The due diligence requires the operator to:

• collect information, documents and data about the relevant products which are subject to the EUDR.
• verify and analyze that information along with other contextual information and on that basis carry out a risk assessment.
• adopt risk mitigation measures, unless the risk assessment carried out concludes that there is no or only negligible risk that the relevant products are non-compliant.

The product-related information that must be assessed includes information specific to the product and its supply chain. And there is additional contextual information needed to assess the level of risk, such as the state of forests within the country of production.

If the product is derived from several sources or geolocations, it is necessary to assess the risk for each source or geolocation. The level of risk can only be assessed on a case-by-case basis, as it depends on a number of factors.

There are various ways to conduct the risk assessment, but the operator must address the following questions and considerations:

• Where was the product produced?

What is the assigned risk level of the country of production or parts thereof. How high is the presence of forests and how high is the prevalence (rate) of forest degradation or deforestation in the country of production or parts thereof? How high is the prevalence (rate) of illegal production or harvest of the relevant commodity within the country/parts thereof?

• What are the product-specific risks?

There are considerable differences in how the various relevant products are produced, which will impact the risk of non-compliance. For example, some products contain raw material produced in hundreds of separate geolocations.

• Is the supply chain complex?
• Are there indications of a company in the supply chain being involved in practices related

to illegality, deforestation, or forest degradation?

There is a higher risk that relevant commodities or products purchased from a company that has been associated with illegal practices, deforestation or forest degradation will be non-compliant. Have any substantiated concerns been submitted regarding companies in the supply chain? Have any companies within the supply chain breached relevant laws and been sanctioned by the state for the breach of such laws?

• Is there any complementary information on EUDR compliance of companies within the

supply chain available from certification or third-party verification schemes?

• Have the relevant products been produced in accordance with the relevant legislation of

the country of production?