ILLÆSA
Hong Kong harbour and the city seen from the hills above
← Insights & Resources

Insight · Refreshed 20 September 2026

The evolving due diligence regime: the horizon has arrived

ILLÆSA20 September 202611 minute read30 notes

Refreshed 20 September 2026. Positions are stated as at that date; this is general commentary, not legal advice. The original was co-authored at PwC in January 2025; this refresh is a personal update.

The evolving due diligence regime rests on two obligations: an obligation of means (do risk-based due diligence and be judged on the quality of your efforts) and an obligation of results (ensure certain outcomes; e.g., keep forced labour out of the product). 1

Twenty months on, both have hardened. They are enforced on the same evidence but on different timelines. The question has changed from “what is coming?” to “how much is enough, and how do I show it?”

The question has changed from “what is coming?” to “how much is enough, and how do I show it?”

When this piece was first published (read here), the framing was simple. That still holds, but what has changed is the enforcement architecture around it.

The Corporate Sustainability Due Diligence Directive (CSDDD) (the ‘obligation of means’) has been reworked through the Omnibus process in a way that changes which companies are in scope and when, but not really what due diligence requires. Attention now shifts to Member State transposition. Beyond Europe, emerging frameworks are advancing across Asia, but for CSDDD, the countdown to implementation (July 2029) has started — and the amount of work required is significant!

Regarding the ‘obligation of results,’ the Commission’s Forced Labour Regulation guidelines are out and the EU Forced Labour Regulation will be fully applicable from 14 December 2027. In the US, forced labour has become an instrument of trade and tariff policy and as a consequence, laws in more than a dozen countries banning the importation of products made with forced labour have been strengthened or enacted. As a response, forced labour requirements are an imperative of today — and will continue to be reinforced both in Europe and in other economies in the coming years.

01

The obligation of means: process becomes law, and law asks for proof

The CSDDD emerged from the Omnibus process leaner: the amending directive has been in force since 18 March 2026, transposition is due by 26 July 2028 and application from 26 July 2029, with thresholds of 5,000 employees and 1.5 billion euros, due diligence explicitly risk-based and prioritised by severity and likelihood, and civil liability left to each Member State.2 The consequences are still real: administrative penalties of up to 3 per cent of worldwide turnover, publication of penalty decisions, and civil liability as each Member State decides.

The CSDDD clock

18 March 2026

Amending directive in force.

July 2027

Commission guidelines due, possibly earlier.

26 July 2028

Member State transposition due.

26 July 2029

Application.

A narrower law is not necessarily a weaker law — the Omnibus left the CSDDD focused on the companies with the greatest leverage and resources, and, with some changes, kept the core duties to identify, prevent, mitigate and remediate, along with stakeholder engagement, grievance mechanisms and monitoring of effectiveness. Civil society reads it differently: a 70 per cent cut in scope, the loss of an EU-wide route to remedy and narrower stakeholder engagement are, on that view, exactly what makes it weaker.

The directive also still covers environmental impacts and climate, even though the Omnibus dropped the climate transition plan; that matters for supplier due diligence, because a supplier is a location, a set of operations and a consequent set of externalities, both social and environmental. The practical detail will sit in the Commission’s guidelines, due by July 2027 and possibly earlier; for a fuller account of the changes, see the July update.3

The Omnibus left the CSDDD focused on the companies with the greatest leverage and resources.

Impact on business

The impact on business is wider than the scope suggests. By one count roughly 1,450 corporate groups remain directly in scope, a third of them headquartered outside the EU, a cut of about 70 per cent.4 The companies that dropped out — broadly those with between 1,000 and 5,000 employees — are not out of the system. They often sit in the value chains of in-scope customers, who must still obtain contractual assurances and may still ask for information where it cannot reasonably be obtained by other means. They are fully exposed to the Forced Labour Regulation and to import bans, which have no size thresholds: the Regulation creates no due diligence duty, but its product bans apply whatever the size of the company. And they remain subject to the French and German laws already in force.5 For them the question is not whether they are in scope, but what their customers will ask for and what they can show.6

The companies that dropped out — broadly those with between 1,000 and 5,000 employees — are not out of the system. They often sit in the value chains of in-scope customers. For them the question is not whether they are in scope, but what their customers will ask for and what they can show.

First steps

First steps are visible. No Member State had published a transposition draft by mid-2026, but the direction is set. The Netherlands consulted in July on a revised bill that names the consumer and markets authority as supervisor. Sweden’s inquiry proposed a corporate responsibility act in September, with the National Board of Trade as supervisor and penalties of up to 3 per cent of turnover. Germany is removing the reporting duty from its Supply Chain Act ahead of a replacement law, with industry pressing for one-to-one transposition.7 Companies, for their part, have mostly not stood down: surveys in 2025 and 2026 show that most companies taken out of scope intend to keep reporting, even as they expect fewer resources behind it, while human rights teams are being trimmed.8 That is the pattern to plan for — transposition, thinner teams, and unchanged expectations from customers, banks and border authorities.

