Author: Bert Paesbrugghe

Start with one question

Here is a question your team already asks suppliers: where was this made?

Seven words. One field in a form. It looks like the easiest thing you will collect all year.

Now watch what happens when four different colleagues ask it in the same quarter.

The sustainability team asks it because the CSRD value chain disclosures need to know where the impacts sit. They want a country, and they will accept an estimate if the supplier cannot give better.

The customs team asks it because CBAM needs the identity of the installation where the goods were produced, along with the embedded emissions and the production route. A country is worthless to them. They need the plant, and they need it tied to the specific consignment.

The sourcing team asks it because the EU Deforestation Regulation needs the geolocation of every plot of land where the commodity was produced. Not the plant. The land.

The legal team asks it because if an authority sends a request under the Forced Labour Regulation, that request will name a product, and someone will have thirty working days to say which sites made it.

Same seven words. Four incompatible answers. And in most organisations, four separate emails to the same supplier, in the same quarter, from four people who have never met.

This piece is about fixing that, and about the one design decision that makes the difference: treat the purpose of a question as part of the data, not as context that lives in someone’s inbox.

Why the obvious fix does not work

The obvious fix is a master questionnaire. One long form, sent once a year, containing everything anybody might need.

It fails for a reason that is now written into EU law rather than merely into supplier patience.

In the reworked sustainability rules, the Commission introduced what it calls the value chain cap. Its own explanatory note is direct about what it does: the cap “prohibits CSRD companies from requiring companies in their value chain that have 1000 employees or fewer, to provide more sustainability information than the content of the sustainability reporting standard for voluntary use.” Companies with ten employees or fewer get additional protection on top.

So the master questionnaire is not just unpopular. For the great majority of your supply base, large parts of it are no longer something you can require.

But read the next sentence in the same note, because this is where the design problem becomes interesting:

“The value chain cap applies only in the context of fulfilling CSRD reporting obligations and does not affect information requests for purposes other than sustainability reporting under CSRD.”

That single sentence is the most useful thing published about supplier data collection this year, and almost nobody is talking about it.

It means the limit does not attach to the question. It attaches to the reason you are asking it.

The identical field, requested from the identical supplier on the identical day, is capped when you are collecting it for CSRD and uncapped when you are collecting it because EUDR requires it to place goods on the market. One is a reporting obligation with a burden-sharing rule attached. The other is a condition of market access with no such rule.

Which means a supplier data set that records only what you asked can no longer tell you whether you were entitled to ask it. You need to record why.

Purpose as a first-class field

Most supplier information systems store a question, an answer, a date and an owner. Add one more column: the purpose, or purposes, this field serves.

It sounds like documentation overhead. It is actually the thing that makes everything downstream possible.

With purpose recorded against every field you can answer, instantly and without a meeting:

• Which questions in this year’s campaign are we entitled to require from a supplier with eighty employees, and which are we asking as a favour
• If a supplier declines a field, which report loses what
• When a new regime arrives, which of its data points do we already hold, and which are genuinely new
• Which single question is carrying the most weight, and therefore deserves the most care in its wording

Without it, every one of those questions becomes a research project, every time. This is the same argument that makes a proper supplier information management layer worth more than a folder of completed forms, and it is the practical half of supplier master data governance.

The four axes that decide whether an answer travels

An answer collected for one purpose is reusable for another only if it matches on four axes. Check these before you assume reuse.

1. What the data attaches to. This is the one that quietly destroys most reuse attempts. Regimes attach their demands to different objects, and an answer attached to the wrong object cannot be converted upwards.

2. The evidence standard. A self-declared answer and a third-party verified answer are different data, even when the words are identical.

3. Who you may ask, and under what limit. The caps differ by regime, and they differ in shape, not just in threshold.

4. The refresh clock. A field that is true annually and a field that must be true per consignment cannot share a collection cycle.

Here is how the main regimes sit against those axes.

Regime	Attaches to	Typical evidence standard	Limit on what you can require	Refresh rhythm
CSRD value chain disclosure	Entity, often country level	Reported data, estimates and sector averages accepted where better data is unavailable	Value chain cap: suppliers with 1,000 employees or fewer cannot be required to give more than the voluntary standard contains	Annual reporting cycle
CSDDD	Entity and relationship, covering direct and indirect business partners	Risk-based, proportionate to severity and likelihood	Requests must be necessary; for partners with fewer than 5,000 employees, information should only be requested where it cannot reasonably be obtained by other means	Periodic, risk-driven
EUDR	Plot of land, and the consignment placed on the market	Geolocation of every plot, supported by a due diligence statement	No size-based cap. The data is a condition of placing goods on the market	Per consignment, with the underlying plot data reused across consignments
CBAM	Installation, and the imported consignment	Installation identification, embedded direct and indirect emissions, production route	Applies above a single mass-based threshold of 50 tonnes of CBAM goods per importer per year	Annual declaration, built from consignment-level data
EU Forced Labour Regulation	Product, traced back to sites	Whatever you can produce on request. There is no prescribed dataset and no due diligence obligation	No routine collection obligation at all. The demand arrives as a request from an authority	On request, with a short response window

Two things fall straight out of that table.

