Low, standard or high risk: what EUDR country benchmarking means for your coffee and cocoa.

Last updated: 23 August 2026

What benchmarking is, and what it measures

Country benchmarking is the EU’s way of pointing enforcement and due-diligence effort where deforestation risk is highest. Under Article 29 of Regulation (EU) 2023/1115, the Commission assesses each country (or a region within it) and assigns it a risk level. That level then feeds into your risk assessment as an operator and into how intensively competent authorities check shipments from that origin.

One thing to be precise about from the start: benchmarking measures deforestation risk only. Article 29 classifies countries by the risk of producing commodities that are not deforestation-free, Article 3, point (a). It says nothing about the legality leg, Article 3(b). So a country’s tier tells you something about one half of compliance and nothing about the other.

A risk tier is an input to your due diligence, not a verdict on your consignment. It shifts how much work is expected of you; it never does the work for you.

The three tiers, defined

Article 29(1) sets out a three-tier system and defines each category precisely. The wording repays a close read, because “low risk” is a higher bar than it sounds:

• High risk: countries where the assessment identifies a high risk of producing commodities that are not deforestation-free.
• Low risk: countries where the assessment concludes there is “sufficient assurance that instances” of non-compliant production are exceptional. Not merely better than average. Exceptional.
• Standard risk. The residual category: “countries… which do not fall in either the category ‘high risk’ or the category ‘low risk’.”

That residual definition matters more than any list, because of how the system was switched on. Article 29(2) provides that, on entry into force, every country started at standard risk, and the Commission then classifies only the low-risk and high-risk outliers by implementing act. The confirmation is explicit in the first list: “A standard level shall be maintained for all countries not listed in the Annex.”

If your origin is not named on the low-risk or high-risk list, it is standard risk by default. Standard is the baseline the whole regulation is built around, not an exception.

How a country gets its tier

The classification is not a vibe or a reputation score. Article 29(3) says it rests primarily on three quantitative criteria:

• the rate of deforestation and forest degradation;
• the rate of expansion of agricultural land for the relevant commodities;
• production trends of the relevant commodities and products.

Article 29(4) lets the assessment also weigh qualitative factors: a country’s climate commitments, agreements with the EU, whether it has and enforces laws against deforestation, how transparently it publishes data and protects the rights of indigenous peoples and local communities, and any UN or EU sanctions. In practice the Commission has leaned on internationally recognised data, above all the FAO’s Global Forest Resources Assessment. The upshot: tiers reflect national forest data, not the conduct of any individual farm or exporter you buy from.

Where the coffee and cocoa origins fall

The first list was adopted as Commission Implementing Regulation (EU) 2025/1093 of 22 May 2025. Read for our commodities, it tells a clear story.

Only four countries are high risk: Belarus, North Korea, Myanmar and Russia. None is a major coffee or cocoa origin, so high-risk sourcing is uncommon for our commodities, though not impossible: Myanmar, for one, has a small specialty-coffee sector. If any of your beans do come from Belarus, North Korea, Myanmar or Russia, treat that origin as high risk and expect the enhanced scrutiny that comes with it.

The largest origins are standard risk. Because standard is the residual tier, an origin is standard simply by not appearing on the low-risk list, and most of the biggest ones don’t. On the coffee side that means Brazil, Colombia, Peru, Ethiopia, Honduras, Guatemala, Nicaragua, Mexico, Uganda, Tanzania and Indonesia are all standard risk. On cocoa, so are Côte d’Ivoire, Nigeria, Cameroon and Ecuador. The world’s number-one coffee origin (Brazil) and its number-one cocoa origin (Côte d’Ivoire) are both standard: the full due-diligence path applies to them in the ordinary way.

A meaningful set of origins is low risk. The low-risk Annex (around 140 countries) does include several real coffee and cocoa producers, among them Vietnam, India, China, Ghana, Kenya, Costa Rica, the Dominican Republic, Papua New Guinea, São Tomé and Príncipe, Madagascar, Togo, the Philippines and Sri Lanka (the list is not exhaustive). If you buy from one of these, the simplified due-diligence route is open to you, with the important limits set out below.

Ghana is low risk; Côte d’Ivoire, the larger cocoa origin next door, is standard. Vietnam is low; Brazil is standard. Two neighbouring or comparable origins can sit in different tiers, so check your specific country rather than assuming from the region.

A caution on precision: this is a per-country reading of the first Annex as published, and the Commission can benchmark parts of a country differently from the whole. Treat the groupings above as the current national picture, and confirm your exact origin against the live list, which is exactly the kind of check we keep current for the origins our clients actually buy from.

