{"id":26713,"date":"2026-10-14T09:00:00","date_gmt":"2026-10-14T09:00:00","guid":{"rendered":"https:\/\/evaluationshub.com\/?p=26713"},"modified":"2026-09-29T15:42:18","modified_gmt":"2026-09-29T15:42:18","slug":"eu-forced-labour-regulation-supplier-readiness","status":"publish","type":"post","link":"https:\/\/evaluationshub.com\/eu-forced-labour-regulation-supplier-readiness\/","title":{"rendered":"The EU Forced Labour Regulation Has No Report to File. Here Is What to Build Instead.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"\n

On 3 September 2026, the European Commission’s guidelines on the EU Forced Labour Regulation were published in the Official Journal as C\/2026\/4637. They were adopted on 26 June 2026 and presented on 30 June alongside the launch of the Forced Labour Single Portal. Together with an implementing regulation that went into force in May, they are the clearest picture yet of how this law will actually be enforced.<\/p>\n\n\n\n

That picture is worth a close look, because the EU Forced Labour Regulation behaves differently from almost every other supply chain rule procurement teams have absorbed in the past three years. There is no periodic report to file. No declaration, no certificate, no registry entry, no annual statement. Nothing falls due on a recurring date.<\/p>\n\n\n\n

Instead, there is one question, and it arrives without warning. An authority writes to you about a specific product and asks what you have done about forced labour risk in that product’s supply chain. You have 30 working days to answer.<\/p>\n\n\n\n

The good news is that 30 working days is a generous window if the answer already exists, and an impossible one if it has to be assembled from scratch. The regulation applies from 14 December 2027, which leaves roughly fifteen months to make sure you are in the first category. This article is about what that actually requires, and why it is a different build from the one most compliance programmes are running.<\/p>\n\n\n\n

What the regulation actually does<\/h2>\n\n\n\n

Regulation (EU) 2024\/3015 entered into force on 13 December 2024 and applies from 14 December 2027. Article 3 is short:<\/p>\n\n\n\n

\n\n

“Economic operators shall not place or make available on the Union market products that are made with forced labour, nor shall they export such products.”<\/p>\n\n<\/blockquote>\n\n\n\n

A few features of that sentence matter more than they first appear.<\/p>\n\n\n\n

There is no value threshold and no de minimis. There is no exemption for small and medium enterprises. It covers imports and exports alike. And it reaches forced labour used at any stage of extraction, harvest, production or manufacture, anywhere in the supply chain, which means a single component can bring a finished product into scope.<\/p>\n\n\n\n

This is product legislation, not reporting legislation. The obligation is an obligation of result: the product must be clean. Enforcement runs through national competent authorities, which Member States were required to designate by 14 December 2025, and through customs, which can suspend and then refuse release of affected goods at the border.<\/p>\n\n\n\n

One qualification on the no-paperwork point is worth knowing. Article 27 allows the Commission to designate, by delegated act, products whose economic operators must provide identifying information to customs: a product description and identifiers, plus the name and contact details of the manufacturer and of the suppliers. That is a data duty attached to a shipment rather than a report on a calendar, and it only applies to products the Commission specifically lists. Until products are designated under that power there is nothing to supply, which makes it a watch item rather than a workstream. It is also one more reason to hold manufacturer and supplier identity as structured data rather than as attachments.<\/p>\n\n\n\n

One further point deserves emphasis, because a great deal of commentary gets it backwards. The burden of proof sits with the authority, not with you. The Commission’s guidelines state that the lead competent authority “bears the burden of establishing a violation of the forced labour ban” and “must provide credible evidence” that forced labour was used. You are not required to prove a negative about your entire supply base. You are required to be able to respond credibly when asked about a particular product.<\/p>\n\n\n\n

It is also worth knowing what a decision does not do. Withdrawal reaches products still being made available on the market. It does not reach products that have already been sold to end users, so this is not a consumer recall regime.<\/p>\n\n\n\n

The artefact to design around: an Article 17 request<\/h2>\n\n\n\n

Most preparation advice for this regulation stays at the level of policy. The more useful exercise is to look at the actual piece of paper that will land on someone’s desk, and work backwards from it.<\/p>\n\n\n\n

