What a month (in so many ways, IYKYK). But, as to the changing regulatory environment…
The US concluded its Section 301 forced labour investigations of 60 economies and imposed tariffs of 10 to 12.5%, effective 24 July. Vietnam, Honduras, Guatemala, India, Indonesia and Brazil adopted or advanced forced labour import bans, several within days of each other. The European Commission published its Forced Labour Regulation guidelines, adopted the simplified sustainability reporting standards, and updated the EUDR. The ban on destroying unsold clothing and footwear took effect in the EU, and the first European Digital Product Passport standards were published. The UK introduced a bill that gives modern slavery reporting real penalties, and Australia proposed a criminal offence for failing to prevent modern slavery. If you needed evidence that supply chain sustainability has moved from reputation-driven needs to regulation-driven imperatives, this past month is it.
The regulatory environment is clearly in a time of change. Yes, there have been delays, and yes, the EU omnibus process changed things. But step back from any single regulation and the picture is unmistakable: the regulatory environment is broadening, and it is hardening. What was proposal and consultation a year ago is now guidance, portals, tariffs and penalties.
It was time to update this post and reorganise the list to explore the shape they are taking. Four big ideas organise what is happening: market access is the new enforcement, products must carry their own evidence, due diligence is becoming law with teeth, and all of this lands on the operating model with direct impacts on supply chain costs, resilience, efficiency, risk, circularity and value creation — the time for transformation.
1. Market access is the new enforcement
Forced labour laws are obligations of results. If forced labour is in the product, anywhere in the chain, the product can lose market access. The US started the (slow but expanding) enforcement process years ago, the EU Forced Labour Regulation applies from December 2027, and the ILO has documented why import bans can play a role with the right supporting measures. What changed this year is the scale of the machinery behind this obligation.
Start with the US. On 12 March 2026, USTR initiated Section 301 investigations of 60 economies for failing to impose and enforce forced labour import bans. On 23 July, the final action landed: additional tariffs of 10% on 17 economies that have bans or made commitments through reciprocal trade agreements, 10% net of MFN on the EU and Taiwan, 12.5% net of MFN on Japan, South Korea and Switzerland, and 12.5% on the remaining economies investigated, including China, Brazil, Vietnam and Australia. Every one of the 60 economies was found actionable, 54 because they had no forced labour import prohibition at all. Forced labour has formally become tariff policy, complete with machinery of its own: annex exclusions for Section 232 goods and scarce raw materials, and textile tariff-rate quotas for Bangladesh, Cambodia, Indonesia and Malaysia tied to their use of US cotton and textile inputs.
And notice the design: economies that made commitments through trade agreements got the lower tier, which means the forced labour clauses in the recent US reciprocal trade agreements (Bangladesh, Indonesia, Cambodia, Malaysia and others) have created a price for non-performance. The mechanism is clearly working: Cambodia, Guatemala, Honduras, India, Sri Lanka and Trinidad and Tobago adopted prohibitions between the June proposal and the July final action, and were repositioned into the 10% tier for it.
The underlying USTR report supplies the numbers behind the policy (ILO: 27.6 million people in forced labour, 86% in the private economy, 63.9 billion dollars a year in illegal profits from lost wages, excluding commercial sexual exploitation) and a template. An acceptable regime is a ban covering even negligible forced-labour inputs plus eight elements of effective enforcement, from statutory definitions and entity lists to rebuttable presumptions, remediation and transparency. Expect every new national ban to be graded against this checklist and expect controversy: trade law commentators have already picked at the report’s foundations, from the US’s own enforcement gaps to its treatment of prison labour. Challenges will come. However, the direction of travel will continue as can be seen by subsequent evolutions.
In a matter of weeks, forced labour import bans were adopted or advanced by Vietnam (Decree 292/2026), Honduras (executive decree), the Dominican Republic (Decreto 502-26, 23 July 2026), Guatemala (Acuerdo Ministerial 377-2026), India (an enabling framework in its Foreign Trade Policy), Indonesia (Permendag 9/2026) and Brazil (a long-pending bill, revived and expanded with due diligence provisions). Mexico had already updated its forced labour mechanisms under the USMCA. Whatever one thinks of tariffs as an instrument, proliferation is happening in real time. Let’s be clear though, as Walk Free states on Indonesia, Pakistan, and El Salvador import bans, “bans risk becoming paper promises with little real change for workers” and as Amnesty International states in BBC News, as carried by BHRRC, trade measures “are not a substitute for effective enforcement, corporate accountability and mandatory human rights due diligence.” Obviously, enforcement capability is the next differentiator, for governments and for companies.