Country of origin is the least reusable field you collect. It satisfies the loosest requirement and converts upward into nothing. The plant, the plot and the part number all convert downward into a country whenever you need one. This is the case for building the supplier, site and part layer rather than a flat vendor list, and it is why centralising supplier data pays off more than centralising supplier documents.

Collect to the strictest standard among the purposes a field serves, not to the average. If three regimes want the same fact and one of them needs it verified, collect it verified once. Collecting the self-declared version first and the verified version later means you have run two campaigns, spent two lots of supplier goodwill, and still only have one usable answer.

The reuse ratio: how to decide what to build first

You cannot build the whole canonical set at once, and you should not try. The question is which fields to build first.

Rank them by reuse ratio: the number of distinct purposes a single supplier question serves.

Run the exercise on paper before you run it in a system. List the regimes, frameworks, customer questionnaires and internal processes that currently generate supplier data requests in your organisation. Include the unglamorous ones: the cybersecurity questionnaires your IT team sends, the KYC and KYB checks in onboarding, the sanctions screening refresh, quality and audit requirements, and any customer who passes their own obligations down to you.

Then list the actual questions each one generates, and count the overlaps.

In most manufacturing supply bases the top of that ranking is predictable, and it is not what people expect. The highest reuse ratios sit on structural facts rather than on sustainability content:

• The list of manufacturing sites, with addresses and a stable identifier
• Which sites make which parts, with the dates those assignments were valid
• Legal entity identity and ownership, which feeds screening, tax and due diligence alike
• Named contacts by role, which determines whether any of the above can be refreshed at all

Those four carry almost every regime on the list. Emissions data, labour policy detail and certification evidence sit lower, because each tends to serve one or two purposes and needs refreshing on its own clock.

That ranking is worth publishing internally, because it settles an argument that otherwise recurs annually. The team that wants a hundred-question sustainability form is not wrong about needing the answers. They are wrong about the order.

The caps are a design brief, not an obstacle

It is tempting to read the value chain cap and the CSDDD necessity test as restrictions on doing your job. They read better as free segmentation advice from the legislator.

Between them, the two rules say something quite precise: ask small partners less, ask them only what you cannot get elsewhere, and concentrate depth where the impact actually is. Under the final Omnibus I outcome, CSDDD information requests are restricted to what is necessary, with extra safeguards for partners employing fewer than 5,000 people, and companies are pointed towards requesting information from the partner where impacts are most likely to occur.

That is risk-based supplier segmentation, written into law. If your programme already segments, the caps mostly describe what you do anyway. If it does not, the caps are a reason to start, and segmentation models are a good place to begin.

The practical shape this takes is three tiers of request rather than one:

A short universal set. Sites, parts, entity identity, contacts. Asked of everyone, kept current, small enough that a supplier with twelve employees can complete it without help. This is the set with the highest reuse ratio, so it earns its place everywhere.

A deeper set for the suppliers where impact concentrates. Emissions at installation level, labour and working conditions, verified evidence. Asked of a defined, justified subset, with the reason stated in the request.

A responsive set, held ready rather than collected. For the Forced Labour Regulation there is nothing routine to file, so the goal is not a dataset, it is the ability to answer a product-shaped question quickly. What you need is the linkage, not another form.

Note that none of the caps stop you asking. They stop you requiring. A supplier can still volunteer more, and many will, particularly when the request explains what it is for and what they get back. That is worth knowing, because the request itself is where most programmes lose their data, long before any legal limit applies. The mechanics of that are covered in automated follow-up for supplier evaluation and risk and in how you design a supplier portal that suppliers will actually log into.

Making one request do the work of four

The reuse ratio tells you what to collect. The next question is how to ask for it once.

Four moves, in the order they tend to pay off.

Consolidate the calendar before you consolidate the form. The first win is not a better questionnaire, it is knowing that four teams were about to contact the same supplier in the same month. A shared view of who is asking whom, and when, removes the most visible symptom immediately and costs nothing but coordination. This is the everyday version of cross-department collaboration on supplier evaluation, and it is usually the point at which evaluation fatigue starts to fall.

Make the supplier’s answer persistent, not transactional. If each request produces a document that lands in an inbox, nothing accumulates and the next campaign starts from zero. If it updates a record the supplier can see and correct, the second request is shorter than the first and the fourth is almost empty. This is the structural difference between running the programme on spreadsheets and running it on a system, and it is the reason the effort curve bends downward rather than upward.

