EUDR Supplier Risk Assessment:
From Questionnaire to Contract Allocation

Written by Louise Baudry, Product Growth Marketer at Sustaain

On December 30, 2026, the EU Deforestation Regulation (EUDR) starts applying to large and medium-sized operators. From that date, every relevant product placed on the EU market needs a due diligence statement. And every statement rests on a question asked long before the goods leave origin: which suppliers can this shipment rely on?

Most trading teams already hold the raw material to answer it: questionnaires, codes of conduct, certificates, geolocation files. What they lack is a way to turn those inputs into a decision a trader can act on and an auditor can follow.

Key Takeaways

EUDR supplier risk assessment means checking each supplier and each plot behind a shipment before goods reach the EU market. Most teams already collect the data. The gap is turning it into a decision. This guide sets out seven steps: prioritize suppliers by exposure, send one tracked request, link every answer to evidence, score risk with explainable rules, cross supplier results with plot-level deforestation checks, use the results to allocate contracts and shipments, and keep an audit-ready record.

Why EUDR Supplier Risk Assessment Breaks Down in Trading Teams

Under the EUDR, due diligence follows three steps: collect information, assess the risk, and mitigate it when the risk is not negligible (Articles 9 to 11 of Regulation (EU) 2023/1115). Since the December 2025 amendment to the EUDR, this due diligence is the responsibility of the operator that first places the product on the EU market. For importing traders, supplier risk assessment is where the three steps meet. It is also where they tend to break down.

The same patterns come up again and again:

• Questionnaires go out by email and come back in different formats, or not at all.

• Evidence lives in inboxes and shared drives, disconnected from the answer it is supposed to support.

• Scores sit in a spreadsheet that only one person can explain.

• Traders cannot see, when allocating a contract, which suppliers can cover it.

None of these is a data problem. Each one is a gap between information and decision. Under the EUDR, that gap has a direct cost: a non-compliant shipment is a blocked revenue event. Not a fine. (For the traceability side of the same challenge, see Managing Traceability Risk in EUDR Compliance.)

How to Run an EUDR Supplier Risk Assessment in 7 Steps

Step 1: Prioritize Suppliers by EUDR Exposure

Not every supplier carries the same weight. A supplier with open contracts and shipments heading to the EU this quarter matters more than one you have not bought from in two years.

Start by linking each supplier to its contracts, shipments and lots, then tag which suppliers are in scope and which are active. The result is a working list ordered by exposure, which keeps the due diligence effort where the revenue is.

Step 2: Run Supplier Due Diligence From a Single Request

At its core, the questionnaire is the supplier's evidence of legality. Article 3(b) of the EUDR requires products to be produced in accordance with the relevant legislation of the country of production, which covers areas such as land use rights, labor rights, environmental protection, human rights and tax rules.

Send the risk assessment questionnaire together with the commitments you ask suppliers to sign, in one request, so every supplier receives the same package.

Then treat that request as an object with a status, not as an email in someone's outbox: draft, sent, opened, completed, overdue. Two things follow. Reminders go out automatically on a set schedule, instead of relying on someone remembering to chase the supplier. And a supplier who has not answered stays visibly pending, rather than being allocated to a contract by default.

Step 3: Link Every Questionnaire Answer to Evidence

A self-declaration is a starting point. What makes an answer usable in an audit is the document behind it: a certificate, a geolocation file, a land rights document, a policy.

Attach each document to the specific question it supports and, where relevant, to the contract or shipment it covers, with its type, version, uploader and date. When a client or an authority asks how you know, the answer is one click away instead of a search through inboxes. Structuring documents once also means they can be reused across workflows (more on that in From EUDR Paperwork to One Data Model).

Step 4: Score Supplier Risk With Rules You Can Explain

Scoring should be rules-based, mapped to the risk criteria listed in Article 10 of the EUDR, and recalculated automatically when answers or evidence change.

The test of a good score is not its precision. It is whether you can explain it. For every risk level, you should be able to trace the path from the rule, to the question, to the evidence that triggered it. You should also be able to export that justification when a client or auditor asks. A score nobody can explain is a weak position in an audit, however accurate it may be.

Step 5: Cross Supplier Results With Plot-Level Deforestation Checks

A supplier score, however well built, covers only half of the picture. It answers one core question: can this supplier demonstrate that its production complies with the relevant laws of the country of production? A geospatial analysis of satellite imagery answers another: was this plot deforested after December 31, 2020? The EUDR requires both, for every plot behind a shipment.

