Article 2(26) of Regulation (EU) 2023/1115 (EUDR) defines negligible risk as the conclusion that there is no cause for concern that a commodity or product is non-compliant with Article 3(a) or (b). That conclusion follows a full assessment of product-specific and general information under Article 10, and mitigation under Article 11 where needed. The Guidance Document (Commission Notice C(2026) 4972 final, 13 July 2026) is clear that operators reach this conclusion through due diligence. It is not a label assigned by country of origin, supplier, or certification scheme.

The EUDR applies from 30 December 2026. For micro or small undertakings established by 31 December 2024, it applies from 30 June 2027 (timber already covered by the EU Timber Regulation No 995/2010 (EUTR) excepted). These dates are set by Article 38 EUDR, as amended by Regulation (EU) 2025/2650. The question is what the operator's file must contain for a competent authority to accept a negligible risk conclusion during a check.

What negligible risk actually means under Article 2(26)

Negligible risk is a documented conclusion, not a self-declaration or a risk status attached to a commodity. Under Article 10(1) EUDR, operators must verify and analyse the information collected under Article 9 and carry out a risk assessment to establish whether products are non-compliant. Operators may only place products on the EU market or export them if the assessment shows negligible risk of non-compliance. The compliance file must show the path from raw information to risk reasoning to final conclusion, not a tick box.

The term is distinct from country benchmarking. The Commission FAQ, Version 5 (April 2026), is explicit: the negligible risk element does not apply to commodities as such. Palm oil, rubber, coffee, cocoa or timber from a given country cannot be considered to carry negligible risk on a commodity basis. Supplier assurances, voluntary certifications, and declarations of origin can inform the assessment but cannot replace it. For non-SME operators and traders, the FAQ confirms that a negligible risk conclusion may only be reached as a result of due diligence under Article 4(1), and that due diligence itself is subject to no exemption.

Competent authorities will not accept a conclusion that rests only on supplier promises. During checks, authorities expect to see how the operator moved from Article 9 information to the final determination on each plot and shipment. If that reasoning is missing, the conclusion collapses regardless of what the supplier told the buyer.

{{product-tour-injectable}}

How country benchmarking under Article 29 changes the evidence burden

Following Implementing Regulation (EU) 2025/1093 of 22 May 2025, country benchmarking under Article 29 sets the risk category of the country of production but does not remove the operator's own obligations. Under Article 16 EUDR, competent authorities are to carry out checks for EUDR-compliance covering a differing number of operators based on risk category: at least 1% of operators for low risk, at least 3% for standard risk, and at least 9% for high risk. The classification also triggers simplified due diligence when sourcing from a low-risk country.

Simplified due diligence under Article 13 EUDR is explained on the Commission's Understand Due Diligence page. If all relevant commodities were produced in countries classified as low risk, the operator does not need to continue to steps two and three: risk assessment under Article 10 and risk mitigation under Article 11. The operator must still collect the full Article 9 information set, including geolocation coordinates. A due diligence statement must still be submitted to the Information System. The simplified due diligence process under Article 13 is only available to operators after they assess supply-chain complexity and the risk of circumvention or mixing before relying on the simplified route.

Simplified does not mean waived. The same guidance notes that if the operator cannot collect the required information, it must not place the product on the EU market or export it. If risk indicators appear, such as a complex intermediary chain, the simplified route no longer applies and full Article 10 risk assessment is required. The benchmarking process is dynamic, and will be reviewed and updated as often as necessary in light of new evidence (Article 29(2)). An operator built around a particular country's low-risk status needs to be ready to switch to full due diligence if that status changes.

The Article 10 risk factors that must be addressed before concluding negligible risk

Before concluding negligible risk, operators must work through each risk assessment criterion in Article 10(2) EUDR. The list includes the country of production's risk assignment under Article 29, the presence of forests, the presence of and consultation with indigenous peoples, the complexity of the supply chain, and the risk of circumvention or mixing with products of unknown origin. The Guidance Document stresses that supply chain complexity increases with the number of processors and intermediaries between the plot of land in the country of production and the operator.

A clean satellite image for a single plot is not sufficient on its own. If the plot is in a region of high deforestation pressure, the broader Article 10(2) factors apply. The same is true where a shipment aggregates product from many smallholders with uneven traceability. The operator must show how each concern was addressed before a negligible risk conclusion can hold.

Substantiated concerns from third parties also feed the assessment, under Article 31 EUDR. When a substantiated concern arises, non-SME downstream operators and traders must confirm due diligence was done and risk was negligible before selling the product. A concern raised through the complaints channel, by an NGO or by a buyer, must be addressed in the risk file. Leaving it unanswered is grounds for a non-negligible finding.

The Guidance Document is also direct about information gaps. Unidentified steps in the supply chain, or any finding that indicates non-compliance, can lead to the conclusion that risk is non-negligible. If an operator cannot name the intermediary between the plot and the port, that unknown step is a reason the file does not support a negligible risk conclusion.

Documentation that proves the negligible risk conclusion to competent authorities

The evidence file must demonstrate that each stage of due diligence was completed and that the conclusion rests on verified information. As stipulated in Article 8(2), due diligence consists of information collection, risk assessment measures and risk mitigation measures under Articles 9 to 11. The file should mirror that structure.