Also under the Omnibus changes, liability has not gone away — it has moved from an EU-wide civil liability regime to localisation where rules are governed by national law. Relevant action is already observable. France’s duty of vigilance continues to be litigated, parent company duty of care claims settle in home courts (a UK technology group settled over conditions at a Malaysian supplier in February), consumer suits target the claim on the label, and Member States will decide whether a CSDDD breach gives rise to civil liabilities.9 Increasingly, what companies write, including in their due diligence processes, is discoverable, and what is certified is litigable.

What companies write, including in their due diligence processes, is discoverable, and what is certified is litigable.

Outside the EU the obligation of means is also emerging. The UK’s Immigration and Asylum Bill, in committee from 10 September, gives Modern Slavery Act reporting prescribed content, a registry deadline, a signed accuracy declaration and civil penalties up to the higher of 1 million pounds or 1 per cent of turnover, but no due diligence duty and no import ban. Alongside the business provisions, it also changes survivor protections in ways that anti-slavery organisations say will weaken protection for victims of trafficking.10 Australia has proposed a criminal offence of failing to prevent modern slavery, with a reasonable steps defence; consultation closes 25 September.11 Across Asia, countries are moving the same way at different speeds, including Taiwan, Indonesia, Malaysia, Thailand, Korea and Japan. 12

The harder problem

Conflict of laws

The harder challenge for Asia-based supply chains is an emerging conflict of laws. China’s new rules cut across all of the above. The State Council’s supply chain security provisions of March 2026 allow the authorities to act against “information gathering activities such as surveys related to industrial and supply chains” that breach Chinese rules, and treat suspending transactions with, or discriminating against, Chinese companies as a threat to supply chain security. The April 2026 regulation on countering foreign extraterritorial jurisdiction adds prohibition orders, a “malicious entity list” and limits on cross-border data flows. Law firms note that the CSDDD and the UFLPA could be designated as improper extraterritorial measures, and the precedent is real: PVH was placed on the Unreliable Entity List in February 2025 for declining Xinjiang cotton.13

The response is about method, not silence.

Add the Data Security Law and personal information rules on exporting worker and supplier data, the 2023 counter-espionage law, and the result is that a questionnaire, a worker interview or a supplier exit can be caught between the regulatory requirements.14 No designation has yet been made under the new rules, but the same act can be compliance in one jurisdiction and discrimination in another, so the response is about method, not silence. Document the commercial reasons for sourcing decisions, have Chinese counsel review due diligence requests and data transfers before they go out, and build escalation, rather than automatic termination, into contracts.15 Above all, evolve supplier engagement, particularly with large and strategic suppliers, so that risks, controls and accountability sit where they actually belong — with the supplier.

02

The obligation of results: from the border to trade policy

Forced labour bans are obligations of results. If forced labour is in the product, the product can lose access to the market, however good the due diligence or sourcing process. In 2026 the global network behind that obligation changed.

If forced labour is in the product, the product can lose access to the market, however good the due diligence or sourcing process.

On 24 July additional US tariffs of 10 or 12.5 per cent took effect on 60 economies found not to enforce forced labour import bans, with the lower rate for those that adopted or committed to bans.16 Importers and then 25 states have challenged the tariffs as unlawful, and in the states’ case as a pretext for replacing the tariffs struck down in February.17 Whatever the courts decide, the bans the tariffs triggered will most likely remain. By one count at least fourteen jurisdictions have adopted prohibitions since March, most without an enforcement record and some, civil society warns, likely to stay on paper.18 The planning assumption is therefore a widening patchwork of prohibitions with uneven enforcement, which is harder to manage than a single strict regime, because exposure now depends on which border a shipment crosses and all the political and trade implications these borders now entail.

Forced labour enforcement is becoming more forensic and data- and AI-driven.19 US Customs and Border Protection (CBP) now asks importers for traceability to raw material, translated sub-tier documentation, proof of payment and worker-level wage and recruitment records; to lift a withhold release order, it also expects worker interviews and a review of the purchasing practices and pricing pressures behind the conditions. Assembling this after detention will be expensive and problematic, if even possible. More than likely, it either exists upstream, in contracts, onboarding and retention requirements, or it does not. The new withhold release orders (WROs) in Serbia and Jordan are also a warning about how risk is screened: neither country sits on a standard high-risk list, and the issues were migrant worker issues — document retention, withheld wages and, in Serbia, recruitment debt.20 In this case, the recruitment model and employment practices carried the risk, not the geography. And this risk, and the WRO impacts, will echo downstream: Section 307 reaches goods made wholly or in part with the copper, so the wire, cable and electronics that contain it are exposed too.

The recruitment model and employment practices carried the risk, not the geography.

Regarding enforcement and the EU’s Forced Labour Regulation, the guidelines say plainly that due diligence will be taken into account but does not guarantee exculpation, and that an authority may decide on the facts available where a company will not cooperate, within a procedure that includes a right to be heard.21 A ban decision attaches to the product, not only to the company investigated, binds any operator placing that product on the EU market, and is published on the EU Forced Labour Single Portal. Therefore, a company can inherit a supplier’s or a competitor’s ban, where the decision covers the same product, producer or area, and its customers will see it. The Regulation applies from 14 December 2027.

A company can inherit a supplier’s or a competitor’s ban.

