Every January someone publishes a list of supplier relationship management trends. Most of it could have been written in any year. This piece takes a different route. It starts from the dates that are already fixed for 2027, works out what each one asks of your suppliers, and only then asks how SRM work has to change to keep up.

The short answer: 2027 is the year several postponed deadlines actually arrive. Deforestation, carbon border, batteries, cybersecurity, forced labour and high-risk AI all land within twelve months. Each one needs supplier data. Very few of them need it in the same shape.

All dates below were checked against primary or professional sources at the end of September 2026. Where something is expected but not confirmed, I say so. If you want the market view (vendors, analyst evaluations, how to choose tools), our SRM research overview covers that ground; this post stays on the calendar.

Three kinds of 2027 date

Before the table, one distinction that makes it easier to plan. The 2027 dates fall into three groups, and each group calls for a different kind of work.

• Hand-over dates. A supplier must give you specific data by a specific day, or you cannot file, import or sell. EUDR, CBAM and the battery passport are in this group. The work is collection.
• Test dates. Nothing is filed, but from this day an authority can ask you a question and your answer will be judged. The Forced Labour Regulation, the Cyber Resilience Act and the Machinery Regulation sit here. The work is readiness: can you answer quickly, with evidence?
• Drafting dates. The rulebook is still being written, and what gets written will shape your 2028 and 2029 requests. The CSDDD guidelines and the ISO 9001:2026 transition belong here. The work is watching, and not over-building.

Most SRM teams treat all three the same way, with a questionnaire. That is how supplier fatigue starts.

The 2027 calendar for supplier managers

A few notes on precision. The EUDR dates come from the European Commission’s EUDR page. The CBAM dates follow the CBAM Omnibus, Regulation (EU) 2025/2083, as summarised by EY and confirmed by KPMG. The battery due diligence postponement is in Regulation (EU) 2025/1561. The Cyber Resilience Act date is on the Commission’s CRA page. The Forced Labour Regulation date is confirmed by Linklaters and Squire Patton Boggs.

The AI Act row deserves a word of its own. The high-risk delay was only a proposal until mid-2026. It is now law: Regulation (EU) 2026/1744 was published in the Official Journal in July 2026, moving Annex III obligations to 2 December 2027 and product-embedded (Annex I) systems to 2 August 2028. Our AI Act guide for procurement covers the rest of that regulation.

What is not on the calendar, and why

• ISO 9001:2026 transition. The standard was published in September 2026. Certification bodies expect ISO 9001:2015 certificates to remain valid until 30 September 2029, but that end date is still subject to confirmation by the accreditation body. Expect supplier recertifications to trickle through 2027 rather than arrive on one date. Ask for the certificate edition in your supplier records now so you can see the drift.
• ESPR digital product passports. The Ecodesign Regulation has been in force since July 2024, and passports arrive product group by product group through delegated acts. I found no product group with a confirmed 2027 application date. The battery passport, which sits under the Batteries Regulation, is the first passport most supplier managers will meet.
• CSDDD itself. After Omnibus I (Directive (EU) 2026/470), companies apply the directive from 26 July 2029. The only 2027 CSDDD date is the Commission’s guidelines deadline.

Five shifts in how SRM work gets done in 2027

A calendar with thirteen rows does not fit inside an annual supplier review. That mismatch drives most of what changes next year.

1. Continuous monitoring replaces the annual cycle

An annual review assumes one moment a year when you ask everything. In 2027 the deadlines are spread from January to December, and the test dates can arrive on any working day as a letter from an authority. The only workable pattern is to monitor signals continuously (certificate expiry, sanctions hits, delivery performance, incident reports) and reserve supplier effort for the points where a date or a signal demands it. We set out that model in moving from annual reviews to continuous supplier monitoring.

2. Supplier, site and part replace the flat vendor record

Look at the second column of the table again. EUDR asks about plots and products. CBAM asks about installations. The battery passport attaches to a product. A forced labour request names a product. Almost none of the 2027 obligations are satisfied by a record that says “Supplier X, country Y”. If your supplier master cannot tell you which site makes which part, and since when, 2027 is the year that gap becomes visible to people outside procurement.

3. Collect once, report many times

The same supplier will be asked for plant locations by trade compliance for CBAM, by sustainability for CSRD and by procurement for EUDR. Three requests, three formats, one answer. The fix is a shared supplier data layer where each field is collected once, to the strictest standard any regime needs, and tagged with the purpose it serves. The purpose tag matters. The CSRD value chain cap protects suppliers with 1,000 employees or fewer from CSRD requests beyond the voluntary standard, but it does not limit a request made for EUDR or CBAM. You can only respect that line if you record why you asked.

