A changing regulatory environment: what has evolved since September

• US · withhold release orders

  Two new withhold release orders, on palm oil. On 29 September CBP issued orders against palm oil and derivative products from two Indonesian producers, Mitra Aneka Rezeki and Hardaya Inti Plantation, citing nine and seven ILO forced labour indicators respectively, from debt bondage and withheld wages to intimidation and abusive living conditions. CBP says its evidence included interview transcripts, payroll slips and harvest quota records.¹ Palm oil is also an EUDR commodity, and certain palm oil derivatives come into EUDR scope from 30 December 2027.² Supply chain regulatory convergence anyone?

  Read more

• USMCA · Rapid Response Labor Mechanism

  Labour rights are being enforced facility by facility. In four weeks USTR announced eight actions under the USMCA Rapid Response Labor Mechanism: three new requests for review, three resolutions and two agreed courses of remediation.³ The latest request, on 13 October, concerns Carolina Performance Fabrics in Guanajuato, a maker of automotive textiles, where a union petition alleged retaliation against workers trying to organise and USTR directed Treasury to “suspend liquidation of unliquidated entries of goods from Carolina”.⁴ Cases close as well as open: on 23 October USTR directed Treasury to resume liquidation of entries from Amphenol Optimize in Sonora after the agreed remediation, including reinstating nine workers with back pay, had been carried out, and the United States and Mexico agreed a course of remediation at Newmont’s Peñasquito mine in Zacatecas, due to be completed by 28 October.⁵

  Read more

• Section 301 · G20 · China

  Tariffs in court, reactions evolving. On 30 September the Court of International Trade heard the challenges to the Section 301 forced labour tariffs; USTR told the judges it required an “express ban”, and the duties remain in effect while the court considers supplemental briefs.⁶ At the G20 Trade Ministerial, which ended on 1 October, only Mexico and Argentina joined the US in a statement recognising their responsibility to adopt or maintain, and effectively enforce, bans on the import or sale of goods made with forced labour.⁷ Beijing, for its part, extended to 27 December its two investigations into US measures that “disrupt global industrial and supply chains”, launched in response to the US forced labour and excess-capacity Section 301 investigations, alongside a US-China trade truce now running to 10 January 2027.⁸

  Read more

Whatever the court decides, the route to the lower tariff tier is legislation, and that tier rewards having a ban, including for economies found not to enforce one.⁹ As I said in July, enforcement capability is the next differentiator, for governments and for companies.

• EU · Empowering Consumers Directive

  Claims are now regulated statements. Since 27 September the EU’s Empowering Consumers Directive has applied. Generic environmental claims are banned unless backed by recognised excellent environmental performance relevant to the claim, and claims of a neutral, reduced or positive climate impact based on offsetting are banned outright. Sustainability labels must be based on a certification scheme or established by public authorities, a rule that covers social characteristics as well as environmental ones.¹⁰ As I noted previously, what a company says about its products, including how they were made, is now something a regulator can test.

  Read more

• Litigation · traceability

  The traceability question reaches the courtroom. Workers suing Starbucks in a proposed class action in federal court in Washington State allege it relied on Brazilian coffee farms where they were forced to endure inhumane conditions; Starbucks has asked the court to dismiss the case, arguing the plaintiffs “haven’t shown the plantations that employed them supplied its beans”.¹¹ At this stage the dispute is about traceability: who can show which farm supplied which chain.

  Read more

• California · SB 253

  Climate data required in California. The Office of Administrative Law approved CARB’s initial regulation on 12 October, effective immediately, setting 10 November for the first Scope 1 and 2 reports under California’s SB 253, with Scope 3 reporting to begin in 2027.¹² SB 253 itself has not been enjoined, and the Ninth Circuit has yet to rule on the challenge to it; the companion climate-risk law, SB 261, remains paused.¹³

  Read more

• EU · steel melt and pour

  Steel now has to show where it was melted. Since 1 October, importers of steel into the EU must provide evidence of the country where it was melted and poured, under the regulation that replaced the steel safeguard from July; the type of evidence is set by Implementing Regulation (EU) 2026/1963, and from as early as October 2027 the data will also be used to distribute quotas by country.¹⁴ Trade defence, not only sustainability law, is now pulling traceability upstream.

  Read more

• EU · CBAM

  Carbon at the border: CBAM goes to trilogue. Technical meetings to prepare trilogue negotiations on extending CBAM to downstream steel- and aluminium-intensive goods began on 28 September, with the three institutions’ positions ranging from about 180 to 457 product types.¹⁵ On the other hand, on 8 October USTR opened a comment process on CBAM and its expansion that asks “whether and what enforcement action may be appropriate to remedy any negative effects of CBAM”.¹⁶

  Read more

• US · low-value shipments

  Visibility reaches the parcel. On 8 October CBP proposed rules for low-value shipments: electronic entry on or before importation, new sender and tracking data for mail, bonds for filers, and a power to require full formal entry by importer, manufacturer or category of goods, citing among other things the enforcement of “laws governing forced labor, rules of origin, origin marking”.¹⁷ With September’s advance notice on supply chain disclosures, the data ask is moving beyond the container to include the parcel.