03

Where the two obligations meet

First, the growing list of official risk indicators (entity lists, Department of Labor lists, the EU’s overdue risk database, and lists such as the US Department of Labor’s List of Goods Produced by Child Labor or Forced Labor22) raises the standard of care and shrinks the space for “we did not know”.23

Second, two visions of compliance now coexist. CBP asks whether you can document that this shipment is clean; the EU asks whether your governance system works.24 Companies need both, built on one capability: knowing the chain and being able to show it, accepting that sub-tier visibility is partial.

CBP asks whether you can document that this shipment is clean; the EU asks whether your governance system works.

Third, products will increasingly carry their evidence with them: the EU Deforestation Regulation from 30 December 2026, Digital Product Passport standards, a proposed downstream extension of the Carbon Border Adjustment Mechanism, revised sustainability reporting standards from 2027, and the Empowering Consumers Directive from 27 September 2026, which makes misleading environmental and social claims riskier.25

04

What minimum compliance looks like: intentional, proportionate, effective

The question often heard is “where is the checklist?” An obligation of means is not a checklist. The CSDDD requires appropriate and effective steps on a risk-based approach. How a company works towards compliance matters as much as getting there.26 The parallel to AML (anti-money laundering approaches) is worth noting and learning from. The overarching goal is to avoid the impact (forced labour or money laundering), not to have completed a set of checklists. This is where intentionality, proportionality and effectiveness begin to matter.

An obligation of means is not a checklist.

Intentionality is the extent to which a company makes deliberate, informed and reasoned choices about how it identifies, prioritises and addresses impacts, based on its risks, its role in them and the effectiveness of available measures.27 It is not just good intentions. It is working to a plan: stated objectives, a sequence, and actions that hold to them over time. Due diligence is not documents assembled after the fact. A control that nobody uses to decide anything is a report, not a control. Regulators read intentionality in the gap between what a company says and does, so be sure to document the reasoning. Documenting it takes legal design: what is written to show intentionality can also be read in court, so decide with counsel what is recorded, by whom, under what protection and how long it is kept.

A control that nobody uses to decide anything is a report, not a control.

Proportionality scales the plan in two dimensions: expectations rise with size, leverage and resources, and the required response strengthens with the severity of the impact and the company’s involvement in it.28 Keep the UN Guiding Principles and the OECD Guidance in mind: prioritise impacts by severity and likelihood, then let involvement and leverage shape the response. Involvement very often means purchasing practices: forecasting, lead times, price and payment terms drive excessive hours and debt-financed recruitment. Affected stakeholders are a primary input, not a consultation step; but engagement must be safe from retaliation.

Effectiveness is the test: do the measures work, how do you know, and what changed?29 Article 15 of the CSDDD requires monitoring of adequacy and effectiveness, and audits alone will not answer it; independent worker channels, payroll data, traceability records and, where relevant, scientific verification will. Indicators make it answerable: recruitment fees repaid, grievances resolved through channels workers trust, hours and wages compliance, sourcing decisions actually changed by findings.

The building blocks, from policy and prioritisation to grievance, remedy, monitoring and governance, are familiar. Minimum compliance hinges not on whether each exists but on whether each is purpose-built for salient risks and working over time, and, prosaically, on knowing which group entities are in scope and under which transposition.30

05

The time to get started? Still now

The current environment is a regime that is fragmented, enforcement-led and harder than it was. Further changes might include further EU simplification, a tariff reversal after litigation or an election, and national bans that are never enforced. Progress is never linear, and there will be both steps forward and backwards. But the direction of travel is clear and the list of actions that serves this direction is also clear:

  1. traceability where severity and exposure meet
  2. worker voice that workers trust, including through worker-led organisations
  3. remedy that reaches workers, including fee repayment
  4. purchasing practices aligned to the harms they can cause
  5. an evidence file that shows decisions changing

Based on experience, every item on that list takes eighteen months or more to build, and none of it can be bought at the point of a detention. That is the argument for starting now. Means and results are converging into one expectation: know the chain, act on what you know, and show both. Intentional, proportionate, effective, and able to prove it.

Know the chain, act on what you know, and show both.

Intentional, proportionate, effective, and able to prove it.

