EUDR Compliance About 100 Days Before Launch
The requirements of the EU Deforestation Regulation will apply to large and medium-sized market participants starting December 30, 2026. As of mid-September, that leaves just over 100 days. Microenterprises and small market participants will follow on June 30, 2027.
After several delays and streamlining measures, the timeline now provides a sufficiently robust basis for implementation. Companies must therefore ensure their operational compliance with the EUDR at this time.
Nevertheless, many decision-makers consider their initial situation to be favorable because a large portion of their goods originate from low-risk countries. This assessment can lead to a dangerous misinterpretation. Classification as a low-risk country reduces the number of individual verification steps. However, it does not exempt companies from either collecting data or submitting a due diligence statement.
The key question, therefore, is not how many countries of origin are classified as low risk. What matters is how many relevant goods already have complete geolocation data and reliable proof of legality.
Executive Summary - EUDR Compliance and Low-Risk Countries
- The timeline is now binding: The EUDR will apply to large and medium-sized market participants as of December 30, 2026. Micro-enterprises and small market participants must comply with the requirements as of June 30, 2027.
- Low risk does not mean an exception: For goods from low-risk countries, the risk assessment under Article 10 and the risk mitigation measures under Article 11 may generally be waived. The basic information requirements and the due diligence statement remain in effect.
- The main challenge lies in supply chain data: Companies continue to need geolocation data at the production site level, proof of lawful production, and a traceable link between the product and its origin.
- Country classifications are subject to change: The European Commission’s benchmarking is not permanent. If a country is upgraded from low risk to normal risk, additional due diligence requirements apply.
- These simplifications reduce the administrative burden: annual due diligence declarations, reusable reference numbers, and submission by authorized representatives streamline the process. However, the required data remains unchanged.
- The need for action lies in data management: Robust EUDR compliance is achieved through a standardized data structure for geolocation, proof of legality, suppliers, and the movement of goods. The risk category should merely determine which additional checks are required.
How the EUDR Country Benchmarking Works
The country risk classification is based on European Commission Implementing Regulation (EU) 2025/1093 of May 22, 2025. It assigns producing countries to three risk categories.
The “high-risk” category is intentionally narrow. It includes Belarus, Myanmar, North Korea, and Russia.
By contrast, key countries of origin for agricultural and forestry raw materials fall into the “normal risk” category. These include, among others, Brazil, Indonesia, the Democratic Republic of the Congo, and Malaysia.
About 140 countries are considered low-risk countries. These include all member states of the European Union, as well as the United States, China, and Australia.
For companies, this classification has significant operational implications. According to estimates, about half of the importing market participants can apply a simplified due diligence process based on the origin of their goods.
This simplification does indeed reduce the administrative burden. For relevant goods from low-risk countries, companies may generally waive the risk assessment required under Article 10 and the risk mitigation measures required under Article 11. This is subject to the condition that there is no information available indicating a specific compliance risk.
This eliminates the most analytically challenging part of the testing process. However, the basic data requirements remain in place.
What the Simplified Due Diligence Process Does Not Mean
A simplified due diligence assessment does not constitute an exemption from the EUDR.
Even for goods from low-risk countries, companies must collect and maintain the required information. This includes, in particular,
- Geolocation data for production areas
- Information on the origin of the relevant raw materials and products
- Evidence of lawful production in accordance with the laws of the country of origin
- a traceable link between the product, the supplier, and the production area
- a declaration of due diligence in the EUDR Information System
The declaration of due diligence must be submitted before the product is placed on the market within the European Union or before it is exported.
The general market ban also remains unchanged. A non-compliant product may not be made available on the European market, regardless of the risk classification of its country of origin.
The simplification thus eliminates one level of analytical review. It does not eliminate the data foundation on which EUDR compliance is based.
Why Assuming Low Risk Is Dangerous
The EUDR’s greatest operational challenge often lies not in risk assessment, but in obtaining complete, accurate, and verifiable origin data.
Companies must obtain geolocation data at the production site level and evidence of lawful production across multi-tiered supply chains. At the same time, there is often no direct business relationship with the farms, plantations, or forest areas at the source.
This data collection process is time-consuming and prone to errors. It requires the cooperation of multiple levels of suppliers, and if information is missing, it cannot be obtained on short notice.
Classifying a country as low-risk does not make this task any easier. It merely reduces the additional risk assessment and risk mitigation required.
It is precisely at this point that the approach of sourcing primarily from low-risk countries can lead to a compliance gap. Those who equate low risk with minimal implementation effort may skip certain analytical steps, but they may also start the more demanding data collection process too late.
Why Country Benchmarking Is Not a Reliable Planning Tool
The European Commission determines the risk classification of countries. This classification may be reviewed and adjusted if the underlying data on deforestation changes.
Today’s classification is therefore not a permanent basis for planning.
A company that collects only the minimum information currently required for low-risk countries and does not establish a robust data structure for the affected production areas exposes itself to significant implementation risk.
If a country of origin is reclassified from low risk to normal risk, additional due diligence requirements apply. In a fragmented supply chain, the necessary documentation of origin and supplier data often cannot be obtained within a few days. The process of gathering this information can take several months.
A compliance model based solely on the current country classification optimizes the process for changing classifications. A robust model, on the other hand, is based on the data that is needed on an ongoing basis.
Companies should therefore systematically collect geolocation data and proof of legality for all significant origins of goods. The respective risk category then determines only which additional analyses and measures are necessary.
