EUDR risk assessment
Article 10 is the risk assessment. Article 11 follows unless the risk is no or only negligible
Direct answer. Under Regulation (EU) 2023/1115, Article 10(1) says operators verify and analyse the information collected under Article 9 and any other relevant documentation, and on that basis carry out a risk assessment to establish whether there is a risk that the relevant products are non-compliant. Article 10(2) says the assessment shall take into account in particular the criteria in points (a) to (n). Article 11(1) begins: “Except where a risk assessment carried out in accordance with Article 10 reveals that there is no or only a negligible risk that the relevant products are non-compliant, the operator shall, prior to placing the relevant products on the market or exporting them, adopt risk mitigation procedures and measures that are adequate to achieve no or only a negligible risk.” Article 10(4) requires operators to document and review the risk assessments at least on an annual basis. Quotes are the consolidated English text 02023R1115 — EN — 18.09.2026 — 003.001. A consolidation is a documentation tool and has no legal effect. Articles 10, 11 and 13 carry no amendment marker in that file. This page is not legal advice.
EUDR Records Manager (Shopify App Store · Write a review): “Track supplier lots, product links, missing fields, document packs, CSV exports, and audit logs for EUDR record review.” It does not perform or certify a risk assessment.
Related: CRALedger Duty Records — CRA duty records before an Article 14 incident. Does not file ENISA notifications.
Free check first: EUDR product scope check runs in your browser and sends nothing.
Checklist
- Article 10 starts from the information collected under Article 9. This page does not reprint Article 9.
- The criteria are (a) to (n), quoted below. The mapping table after them is a practical note, not an EUDR sentence.
- Article 11 is the mitigation step unless the assessment reveals no or only a negligible risk.
- Low-risk countries and simplified due diligence are Article 13, quoted below, and the benchmarking guide. This page does not list countries.
- Who must comply, and the dates, are operator and trader and scope. This page does not restate dates.
Which text this page quotes
The quotes are the consolidated text of 18 September 2026 (02023R1115 — EN — 18.09.2026 — 003.001). The file says it is a documentation tool and has no legal effect. Its “Amended by” list names Regulation (EU) 2024/3234, Regulation (EU) 2025/2650, and Commission Delegated Regulation (EU) 2026/2102. In the body, amendment markers for Regulation (EU) 2025/2650 sit on other provisions, including Article 2, Article 3, Article 4, Article 5 and Article 9. They do not sit on Article 10, Article 11 or Article 13. The English Official Journal of Regulation (EU) 2025/2650 amends the EUDR and, in the operative text read for this page, does not contain the strings “Article 10”, “Article 11” or “Article 13”. This page therefore quotes Articles 10, 11 and 13 as they stand in the 18 September 2026 consolidation.
Article 10(1), (3) and (4)
Article 10(1): “Operators shall verify and analyse the information collected in accordance with Article 9 and any other relevant documentation. On the basis of that information and documentation, the operators shall carry out a risk assessment to establish whether there is a risk that the relevant products intended to be placed on the market or exported are non-compliant. Operators shall not place the relevant products on the market or export them, except where the risk assessment reveals no or only a negligible risk that the relevant products are non-compliant.”
Article 10(3): “Wood products which fall within the scope of Regulation (EC) No 2173/2005 that are covered by a valid FLEGT license from an operational licensing scheme shall be deemed to comply with Article 3, point (b), of this Regulation.”
Article 10(4): “The operators shall document and review the risk assessments at least on an annual basis and make them available to the competent authorities upon request. Operators shall be able to demonstrate how the information gathered was checked against the risk assessment criteria set out in paragraph 2 and how they determined the degree of risk.”