US enforcement itself is getting more operational and more forensic. In June, CBP issued its first consolidated Forced Labor Enforcement Operational Guidance for Importers, spanning Section 307, the UFLPA and CAATSA. The message to importers: clear and convincing evidence, complete and translated documentation down the sub-tiers, pre-importation due diligence, and real weight on worker-reported evidence. I (and others) argue this means your traditional social audits alone will not be sufficient.
New withhold release orders followed within weeks, against Zijin Copper in Serbia, Chinese-owned production outside China, and two garment producers in Jordan, a US free-trade-agreement partner. Enforcement is crossing borders and touching preferential trade relationships. For companies caught in it, CBP’s WRO modification guide (June 2025) sets out the remediation path: identify, correct, prevent, benchmarked to the ILO indicators, with worker remedies and a hard look at the buyer’s own purchasing practices (note the alignment with CSDDD).
Europe’s version of the same idea arrived on 26 June, when the Commission published its guidelines on applying the Forced Labour Regulation and launched the Forced Labour Single Portal. The guidelines are built on the ILO indicators and structured around the OECD six-step due diligence framework, and they are direct on the core point: due diligence helps but “does not guarantee exculpation.” The ban is again an obligation of result.
Competent authorities may use any information from the preliminary investigation, including the due diligence measures taken by the business. A single information submission point will take allegations from workers, whistleblowers and civil society when the Regulation applies in December 2027. Add the revised ILO Indicators of Forced Labour, and note that Taiwan’s February 2026 corporate prevention guidelines integrate the ILO indicators. Looks to me like we have a converging global evidence standard for what forced labour looks like and what companies are expected to do about it.
2. Products must carry their own evidence
The second idea: regulation is steadily requiring the product itself to arrive with its evidence attached. ESPR and digital product passports (starting with the EU Battery Regulation), connecting to critical raw materials and the tracking of substances of concern, will illuminate and connect supply chains, integrating facility environmental and social footprints, product footprints and due diligence. Sooner than you expect: no DPP, no market access to the EU. China is building a parallel system, so expect similar requirements there.
But also, no DPP, no market differentiation and storytelling to your consumer. This stopped being theoretical in July. The first European DPP standards were published on 15 July, six already cited in the Official Journal, and the central EU registry went live on 20 July (in testing phase). The data architecture choices companies make in the next twelve months — identifiers, data carriers, interoperability — will determine whether DPP compliance is a bolt-on or a rebuild.
The ESPR also got real for fashion on 19 July, when the ban on destroying unsold clothing and footwear took effect for large companies. This is not just a fashion story. It pulls inventory management, forecasting and returns processes into sustainability scope, because the cheapest way to comply with a destruction ban is to not create the excess in the first place (reminds me of the older energy-efficiency work — the cheapest energy is the energy you don’t use). Add extended producer responsibility in France and California, and France’s ultra-fast-fashion law, adopted and awaiting promulgation (penalties reaching up to 20 euros per item by 2030 and an advertising ban including influencer promotion), and the direction is clear: circular, efficient, visible supply chains are becoming the regulatory default.
Deforestation follows the same pattern. The EUDR — updated, simplified and confirmed in May, following the December 2025 amendment (Regulation (EU) 2025/2650), and with its product scope refreshed on 13 July — applies to large and medium operators from 30 December 2026: no due diligence and traceability, no market access. The UK announced its own regime on 23 June, targeting illegal deforestation in cocoa, coffee, palm oil, rubber, soy and wood (via a strengthened UK Timber Regulation), with consultation in late 2026. Note the design difference — legality-based rather than deforestation-free — and the compliance consequence: one supply chain, two evidentiary standards.
Carbon is joining the same architecture. The EU’s CBAM, with certificates priced against EU ETS auction averages (currently around 75–82 euros per tonne), makes supplier emissions data a cost line for steel, cement, aluminium, fertilisers and electricity and hydrogen, with knock-on effects into automotive, construction and machinery. Verification is mandatory from 2026, and on 12 June the Council agreed its position on extending CBAM to downstream products, going beyond the Commission proposal of roughly 180 steel- and aluminium-intensive product categories and requiring annual reviews of scope. Watch for a deal by year-end. Meanwhile scope 3 reporting spreads: California (though SB 253’s scope 3 requirement faces live litigation, with a Ninth Circuit appeal pending), possibly New York, and China’s corporate climate reporting standard all reach scope 3. And we all know reporting scope 3 is the easy part; doing something about it will take real work.