So the supplier result does not stay on the supplier profile. It is carried down to each of the supplier's plots, where it meets the deforestation result for that plot. A plot is cleared only when both results are positive. If the supplier assessment is still pending, every plot of that supplier stays pending, however clean the satellite picture looks.

The result then rolls up to the shipment. Because verified volumes cannot be mixed with volumes of unknown or non-compliant origin, a single plot that is pending or non-compliant makes the shipment it feeds ineligible for the EU market. Only that shipment, not the whole contract. The trader sees which plot is blocking, why, and what would clear it.

Step 6: Allocate Contracts and Shipments Based on Cleared Plots

Once results roll up to shipments, contracts allocation follows. With a clear status for every shipment, the trader can see where each supplier's volume fits: which contract it can cover and which shipment it can join. To make that call, a trader needs to see, in two clicks from a supplier, a contract or a shipment, the current status (go, conditional, no-go or pending) and the date of the last update.

Two additions make that status operational:

• Alerts when a supplier or a plot becomes high-risk or incomplete, so its volume is not allocated to a shipment it cannot join.

• A shared view of which suppliers can cover which contracts, filterable by commodity, origin and risk, so the commercial team works from the same vetted base as compliance.

Step 7: Keep an Audit-Ready Due Diligence Record

The EUDR requires operators to keep due diligence documentation for at least five years and to review their due diligence system at least once a year (Article 12). The simplest way to meet both is to build the record as you go.

For each supplier, that means a pack combining the questionnaire, a summary of the scoring logic and the supporting evidence, with timestamps and the scoring rules applied at the time.

Each supplier assessment should also carry a validity date, so the team knows when it is due for re-assessment. When a supplier is re-assessed, the new result flows down to its plots and the shipment statuses are recalculated, while the previous status stays on record.

At management level, the same data shows where risk concentrates by commodity and origin, and what it would take to bring each supplier to low risk.

EUDR Supplier Due Diligence Checklist

1. Suppliers linked to their contracts, shipments and lots

2. Suppliers tagged as in scope for the EUDR and as currently active

3. Questionnaire and supplier commitments sent in a single request

4. Response status tracked, with automated reminders

5. Every answer linked to supporting evidence

6. Rules-based score, recalculated when data changes

7. Each risk level traceable from rule to question to evidence

8. Supplier result applied to each plot and combined with its deforestation result

9. Status visible from the supplier, the contract and the shipment, showing which plot is blocking

10. Alerts on high-risk or incomplete suppliers and plots

11. Validity date on each supplier assessment

12. Audit pack available for each supplier

13. Due diligence system reviewed at least once a year

Questions Trading Teams Ask Us

What if a supplier's answers contradict what you already know?

It happens more often than you might expect. In one case we worked on, a supplier declared that it did not provide polygons for farms above four hectares, when in fact it already did. The right response is neither to leave the answer as it is nor to overwrite it quietly. Correct it on the basis of the evidence, and make sure the correction is logged with who made it, when and why. A self-declaration is one input. The evidence and the audit trail are what you defend.

Does a single red flag make a supplier high-risk?

Not necessarily. In supplier deforestation risk assessment, some risks only become material in combination. Land conversion in a sourcing area since December 31, 2020 is a warning sign. Combined with the absence of a system to segregate compliant from non-compliant products, it becomes a deforestation risk for your supply chain, because the two can mix. With segregation in place, that mixing risk is contained. Scoring rules that read factors together avoid downgrading a supplier on a single answer taken out of context.

How often should a supplier risk score be updated?

A supplier risk score should be updated both when something changes and on a set schedule. A new answer, a new document, an expired certificate or new geolocation data should trigger a recalculation, so the status a trader sees is always current. In parallel, each assessment should carry a validity date, and the supplier is re-assessed when it expires. On top of that, the EUDR requires operators to review their due diligence system as a whole at least once a year.

From Supplier Risk Assessment to Sourcing Decisions

Supplier risk assessment is often treated as a compliance task to complete before a deadline. Run well, it becomes something more useful: a shared, current view of which supplier volumes can cover which contracts today, and why. That is where compliance starts to feed sourcing decisions, and what we mean by sourcing intelligence.