Give something back with every request. The strongest lever available is data you already own. A supplier who receives their scorecard alongside the request is being asked for a contribution to a conversation rather than for homework. The same applies to sharing what their data was used for afterwards.

Keep the trail as you go, not afterwards. Who asked, for what purpose, when, what was answered, what evidence was attached, and what changed since. Assembled at the time this is nearly free. Reconstructed under an audit or an authority’s request it is expensive and incomplete, which is why a reporting and audit trail belongs in the design rather than in the remediation plan.

Where an answer comes back incomplete or an evidence gap opens, that belongs in the same loop as any other finding, through corrective actions rather than through a separate chase list.

Where to start if you are starting today

If the map above is new to your team, the cheapest useful first step is not a system change. It is a single page listing every supplier data request your organisation made in the last twelve months, who sent it, and what it was for.

Most teams doing this for the first time find the same three things: the same supplier contacted more times than anyone realised, several questions asked in more than one form with slightly different wording, and at least one regime whose data nobody currently owns.

That page is the start of your mapping table. Everything else in this article is a way of filling it in.

From there, the sequence that tends to work is to build the universal set first because it has the highest reuse ratio, wire it into supplier onboarding so new suppliers arrive with it complete, and then backfill the existing base in priority order rather than all at once. Teams that have taken a programme from a handful of suppliers to a few hundred usually describe scaling in waves rather than in one campaign, and the same applies here.

If you want to prove the approach before committing to it, a supplier performance pilot on a single category is enough to show whether the second request really is shorter than the first.

The point

The regimes are not going to stop arriving, and they are not going to converge on a common format. That part is outside anyone’s control.

What is inside your control is whether each new one lands as a fresh collection campaign or as a mapping exercise against data you already hold.

The difference between those two outcomes is not budget and it is not software. It is a decision made early about what a supplier data point is: not an answer sitting in a form, but a fact with an owner, a date, an evidence standard and a recorded purpose. Build it that way and the fifth regime costs a fraction of the first.

Ask once, report many times, and let the supplier notice the difference.

Frequently asked questions

Does the CSRD value chain cap mean we cannot ask small suppliers for detailed sustainability data at all?
No. The cap limits what you can require from suppliers with 1,000 employees or fewer for the purpose of CSRD reporting, setting the ceiling at the content of the voluntary reporting standard. You can still ask beyond it, provided you make clear that the request goes beyond the cap and that the supplier may decline. The Commission’s own explanation also notes the cap applies only to CSRD reporting purposes and does not affect requests made for other purposes.

If EUDR is not capped, can we ask EUDR questions of everyone?
The absence of a size-based cap reflects that the data is a condition of placing goods on the market rather than a reporting burden to be shared. In practice you need it from the suppliers whose commodities are in scope, and asking it of suppliers outside scope adds effort without adding an answer you need. Scope by product, not by supplier size.

Which single field should we build first?
The manufacturing site list, with a stable identifier and the dated link between sites and the parts they make. It has the highest reuse ratio of anything you will collect, it converts downward into country of origin whenever a looser requirement needs one, and it is the only thing that lets you answer a product-shaped question quickly.

How often should this data be refreshed?
It depends on the field rather than on the supplier. Structural facts such as sites and entity identity change rarely and should be refreshed on an event basis, when the supplier tells you something has changed or when a signal suggests it has. Consignment-level data refreshes per shipment. Treating all supplier data on a single annual clock is what makes programmes feel heavy. There is more on separating those rhythms in the approach of moving from annual reviews to continuous supplier monitoring.

We operate across several countries and languages. Does that change the approach?
It raises the value of it. The duplication problem multiplies when each entity runs its own requests, and a shared canonical set is the only practical way to avoid contacting the same supplier from three subsidiaries in three languages. See multi-entity and multi-language supplier onboarding.

Is this a compliance project or a procurement project?
Procurement owns the relationship and the request, so procurement owns the data. Compliance and sustainability own the interpretation of what each regime needs from it. Splitting it the other way tends to produce a dataset that satisfies reports and cannot answer an operational question.

On 3 September 2026, the European Commission’s guidelines on the EU Forced Labour Regulation were published in the Official Journal as C/2026/4637. They were adopted on 26 June 2026 and presented on 30 June alongside the launch of the Forced Labour Single Portal. Together with an implementing regulation that went into force in May, they are the clearest picture yet of how this law will actually be enforced.

That picture is worth a close look, because the EU Forced Labour Regulation behaves differently from almost every other supply chain rule procurement teams have absorbed in the past three years. There is no periodic report to file. No declaration, no certificate, no registry entry, no annual statement. Nothing falls due on a recurring date.

Instead, there is one question, and it arrives without warning. An authority writes to you about a specific product and asks what you have done about forced labour risk in that product’s supply chain. You have 30 working days to answer.