In most cases, before any formal investigation, there is a preliminary phase under Article 17. The lead competent authority requests information from the economic operators under assessment about the actions they have taken to identify, prevent, mitigate, bring to an end or remediate risks of forced labour in their operations and supply chains. You have 30 working days to respond. The authority can skip that request where making it would jeopardise the outcome of its assessment, so this is the usual route rather than a guaranteed one. The authority then has 30 working days from receiving your information to decide whether a “substantiated concern” exists, which the guidelines define as “a reasonable indication based on objective, factual and verifiable information” to suspect that a product was likely made with forced labour.<\/p>\n\n\n\n

If it concludes there is a substantiated concern, the matter moves to a formal investigation under Article 18, where the timescales change again: there the authority sets a deadline of at least 30 and no more than 60 working days for submissions, and must take into account the size and resources of the operator, including whether it is an SME, when considering extensions.<\/p>\n\n\n\n

Those two stages are frequently conflated in summaries of this law. The distinction matters in practice, because the preliminary phase is the one where a good answer can end the matter before it becomes an investigation. That is the stage worth designing for.<\/p>\n\n\n\n

Why this is a product question, not a supplier question<\/h2>\n\n\n\n

Here is the part that catches well-run programmes out.<\/p>\n\n\n\n

Almost all supplier compliance data is supplier-shaped. A vendor register. A signed code of conduct per supplier. An ESG questionnaire per supplier. A risk score per supplier. If someone asks “what do we know about this vendor”, the answer is one row and a folder of attachments.<\/p>\n\n\n\n

An Article 17 request arrives attached to a named product. The question is framed around your operations and supply chains, but the thing under assessment is a product, and a credible answer has to trace that product’s chain: from the finished item to the suppliers who contributed to it, to the specific sites those suppliers used, to the inputs that came from somewhere upstream. A supplier register cannot do that walk. It knows who you buy from. It does not know what is in what.<\/p>\n\n\n\n

This is the single largest readiness gap we see, and it is a data modelling problem rather than a policy problem. The fix is to make the link between supplier, site and product an actual field in your supplier information management<\/a> records rather than institutional knowledge held by a category manager. Teams that have already invested in procurement data management and supplier master data governance<\/a> have a considerable head start here, because the hard part is not collecting the data once. The hard part is keeping the mapping accurate as the supply base changes.<\/p>\n\n\n\n

A readiness self-test<\/h2>\n\n\n\n

For any product line you sell into or out of the EU, can you produce the following within 30 working days, without a special project?<\/p>\n\n\n\n

\n\n\n\n\n\n\n\n\n
Question<\/th>\nWhere the answer should already live<\/th>\n<\/tr>\n<\/thead>
Which suppliers contribute to this product, and which of their sites?<\/td>\nSupplier master data, with a product and site link<\/td>\n<\/tr>\n
Which inputs come from an area or sector with documented forced labour risk?<\/td>\nRisk-based supplier segmentation<\/a> and country or sector risk flags<\/td>\n<\/tr>\n
What did we ask these suppliers, when, and what did they answer?<\/td>\nSupplier portal<\/a> and evaluation history<\/td>\n<\/tr>\n
What did we do when an answer was weak or missing?<\/td>\nCorrective and preventive action records<\/a><\/td>\n<\/tr>\n
Can we show that trail without rebuilding it from inboxes?<\/td>\nReporting and audit trail<\/a><\/td>\n<\/tr>\n
Who owns the response, and how quickly can they assemble it?<\/td>\nA named owner and a cross-department process<\/a><\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n

A team that answers yes to all six is in good shape, whatever its policy documents say. A team that answers no to three or more will find 30 working days very short, which is the practical argument for starting now rather than in 2027.<\/p>\n\n\n\n

If most of those answers currently live in spreadsheets and email threads, that is the thing to change first. The problem is not that spreadsheets hold the wrong data. It is that they cannot produce a defensible history of who was asked what and when, which is precisely what the preliminary phase turns on. This is the same case for replacing spreadsheets in supplier management<\/a> that quality teams already know, arriving now from a compliance direction.<\/p>\n\n\n\n

What due diligence buys you, and what it does not<\/h2>\n\n\n\n

Be clear on this, because the marketing around forced labour compliance is not.<\/p>\n\n\n\n

