsibility. An efficient compliance plan must still include traceability tools, document workflows, and real-time benchmarking logic to stay aligned with evolving EUDR rules.

FAQ: Due diligence for low-risk countries

Do I still need to submit a DDS for low-risk countries?

Yes. The EUDR requires a due diligence statement (DDS) for every shipment, regardless of the country’s risk classification. Low-risk status does not exempt you from this filing.

What happens if a low-risk country is downgraded?

If the European Commission reclassifies a country as standard- or high-risk, you must begin conducting risk assessments and mitigation for future shipments from that origin. Your due diligence workflow must adapt immediately.

What documents are still required for low-risk countries?

You must collect all core documentation: geolocation coordinates, production or harvest dates, supplier details, and proof of deforestation-free production and legal compliance. This information must be retained for at least five years.

Are SME operators treated differently?

Yes. SME operators still need to comply, but they benefit from simplified procedures - such as no requirement for annual audits or a designated compliance officer. If an SME is downstream, it can often rely on the DDS from an upstream operator rather than conducting full due diligence itself.

Yes. SME operators are still required to comply with the EUDR, but they benefit from simplified obligations. For example, SMEs are not required to appoint a designated compliance officer or conduct annual audits. Additionally, downstream SMEs do not need to submit a due diligence statement (DDS) themselves, they can simply pass along the reference number of the existing upstream DDS. If the SME is first in line, then they must exercise due diligence and submit the DDS as normal.

Regarding benchmarking simplifications, SMEs are treated the same as non-SMEs: if an SME is required to perform full due diligence on a product from a low-risk country, it can skip the risk assessment and risk mitigation steps - just as a larger company could.