The good news is that 30 working days is a generous window if the answer already exists, and an impossible one if it has to be assembled from scratch. The regulation applies from 14 December 2027, which leaves roughly fifteen months to make sure you are in the first category. This article is about what that actually requires, and why it is a different build from the one most compliance programmes are running.

What the regulation actually does

Regulation (EU) 2024/3015 entered into force on 13 December 2024 and applies from 14 December 2027. Article 3 is short:

“Economic operators shall not place or make available on the Union market products that are made with forced labour, nor shall they export such products.”

A few features of that sentence matter more than they first appear.

There is no value threshold and no de minimis. There is no exemption for small and medium enterprises. It covers imports and exports alike. And it reaches forced labour used at any stage of extraction, harvest, production or manufacture, anywhere in the supply chain, which means a single component can bring a finished product into scope.

This is product legislation, not reporting legislation. The obligation is an obligation of result: the product must be clean. Enforcement runs through national competent authorities, which Member States were required to designate by 14 December 2025, and through customs, which can suspend and then refuse release of affected goods at the border.

One qualification on the no-paperwork point is worth knowing. Article 27 allows the Commission to designate, by delegated act, products whose economic operators must provide identifying information to customs: a product description and identifiers, plus the name and contact details of the manufacturer and of the suppliers. That is a data duty attached to a shipment rather than a report on a calendar, and it only applies to products the Commission specifically lists. Until products are designated under that power there is nothing to supply, which makes it a watch item rather than a workstream. It is also one more reason to hold manufacturer and supplier identity as structured data rather than as attachments.

One further point deserves emphasis, because a great deal of commentary gets it backwards. The burden of proof sits with the authority, not with you. The Commission’s guidelines state that the lead competent authority “bears the burden of establishing a violation of the forced labour ban” and “must provide credible evidence” that forced labour was used. You are not required to prove a negative about your entire supply base. You are required to be able to respond credibly when asked about a particular product.

It is also worth knowing what a decision does not do. Withdrawal reaches products still being made available on the market. It does not reach products that have already been sold to end users, so this is not a consumer recall regime.

The artefact to design around: an Article 17 request

Most preparation advice for this regulation stays at the level of policy. The more useful exercise is to look at the actual piece of paper that will land on someone’s desk, and work backwards from it.

In most cases, before any formal investigation, there is a preliminary phase under Article 17. The lead competent authority requests information from the economic operators under assessment about the actions they have taken to identify, prevent, mitigate, bring to an end or remediate risks of forced labour in their operations and supply chains. You have 30 working days to respond. The authority can skip that request where making it would jeopardise the outcome of its assessment, so this is the usual route rather than a guaranteed one. The authority then has 30 working days from receiving your information to decide whether a “substantiated concern” exists, which the guidelines define as “a reasonable indication based on objective, factual and verifiable information” to suspect that a product was likely made with forced labour.

If it concludes there is a substantiated concern, the matter moves to a formal investigation under Article 18, where the timescales change again: there the authority sets a deadline of at least 30 and no more than 60 working days for submissions, and must take into account the size and resources of the operator, including whether it is an SME, when considering extensions.

Those two stages are frequently conflated in summaries of this law. The distinction matters in practice, because the preliminary phase is the one where a good answer can end the matter before it becomes an investigation. That is the stage worth designing for.

Why this is a product question, not a supplier question

Here is the part that catches well-run programmes out.

Almost all supplier compliance data is supplier-shaped. A vendor register. A signed code of conduct per supplier. An ESG questionnaire per supplier. A risk score per supplier. If someone asks “what do we know about this vendor”, the answer is one row and a folder of attachments.

An Article 17 request arrives attached to a named product. The question is framed around your operations and supply chains, but the thing under assessment is a product, and a credible answer has to trace that product’s chain: from the finished item to the suppliers who contributed to it, to the specific sites those suppliers used, to the inputs that came from somewhere upstream. A supplier register cannot do that walk. It knows who you buy from. It does not know what is in what.

This is the single largest readiness gap we see, and it is a data modelling problem rather than a policy problem. The fix is to make the link between supplier, site and product an actual field in your supplier information management records rather than institutional knowledge held by a category manager. Teams that have already invested in procurement data management and supplier master data governance have a considerable head start here, because the hard part is not collecting the data once. The hard part is keeping the mapping accurate as the supply base changes.

A readiness self-test

For any product line you sell into or out of the EU, can you produce the following within 30 working days, without a special project?

Question	Where the answer should already live
Which suppliers contribute to this product, and which of their sites?	Supplier master data, with a product and site link
Which inputs come from an area or sector with documented forced labour risk?	Risk-based supplier segmentation and country or sector risk flags
What did we ask these suppliers, when, and what did they answer?	Supplier portal and evaluation history
What did we do when an answer was weak or missing?	Corrective and preventive action records
Can we show that trail without rebuilding it from inboxes?	Reporting and audit trail
Who owns the response, and how quickly can they assemble it?	A named owner and a cross-department process

A team that answers yes to all six is in good shape, whatever its policy documents say. A team that answers no to three or more will find 30 working days very short, which is the practical argument for starting now rather than in 2027.