  Read more

• EU · CSDDD

  CSDDD: the argument is now about reach, not existence. The US government’s comments on the CSDDD guidelines ask the EU to confine the Directive to the EU subsidiaries and EU business partners of US companies, to treat countries with robust regulatory systems as presenting “negligible risk”, to base fines “exclusively on revenue generated from activities within the EU”, and to allow civil claims only after a supervisory authority has assessed compliance.¹⁸ Meanwhile Sweden’s inquiry, published on 17 September, proposes a new Corporate Responsibility Act to transpose the Directive,¹⁹ which counsel describe as a minimum-implementation approach for the largest companies, entering into force on 26 July 2029.²⁰

  Read more

• UK · Immigration and Asylum Bill

  United Kingdom. In the Commons committee on the Immigration and Asylum Bill, a new clause first tabled by Liam Byrne MP, and on the 21 October amendment paper standing in the names of Sir Gavin Williamson, Sir Iain Duncan Smith and Sir Alec Shelbrooke, would require organisations with turnover of £36 million or more to take “reasonable and proportionate steps to prevent slavery and human trafficking” across their operations, subsidiaries and value chain, with penalties of up to 5% of global turnover and exclusion from public procurement.²¹ A second clause would let the Secretary of State designate goods “presumed to be made with the involvement of, or as the result of, forced labour”, and require organisations to disclose whether they import, export or sell them.²² Neither is a government clause, and the committee had not reached them by 22 October, but together they put the move from a transparency statement to a duty to prevent on the parliamentary record.²³

  Read more

• UK · illegal working

  United Kingdom: illegal working liability now runs down the contract chain. Since 1 October, UK right-to-work checks and civil penalties reach beyond employees to workers, individual subcontractors and people engaged through online matching services, and a business can be liable for illegal working further down its contracting chain, including where a contract allows substitution. Penalties start at £45,000 per illegal worker, or £60,000 for a repeat breach, and the statutory excuse for this extended liability depends on prescribed contract terms, checks on any substitute and identity verification all being in place before the work begins.²⁴ In effect, due diligence on labour supply, with a price per worker attached.

  Read more

• Canada

  Canada. On 8 October Ottawa published two “What We Heard” reports, on strengthening its forced labour import ban through Bill C-35 and on due diligence and civil liability. Stakeholders broadly backed risk-based, transparent import controls and a due diligence law with public reporting that complements C-35. “Views were divided” on letting victims sue in Canadian courts.²⁵

  Read more

• Australia · Asia-Pacific

  Australia and the Asia-Pacific. Consultation on a criminal offence of failing to prevent modern slavery closed in Australia on 25 September, and the Attorney-General’s Department intends to publish the responses.²⁶ Walk Free reports Indonesia advancing proposals for mandatory human rights due diligence and Thailand for stronger corporate accountability.²⁷

  Read more

• Trafficking · FATF · prosecutors

  The financial crime thread. The State Department’s 2026 Trafficking in Persons Report, released on 8 October, identifies twelve countries with a documented government “policy or pattern” of trafficking, and estimates that Americans lost at least US$18.2 billion to Southeast Asia-based scams in 2025.²⁸ FATF’s President said this month that FATF is conducting “a focused review of the end-to-end illicit financial flows from scam compounds”, which AML Intelligence describes as places where trafficked or coerced workers are forced to run the scams.²⁹ Prosecutors are moving too. On 1 October the Justice Department’s Fraud Division told its prosecutors to prioritise “fraud schemes involving tariff evasion, importation of goods or services, or forced labor” in corporate investigations, and its leadership to design programmes that “incentivize whistleblowers to bring forward credible information pertaining to fraud”.³⁰ With September’s FinCEN alert,³¹ questions about forced labour will increasingly come from the bank and the prosecutor as well as the customer.

  Read more

Looking at all of the above, this month’s developments line up behind the three operating model implications from July.

• Implication one

  Sourcing strategy owns more of this. Market access now turns on named producers, named facilities and the exporting country’s own law: orders on two palm oil producers, liquidation suspended at one textile plant, tariff tiers keyed to national bans. In Canada, Aviva Canada’s national manager of risk management solutions described companies covered by the supply chain reporting law telling suppliers: “I need to know more about your supply chain because you’re part of my supply chain.”³²

  Read more

• Implication two

  Worker voice is becoming evidentiary infrastructure. CBP’s palm oil orders rest in part on interview transcripts and payroll slips, and the Carolina case began with a union petition. Regulators are acting on workers’ own accounts and their organisations, which is why grievance systems built as CSR programming will struggle to prove what companies now need to prove.

  Read more

• Implication three

  Data architecture is destiny. Melt-and-pour evidence, parcel-level entry data, CBAM emissions, Scope 1 and 2 filings and substantiated claims all draw on the same underlying capability: knowing your chain and being able to show it.

  Read more

The common thread is the one this series started with. The claim on the pack, the modern slavery statement, the choice of supplier and the emissions number were once managed for reputation. Each is becoming something a regulator, a customs officer or a court can test.