4. Supplier response rate becomes a planning constraint

Every hand-over date on the calendar depends on a supplier replying. A small cocoa cooperative, a Turkish steel mill and a Chinese battery cell maker have finite attention, and your competitors are asking them too. In 2027 the binding constraint on compliance will often be the reply rate rather than the regulation. Good teams will plan requests the way they plan capacity: fewer, shorter, pre-filled with what you already hold, and returned with something useful for the supplier, such as their own scorecard. A two-way supplier portal helps because the supplier updates one record instead of answering five emails.

5. AI proposes, people approve

The volume of signals in shift one is more than a small SRM team can read. One answer is AI that watches contracts, scorecards and risk feeds, then proposes an action with its reasoning. The sensible design keeps a person in charge of anything that reaches a supplier and logs every decision. If you are evaluating tools on this point, our guide on how to compare AI features in SRM software sets out the questions to ask. The AI Act dates above are also a reminder to check which AI in your own stack falls into a regulated use before 2 December 2027.

A 2027 planning routine that fits on one page

1. Map each row to categories. For every date, list the categories and suppliers affected. Most organisations will find that only some rows apply, and that is useful to know early.
2. Tag each row by type. Hand-over rows go into a collection plan with supplier deadlines set four to six weeks before yours. Test rows go into a readiness check: could you answer a request about a named product quickly, with evidence? Drafting rows go on a watch list.
3. Build the site layer where two or more rows overlap. If a supplier appears in the EUDR, CBAM and forced labour rows, start there.
4. Merge the requests. One campaign per supplier per quarter, not one per regulation.
5. Close the loop. Missing or poor data becomes a corrective action with an owner and a date, tracked like any other supplier nonconformity, alongside OTIF and PPM issues. A supplier who cannot supply EUDR geolocation is a supplier quality problem, and CAPA is the tool you already use for those.

Where EvaluationsHub, InitiativesHub and Eva AI fit

Read the calendar again and it is a data problem before it is a compliance problem. EvaluationsHub is a supplier performance and lifecycle management platform: supplier risk, ESG and CSRD data, weighted performance scorecards, CAPA, QBR management and a two-way supplier portal, with an audit trail on every change. It holds the supplier record the table depends on, and it is ISO 27001 certified and hosted on AWS in the EU.

InitiativesHub covers the execution side of the lifecycle: intake, RFx, supplier qualification, awarding, contract management with SLAs and KPIs mapped to clauses, and onboarding with a handover into EvaluationsHub. That handover matters for 2027, because EUDR, CBAM and battery requirements are easiest to write into a contract at award, not bolt on afterwards.

Eva AI sits on top of both. It is designed to compare contract KPI obligations against live scorecard data and propose a CAPA when a deviation crosses a threshold, to monitor risk signals against your acceptance frame and recommend a compliance workflow linked to the relevant clause, and to surface cost reduction candidates as projects in InitiativesHub. Every proposal is held for human approval, shows its reasoning, and lands in an exportable AI decision audit log. Nothing reaches a supplier without a person saying yes.

If you want to see how your 2027 calendar would map onto it, book a demo.

Frequently asked questions

What will change in SRM in 2027?

The main change is volume and timing. Thirteen EU dates with supplier data implications fall between 30 December 2026 and 30 December 2027, including EUDR, CBAM, the battery passport, the AI Act high-risk rules, the Cyber Resilience Act and the Forced Labour Regulation. That pushes SRM towards continuous monitoring, site and product-level supplier data, and fewer but better supplier requests.

Were the AI Act high-risk obligations delayed?

Yes. Regulation (EU) 2026/1744, published in the Official Journal in July 2026, moved obligations for stand-alone high-risk systems listed in Annex III to 2 December 2027, and for high-risk AI embedded in regulated products to 2 August 2028.

When does the EU Forced Labour Regulation apply?

From 14 December 2027, under Regulation (EU) 2024/3015. The practical preparation for supplier managers is to be able to show, for a named product, which supplier sites and inputs sit behind it.

Does CSDDD apply in 2027?

No. After Omnibus I, companies apply CSDDD from 26 July 2029. In 2027 the relevant date is 26 July, the Commission’s deadline for general due diligence guidelines. Newly in-scope CSRD companies, however, start collecting value chain data for financial year 2027.

By Prof. Dr. Bert Paesbrugghe, founder of EvaluationsHub and associate professor at IÉSEG School of Management.