If most of those answers currently live in spreadsheets and email threads, that is the thing to change first. The problem is not that spreadsheets hold the wrong data. It is that they cannot produce a defensible history of who was asked what and when, which is precisely what the preliminary phase turns on. This is the same case for replacing spreadsheets in supplier management that quality teams already know, arriving now from a compliance direction.

What due diligence buys you, and what it does not

Be clear on this, because the marketing around forced labour compliance is not.

The regulation does not impose a due diligence obligation. The Commission’s guidelines are explicit that it operates “whilst not imposing any specific due diligence obligations on companies”, while recognising due diligence as “a useful tool to address forced labour in supply chains”.

There is also no safe harbour. The guidelines state plainly that providing information “does not guarantee exculpation for the economic operator or that the product will not be subject to a ban decision”. No certificate, audit report or third-party attestation changes that. Any vendor promising forced labour compliance as a product is selling something the regulation does not offer.

So what is the return on doing the work?

Three things, all real. First, due diligence evidence is the material you put in front of the authority in the preliminary phase, and it is one of the inputs weighed when deciding whether a substantiated concern exists. Second, the guidelines note that where an operator demonstrates within the deadline that it is taking appropriate steps to address a forced labour situation, the authority may allow a reasonable period to complete them. That is discretionary rather than guaranteed, but it does not become available at all to a company that cannot show what it is doing. Third, and least discussed, the same evidence base serves several regimes at once.

That last point is the strongest commercial argument. The supplier data that answers an Article 17 request overlaps heavily with what you already collect for CSDDD and for ESG and CSRD requirements in onboarding. Collecting it once and reusing it is the difference between a manageable programme and four parallel questionnaires landing on the same supplier, which is the fastest way to depress response rates across all of them.

Four things worth doing in the next quarter

Deliberately capability-shaped rather than calendar-shaped, because the deadline is far enough away that a week-by-week plan would be theatre.

Start with products, not suppliers. Pick the two or three product families with the most exposure, judged on where inputs originate and which sectors they sit in. Map those properly, end to end. A complete map of three product families is worth more than a shallow questionnaire sent to every vendor, and it tells you how much work the full picture will be.

Make the supplier-to-product link a field. If the only place that knows which supplier feeds which product is a category manager’s memory or a spreadsheet tab, that is the first thing to fix. Everything else depends on it.

Ask once and reuse. Fold forced labour questions into the onboarding questionnaire and the existing evaluation cycle rather than launching a standalone campaign. Suppliers have a finite amount of attention, and evaluation fatigue is the reason well-designed programmes stall. Where you operate across borders, multi-language supplier onboarding matters more here than usual, since the suppliers closest to the risk are often the least likely to work comfortably in English.

Let the trail build itself. The audit trail should be a by-product of running the process, not a document someone writes afterwards. If a colleague has to reconstruct the history from inboxes, you do not have 30 working days, you have 30 working days minus a forensic exercise. Automated follow-up and continuous monitoring rather than annual reviews both help, because they leave a dated record as they go.

For regulated sectors the case is sharper still. Teams running supplier relationship management for medical devices or for pharma already maintain product-level supplier traceability for other reasons, and extending it is a smaller step than building it.

What exists today, and what does not

Worth being precise, because plans have already been built on things that are not there yet.

Available now. The guidelines, adopted 26 June 2026 and published in the Official Journal on 3 September 2026. They are a Commission Notice and non-binding, but they carry weight, not least because the Commission itself acts as lead competent authority for cases outside the EU. The Forced Labour Single Portal has been live since 30 June 2026. Commission Implementing Regulation (EU) 2026/903 of 24 April 2026, in force since 17 May 2026, specifies the details and functionalities of the system competent authorities and customs will use to exchange information, which is a reasonable signal of how coordinated enforcement is intended to be.

Not available yet. The database of forced labour risk areas and products under Article 8. The Commission’s own page for it still carries the label “Database in development”. When it does arrive it will be indicative and non-exhaustive by design, so it will inform your risk assessment rather than settle it. Any guidance telling you to check your products against the database today is describing something that does not exist, and any plan that waits for it is fifteen months of waiting.

Coming up. The Commission is running a webinar series through autumn 2026: solar on 13 October, textiles on 20 October, electronics and semiconductors on 12 November, agri-food on 17 November, automotive on 19 November, and fisheries on 24 November. If one covers your category, it is a direct read on how the Commission thinks about risk in your sector, which is useful input for deciding where to start.

The encouraging part

Strip away the novelty and this regulation asks for something procurement teams have been building towards anyway: knowing what is in your products, knowing who made each part, knowing what you asked and what came back, and being able to show it quickly.

