Supply chain due diligence: CSDDD, EUDR and forced labour rules

What does supply chain due diligence under the CSDDD mean for a non-EU supplier?

It does not bind you directly, but it requires your largest EU customers to identify, prevent and end harm to human rights and the environment in their chain of activities, which includes you. Directive (EU) 2024/1760 on corporate sustainability due diligence, the CSDDD, covers a company's own operations, its subsidiaries and its upstream business partners: design, extraction, sourcing, manufacture, transport and storage.

In practice, a group in scope will ask you for a code of conduct commitment, contract clauses, questionnaires, verification and, where a risk is found, an action plan. The annex to the directive lists the rights protected: the ban on child labour (ILO Conventions No 138 and No 182) and on forced labour, freedom of association, equal treatment, fair working conditions, and environmental prohibitions drawn from international conventions (mercury, persistent organic pollutants, hazardous waste).

Three other EU laws also push requests down to suppliers: the EUDR, the Forced Labour Regulation and CBAM. ESG data requested for a customer's CSRD report follows different rules: see supplier ESG questionnaires, CSRD and VSME.

Which EU laws are behind your customers' requests?

Four laws with three logics: company due diligence (CSDDD), product bans (EUDR, forced labour) and carbon pricing (CBAM). The table summarises what we read on EUR-Lex on 11 November 2026.

One customer may rely on several laws at once, and the CSRD value-chain cap does not cover due diligence requests.

What did Omnibus I change in the CSDDD?

It narrowed the scope, pushed back the timetable and limited what groups may ask of smaller partners. Directive (EU) 2026/470 of 24 February 2026, in force since 18 March 2026, amended dozens of provisions; the earlier stop-the-clock Directive (EU) 2025/794 had already postponed transposition.

The left column is the text published in the Official Journal on 5 July 2024; the right column is the consolidated version of 18 March 2026. The Commission must also adopt guidance on voluntary model contract clauses by 26 July 2027 (Article 18): it will shape the contracts you receive.

What will a customer in scope actually ask of you?

Written commitments, evidence and, where a risk exists, a monitored action plan. Articles 10 and 11 describe the measures the group must take, and therefore what lands at the supplier:

1. Code of conduct and contractual commitments. The group seeks assurances from its direct partners that they will comply with its code of conduct and, where needed, a prevention action plan, and cascade these commitments to their own suppliers (Article 10(2)(b)).
2. Verification. Commitments come with verification measures; the group may rely on independent third-party verification, including through industry or multi-stakeholder initiatives (Article 10(5)).
3. Fair terms for SMEs. Terms must be fair, reasonable and non-discriminatory; the group bears the cost of third-party verification and may provide targeted support such as training or management system upgrades (Article 10(2) and (5)).
4. An action plan. Where a risk cannot simply be prevented, the group draws up a prevention action plan with timelines and qualitative and quantitative indicators. Part of it will be yours.
5. Suspension as a last resort. If the risk persists despite an enhanced plan, the group does not expand the relationship and may suspend it (Article 10(6)).
6. Access to complaints. Affected people, trade unions and civil society organisations must be able to file complaints about impacts linked to the group's partners (Article 14).

A supplier that arrives with a risk map, evidence and a plan already under way negotiates its clauses from a stronger position.

Does the EU Forced Labour Regulation affect exporters outside the EU?

Yes, if they sell products destined for the EU market. Regulation (EU) 2024/3015 of 27 November 2024 prohibits economic operators from placing products made with forced labour on the EU market, making them available or exporting them. It entered into force on 13 December 2024 and applies from 14 December 2027. What the text says:

• definition: forced labour as defined in Article 2 of ILO Convention No 29, including forced child labour;
• reach: a product is "made with forced labour" if forced labour was used, in whole or in part, at any stage of its extraction, harvesting, production or manufacture, including processing (Article 2);
• no size threshold: the ban applies to every economic operator (Article 3);
• no new due diligence duty (Article 1(3)), but the authority assessing a risk first asks operators what they did to identify, prevent, mitigate or end it (Article 17);
• product sanctions: where a breach is established, the authority bans placing on the market and export, and orders withdrawal and disposal of the products (Article 20);
• public tools: a Commission database on risk areas and products (Article 8), still “in development” on the Commission site on 11 November 2026, and guidelines (Article 11), released by the Commission on 30 June 2026 and published in the Official Journal on 3 September 2026 (C/2026/4637), which notably exclude transport, warehousing and logistics services from the scope.

For a manufacturer in Morocco or elsewhere in Africa, the task is to be able to show quickly, product by product, that neither its plant nor its material suppliers use forced labour. Indicators to watch: retention of identity documents, recruitment debt bondage, wage deductions, imposed overtime, restriction of movement.

Which EUDR and CBAM data should you send, without mixing them up?

