A legality assessment returns a result for every origin of a product: most often Negligible or Non-negligible. This article explains what that result is based on, why it stays fixed once it is set, and why the conclusion that a product was produced legally stays with you.

The EU Deforestation Regulation (EUDR) allows a product on the EU market only if it was produced in accordance with the relevant legislation of the country of production (Article 3). Article 2(40) lists what that legislation covers: land use rights, environmental protection, forest-related rules, third parties' rights, labour rights, human rights protected under international law, free, prior and informed consent, and tax, anti-corruption, trade and customs rules. Article 9 asks you to collect conclusive and verifiable information that the commodity was produced in line with this legislation, and Article 10 asks you to assess the risk that it was not.

The legality assessment supports that risk assessment. It looks at the producer of each origin and reads the producer's score in the EUDR perspective. That score combines four kinds of signals, grouped into seven risk categories that follow these areas of legislation:

A score of 40 or higher gives Negligible, a score below 40 gives Non-negligible. The exact rules and data are in the methodology and data sources articles linked at the end.

Each origin is assessed once. The result is then fixed, together with the score, the risk band and the threshold that produced it. When the producer's score changes later, for example because a new alert appears, the result of the origin stays as it is.

The reason is traceability. A Due Diligence Statement (DDS) records your conclusion about specific products at a specific moment. If the legality result behind it changed every time the score moved, you could not show later which information your conclusion was based on. A fixed result keeps the link between the evidence, the result and the DDS intact.

The deforestation check works the same way: each origin is checked once and keeps its result. The difference is the evidence. The deforestation check looks at the plots of land; the legality assessment looks at the producer and the information available about it.

New information is not lost. A self-assessment result or an internal score added later counts in the producer's score from the next assessment on, for example for a new origin of the same producer.

The result of each origin rolls up. A Product Origin Request and a product each take the result of their weakest origin, so one Non-negligible origin is enough to block the DDS for the product.

Before an origin has a result, it shows one of two statuses:

Neither is a finding about the producer. The assessment runs again automatically, for example when the producer is identified or its screening finishes, until the origin has a result.

"A Non-negligible result means the producer acted illegally." It does not. It means that the available signals point to a risk that is not negligible. It is a reason to look closer, not a finding of non-compliance.

"Sending a self-assessment changes the result." Not once the result is fixed. A self-assessment or an internal score counts from the next assessment on. Requesting information from the producer is part of how you investigate a risk; the fixed result only changes when you mark it as Derisked.

"A clean category makes up for a risky one." No. Risk signals add up: each signal makes the producer score worse. A category without signals does not improve the producer score. It only leaves the score as it is. Risk in one category is never averaged out by low risk in another.

"Negligible means the product is legal." It does not. Negligible means that the signals Prewave can see show no more than a negligible risk. It does not check every applicable law, and it says nothing about whether the product is deforestation-free, which the deforestation check covers.

Which laws apply depends on the country of production, and checking them is a qualitative assessment that stays with you. The European Commission plans a repository of relevant legislation, in which countries of production list their legislation for each area of Article 2(40). Its guidance document names December 2026 as the target. Once the repository is available, it will become a lot clearer which documents to look at for this assessment, and Prewave may be able to support the qualitative part of it.

Prewave provides a risk signal for each origin. It does not decide whether a product was produced legally.

This follows from the regulation. You can conclude that the risk is negligible only as the result of your own due diligence (Commission FAQ 5.10). By submitting a DDS, you confirm that you found no or only negligible risk, and you take responsibility for the compliance of the product (Article 4). Where the risk is not negligible, Article 11 requires risk mitigation, such as additional information from suppliers or independent surveys and audits.

When your review concludes that the risk of a Non-negligible origin is negligible after all, you mark the origin as Derisked and record why. A Derisked origin counts as Negligible for the product and the Product Origin Request. Keep the evidence behind that conclusion with your due diligence records for at least five years.