Teams already running structured supplier evaluation with a working supplier risk management process have most of the machinery. What usually needs adding is the product dimension and the speed of retrieval. Both are ordinary data problems with ordinary solutions, and fifteen months is a comfortable runway for ordinary data problems.

The teams that will struggle in December 2027 are not the ones with gaps in their supply chains. Every supply chain has gaps. They are the ones who cannot describe their own supply chain quickly enough to have a useful conversation about it.

If you want to see what product-level supplier traceability looks like in practice, a supplier performance pilot on a single product family is a low-commitment way to find out, or you can book a demo and we will walk through it with your own categories.

Frequently asked questions

When does the EU Forced Labour Regulation apply?
It applies from 14 December 2027. The regulation entered into force on 13 December 2024, and Member States were required to designate their competent authorities by 14 December 2025.

Does the EU Forced Labour Regulation require due diligence?
No. The Commission’s guidelines confirm it does not impose specific due diligence obligations. Due diligence is still practically important, because the evidence of it is what you submit during the Article 17 preliminary phase, and one of the inputs the authority weighs when deciding whether a substantiated concern exists.

Is there a safe harbour if we can show strong due diligence?
No. The guidelines state that providing information does not guarantee exculpation or that a product will avoid a ban decision. Certificates and audit reports are not a safe harbour either. What good evidence buys you is a faster, more credible response and, at the authority’s discretion, potentially time to complete remediation steps.

How long do we have to respond to an information request?
30 working days in the preliminary phase under Article 17. The authority then has 30 working days from receiving your response to decide whether a substantiated concern exists. If the matter moves to a formal investigation under Article 18, the authority sets a separate deadline of at least 30 and no more than 60 working days.

Are small and medium enterprises exempt?
No. There is no SME exemption and no value threshold. SMEs do receive specific consideration: Article 10 provides for support measures for SMEs, and the Commission’s guidelines note that SMEs can seek help from a national contact point on how to engage with the lead competent authority. Authorities are directed to weigh size and economic resources when prioritising enforcement, and must take them into account when setting deadlines during an investigation under Article 18(4).

Can we check our products against the EU forced labour risk database?
Not yet. The Article 8 database is still in development as of late September 2026. When published it will be indicative and non-exhaustive, drawing on sources such as ILO reporting, so it will support your own risk assessment rather than replace it.

What happens to products found to be made with forced labour?
The authority prohibits placing or making them available on the EU market and prohibits export, orders withdrawal of products still being made available, and orders disposal. Products are disposed of in line with the waste hierarchy, by recycling where possible or otherwise rendering them inoperable; perishable products are donated for charitable or public interest purposes. Operators generally get at least 30 working days to comply for non-perishable goods and 10 working days for perishable goods. Products that have already reached end users are not withdrawn.

---

Sources

• Regulation (EU) 2024/3015 on prohibiting products made with forced labour on the Union market, Official Journal, 12 December 2024
• Commission Notice: Guidelines on the application of Regulation (EU) 2024/3015, C/2026/4637, Official Journal, 3 September 2026
• Commission Implementing Regulation (EU) 2026/903 of 24 April 2026
• European Commission, Forced Labour Regulation, including the Single Portal and the 2026 webinar series
• European Commission, Which products and areas are at risk of forced labour, database status
• European Parliament legislative observatory summary, entry into force and application dates

Related reading

• The Purchasing Manager’s Guide to CSDDD
• ESG, CSRD and CSDDD Requirements in Onboarding
• The EU AI Act for Procurement: The Complete 2026 Guide
• Supplier Compliance Management Software: Tracking and Audits
• Digital Supplier Audits and Remote Compliance
• KYC and KYB in Supplier Onboarding

Just under 100 days separate us from 30 December 2026, the date the EU Deforestation Regulation starts to apply to large and medium operators and traders. Micro and small operators that are new to the rules have until 30 June 2027, although those already covered by the old EU Timber Regulation are in the December group.

After two postponements, this date looks firm. In its simplification review of May 2026 the European Commission confirmed that the regulation will not be reopened and that the existing timelines continue to apply. The July 2026 package then delivered the practical pieces teams had been waiting for: an updated product scope, a working information system, and guidance and FAQs in all EU languages.

Here is the encouraging part. Most of what EUDR asks for is supplier data, and collecting supplier data at scale is something procurement teams already know how to do. The teams that will be comfortable in December are not the ones with the best legal memo. They are the ones who started the data campaign early and kept the response rate high.

