The Article 10 risk assessment: from fourteen factors to a determination
Fourteen prescribed factors, resolved into one documented determination: is the risk that this product is non-compliant negligible, or not? If it is not, you mitigate until it is, or you do not sell.
Updated 31 July 2026, 4 min read
Where it sits
Due diligence has three steps: collect information under Article 9, assess risk under Article 10, mitigate under Article 11. The assessment is the middle step, and it is the one that turns a pile of data into a defensible position. You skip it only where simplified due diligence applies, production in a low-risk country, with no complexity or risk of circumvention in the chain.
The fourteen factors
Article 10(2) lists the criteria you must take into account. They fall into four natural groups.
| Group | What you must consider |
|---|---|
| Country and place | The risk classification assigned to the country or region of production · whether forests are present · whether indigenous peoples are present · whether there has been consultation and cooperation in good faith with indigenous peoples · whether land-tenure claims by indigenous peoples exist · prevalence of deforestation or forest degradation in the area |
| Governance | Prevalence of corruption, document and data falsification, lack of law enforcement, armed conflict or sanctions · whether relevant legislation is enforced in the country of production |
| Your information | Reliability, validity and links between the pieces of information you hold · concerns about the country of production and its supply chains, including substantiated concerns submitted to you · conclusions of the Commission's expert group |
| Chain structure | Complexity of the supply chain and the stage of processing · difficulty in connecting products to the plot where they were produced · risk of mixing with products of unknown origin or from non-compliant areas · risk of circumvention of the regulation |
These are not a scorecard. The regulation does not weight the factors or set a passing score. Some are decisive on their own, an unresolved indigenous land-tenure claim over your plot is not offset by a clean satellite screen. The assessment is a reasoned judgement you have to record, not an average you calculate.
What "negligible risk" means
The threshold is that, after a full assessment of the product-specific and general information, there is no cause for concern that the product is non-compliant. That is a demanding standard, and deliberately so. It is not "on balance compliant", not "reasonable effort made", and not "no evidence of a problem".
Two practical consequences follow. Absence of information is not the same as absence of risk, a supply chain you cannot see into is a supply chain you cannot conclude is negligible. And an unresolved satellite alert is by definition a cause for concern until you have resolved it, so investigate flagged plots rather than filing around them.
Article 11: mitigation
Where risk is more than negligible, you take measures to bring it down before placing the product. The regulation offers examples, and they are the ones that work in practice:
- Require additional information: documents, data, plot-level detail your supplier did not initially provide.
- Commission independent surveys or audits: including field verification where remote evidence is inconclusive.
- Support supplier capability: particularly with smallholders, where the gap is usually capacity rather than willingness.
- Improve your own systems: better traceability, segregation at bulking points, tighter contractual data requirements.
You also need the institutional side: a documented risk management policy, controls to verify it is followed, an independent audit function for non-SMEs, and an annual review of the whole system.
Mitigation has an endpoint, and it can be "no". If you cannot get to negligible risk, you cannot place the product. This is the part most easily lost in a process diagram. Article 11 is not a procedure that always terminates in a filing, sometimes the correct output is that a lot does not go to the EU.
What a defensible determination looks like
An inspector is not assessing whether your conclusion was right in hindsight. They are assessing whether you did the work and can show it. A determination that survives contact with a competent authority has five things:
- Each factor addressed explicitly, including the ones that were obviously not applicable, "no indigenous peoples present in this region, per [source]" is a finding; silence is a gap.
- Sources named and dated. Which dataset, which report, which supplier communication, when.
- Disagreements resolved on the record. Where two datasets conflicted, what you concluded and why.
- A stated conclusion, with the person and date attached to it.
- Mitigation traced through, where it was needed, what you asked for, what came back, and what changed as a result.
The recurring failure is a correct conclusion with no visible reasoning. Teams do genuinely careful work in email threads and spreadsheets, reach the right answer, and then cannot reconstruct it eighteen months later when someone asks. The record is the deliverable.
Reassessment
The assessment is not a one-time exercise. It has to be reviewed at least annually, and updated whenever something material changes, a new supplier, a new origin, a country reclassified, a substantiated concern submitted to you, or new information about a plot you already source from. A country moving from low to standard risk retrospectively invalidates the simplified route you relied on.
Related
Sources
Every claim on this page is drawn from Regulation (EU) 2023/1115 as amended, the Commission’s guidance and FAQ, and the implementing and delegated acts. Read the consolidated text on EUR-Lex.
Konstata is compliance software, not legal advice. Verify obligations against the consolidated EUDR text on EUR-Lex.
Doing the work