Notes

  1. PwC (J. Prepscius, M. Timmons and N. Reigl), “The evolving due diligence regime: looking to the horizon”, 22 January 2025. https://www.pwc.com/gx/en/services/tax/esg-tax/the-evolving-due-diligence-landscape.html ↩
  2. Directive (EU) 2026/470 of 24 February 2026 (Omnibus I), OJ L, 2026/470, 26 February 2026, in force from 18 March 2026: https://eur-lex.europa.eu/eli/dir/2026/470/oj Consolidated text of Directive (EU) 2024/1760 as amended (thresholds in Art 2, including EUR 1.5 billion EU turnover for non-EU companies; prioritisation in Art 9; core duties in Arts 7 to 15; penalties and their publication in Art 27(4) and (5); Art 22 climate transition plan and Art 29 civil liability deleted; dates in Art 37): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024L1760-20260318 Clifford Chance, “Omnibus I: the European Union concludes CSDDD and CSRD reforms”, 24 February 2026: https://www.cliffordchance.com/insights/resources/blogs/business-and-human-rights-insights/2026/02/omnibus-i-the-european-union-concludes-csddd-and-csrd-reforms.html Covington & Burling, “EU CSDDD/CSRD Omnibus Published in Official Journal”, 27 February 2026: https://www.cov.com/en/news-and-insights/insights/2026/02/eu-csddd-csrd-omnibus-published-in-official-journal-transposition-delegated-acts-and-guidelines-are-next On the civil society view: European Coalition for Corporate Justice, press release, 24 June 2025: https://corporatejustice.org/news/press-release-deregulation-and-betrayal-of-victims-councils-general-approach-on-the-csddd/ ClientEarth and Frank Bold, legal analysis, February 2026: https://www.clientearth.org/media/rpfkpapv/client-earth-legal-analysis_v3.pdf SOMO, CSDDD Datahub, 2026: https://www.somo.nl/updated-datahub-shows-1400-corporate-groups-covered-by-weakened-csddd/ ↩
  3. Directive (EU) 2024/1760 as amended, Art 19(3) (first guidelines due by 26 July 2027; consolidated text cited above). European Commission, “Corporate sustainability due diligence – development of guidelines”, public consultation 12 June to 14 August 2026, with adoption of the guidelines planned for the first quarter of 2027: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14445-Corporate-sustainability-due-diligence-development-of-guidelines_en Linklaters, “EU CSDDD: Commission consults on implementation guidelines”, 17 June 2026: https://sustainablefutures.linklaters.com/post/102n30d/eu-csddd-commission-consults-on-implementation-guidelines Business & Human Rights Resource Centre, 20 July 2026: https://www.business-humanrights.org/en/latest-news/eu-commission-opens-public-consultation-about-guidelines-to-support-the-implementation-of-the-csddd/ ↩
  4. SOMO, CSDDD Datahub, updated 2026 (1,447 corporate groups in scope, one third headquartered outside the EU; a 71 per cent reduction on the 2024 directive): https://www.somo.nl/updated-datahub-shows-1400-corporate-groups-covered-by-weakened-csddd/ ClientEarth and Frank Bold, legal analysis of the Omnibus, February 2026: https://www.clientearth.org/media/rpfkpapv/client-earth-legal-analysis_v3.pdf ↩
  5. Directive (EU) 2024/1760 as amended, Art 8 (information may be requested from business partners only where necessary and, for partners with fewer than 5,000 employees, only where it cannot reasonably be obtained by other means) and Arts 10 and 11 (contractual assurances); consolidated text cited above. The separate 1,000-employee “value chain cap” in the amended Accounting Directive (Art 19a(3)) limits requests made for sustainability reporting and expressly does not limit requests made to comply with due diligence law. Charles Russell Speechlys, “Post-Omnibus amendments: a practical overview of the CSDDD for businesses”, 2026: https://www.charlesrussellspeechlys.com/en/insights/expert-insights/dispute-resolution/2026/post-omnibus-amendments-a-practical-overview-of-the-corporate-sustainability-due-diligence-directive-csddd-for-businesses/ ↩
  6. For reporting purposes, the EU’s voluntary reporting standard for small and medium-sized companies (VSME) is now the ceiling on what can be asked of partners with fewer than 1,000 employees (Directive 2013/34/EU as amended by Directive (EU) 2026/470, Art 19a(3)); the cap does not limit requests made to comply with due diligence law. ↩
  7. Linklaters, CSDDD Transposition Tracker, May 2026: https://sustainablefutures.linklaters.com/post/102mx48/eu-corporate-sustainability-due-diligence-directive-csddd-cs3d-transposition-t Netherlands: consultation on the revised Wet internationaal verantwoord ondernemen, 3 July to 3 August 2026: https://www.internetconsultatie.nl/wivo2/b1 Sweden: SOU 2026:56, Government press release, 17 September 2026: https://www.regeringen.se/pressmeddelanden/2026/09/utredningen-om-tillborlig-aktsamhet-for-foretag-i-fraga-om-hallbarhet-har-overlamnat-sitt-betankande/ Germany: Bundestag, first reading of the bill amending the Supply Chain Due Diligence Act, 16 January 2026: https://www.bundestag.de/dokumente/textarchiv/2026/kw03-de-lieferketten-1136308 Federal Ministry of Labour and Social Affairs on the planned law on international corporate responsibility: https://www.bmas.de/DE/Service/Gesetze-und-Gesetzesvorhaben/gesetz-zur-aenderung-des-lieferkettensorgfaltspflichtengesetzes.html VCI, position on CSDDD transposition, 2 March 2026: https://www.vci.de/themen/recht/unternehmensrecht-compliance/csddd-umsetzung-ohne-mehrlasten.jsp ↩