The short version

• 30 December 2026 is the application date for large and medium operators and traders, plus micro and small operators previously covered by the EU Timber Regulation. 30 June 2027 applies to other micro and small operators.
• Seven commodities are in scope: cattle, cocoa, coffee, oil palm, rubber, soya and wood, along with many derived products such as leather, chocolate, tyres, furniture and paper.
• The core deliverable is a due diligence statement (DDS) submitted through the EU information system, which returns a reference number that travels down the chain.
• Geolocation is the hard part. You need coordinates for every plot of land where the commodity was produced, plus evidence that production was legal in the country of origin.
• Records are kept for five years, so this is a permanent data set, not a one-off filing.
• Several simplifications genuinely reduce the workload, including one statement covering multiple shipments in defined cases, reuse of upstream reference numbers by downstream operators, and a group authorised representative.
• Penalties are meaningful, with maximum fines of at least 4 percent of total annual EU-wide turnover, so this is worth doing properly.

What actually decides whether you are ready

Almost every EUDR article focuses on the legal obligations. That framing is useful for the general counsel and much less useful for the person who has to make it happen.

In practice, readiness comes down to one number: the share of your in-scope suppliers who have returned complete, usable data. A legal analysis can be finished in a week. Getting plot coordinates out of several hundred suppliers across multiple countries and languages takes months, because it depends on people outside your organisation finding time to answer you.

That reframing changes what you do first. Instead of starting with the regulation, start with the list of suppliers you need to hear from, and treat the next 14 weeks as a structured data campaign with owners, reminders and a visible completion rate. This is the same discipline as a good supplier onboarding programme, applied to a narrower question.

The data you need from suppliers

The regulation is specific about the information an operator has to collect and keep. For each in-scope product, that means:

1. Product description, including HS code, trade name and the commodities it contains.
2. Quantity, expressed in net mass and, where relevant, volume or number of units.
3. Country of production, and for some chains the specific region.
4. Geolocation of every plot of land where the commodity was produced. For cattle, this extends to every establishment where the animals were kept from birth to slaughter.
5. Evidence of legal production under the laws of the country of origin, covering land use rights, environmental and forest rules, labour rights and tax and customs obligations.
6. Supplier and customer details for products that already carry due diligence, including the reference numbers of the statements attached to them.

Two practical notes make this much easier to run. First, composite products need geolocation for each in-scope commodity they contain, so a chocolate bar with cocoa and palm oil generates two data trails rather than one. Second, the five-year retention requirement means this belongs in your permanent supplier master data, not in an inbox folder.

Where the simplifications genuinely help

The December 2025 revision and the 2026 packages removed real work. Four changes are worth building your plan around.

One statement can cover several shipments. Where the material comes from the same assessed harvest events and nothing in the supply chain has changed, a single due diligence statement can cover multiple shipments within a year. That turns a per-consignment task into a per-supply-chain task, which is a very different workload.

Downstream operators reuse reference numbers. Companies handling products for which due diligence has already been done collect and retain the upstream reference numbers rather than repeating the exercise. First-level downstream operators are not required to chase suppliers for those numbers either, since upstream operators provide them. If most of your volume is bought inside the EU from operators who have already filed, your job is largely to capture and store numbers reliably.

Groups can use one authorised representative. A single EU-established entity can submit statements on behalf of group members, which helps organisations with many legal entities. Legal responsibility still sits with each operator, so internal ownership still needs to be clear. If you run a multi-entity supply base, the same logic as multi-entity, multi-language onboarding applies here.

Country benchmarking reduces effort on low-risk origins. Where a commodity comes from a country classified as low risk, simplified due diligence applies and a full risk assessment is not required unless a substantiated concern arises. Knowing your origin mix early tells you where the real work sits.

Scope has narrowed in useful places. Printed products such as books and newspapers came out in December 2025. The July 2026 delegated act removed cattle hides and leather, retreaded tyres, soybeans for sowing, rubber articles, belts and vehicle seats, and added soluble coffee, certain palm oil derivatives and frozen cattle tongues, with the newly added products applying from 30 December 2027. Re-checking your HS codes against the current list is one of the highest-return hours you can spend this month.

A 14-week supplier data plan

Weeks 1 to 3: scope and segment

1. Pull every purchased item against the current in-scope HS code list and confirm your own status as operator, trader or downstream actor. Scope errors are the most expensive mistake available, and they are cheap to fix now.
2. Split in-scope suppliers into three groups: EU suppliers who will pass you a reference number, direct importers where you own the full due diligence, and suppliers whose status you cannot yet tell.
3. Rank by volume and by origin risk. A simple risk-based segmentation tells you which twenty suppliers deserve a phone call rather than an email.

Weeks 4 to 7: launch the data request

1. Build one request form per supplier group rather than one for everybody. A supplier passing you a reference number should not be asked for plot coordinates.
2. Send it through a channel that tracks who has responded. A supplier portal with a visible completion status beats an email campaign, because you can see the gap rather than guess at it.
3. Tell suppliers why you are asking and what happens if the data is late. Suppliers respond faster to a clear commercial consequence and a named contact than to a forwarded regulation.
4. Set automated follow-up on a fixed cadence. Response rates rise sharply with the second and third reminder, and nobody has time to chase 300 suppliers by hand.