All of this data feeds claims, and claims are increasingly policed: the Empowering Consumers Directive (applying September 2026), the UK Green Claims Code (including the CMA’s recent supply chain update), and Singapore’s guidance. Substantiation increasingly means information from the supply chain, verified. And the regulator is not the only reader: on 21 July a US consumer protection lawsuit was filed against Lindt alleging the child-labour-related certifications on its cocoa packaging mislead consumers. The suit targets the claims, not the conduct in the first instance, and the same firm has run this playbook against other chocolate makers. Obviously, certifications and sustainability statements are litigable, and they need evidence behind them.
And every article needs an AI mention, so here it is with a purpose: governments and customs agencies, including US CBP, are using AI to analyse global trade, country of origin and indirect links to sanctioned companies. Cross-correlation with EU VAT digitisation and its near-real-time e-invoicing by 2030 must surely be anticipated, and the proposed US Manifest Modernization Act would extend customs data transparency beyond ocean freight. Supply chains are increasingly visible, and not only to regulators. The CSDDD requires grievance processes accessible to the value chain, the Norwegian Transparency Act requires answers to information requests, CBP actively solicits allegations, and the EU will do the same through the Forced Labour Single Portal. The transposition process is picking this up: under the proposed Netherlands law, any natural or legal person has the right to submit a reasoned report to the Authority for Consumers and Markets if they have objective reasons to believe an enterprise is not complying with its obligations (translation of the proposed law).
Transparency about your supply chain, from the outside in, will meet transparency from your supply chain, inside out. The gap between the two is where risk lives.
3. Due diligence becomes law, and the law grows teeth
How do you avoid forced labour, deforestation and the rest? The core is due diligence, built on the UNGPs and the OECD Guidelines. The Corporate Sustainability Due Diligence Directive remains the anchor. With the omnibus done and dusted, the amending directive was published in February and entered into force on 18 March 2026, with transposition by July 2028 and application from July 2029. For corporates in scope, 2029 is not far away. Support is accumulating: the EU’s due diligence navigator, German BMZ-commissioned Helpdesk on Business & Human Rights work on implementing diverse regulatory requirements and OECD policy papers mapping due diligence legislation and its reporting requirements. The Commission is consulting on CSDDD implementation guidelines until 14 August, so now is the moment to weigh in.
The reporting architecture CSDDD leans on settled on 3 July, when the Commission adopted the revised, simplified ESRS, cutting mandatory datapoints by more than 60% and applying from FY2027, alongside a voluntary standard for smaller companies. Anchored in the amended CSRD and operationalised by the voluntary standard is a provision every supply chain team should note: in-scope companies cannot demand more information from value chain partners with 1,000 or fewer employees than the voluntary standard covers, with a carve-out for greenhouse gas data. That is a structural cap on how data requests cascade down supply chains. It’s time to rethink the supplier questionnaire accordingly — and to rethink the whole supplier engagement paradigm. Again, the time for transformation is here.
Due diligence is not a US or European topic anymore. Taiwan’s Ministry of Economic Affairs has a draft programme for supply chain human rights, and the Control Yuan followed its fascinating WRO case analysis with a new investigation into forced labour in the textile industry. South Korea has two HREDD bills pending in the National Assembly. Indonesia is drafting a Presidential Regulation on human rights due diligence, with unions pressing for it to be mandatory. Malaysia’s National Action Plan on Business and Human Rights prioritises forced labour and explores due diligence legislation, while migrant worker cases in the Bangladesh-to-Malaysia corridor keep the enforcement gap visible. Japan’s amended National Action Plan makes due diligence implementation a priority, supported by JETRO’s work on challenges on Bangladesh, Cambodia and Vietnam, the ILO Japan study guide and the UNDP’s heightened due diligence training guide. Thailand’s proposals continue to develop. The direction across Asia is the same, even where the pace differs.
And the disclosure regimes are growing teeth. On 30 June the UK introduced the Immigration and Asylum Bill, which rebuilds Modern Slavery Act reporting: mandatory content, a fixed filing deadline with registry submission, board-approved accuracy declarations, extension to larger public authorities, and civil penalties up to the higher of 1 million pounds or 1% of turnover. No import ban yet, though Sir Chris Bryant MP, Minister for Trade has signalled one before this Parliament ends, and the Independent Anti-Slavery Commissioner’s model law (import ban plus a failure-to-prevent duty) remains the blueprint on the table. On 16 July Australia announced a criminal failure-to-prevent modern slavery offence for large companies, with a reasonable-steps defence, plus civil penalties for non-compliant reporting. In New South Wales, modern slavery tender clauses apply to high-risk government procurement from 1 July 2026.