  8. osapiens and Copenhagen Business School, “Beyond Compliance”, survey of 403 executives, 19 March 2026 (ESG Today summary): https://www.esgtoday.com/90-of-companies-no-longer-in-csrd-scope-plan-to-maintain-expand-sustainability-reporting-survey/ PwC, Global Sustainability Reporting Survey 2025 (ESG Today summary): https://www.esgtoday.com/most-companies-say-pressure-for-sustainability-reporting-increasing-despite-regulatory-pullback-pwc-survey/ Business & Human Rights Resource Centre, “Retreat or respect?”, August 2026: https://www.business-humanrights.org/en/from-us/briefings/us-analysis-2026/retreat-or-respect/ ↩
  9. France: TotalEnergies, press release on its appeal of the Paris Judicial Court judgment of 25 June 2026 (duty of vigilance, climate): https://totalenergies.com/newsroom/totalenergies-se-appeals-the-25-june-2026-judgment-in-the-duty-of-vigilance-climate-case/?lang=eng Verfassungsblog commentary: https://verfassungsblog.de/duty-of-vigilance-climate-totalenergies-judgment-of-25-june-2026/ La Poste, Paris Court of Appeal, 17 June 2025 (Gide summary): https://www.gide.com/en/news-insights/premier-arret-au-fond-sur-le-devoir-de-vigilance-dans-laffaire-la-poste-la-cour-dappel-de-paris-confirme-le-jugement-en-toutes-ses-dispositions/ UK: Leigh Day, press release on the settlement of Limbu and others v Dyson Technology Ltd and others, 26 February 2026 (no admission of liability; terms undisclosed): https://www.leighday.co.uk/news/press-releases/2026-news/dhan-kumar-limbu-and-others-v-dyson-technology-limited-dyson-limited-and-dyson-manufacturing-sdn-bhd/ Background: NYU Stern Center for Business and Human Rights, “UK Courts: Migrant Suit Against Dyson to Proceed to Trial”, 12 February 2026: https://bhr.stern.nyu.edu/quick-take/uk-courts-migrant-suit-against-dyson-to-proceed-to-trial/ US: Reuters (via US News), “Swiss chocolate maker Lindt misleads consumers about child labor, US lawsuit claims”, 23 July 2026 (complaint by International Rights Advocates, US District Court for the District of Columbia, targeting certifications on packaging): https://www.usnews.com/news/top-news/articles/2026-07-23/swiss-chocolate-maker-lindt-misleads-consumers-about-child-labor-us-lawsuit-claims Business & Human Rights Resource Centre: https://www.business-humanrights.org/en/latest-news/africa-chocolate-maker-lindt-sued-in-a-us-court-over-its-alleged-use-of-child-labor-in-ghana-and-ivory-coast/ ↩
  10. UK Parliament, Immigration and Asylum Bill (session 2026–27), bill page (first reading 30 June 2026; second reading 13 July 2026; Public Bill Committee from 10 September 2026, reporting by 3 November 2026): https://bills.parliament.uk/bills/4254 Call for written evidence: https://www.parliament.uk/business/news/2026/july-2026/immigration-and-asylum-bill-call-for-evidence/ House of Commons Library, Immigration and Asylum Bill 2026, briefing CBP-10940, 8 July 2026: https://commonslibrary.parliament.uk/research-briefings/cbp-10940/ Osborne Clarke, “UK Immigration and Asylum Bill transforms modern slavery reporting by businesses”, 5 August 2026: https://www.osborneclarke.com/insights/uk-immigration-and-asylum-bill-transforms-modern-slavery-reporting-businesses Skadden, “Proposed Amendments to the UK Modern Slavery Act”, July 2026: https://www.skadden.com/insights/publications/2026/07/proposed-amendments-to-the-uk-modern-slavery-act On the Bill’s survivor-protection provisions: Anti-Slavery International and partners, joint statement, “The new Immigration and Asylum Bill will damage modern slavery protections”, 2 July 2026: https://www.antislavery.org/latest/the-new-immigration-and-asylum-bill-will-damage-modern-slavery-protections/ Helen Bamber Foundation and Asylum Aid, “When the law changes sides: the criminalisation of survivors of trafficking in the UK”, 22 July 2026: https://www.asylumaid.org.uk/resources/report/when-law-changes-sides-criminalisation-survivors-trafficking-uk ↩
  11. Australian Government, Attorney-General’s Department, consultation “Strengthening Australia’s response to modern slavery in supply chains”, 21 August 2026 (submissions close 25 September 2026; proposed offence for entities with consolidated revenue of at least AUD 100 million): https://consultations.ag.gov.au/crime/modern-slavery/ Media releases of 16 July 2026: https://ministers.ag.gov.au/media-centre/albanese-government-combatting-modern-slavery-16-07-2026 and 21 August 2026: https://ministers.ag.gov.au/media-centre/consultation-strengthen-australias-modern-slavery-framework-21-08-2026 King & Wood Mallesons commentary: https://www.mallesons.com/au/en/insights/latest-thinking/modern-slavery-proposed-criminal-offence-for-failure-to-prevent-and-civil-penalties-for-non-compliant-reporting.html ↩