Weeks 8 to 11: assess, verify and close gaps

1. Run risk assessment on what has arrived: check coordinates resolve to plausible plots, check legality evidence is current, and check the country classification you assumed.
2. Escalate non-responders commercially. Category managers move data faster than compliance reminders do.
3. For high-volume or high-risk origins, decide whether you need mitigation such as satellite checks, third-party verification or a remote supplier audit.
4. Treat every missing or failed data point as a tracked action with an owner and a date, the same way you would handle a supplier corrective action.

Weeks 12 to 14: file and prove

1. Register in the information system, dry-run a due diligence statement for one straightforward chain, and confirm the reference number flows to the people who need it.
2. Decide which chains qualify for a single multi-shipment statement and document why, since that reasoning is what you will be asked about later.
3. Make sure every decision, document and reference number sits in a reporting and audit trail that someone can navigate in minutes, with retention set to five years.

If you finish the first two blocks and are still collecting in week 12, that is normal. The value of starting now is that the gap is visible while there is still time to close it.

The data is worth more than the filing

It is tempting to treat this as a compliance cost. The more useful view is that you are about to build something your organisation has wanted for years: a verified map of where your material actually comes from, down to the plot.

That map answers questions well beyond deforestation. It tells you your true origin concentration, which is a supply continuity question. It feeds CSRD and CSDDD reporting rather than duplicating it, since much of the same evidence is requested twice under different names. It gives customers a credible answer when they flow their own requirements down to you. And it supports the wider supplier ESG picture you are already being asked for.

Teams that build this once, in a structured system, spend the following years maintaining it. Teams that build it in a spreadsheet for December rebuild it every time someone asks a new question. The same logic applies here as in the shift from annual reviews to continuous monitoring: the cadence you design now decides how much effort next year costs.

Where software helps

No platform makes you EUDR compliant, and any vendor who says otherwise is overselling. What good software does is remove the two things that actually break these programmes: chasing people, and losing evidence.

EvaluationsHub handles the supplier-facing layer of exactly this work. Structured data requests with per-supplier completion tracking, automated reminders that keep the response rate climbing, documents and evidence stored against the supplier record rather than in an inbox, and an audit trail that builds itself as the team works. It connects to the rest of the supplier lifecycle too, so origin and compliance data sits beside supplier scorecards, risk and corrective actions instead of in a separate silo. If you are also working through the broader due diligence agenda, our purchasing manager’s guide to CSDDD covers the neighbouring requirement.

If you want to see what this looks like with your own supplier list, you can run a focused pilot or book a demo.

Frequently asked questions

When does EUDR apply?
The EU Deforestation Regulation applies from 30 December 2026 for large and medium operators and traders, and for micro and small operators that were already covered by the EU Timber Regulation. Other micro and small operators have until 30 June 2027. Products added by the July 2026 delegated act apply from 30 December 2027.

Which products are covered by EUDR?
Seven commodities are in scope: cattle, cocoa, coffee, oil palm, rubber, soya and wood, together with many derived products including leather, chocolate, tyres, furniture and paper. The list has changed more than once, so check current HS codes rather than an older summary.

What supplier data does EUDR require?
Product description and HS code, quantity, country of production, geolocation coordinates for every plot of land where the commodity was produced, evidence that production was legal in the country of origin, and supplier and customer details including reference numbers of any existing due diligence statements. Records are kept for five years.

Do I need a due diligence statement for every shipment?
Not always. A single statement can cover several shipments within a year where the material comes from the same assessed harvest events and the supply chain has not changed. Once different harvest events are involved, a new statement is needed.

What if I only buy from EU suppliers?
You are likely a downstream actor for much of that volume. In that case your main obligation is to collect and retain the reference numbers of the due diligence statements provided by your suppliers, rather than repeating the underlying due diligence yourself.

What are the penalties for non-compliance?
Member States set penalties, with maximum fines for legal entities of at least 4 percent of total annual EU-wide turnover. Other sanctions include confiscation of products and revenues, temporary exclusion from public procurement and public funding, and a temporary ban on placing or exporting the products concerned.

Is EUDR going to be delayed again?
In its simplification review of May 2026 the Commission confirmed that the regulation will not be reopened and that existing timelines continue to apply. Planning around 30 December 2026 is the prudent assumption.

---

Sources: European Commission, Regulation on deforestation-free products; European Commission, Commission updates product scope and tools to support EUDR, 13 July 2026; Council of the EU, Council signs off targeted revision to simplify and postpone the regulation, 18 December 2025; Baker McKenzie, EU Commission publishes simplification review of EUDR, May 2026; Schoenherr, EU Deforestation Regulation: is your supply chain ready?.