📖 Reference · For users who want to look up how a legality assessment result was produced, by methodology version.
A legality assessment checks whether there is a non-negligible risk that a product was not produced in line with the relevant legislation of the country of production, as the EU Deforestation Regulation (EUDR) requires. This article describes each version of the methodology Prewave uses for that assessment.
Why the methodology is versioned
Every legality assessment result carries the version of the methodology that produced it. Versioning keeps results traceable: for any result, you can look up which data and which decision rules were used, and reproduce how the result came about.
Prewave creates a new version when the data analysis or the decision rules change substantially, or when the underlying data sources change substantially. Prewave decides when a change is substantial enough for a new version. Each new version is added to this article, and earlier versions stay documented here.
Version | Period of application | What defines it |
Version 2.1 | September 2026 to present | One fixed result per origin, taken from the producer score at the moment the origin is assessed |
Version 1 | July 2024 to September 2026 | A live result per origin that follows the producer score as it changes |
Version 2.1
Period of application
September 2026 to present.
Changes from Version 1
The result is fixed. Each origin is assessed once, and the result stays as it is when the producer score changes later.
An origin has two statuses before it has a result: Pending and Required (see below).
A Non-negligible result can be marked as Derisked. A Derisked origin counts as Negligible for the product and the Product Origin Request.
Several country risk indices use newer editions, and the list of alert event types was updated. Details are in the data sources reference.
The score composition, the weights, the risk bands and the threshold are the same as in Version 1.
Checks and decision rules
Each origin is assessed on the producer linked to it. The assessment runs automatically when the origin is created and again when its producer is discovered or the producer's screening finishes, until the origin has a result. The result is then fixed, together with the score, the risk band and the threshold that produced it.
Status | Meaning |
Pending | The origin has not been assessed yet. |
Required | The origin was assessed, but no result can be produced yet: the origin has no producer, the producer is not screened yet, or no complete score is available for the producer. |
Negligible | The producer score is 40 or higher. |
Non-negligible | The producer score is below 40. |
Derisked | A Non-negligible result was reviewed and marked as derisked, with a comment. |
Not required | No legality assessment applies to the origin. |
Decision rules:
A producer with a score of 40 or higher is Negligible. A producer with a score below 40 is Non-negligible. For example, a producer scoring 40 is Negligible, and a producer scoring 39 is Non-negligible.
The decision uses the overall producer score. Risk signals add up: each signal makes the score worse, and a category without signals does not improve it. Risk in one category is not averaged out by low risk in another.
An origin covered by a supplier's Due Diligence Statement (DDS) is Not required.
A self-assessment result or an internal score added after an origin was assessed counts in the producer score from the next assessment on. It does not change a result that is already fixed. Only Derisked changes the status of a Non-negligible origin.
A Product Origin Request and a product each take the result of their weakest origin. A Derisked origin counts as Negligible.
Data analysis
The data analysis is the same as in Version 1: the same producer score in the EUDR perspective, the same weights, the same risk bands and the same threshold. The full description is under Version 1, Data analysis below.
The score is read once, at the moment the origin is assessed, and stored with the result.
Data sources
Version 1
Period of application
July 2024 to September 2026.
Changes from the previous version
None. Version 1 is the first version of the methodology.
Checks and decision rules
Each origin takes the current score of the producer linked to it.
Status | Meaning |
Required | The origin has no result yet. |
Negligible | The producer score is 40 or higher. |
Non-negligible | The producer score is below 40. |
Not required | No legality assessment applies to the origin. |
Decision rules:
A producer with a score of 40 or higher is Negligible. A producer with a score below 40 is Non-negligible.
The result follows the producer score. When the score changes, the result changes with it, including after a DDS was created.
The decision uses the overall producer score. Risk signals add up: each signal makes the score worse, and a category without signals does not improve it. Risk in one category is not averaged out by low risk in another.
A product takes the result of its weakest origin.
Data analysis
The legality assessment uses the overall score of the producer in the EUDR perspective. The score runs from 1 to 100: 100 means no risk was detected, and a lower score means more risk indications.
The score combines four components:
Component | Weight | What it measures |
Peer score | 30% | Country risk (15%), industry risk (7.5%) and commodity risk (7.5%). When no commodity risk is available, industry risk counts 15%. |
Alert score | 40% | Number and severity of public alerts on the producer in the EUDR perspective. Private alerts created by customers do not count. |
Self-assessment score | 20% | Answers from producer self-assessments on EUDR topics. Optional: without a self-assessment result, this component has no effect on the score. |
Internal score | 10% | Information a company provides about the producer, such as a known incident. Optional: without internal information, this component has no effect on the score. |
Within the alert score, alerts are grouped into seven EUDR risk categories: land use rights, community rights, forest-related rules, human rights, business practices, labour rights and environmental protection. Negative events weigh more than positive ones, and a producer without alerts scores 100 on alerts.
The score is placed in one of five risk bands. For EUDR, the threshold for critical risk is set at 20, which gives these bands:
Band | Score |
Critical | 1 to 20 |
High | 21 to 40 |
Mid | 41 to 60 |
Low | 61 to 80 |
No risk | 81 to 100 |
The decision uses the score, not the band. A producer scoring exactly 40 is shown in the High band and the result is Negligible.