  12. Regional developments compiled in ILLAESA, “A changing regulatory environment”, 26 July 2026: https://illaesa.com/update-changing-regulation Thailand (draft mHREDD law, second draft September 2025, not yet before parliament): Business & Human Rights Resource Centre, 13 March 2025: https://www.business-humanrights.org/en/latest-news/thailand-govt-to-mandatory-human-rights-and-environmental-due-diligence-legislation-aiming-to-push-for-responsible-business-practices/ Ropes & Gray, update on mandatory HREDD legislation, 20 January 2026: https://www.ropesgray.com/en/insights/viewpoints/102m2ad/an-update-on-mandatory-human-rights-and-environmental-due-diligence-legislation-i Korea (HREDD bills pending in the National Assembly): https://www.business-humanrights.org/en/latest-news/s-korea-mandatory-human-rights-and-environmental-due-diligence-bill-marks-first-push-under-new-government/ Japan: Human Rights Watch, letter to the Chairperson of the Japan Uyghur Parliamentary Association, 23 February 2026: https://www.hrw.org/news/2026/02/23/letter-to-the-chairperson-of-the-japan-uyghur-parliamentary-association-keiji Malaysia (National Action Plan on Business and Human Rights 2025–2030): https://www.business-humanrights.org/en/latest-news/malaysia-nap-on-business-human-rights-officially-launched-with-expectations-for-future-reforms-on-corporate-manslaughter-anti-slapp-and-due-diligence-laws/ Indonesia (Presidential Regulation 60/2023 and follow-on regulation): https://www.petersonindonesia.com/post/indonesia-s-2026-regulatory-update-on-business-and-human-rights Taiwan (National Action Plan and supply-chain guidelines): https://investtaiwan.nat.gov.tw/bhr/en-gb/article/56 ↩
  13. State Council Decree No. 834, Provisions on Industrial and Supply Chain Security, 31 March 2026 (China Law Translate): https://www.chinalawtranslate.com/en/-State-Council-Provisions-on-Industrial-and-Supply-Chain-Security/ State Council Decree No. 835, Regulation on Countering Improper Extraterritorial Jurisdiction, April 2026 (Morrison Foerster, 20 April 2026): https://www.mofo.com/resources/insights/260420-china-issues-new-regulations-countering-foreign-states Freshfields, 11 June 2026: https://www.freshfields.com/en/our-thinking/blogs/sustainability/chinas-new-2026-supply-chain-security-and-counter-extraterritoriality-rules-wha-102n2b2 Morgan Lewis, 15 April 2026: https://www.morganlewis.com/pubs/2026/04/china-issues-new-regulations-on-countering-foreign-extraterritorial-jurisdiction-what-mncs-need-to-know PVH Corp. and Illumina added to the Unreliable Entity List, 4 February 2025 (Fashion Dive): https://www.fashiondive.com/news/pvh-added-unreliable-entities-list-china/739316/ ↩
  14. King & Wood Mallesons, “Auditing your China supply chain in 2026: meeting forced-labour due diligence mandates without crossing China’s new red lines”, 9 June 2026: https://www.kingandwood.com/global/en/insights/latest-thinking/auditing-your-china-supply-chain-in-2026-meeting-forced-labour-due-diligence-mandates-without-crossing-china-s-new-red-lines.html Cyberspace Administration of China, Provisions on Promoting and Regulating Cross-border Data Flows, 22 March 2024 (Greenberg Traurig): https://www.gtlaw.com/en/insights/2024/3/china-relaxes-requirements-for-cross-border-data-transfers K2 Integrity on the revised Counter-Espionage Law and the 2023 raids on due diligence firms, 15 May 2023: https://www.k2integrity.com/en/knowledge/policy-alerts/revisions-to-chinas-counterespionage-law-and-accompanying-raids-on-foreign-businesses-heighten-risks-for-international-investors-and-mncs/ ↩
  15. Steptoe LLP, “Two regulations, one direction: China’s expanding economic security playbook”, 30 April 2026 (noting that no foreign measure had yet been formally identified under the new mechanism): https://www.steptoe.com/en/news-publications/international-compliance-blog/two-regulations-one-direction-chinas-expanding-economic-security-playbook.html Harris Sliwoski, “China’s new supply chain security rules”, 29 April 2026: https://harris-sliwoski.com/chinalawblog/china-supply-chain-security-rules/ King & Wood Mallesons, 9 June 2026 (above). ↩
  16. Office of the United States Trade Representative, “USTR Takes Action in Forced Labor Section 301 Investigations”, 23 July 2026: https://ustr.gov/about/policy-offices/press-office/press-releases/2026/july/ustr-takes-action-forced-labor-section-301-investigations Notice of Actions, 91 Fed. Reg. 47318, 28 July 2026 (10 per cent for 17 economies with a ban, a ban commitment or a partial regime; 12.5 per cent for the rest; effective 24 July 2026): https://www.federalregister.gov/documents/2026/07/28/2026-15181/notice-of-actions-in-section-301-investigations-of-acts-policies-and-practices-of-various-economies USTR, Report in the Section 301 investigations, 2 June 2026: https://ustr.gov/sites/default/files/files/Press/Releases/2026/USTR%20Report%20Sec%20301%20FL%20301%206-2-26%20FINAL%20for%20upload.pdf ↩