The Article 9 information set covers six items: product description and quantity, country of production, geolocation coordinates for every plot, supplier and buyer details, and evidence that the products are deforestation-free, alongside legality evidence under the country of production's laws. All of this information must be kept and made available to competent authorities upon request.

A defensible risk file typically contains:

• Plot-level geolocation data and the date of production or harvest.
• Forest-cover evidence for each geolocated plot, drawn from satellite data or equivalent verified sources.
• Legality evidence under the laws of the country of production, referenced to the specific laws relied on.
• Supplier identification and chain-of-custody records covering every intermediary between the plot and the operator.
• A written record of the Article 10(2) risk assessment, naming the sources used and the reasoning behind the conclusion.
• Evidence of any mitigation measures taken under Article 11, where risk was reduced to negligible rather than being negligible from the outset.
• Logs of substantiated concerns received and the operator's response.

The Guidance Document is clear that mitigation measures under Article 11 must be adopted unless the Article 10 assessment concludes that risk is no more than negligible. An absence of mitigation steps is only acceptable where the Article 10 reasoning expressly supports it. For operational detail on what inspectors will look for, Coolset's EUDR compliance checklist for December 2026 enforcement walks through the file structure most likely to withstand a check.

{{custom-cta}}

Where operators most often fail the negligible risk test

The most common failure is treating a certification scheme as a substitute for due diligence. The FAQ confirms that certifications may inform the assessment but cannot replace the operator's own analysis under Article 10. A buyer who cites certification as the only evidence in a due diligence statement has not met the regulation's due diligence requirement. The negligible risk conclusion belongs to the operator, and the file has to show the operator's own reasoning.

A second recurring failure is relying on supplier declarations without verifying geolocation coordinates against independent deforestation data. A declaration that a plot was not deforested is not evidence. The Guidance Document treats unidentified supply chain steps and unresolved findings of non-compliance as triggers for a non-negligible conclusion. An operator who accepts coordinates without checking them is exposed as soon as satellite data is cross-referenced during a check.

A third failure involves mixed shipments and aggregated supply chains. If some plots lack individual geolocation, that portion of the shipment fails the Article 9 requirement. The mixing risk with products of unknown origin under Article 10(2)(j) also applies. Coolset's deep dive on mixing and circumvention risk covers how cooperatives and processors should structure traceability so that negligible risk remains defensible.

A fourth failure concerns downstream operators and traders who assume they have no assessment duty, contrary to their actual obligation to be able to prove prior due diligence and confirmed negligible risk as discussed above. A downstream operator that ignores a credible complaint is non-compliant even where its direct supplier submitted a due diligence statement.

A final failure is the stale file. Risk assessments are not one-time events. If a new deforestation alert appears on a previously cleared plot, or if a country’s risk category changes, the file must be updated and the simplified route may no longer apply. Coolset's guide to EUDR audit pitfalls links these failure patterns to the specific document gaps that attract enforcement.

How to build a defensible negligible risk file

A defensible file is organized by plot, not by shipment or supplier. Each geolocated plot carries its own Article 9 information, its own Article 10(2) assessment with named sources, and a traceable chain back to the operator through every intermediary. Where mitigation under Article 11 was applied to reach a negligible conclusion, that reasoning is stored with the plot record in the same file. Start by restructuring the file around the plot: without that foundation, no negligible risk conclusion is defensible in a check. Coolset's overview on EUDR operator obligations before December 2026 shows how the full obligation framework fits that file structure.

Frequently asked questions

Can a product from a low-risk country automatically be treated as negligible risk?

No. The Commission FAQ confirms that there is no risk status per commodity and no automatic negligible risk based on country of origin. Sourcing from a low-risk country allows the operator to apply simplified due diligence (Article 13), meaning the risk assessment and mitigation steps can be skipped, but Article 9 information collection and geolocation obligations still apply.

Does a certification scheme such as FSC or RSPO prove negligible risk?

No. Certifications may inform the operator's assessment but cannot replace it. The negligible risk conclusion must be reached by the operator through its own due diligence under Article 4(1), based on Article 9 information and the Article 10(2) risk criteria. A due diligence statement that cites certification as the sole basis of compliance is not consistent with the regulation.

What triggers a non-negligible risk conclusion?

The Guidance Document identifies two main triggers: unidentified steps in the supply chain, and any finding indicating non-compliance. Supply chain complexity, substantiated concerns raised by third parties, and risk of mixing with products of unknown origin under Article 10(2)(j) will each push a file toward non-negligible unless the operator can show how the concern was closed out.

Do downstream operators and traders need to reach their own negligible risk conclusion?

Under Articles 4 and 5, non-SME downstream operators and traders must, in cases of substantiated concern, verify that due diligence was exercised and that no or only a negligible risk was found before placing products on the market. They do not restart Article 10 from scratch for every shipment, but they cannot ignore credible concerns and must be able to show they acted on them.

How should the negligible risk evidence file be retained?

Records tied to a due diligence statement must be retained for five years and made available to competent authorities on request. The file should cover the full Article 9 information set, the Article 10 risk assessment, any Article 11 mitigation, and any logged concerns and responses, for each due diligence statement submitted to the Information System.

‍