The regulation does not impose a due diligence obligation. The Commission’s guidelines are explicit that it operates “whilst not imposing any specific due diligence obligations on companies”, while recognising due diligence as “a useful tool to address forced labour in supply chains”.<\/p>\n\n\n\n

There is also no safe harbour. The guidelines state plainly that providing information “does not guarantee exculpation for the economic operator or that the product will not be subject to a ban decision”. No certificate, audit report or third-party attestation changes that. Any vendor promising forced labour compliance as a product is selling something the regulation does not offer.<\/p>\n\n\n\n

So what is the return on doing the work?<\/p>\n\n\n\n

Three things, all real. First, due diligence evidence is the material you put in front of the authority in the preliminary phase, and it is one of the inputs weighed when deciding whether a substantiated concern exists. Second, the guidelines note that where an operator demonstrates within the deadline that it is taking appropriate steps to address a forced labour situation, the authority may allow a reasonable period to complete them. That is discretionary rather than guaranteed, but it does not become available at all to a company that cannot show what it is doing. Third, and least discussed, the same evidence base serves several regimes at once.<\/p>\n\n\n\n

That last point is the strongest commercial argument. The supplier data that answers an Article 17 request overlaps heavily with what you already collect for CSDDD<\/a> and for ESG and CSRD requirements in onboarding<\/a>. Collecting it once and reusing it is the difference between a manageable programme and four parallel questionnaires landing on the same supplier, which is the fastest way to depress response rates across all of them.<\/p>\n\n\n\n

Four things worth doing in the next quarter<\/h2>\n\n\n\n

Deliberately capability-shaped rather than calendar-shaped, because the deadline is far enough away that a week-by-week plan would be theatre.<\/p>\n\n\n\n

Start with products, not suppliers.<\/strong> Pick the two or three product families with the most exposure, judged on where inputs originate and which sectors they sit in. Map those properly, end to end. A complete map of three product families is worth more than a shallow questionnaire sent to every vendor, and it tells you how much work the full picture will be.<\/p>\n\n\n\n

Make the supplier-to-product link a field.<\/strong> If the only place that knows which supplier feeds which product is a category manager’s memory or a spreadsheet tab, that is the first thing to fix. Everything else depends on it.<\/p>\n\n\n\n

Ask once and reuse.<\/strong> Fold forced labour questions into the onboarding<\/a> questionnaire and the existing evaluation cycle rather than launching a standalone campaign. Suppliers have a finite amount of attention, and evaluation fatigue<\/a> is the reason well-designed programmes stall. Where you operate across borders, multi-language supplier onboarding<\/a> matters more here than usual, since the suppliers closest to the risk are often the least likely to work comfortably in English.<\/p>\n\n\n\n

Let the trail build itself.<\/strong> The audit trail should be a by-product of running the process, not a document someone writes afterwards. If a colleague has to reconstruct the history from inboxes, you do not have 30 working days, you have 30 working days minus a forensic exercise. Automated follow-up<\/a> and continuous monitoring rather than annual reviews<\/a> both help, because they leave a dated record as they go.<\/p>\n\n\n\n

For regulated sectors the case is sharper still. Teams running supplier relationship management for medical devices<\/a> or for pharma<\/a> already maintain product-level supplier traceability for other reasons, and extending it is a smaller step than building it.<\/p>\n\n\n\n

What exists today, and what does not<\/h2>\n\n\n\n

Worth being precise, because plans have already been built on things that are not there yet.<\/p>\n\n\n\n

Available now.<\/strong> The guidelines, adopted 26 June 2026 and published in the Official Journal on 3 September 2026. They are a Commission Notice and non-binding, but they carry weight, not least because the Commission itself acts as lead competent authority for cases outside the EU. The Forced Labour Single Portal has been live since 30 June 2026. Commission Implementing Regulation (EU) 2026\/903 of 24 April 2026, in force since 17 May 2026, specifies the details and functionalities of the system competent authorities and customs will use to exchange information, which is a reasonable signal of how coordinated enforcement is intended to be.<\/p>\n\n\n\n