  17. Learning Resources, Inc. v. Trump, No. 24-1287 (US Supreme Court, 20 February 2026) (IEEPA tariffs): https://www.supremecourt.gov/opinions/25pdf/24-1287_4gcj.pdf Importers: Burlap and Barrel, Inc. v. United States, CIT No. 1:26-cv-03345, filed 24 July 2026: https://libertyjusticecenter.org/cases/burlap-and-barrel-inc-v-greer-et-al/ States: State of Oregon et al. v. Trump, CIT No. 26-03467, filed 3 August 2026 by 23 states and two governors, complaint: https://portal.ct.gov/-/media/ag/press_releases/2026/tariffs-section-301--states-complaint--ecf-2.pdf Supply Chain Dive, “25 states sue Trump over Section 301 forced-labor tariffs”, 4 August 2026: https://www.supplychaindive.com/news/25-states-sue-trump-over-section-301-forced-labor-tariffs/826908/ Nakachi Eckhardt & Jacobson, “Twenty-Five States Sue to Block the Section 301 Forced-Labor Tariffs”, 7 August 2026: https://www.tradelawcounsel.com/insights-news/2026/8/7/twenty-five-states-sue-to-block-the-section-301-forced-labor-tariffs ↩
  18. Steptoe LLP, “From Two Regimes to Many: Preparing for the Global Proliferation of Forced Labor Import Bans”, 5 August 2026: https://www.steptoe.com/en/news-publications/risk-and-resilience/from-two-regimes-to-many.html CSIS (L. T. Murphy), “A Global Forced Labor Import Regime Is Emerging: Can It Work?”, 31 July 2026 (at least 27 countries have passed, drafted or committed to bans, 14 of them adopted): https://www.csis.org/analysis/global-forced-labor-import-regime-emerging-can-it-work On enforcement, Walk Free, “New forced labour import bans sparked by US trade war must be enforced for real impact”, 15 May 2026: https://www.walkfree.org/news/2026/new-forced-labour-import-bans-sparked-by-us-trade-war-must-be-enforced-for-real-impact/ ↩
  19. US Department of Homeland Security, “United States Customs and Border Protection – AI Use Cases”, AI use case inventory, last updated 9 September 2026: entries DHS-24 (Entity Resolution, deployed: AI used “to aggregate and analyze global trade data across multiple languages” and to “provide actionable insights for cross-border investigations”), DHS-101 (Advanced Trade Analytics Program) and DHS-2447 (Forced Labor Virtual Consultant, pre-deployment). https://www.dhs.gov/ai/use-case-inventory/cbp ↩
  20. US Customs and Border Protection, Forced Labor Enforcement Operational Guidance for Importers (Publication No. 5560-0526, 9 June 2026; CSMS # 68927213, 12 June 2026), which asks importers for traceability “back to the raw material stage”, English translations of all foreign-language documents, a supply chain map of every entity involved, proof of payment, and wage-payment and recruitment information for workers at each entity: https://www.cbp.gov/document/guides/cbp-forced-labor-enforcement-operational-guidance-importers CBP, withhold release order on Serbia Zijin Copper D.O.O., 16 June 2026 (ILO indicators cited include retention of identity documents and withholding of wages): https://www.cbp.gov/newsroom/national-media-release/cbp-issues-withhold-release-order-serbia-zijin-copper-doo Recruitment-related deposits among foreign workers are reported by China Labor Watch: https://chinalaborwatch.org/u-s-cbp-issues-withhold-release-order-against-serbia-zijin-copper-action-builds-on-china-labor-watch-investigation/ CBP, withhold release orders on Needle Craft Ltd. and Casual Wear Apparel LLC, Jordan, 23 June 2026: https://www.cbp.gov/newsroom/national-media-release/cbp-issues-2-withhold-release-orders-needle-craft-and-casual-wear Jordanian garments were removed from the US Department of Labor list in 2016 (ILO): https://www.ilo.org/resource/news/jordan%E2%80%99s-garment-sector-removed-us-forced-labour-listing CBP, Withhold Release Order and Finding Modifications Guide (Publication No. 5040-0525, version of 21 August 2025), which is the source for worker-reported evidence (documented worker interviews and survey results) and for the review of whether purchasing practices, contract terms or pricing pressures contributed to the forced labour conditions: https://www.cbp.gov/document/guides/wro-and-finding-modifications-guide Institute for Human Rights and Business, Employer Pays Principle: https://www.ihrb.org/projects/employer-pays-principle Section 307 covers goods “mined, produced, or manufactured wholly or in part” with forced labour: 19 U.S.C. § 1307, https://www.law.cornell.edu/uscode/text/19/1307 ↩
  21. European Commission, Guidelines on the application of Regulation (EU) 2024/3015 on prohibiting products made with forced labour on the Union market, C(2026) 4386, 26 June 2026: https://single-market-economy.ec.europa.eu/document/download/41642959-ab02-4bc9-8cb2-e6aae9024203_en?filename=EU%20Forced%20Labour%20Regulation%20guidelines%20EN.pdf Published as Commission Notice C/2026/4637, OJ C, 3 September 2026: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52026XC04637 Regulation (EU) 2024/3015 (facts available: Art 18): https://eur-lex.europa.eu/eli/reg/2024/3015/oj Forced Labour Single Portal: https://single-market-economy.ec.europa.eu/single-market/goods/forced-labour-regulation_en Latham & Watkins, “European Commission Publishes Guidelines on the EU Forced Labour Regulation”, 2 July 2026: https://www.lw.com/en/insights/european-commission-publishes-guidelines-on-the-eu-forced-labour-regulation Steptoe LLP, “Human Rights Due Diligence vs. Documentary Compliance: What the New US and EU Forced Labor Guidance Tells Us About the Future of Import Ban Enforcement”, 21 July 2026: https://www.steptoe.com/en/news-publications/human-rights-due-diligence-vs-documentary-compliance.html ↩