Article 10(2)(a) to (n)
Article 10(2) opens: “The risk assessment shall take into account, in particular, the following criteria:”
- “(a) the assignment of risk to the relevant country of production or parts thereof in accordance with Article 29;”
- “(b) the presence of forests in the country of production or parts thereof;”
- “(c) the presence of indigenous peoples in the country of production or parts thereof;”
- “(d) the consultation and cooperation in good faith with indigenous peoples in the country of production or parts thereof;”
- “(e) the existence of duly reasoned claims by indigenous peoples based on objective and verifiable information regarding the use or ownership of the area used for the purpose of producing the relevant commodity;”
- “(f) prevalence of deforestation or forest degradation in the country of production or parts thereof;”
- “(g) the source, reliability, validity, and links to other available documentation of the information referred to in Article 9(1);”
- “(h) concerns in relation to the country of production and origin or parts thereof, such as level of corruption, prevalence of document and data falsification, lack of law enforcement, violations of international human rights, armed conflict or presence of sanctions imposed by the UN Security Council or the Council of the European Union;”
- “(i) the complexity of the relevant supply chain and the stage of processing of the relevant products, in particular difficulties in connecting relevant products to the plot of land where the relevant commodities were produced;”
- “(j) the risk of circumvention of this Regulation or of mixing with relevant products of unknown origin or produced in areas where deforestation or forest degradation has occurred or is occurring;”
- “(k) conclusions of the meetings of the Commission expert groups supporting the implementation of this Regulation, as published in the Commission’s expert group register;”
- “(l) substantiated concerns submitted under Article 31, and information on the history of non-compliance of operators or traders along the relevant supply chain with this Regulation;”
- “(m) any information that would point to a risk that the relevant products are non-compliant;”
- “(n) complementary information on compliance with this Regulation, which may include information supplied by certification or other third-party verified schemes, including voluntary schemes recognised by the Commission under Article 30(5) of Directive(EU) 2018/2001 of the European Parliament and of the Council, provided that the information meets the requirements set out in Article 9 of this Regulation.” The consolidation prints “Directive(EU)” without a space. A footnote marker follows “Council”.
Article 11(1)
Article 11(1): “Except where a risk assessment carried out in accordance with Article 10 reveals that there is no or only a negligible risk that the relevant products are non-compliant, the operator shall, prior to placing the relevant products on the market or exporting them, adopt risk mitigation procedures and measures that are adequate to achieve no or only a negligible risk. Such procedures and measures may include any of the following: (a) requiring additional information, data or documents; (b) carrying out independent surveys or audits; (c) taking other measures pertaining to information requirements set out in Article 9.”
The same paragraph continues: “Such procedures and measures may also include supporting compliance with this Regulation by that operator’s suppliers, in particular smallholders, through capacity building and investments.”
Article 13(1): simplified due diligence
Article 13(1): “When placing relevant products on the market or exporting them, operators shall not be required to fulfil the obligations under Articles 10 and 11 where, after having assessed the complexity of the relevant supply chain and the risk of circumvention of this Regulation or the risk of mixing with products of unknown origin or origin in high-risk or standard-risk countries or parts thereof, they have ascertained that all relevant commodities and relevant products have been produced in countries or parts thereof that were classified as low risk in accordance with Article 29. In such cases, the operator shall make available to the competent authority upon request relevant documentation demonstrating that there is a negligible risk of circumvention of this Regulation or of mixing with products of unknown origin or origin in high-risk or standard-risk countries or parts thereof.”
Negligible risk and low-risk countries, beyond that quotation, are Article 29 country benchmarking. This page does not list countries.
Where the evidence usually sits
Practical mapping, not an EUDR statement. The left column repeats the criterion letter. The right column is a filing hint for records a merchant may already keep. It is not a sentence of the Regulation and it is not a template.
| Criterion | Where the evidence usually sits in your records |
|---|---|
| (a) | Country-of-production note on the supplier or lot record, next to whatever Article 29 classification you are using. The country list is not on this page. |
| (b) (c) (d) (e) (f) (h) | Documents you keep about the country or part of the country of production. This page does not say which document satisfies the criterion. |
| (g) | The Article 9 information file for that product, and a note of where each document came from. |
| (i) (j) | Supplier and lot chain, plus the geolocation file if you keep one. Geolocation format is the geolocation guide. |
| (k) (l) (m) (n) | A document pack for outside information you actually hold: expert-group material, substantiated concerns, and any certification papers. A certificate name alone is not point (n). |
Related EUDR pages
The due diligence statement is Annex II fields. Commodities are Annex I. The information system is TRACES. Reference numbers are Article 33. Who is an operator or a trader is Article 2. Dates and who must comply are the scope guide.
What this page is not
- Not a risk-assessment template, an example file, or a third-party tool.
- Not a country list.
- Not a penalty page.
- Not a statement that the app performs or certifies an assessment.
Related pages
- EUDR product scope check
- Country benchmarking
- EUDR scope
- Operator vs trader
- Due diligence statement
- Geolocation
- Annex I commodities
- Information System
- DDS reference number
- Regulation (EU) 2023/1115 — ELI for the act
- Consolidated text of 18 September 2026
- EUDR Records Manager — live App Store listing
- Shopify apps hub
- Tools
Not legal advice. Confirm Articles 10, 11 and 13 on EUR-Lex. The quotes are the consolidated English text of 18 September 2026. The mapping table is a filing hint, not the Regulation. The app tracks supplier lots, product links, missing fields, document packs, CSV exports, and audit logs. It does not perform or certify a risk assessment.