A word to the lawyers, because this is where the quiet change is happening: disclosure is becoming liability. Everything a company publishes under CSRD, CSDDD or a modern slavery regime is material regulators, plaintiffs and NGOs can quote back, and the Lindt lawsuit shows private plaintiffs doing exactly that with on-pack certifications. What you publish is discoverable, what you certify is litigable, and what you attest will become personal. The internal review conversation around these documents needs to change accordingly.
Follow that thread one step further and you reach financial crime. Forced labour is a predicate crime that generates illicit proceeds, and those proceeds flow through supply chains and the banks that finance them. The standards world sees it: ISO is close to publishing ISO 37200 on managing modern slavery risk and has begun anti-money-laundering guidance (ISO 37013) in the same committee. The FATF typology work on financial flows from human trafficking is the foundational reference: it documented trafficking proceeds growing from 32 billion to over 150 billion dollars annually and equipped financial institutions with red-flag indicators to find them, with banks like Barclays, HSBC and Western Union contributing to its development. Expect supply chain due diligence and AML compliance to keep converging, and expect questions about forced labour in the chain to start arriving from multiple directions.
One counter-current deserves its own paragraph: China’s Decree 834 and 835. China’s new supply chain security investigation measures penalise compliance with foreign restrictive measures, which complicates forced labour due diligence conducted in China. A company can now face a legal duty to investigate its China supply chain under EU or US law and a Chinese prohibition on cooperating with that investigation (MOJ FAQ here). This is sanctions law déjà vu, and it needs governance, documented legal review of audit scopes and data transfer protocols, not just awareness.
4. What this means for the operating model
Add it up. Enforcement through market access and tariffs. Products required to carry their own evidence. Due diligence mandated by law, with disclosure and potentially criminal exposure at the edges. These trends are leading, over time, to transparent, stakeholder-informed, digitised value chains where information follows product, integrates producer information, and connects to customers, consumers, regulators, customs and tax authorities and supply chain partners. The impacts on supply chain costs, resilience, efficiency, risk, circularity and value creation will be felt everywhere, and they land on more desks than the compliance team’s.
Three operating model implications stand out. First, sourcing strategy now owns part of this. When forced labour risk moves through both customs detentions and tariff differentials, country risk profiles, dual-sourcing decisions and supplier development investments all shift. Second, worker voice is becoming evidentiary infrastructure. CBP elevates worker-reported evidence, remediation requires worker involvement, and the EU portal will receive allegations directly; companies that treat grievance systems as CSR programming rather than as evidence systems will be unable to prove what they need to prove. Third, data architecture is destiny. DPP identifiers, EUDR geolocation, CBAM emissions, ESRS datapoints and due diligence records are converging on the same underlying capability: knowing your chain and being able to show it.
None of this makes due diligence a burden only. As the UNDP argues, and as Joanna Lovatt and I have written, the same capabilities create value: differentiation, resilience, customer trust, verifiable claims. How companies manage these complexities in a changing geopolitical and trade world will directly impact their success, and that management will be built on the intentionality, proportionality and effectiveness of the controls put in place (more on that here).
The dates that bind
Already in effect: the ESPR destruction ban for large companies, the US Section 301 tariffs, CBP’s operational guidance, and the new national import bans as they enter into force. By 30 December 2026: EUDR compliance for large and medium operators. During 2027: the expected textiles ecodesign delegated act, possible UK deforestation legislation, and on 14 December 2027 the EU Forced Labour Regulation applies. FY2027: the revised ESRS apply. By 26 July 2028: CSDDD transposition. From 26 July 2029: CSDDD applies to in-scope companies. Every one of these dates assumes the underlying work, traceability, supplier data, due diligence systems and evidence trails, started well before.
And so…
The above is a snapshot — well, it started as a snapshot and is now rather more than that — of a fast-evolving situation, and if the past month proves anything, it is that more comes faster than expected, and from more directions: tariffs from Washington, guidelines from Brussels, decrees from Hanoi and Tegucigalpa, bills from London and Canberra. These regulatory changes, added to cost pressure, market access, technology evolution, rising customer expectations, the opportunity for product differentiation and the need for verifiable claims, are creating a tipping point where action, innovation and value will be found. The winners will be the companies that move from frameworks and reports, from a suite of visible artefacts of due diligence that cannot be shown to drive decisions, to interoperability and operational embedment: action, implementation, impact and risk reduction.
Corrections and additions welcome. What am I missing? I am sure there is plenty.
See my LinkedIn posts for more writing and exploration of the themes above.