Your EUDR Expert
Simplification reduces the reporting burden, not the data requirements
The European Commission’s simplification package from May 2026, designated COM(2026) 191, reduces several administrative burdens.
Larger market participants can now submit declarations of due diligence annually rather than for each individual shipment. Reference numbers can be reused throughout the supply chain. In addition, authorized representatives may submit declarations on behalf of a market participant.
The EUDR Information System reopened in June 2026 for the submission of these declarations.
These measures streamline administrative processes. They reduce the number of submissions and simplify the sharing of references throughout the supply chain.
However, they do not reduce the amount of information a company is required to maintain.
Geolocation data for the production areas, proof of lawful production, and a traceable link between the product and its origin will also continue to be required for the annual due diligence statement.
Reporting less frequently does not mean having to know less. The simplification applies to the transmission of information. The technical requirements regarding its quality, completeness, and traceability remain in effect.
Companies that have reduced or postponed their data collection as a result of the simplification package should therefore reconsider this decision.
A Fragile Approach and a More Resilient Approach
A cautious approach initially classifies suppliers and goods according to the current risk category of the country of origin. For each category, only the minimum required information is collected.
In this model, low-risk countries are effectively considered closed. Data collection focuses on countries with normal or high risk.
This approach appears to be efficient in the short term. However, it becomes a risk as soon as a country’s classification changes or a regulatory agency requests additional documentation. Missing geolocation data and proof of legality cannot then be provided on short notice.
The supposed savings merely shift the workload to a later stage, while at the same time increasing time pressure, costs, and compliance risk.
A robust approach defines traceability back to the production site as a key outcome. The current country risk category is then applied as a filter to this data set.
To this end, a standardized supplier data process will be established to collect the following information for all major sources of origin:
- Geolocation data for production areas
- Evidence of lawful production
- Product data and relevant commodity codes
- Suppliers and Subcontractors
- Transactions and Goods Movements
- References to Due Diligence Statements
- Connections Between Products and Production Space
In this model, the country classification determines the extent to which additional risk assessment and risk mitigation must be conducted. It does not determine whether the basic source data is collected.
If a risk category changes, only the analytical review level is adjusted. The necessary data foundation is already in place.
That is the difference between a compliance model that can adapt to regulatory changes and a model that must be rebuilt from scratch every time an adjustment is made.
Recommendations for Action for the Remaining 100 Days
Companies should not use the remaining time primarily to reanalyze country risk categories. What is crucial is a reliable assessment of the data that is actually available.
The following questions should now be answered
For which relevant goods is complete geolocation data available?
Can the data be clearly assigned to the respective production areas?
Is there reliable evidence of lawful production?
Is the link between the product, the supplier, and the production area traceable?
Can the information be submitted in its entirety to the EUDR Information System?
Can missing or incorrect data be systematically returned to suppliers?
Will the process remain functional even if the country classification changes?
The responses provide a much more accurate picture of the actual level of EUDR compliance than the percentage of goods from low-risk countries.
Why Choose Ventum Consulting for EUDR
: Over 1,500 Projects Completed
Large corporations and small and medium-sized businesses rely on our experience because we deliver what we promise—time and time again.
Over 20 Years of Consulting Expertise at
We know the pitfalls and the shortcuts—so you can get where you’re going faster.
100% Dedicated to Your
Business Success
We aren’t satisfied until you are, because it’s the measurable results that count. That’s how we measure our success.
Strategy through
Implementation
Everything from a single source—so there are no gaps between concept and impact that waste time and money.
+1,500 projects completed
Over 20 Years of Consulting Expertise
100% Dedicated to Your Company's Success
Strategy through
Implementation
- Talk directly with subject matter experts—no sales team involved
- Free Assessment of Your Situation and Needs
Schedule a no-obligation initial consultation at now
- Meet the Deadline: Fulfill the Requirements by December 30, 2026
- Transparency: Thoroughly Verify Geolocation Data and Proofs of Legality
- Supply-chain-oriented: Obtaining missing information from suppliers in a targeted manner
- Resilient: Building Compliance Regardless of Country Risk Categories
- Auditable: Unambiguously link goods, suppliers, and production areas
TISAX and ISO certification apply only to the Munich location
Your message
FAQ - Frequently Asked Questions About EUDR Compliance and Low-Risk Countries
The requirements will apply to large and medium-sized market participants starting December 30, 2026. Microenterprises and small market participants will follow on June 30, 2027.
No. Classification as low risk allows for a simplified due diligence process but does not result in an exemption. Disclosure requirements, geolocation data, proof of legality, and the submission of a due diligence statement remain mandatory.
In principle, the risk assessment required under Article 10 and the risk mitigation required under Article 11 may be omitted. However, this applies only as long as there is no information indicating a specific compliance risk.
Companies continue to require information about the product and its origin, geolocation data for production areas, proof of lawful production, and a traceable link between the product and its origin.
The relevant information often has to be obtained across multiple levels of the supply chain. Market participants do not always have a direct relationship with the farm or forestry operation at the source. As a result, missing data usually cannot be supplemented on short notice.
Yes. The European Commission can review and adjust the benchmarking if the underlying data changes. Companies should therefore not base their processes solely on the current classification.
In particular, the package reduces the administrative burden. Among other things, it allows for annual due diligence statements for larger market participants, the reuse of reference numbers within the supply chain, and submissions by authorized representatives.