  22. US Department of Labor, Bureau of International Labor Affairs, List of Goods Produced by Child Labor or Forced Labor (2024 edition). https://www.dol.gov/agencies/ilab/reports/child-labor/list-of-goods ↩
  23. ILO, Indicators of Forced Labour (2025 revised edition): https://www.ilo.org/publications/ilo-indicators-forced-labour-1 DHS, UFLPA Entity List: https://www.dhs.gov/uflpa-entity-list CBP, forced labor enforcement: https://www.cbp.gov/trade/forced-labor/enforcement US Department of Labor, List of Goods Produced by Child Labor or Forced Labor (2024 edition): https://www.dol.gov/agencies/ilab/reports/child-labor/list-of-goods European Commission, forced labour risk database (due by 14 June 2026; in development): https://single-market-economy.ec.europa.eu/single-market/goods/forced-labour-regulation/which-products-and-areas-are-risk-forced-labour_en EUDR country benchmarking, Implementing Regulation (EU) 2025/1093: https://eur-lex.europa.eu/eli/reg_impl/2025/1093/oj ↩
  24. Steptoe LLP, “Human Rights Due Diligence vs. Documentary Compliance” (21 July 2026), cited above, which contrasts CBP’s focus on proof with the Commission’s focus on process. ↩
  25. European Commission, EUDR product scope and tools update, 13 July 2026: https://environment.ec.europa.eu/news/commission-updates-product-scope-and-tools-support-eudr-2026-07-13_en Regulation (EU) 2025/2650 amending the EUDR (application from 30 December 2026; 30 June 2027 for micro and small operators): https://eur-lex.europa.eu/eli/reg/2025/2650/oj European Commission, “Commission adopts revised sustainability reporting standards”, 3 July 2026: https://finance.ec.europa.eu/news/commission-adopts-revised-sustainability-reporting-standards-2026-07-03_en EFRAG (application from financial years beginning on or after 1 January 2027): https://www.efrag.org/en/news-and-calendar/news/european-commission-publishes-delegated-act-on-revised-esrs-and-voluntary-sustainability-reporting CEN-CENELEC, first series of eight European Digital Product Passport standards, 15 July 2026: https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-15-dpp/ Council of the EU, “Council moves to strengthen the EU’s carbon border adjustment mechanism”, 12 June 2026: https://www.consilium.europa.eu/en/press/press-releases/2026/06/12/council-moves-to-strengthen-the-eu-s-carbon-border-adjustment-mechanism/ Directive (EU) 2024/825 (Empowering Consumers for the Green Transition), applicable from 27 September 2026; it adds environmental and social characteristics to the misleading-actions test and bans sustainability labels not based on a certification scheme, while the per se bans on generic claims cover environmental claims only: https://eur-lex.europa.eu/eli/dir/2024/825/oj/eng ↩
  26. A. Hawley, J. Leduc-Sands, N. Reigl and J. Prepscius, “What Does ’Minimum Compliance’ with the CSDDD Actually Look Like?”, LinkedIn, 5 March 2026 (Alex Hawley, Jennyfer Leduc-Sands, Nicolás Reigl and Jeremy Prepscius). https://www.linkedin.com/pulse/what-does-minimum-compliance-csddd-actually-look-like-prepscius-sa0vf/ On the due diligence obligation and its elements, see Directive (EU) 2024/1760 as amended, Arts 5 and 7 to 9 (obligation, policy, identification and prioritisation). ↩
  27. Hawley, Leduc-Sands, Reigl and Prepscius, “What Does ’Minimum Compliance’ with the CSDDD Actually Look Like?” (5 March 2026), cited above. ↩
  28. See Hawley, Leduc-Sands, Reigl and Prepscius, “What Does ’Minimum Compliance’ with the CSDDD Actually Look Like?” (5 March 2026), cited above. Directive (EU) 2024/1760 as amended, Art 3(1)(o) (“appropriate measures”) and Art 9 (prioritisation). UN Guiding Principles on Business and Human Rights (2011), Principles 19 and 24: https://www.ohchr.org/sites/default/files/documents/publications/guidingprinciplesbusinesshr_en.pdf OECD Due Diligence Guidance for Responsible Business Conduct (2018): https://www.oecd.org/en/publications/oecd-due-diligence-guidance-for-responsible-business-conduct_15f5f4b3-en.html ↩
  29. See Hawley, Leduc-Sands, Reigl and Prepscius, “What Does ’Minimum Compliance’ with the CSDDD Actually Look Like?” (5 March 2026), cited above. Directive (EU) 2024/1760 as amended, Art 15 (periodic assessments at least every five years and when significant changes occur); consolidated text cited above. ↩
  30. See Hawley, Leduc-Sands, Reigl and Prepscius, “What Does ’Minimum Compliance’ with the CSDDD Actually Look Like?” (5 March 2026), cited above. See also ILLAESA, “Global supply chains are in a time of transformation”, 9 December 2025: https://illaesa.com/foundation-transformation.html ↩

Sic utere tuo ut alienum non laedas

Use what is yours so as to harm no other.

Start a conversation