What each tier actually changes for you

The tier changes two things: how much due diligence you owe, and how likely a competent authority is to check you.

• Low risk → simplified due diligence. Under Article 13, an operator sourcing only from low-risk origins is not required to carry out the risk assessment (Article 10) and risk mitigation (Article 11) steps. You still collect the information, still file. This route has real conditions, enough that it has its own guide on who simplified due diligence is really for.
• Standard risk → full due diligence. The complete three-step process applies: collect the plot data, assess the risk, mitigate until it is negligible. This is the path for most coffee and cocoa importers.
• High risk → full due diligence plus enhanced scrutiny. The same operator obligations apply, and competent authorities are required to apply enhanced scrutiny to those shipments.

The enforcement dial is set in Article 16, which tells each Member State’s authority the minimum share of operators it must check each year, scaled by the origin’s tier:

• 1% of operators sourcing from low-risk countries (Article 16(10));
• 3% of operators sourcing from standard-risk countries (Article 16(8));
• 9% of operators (and 9% of the quantity) from high-risk countries (Article 16(9)).

Those are floors, not ceilings, and they are risk-based on top: an authority steers its checks toward complex chains, plots next to forest, and any history of non-compliance. But the shape is clear: a standard-risk origin carries roughly triple the baseline check rate of a low-risk one. It feeds directly into the enforcement picture.

Why low risk is not a free pass

It is tempting to read “my origin is low risk” as “I’m mostly covered.” The regulation does not allow that reading, and three points keep it honest.

First, simplified is not exempt. Article 13 lifts the assessment and mitigation steps; it does not lift the collection of plot-level information under Article 9, the due-diligence system, or the Due Diligence Statement itself. You still gather the geolocation and still file. The guide on simplified due diligence walks through exactly what stays.

Second, the low-risk route carries its own test. Article 13 makes it conditional on the operator having assessed the complexity of the chain and the risk of circumvention or of mixing with product of unknown origin or from higher-risk countries, and being able to show the authority documentation that this mixing risk is negligible. A cooperative lot blended across borders can fail that test even from a low-risk headline origin.

Third, and most often missed: benchmarking is silent on legality. Because the tiers only measure deforestation risk, a low-risk classification says nothing about whether production complied with the country’s land, labour and forest laws: the Article 3(b) leg you still have to satisfy. Low risk lightens one duty and leaves the other untouched.

Low risk changes the amount of work, never the responsibility for it. The Due Diligence Statement, and the liability behind it, stay with you as the operator whatever your origin’s tier.

The list moves: plan for that

The benchmarking list is not fixed. Article 29(2) requires it to be “reviewed, and updated if appropriate, as often as necessary in light of new evidence,” and Article 29 sets out a formal process for moving a country between tiers, including notifying the country and hearing its reply. A first list this generous (roughly 140 countries low, only four high) could change as new evidence is reviewed, in either direction, so an origin’s tier is worth re-checking rather than treating as settled.

For you that means an origin’s tier is a current fact, not a permanent one. An origin that is low risk today, letting you use simplified due diligence, could be reclassified to standard, at which point the full assessment and mitigation steps switch back on for your next consignment. Building your process around the plot data you need anyway, rather than around a tier that might change, is the resilient choice.

What to do with your country’s tier

The practical takeaways are short:

• Find your exact origin on the current list. Don’t infer it from the region: neighbouring origins sit in different tiers. And remember a country can be benchmarked in parts.
• If it’s standard (most likely), run full due diligence. Collect the plot geolocation, screen for post-2020 deforestation, assess and mitigate to negligible risk, and file.
• If it’s low, you may simplify, carefully. Confirm you genuinely meet Article 13’s conditions, document the negligible mixing risk, and keep collecting the geolocation. Read the simplified-DD guide before you rely on it.
• Either way, get the geolocation. It is required on both paths, it is the hardest part to assemble late, and it is the one thing a change in your origin’s tier cannot take away from you.

This is the work we do. We take your origin data in whatever shape it arrives, place each plot against the right country tier and the deforestation record, run a type-aware screen that won’t mistake shade-grown agroforestry for clearing, and assemble the evidence file that makes your conclusion defensible if a competent authority asks . Then, if you want, file the statement in TRACES under your operator identity. What we do not do (what no service honestly can) is take on the legal responsibility, which stays with you as the operator. The whole picture is in the complete importer guide, and the method is on how it works.