Sourcing only from low-risk countries cuts EUDR risk assessment, not geolocation or the due diligence statement. Here's what simplified due diligence keeps.
A timber importer in Rotterdam buys spruce lumber from three sawmills in British Columbia. Canada is classified as low risk under the EU Deforestation Regulation. So when the compliance question came up at the management meeting, the answer was quick: low risk, simplified due diligence, nothing much to do.
Half of that is right. The importer can skip two of the three steps of due diligence. It still needs the geolocation of every forest plot the timber came from, evidence that the harvest was legal, a due diligence statement before each placing on the market, and a reference number for customs. That's most of the work, and it's the part that depends on suppliers.
Short answer: Sourcing only from low-risk countries lets an operator skip the risk assessment and risk mitigation steps of EUDR due diligence. It doesn't remove the information requirements, including plot geolocation and legality evidence, the due diligence statement or record keeping. And the operator must switch back to full due diligence if it learns of any risk.
Under Article 29 of the regulation, the Commission classifies countries, or parts of them, as low, standard or high risk for producing commodities linked to deforestation. The first list came in Implementing Regulation (EU) 2025/1093, adopted on 22 May 2025.
The list is not fixed. The Commission has said it intends to review the classification in 2026, drawing on updated forest data, and any country can move between tiers. A move from low to standard risk would take an operator out of simplified due diligence for that origin overnight.
Short answer: Two things. Under Article 13, an operator that has established that all its relevant products were produced in low-risk countries doesn't have to carry out a formal risk assessment (Article 10) or risk mitigation (Article 11).
Full EUDR due diligence has three steps: collect information, assess risk, mitigate risk. For standard and high-risk origins, the second and third steps are where much of the analytical work sits. That means weighing deforestation patterns in the region, the presence of indigenous peoples, corruption indicators, supply chain complexity and certification, then commissioning extra checks or audits where the risk isn't negligible.
Low-risk sourcing takes that middle out. It's a real saving. It just isn't the saving most people assume.
Short answer: Everything else. Simplified due diligence still requires the full information package, a due diligence statement for every placing on the market, and records for five years.
Competent authorities will still check. Each member state must check at least 1% of operators sourcing from low-risk origins every year. A check looks at the due diligence system and the records behind specific statements, and it can include satellite imagery of the declared plots.
For the Rotterdam importer, the practical difference between low risk and standard risk is a risk report it no longer has to write. The plot data from British Columbia is needed either way.
Simplified due diligence is all or nothing for a given product. A plywood panel made in a low-risk country with a tropical hardwood face veneer from a standard-risk origin needs full due diligence. So does a chocolate bar with cocoa from Ecuador or Côte d’Ivoire, both standard risk, or a cattle feed that includes soy of mixed origin. The question is never "where is my supplier?". It's "where was every relevant commodity in this product grown?".
Goods can pass through a low-risk country without being produced there. Timber cut in a standard-risk country and processed in a low-risk one keeps its country of production. Operators using simplified due diligence are expected to consider the risk of mixing with products of unknown or higher-risk origin, and the risk that a supply chain is routing goods to avoid scrutiny. Long or opaque chains with traders in the middle are where this tends to happen.
Country benchmarking reflects deforestation risk. It says nothing about whether a specific harvest had a valid permit, respected land tenure or met labor rules. EUDR requires products to be both deforestation-free and legally produced, and simplified due diligence doesn't change the second test. Harvest permits, concession documents and land titles still have to be collected.
The first list is from May 2025 and a review is expected. If a sourcing country moves to standard risk, every product from it needs full due diligence from that point. Operators building their process around simplification should build the risk assessment step anyway, even if it sits unused for now.
Within the EU, the operator is usually whoever first places the commodity on the market: the forest owner selling logs, the farmer selling soy, the farm selling cattle. A sawmill or feed mill buying from them is often a downstream operator, with record-keeping duties and no statement to file. The reverse also happens: a company importing from a low-risk country outside the EU is the operator, and the simplification doesn't change that. Getting the role right comes before getting the risk level right. See more about the right roles in our recent article.
There's one more simplification that only exists in low-risk countries. Micro and small companies, and individuals, established in a low-risk country and selling what they grew, harvested or raised themselves can file a one-time simplified declaration instead of a statement per shipment. They can give postal addresses instead of coordinates. Where a national database already holds the information, as with EU cattle registers, they may not need to file at all once the member state shares the data.
For a small Finnish forest owner or a family beef farm in Ireland, that changes the workload substantially. For a company buying from them, it changes what arrives with the goods: a declaration identifier instead of a due diligence statement reference number. Both need to be collected and kept.
- What is simplified due diligence under EUDR? It's the regime in Article 13 for operators whose relevant products all come from countries classified as low risk. They don't have to carry out risk assessment or risk mitigation, but they must still collect all required information and file a due diligence statement.
- Do I need geolocation if I source from a low-risk country? Yes. Plot geolocation is part of the information every operator must collect under Article 9, whatever the risk level of the country. Only micro and small primary operators selling their own production can use postal addresses instead.
- Are EU countries low risk under EUDR? Yes. Every EU member state is classified as low risk in Implementing Regulation (EU) 2025/1093. Operators placing EU-produced commodities on the market can use simplified due diligence but still need plot geolocation and a due diligence statement.
- Which countries are high risk under EUDR? Four: Belarus, Myanmar, North Korea and Russia. Around fifty countries, including Brazil and Indonesia, are standard risk. Most other countries are low risk. The Commission plans to review the list.
- What happens if a product contains inputs from a standard-risk country? Simplified due diligence no longer applies to that product. The operator must carry out the full risk assessment and, where needed, risk mitigation for it.
- Does low risk mean fewer inspections? Fewer, not none. Member states must check at least 1% of operators sourcing from low-risk origins each year, compared with 3% for standard risk and 9% for high risk.
The low-risk classification rewards something real: countries with strong forest governance and little recent deforestation. It's reasonable that importers from those countries shouldn't have to write a risk report for every shipment.
But the part of EUDR that takes time was never the risk report. It's getting suppliers to provide plot coordinates they've never been asked for, checking those plots, and collecting legality documents from people several steps up the chain. Low-risk sourcing doesn't touch any of that. The companies that read "simplified" as "optional" will find out in January, when their first statement needs geolocation they don't have.
If your supply chain is entirely low risk, you're in the best position under EUDR. Use it to get the data right, not to postpone collecting it.
If you'd like to check how much of your supply chain qualifies, our free EUDR assessment works through your products, origins and suppliers in one call. Book a slot now.
Orbify monitors vegetation threats, climate risks, and infrastructure changes across your entire network — so you can prevent outages, optimize maintenance, and stay compliant.
Start with a 4-week pilot on your priority corridors. No enterprise contracts. No multi-month implementations. Just results you can verify against field data.