Not available yet.<\/strong> The database of forced labour risk areas and products under Article 8. The Commission’s own page for it still carries the label “Database in development”. When it does arrive it will be indicative and non-exhaustive by design, so it will inform your risk assessment rather than settle it. Any guidance telling you to check your products against the database today is describing something that does not exist, and any plan that waits for it is fifteen months of waiting.<\/p>\n\n\n\n

Coming up.<\/strong> The Commission is running a webinar series through autumn 2026: solar on 13 October, textiles on 20 October, electronics and semiconductors on 12 November, agri-food on 17 November, automotive on 19 November, and fisheries on 24 November. If one covers your category, it is a direct read on how the Commission thinks about risk in your sector, which is useful input for deciding where to start.<\/p>\n\n\n\n

The encouraging part<\/h2>\n\n\n\n

Strip away the novelty and this regulation asks for something procurement teams have been building towards anyway: knowing what is in your products, knowing who made each part, knowing what you asked and what came back, and being able to show it quickly.<\/p>\n\n\n\n

Teams already running structured supplier evaluation<\/a> with a working supplier risk management<\/a> process have most of the machinery. What usually needs adding is the product dimension and the speed of retrieval. Both are ordinary data problems with ordinary solutions, and fifteen months is a comfortable runway for ordinary data problems.<\/p>\n\n\n\n

The teams that will struggle in December 2027 are not the ones with gaps in their supply chains. Every supply chain has gaps. They are the ones who cannot describe their own supply chain quickly enough to have a useful conversation about it.<\/p>\n\n\n\n

If you want to see what product-level supplier traceability looks like in practice, a supplier performance pilot<\/a> on a single product family is a low-commitment way to find out, or you can book a demo<\/a> and we will walk through it with your own categories.<\/p>\n\n\n\n

Frequently asked questions<\/h2>\n\n\n\n

When does the EU Forced Labour Regulation apply?<\/strong>\nIt applies from 14 December 2027. The regulation entered into force on 13 December 2024, and Member States were required to designate their competent authorities by 14 December 2025.<\/p>\n\n\n\n

Does the EU Forced Labour Regulation require due diligence?<\/strong>\nNo. The Commission’s guidelines confirm it does not impose specific due diligence obligations. Due diligence is still practically important, because the evidence of it is what you submit during the Article 17 preliminary phase, and one of the inputs the authority weighs when deciding whether a substantiated concern exists.<\/p>\n\n\n\n

Is there a safe harbour if we can show strong due diligence?<\/strong>\nNo. The guidelines state that providing information does not guarantee exculpation or that a product will avoid a ban decision. Certificates and audit reports are not a safe harbour either. What good evidence buys you is a faster, more credible response and, at the authority’s discretion, potentially time to complete remediation steps.<\/p>\n\n\n\n

How long do we have to respond to an information request?<\/strong>\n30 working days in the preliminary phase under Article 17. The authority then has 30 working days from receiving your response to decide whether a substantiated concern exists. If the matter moves to a formal investigation under Article 18, the authority sets a separate deadline of at least 30 and no more than 60 working days.<\/p>\n\n\n\n

Are small and medium enterprises exempt?<\/strong>\nNo. There is no SME exemption and no value threshold. SMEs do receive specific consideration: Article 10 provides for support measures for SMEs, and the Commission’s guidelines note that SMEs can seek help from a national contact point on how to engage with the lead competent authority. Authorities are directed to weigh size and economic resources when prioritising enforcement, and must take them into account when setting deadlines during an investigation under Article 18(4).<\/p>\n\n\n\n

Can we check our products against the EU forced labour risk database?<\/strong>\nNot yet. The Article 8 database is still in development as of late September 2026. When published it will be indicative and non-exhaustive, drawing on sources such as ILO reporting, so it will support your own risk assessment rather than replace it.<\/p>\n\n\n\n

What happens to products found to be made with forced labour?<\/strong>\nThe authority prohibits placing or making them available on the EU market and prohibits export, orders withdrawal of products still being made available, and orders disposal. Products are disposed of in line with the waste hierarchy, by recycling where possible or otherwise rendering them inoperable; perishable products are donated for charitable or public interest purposes. Operators generally get at least 30 working days to comply for non-perishable goods and 10 working days for perishable goods. Products that have already reached end users are not withdrawn.<\/p>\n\n\n\n

\n\n\n\n

Sources<\/h2>\n\n\n\n