These are product and installation data, not social due diligence evidence: keep them in separate files. For the EUDR, your customer needs the country of production, plot geolocation, production dates and evidence of legality for each batch; our article on the EUDR from 30 December 2026 covers products in scope, country risk categories and a dated action plan. For CBAM, the importer declares the embedded emissions of covered goods (cement, iron and steel, aluminium, fertilisers, electricity, hydrogen) per installation: see CBAM for exporters and our article on the CBAM definitive period.

How do you map risks in your own supply chain?

By combining the three factors the CSDDD itself names: the partner, the geography and context, the sector and product (Article 8(2)). Effort goes where harm is most likely and most severe.

The map yields three classes: low risk (self-assessment and code of conduct commitment), medium (documentary evidence, annual follow-up), high (on-site audit, corrective action plan). Lenders ask the same: see EBRD and IFC ESG requirements.

Self-assessment, second-party audit or third-party social audit?

Risk level decides. Self-assessment is enough for low risk; an on-site audit is needed when risk is high or a customer requires it.

The CSDDD lets groups rely on independent reports and industry initiatives (Article 8(3)): one third-party social audit recognised by several customers avoids one audit per customer. To organise audits at your own suppliers, see audits and inspections.

What goes into your evidence file?

Existing, dated documents linked to a register, rather than statements, gathered once for every customer:

• Employment: personnel register, contracts, social security filings, age checks at hiring, contracts with temporary work agencies and lists of their workers on site.
• Working time and pay: time records, overtime and its payment, payslips, no unlawful deductions, no retention of identity documents.
• Health and safety: risk assessment, health and safety committee minutes, accident log, training; an ISO 45001 system provides most of it.
• Environment: permits, discharge and waste monitoring, chemicals; ISO 14001:2026 (formerly ISO 14001:2015) structures the data.
• Procurement: signed supplier code of conduct, risk map, self-assessments, audit reports, corrective action plans and closure evidence.
• Traceability: material origin by batch, EUDR data where it applies.

In Morocco, the CSR charter of the CGEM (the national employers' confederation) already uses as purchasing criteria suppliers' good standing with social security bodies, their workers' safety and the minimum working age: see CSR and the CGEM label.

How do you build a credible grievance mechanism?

With a written, accessible, confidential procedure that is followed up. The CSDDD requires groups in scope to run a fair, publicly available, accessible, predictable and transparent complaints procedure that protects complainants, plus a notification mechanism accepting anonymous or confidential reports (Article 14). Customers will expect something comparable from you, or your participation in theirs. A workable mechanism for an industrial site includes:

1. several channels, at least one anonymous, known to employees, agency workers and on-site subcontractors;
2. a written procedure: receipt, acknowledgement, investigation, decision, reply, time limits;
3. written and applied protection against retaliation;
4. a log tracking each case to closure;
5. periodic management review linking grievances to the risk map.

How does ISO 20400 structure your own procurement?

By building due diligence into the purchasing process, from policy to contract. ISO 20400:2017, "Sustainable procurement — Guidance", published in April 2017 and confirmed by ISO in 2023, helps any organisation integrate the social responsibility described in ISO 26000:2010 into procurement. It is guidance, not a certifiable standard. A programme based on it sets a sustainable procurement policy approved by management, ranks spend categories by risk, builds social and environmental criteria into selection, specifications and contracts, trains buyers, and measures results.

Is your company ready for due diligence requests?

Supply chain due diligence checklist, to review with management, procurement, HR, quality and legal:

• Every due diligence request received is listed with the customer, the legal basis and the deadline.
  
• Signed codes of conduct and clauses are archived and their commitments known to the departments concerned.
  
• Your sites, subcontractors and tier-1 suppliers are mapped by country, sector and raw material.
  
• Products sold in the EU that fall under the EUDR or CBAM are identified.
  
• Agency labour and labour subcontracting are known and covered by contract.
  
• No employee identity document is held by the company or a recruitment agency.
  
• The social and environmental evidence file is current and indexed.
  
• A grievance mechanism exists, with an anonymous channel and a log.
  
• High-risk suppliers have been audited or their audit is scheduled.
  
• Every finding has an action, an owner, a deadline and closure evidence.
  
• Answers sent to customers are archived and consistent with one another.
  

Why work with ACG on supply chain due diligence?

Because we start from your systems and evidence, not from a report template. ACG has delivered 502 projects and trained more than 120,000 people; the team brings together 10 in-house consultants and more than 100 qualified external experts. We work with exporters and manufacturers in Morocco, Africa and the Middle East, particularly in food, packaging and industry and energy.

We prepare, structure and train; we issue no certificate or social audit attestation. For training, see our training catalogue; for the overview, our ESG and CSR page. To discuss the requests you receive, contact us.