ISO 20400 sustainable procurement: a practical guide for suppliers

ISO 20400 sustainable procurement: what does the standard cover?

ISO 20400:2017 is the international standard that explains how to integrate sustainability into an organisation’s procurement, whatever its size or activity. It applies the social responsibility framework of ISO 26000:2010 to purchasing and is written for everyone involved in, or affected by, procurement decisions.

Its full title is “ISO 20400:2017 — Sustainable procurement — Guidance” (in French, Achats responsables — Lignes directrices). According to its iso.org page, read on 11 November 2026, it provides guidance to organisations, independent of their activity or size, on integrating sustainability within procurement, as described in ISO 26000. When it was published on 21 April 2017, ISO presented it as the world’s first International Standard for sustainable procurement.

Three short definitions used in this guide:

• Sustainable procurement: purchasing decisions that meet an organisation’s needs in a way that benefits the organisation, society and the environment; this is how ISO described it when the standard was published. It is also called responsible purchasing or responsible sourcing.
• Guidance standard: a standard that recommends rather than requires. It cannot serve as the basis for certification, unlike ISO 9001:2026 (formerly ISO 9001:2015) or ISO 14001:2026 (formerly ISO 14001:2015).
• Supplier ESG assessment: a review of a supplier’s social, environmental and ethical practices, by questionnaire, evidence review or audit, in proportion to the risk it presents.

ISO 20400 at a glance, as shown on iso.org

A 2017 standard is therefore not out of date: ISO reviews every standard every five years, and ISO 20400 was confirmed unchanged at its last review. The full text is paid for; this guide relies on what ISO publishes openly and on our own practice, without reproducing the standard.

Why do suppliers outside the EU need a sustainable procurement approach?

Because their European customers pass on their due diligence obligations and ask suppliers to cascade them to their own supply base. An approach based on ISO 20400 gives a structured answer to the question that keeps appearing in customer questionnaires: “how do you assess your suppliers?”

Directive (EU) 2024/1760 on corporate sustainability due diligence (CSDDD), as amended by Directive (EU) 2026/470, applies to very large groups from 26 July 2029; our article on the CSDDD after Omnibus I covers its scope and timeline. Two points in its Article 10, read in the consolidated version of 18 March 2026, concern your purchasing directly:

• the group seeks contractual assurances from its direct business partners that they will comply with its code of conduct, including by obtaining corresponding commitments from their own partners (Article 10(2)(b)): the cascade reaches your suppliers;
• the group makes the necessary changes to its own business, including its purchasing, design and distribution practices (Article 10(2)(d)): the directive treats procurement as a prevention lever, which is exactly what ISO 20400 is about.

The forced labour regulation states that it creates no additional due diligence obligations (Article 1(3)); among the references an authority may take into account, it lists due diligence guidance from the United Nations, the ILO and the OECD (Article 17). The EUDR is covered in our article on the EUDR from 30 December 2026, and the full picture on our supply chain due diligence page.

ISO itself points out that ISO 20400 does not replace legislation: it gives a method for building these requirements into the way you buy.

How is the ISO 20400 standard structured?

According to ISO, the standard looks at how sustainability affects four levels of procurement activity: policy, strategy, organisation and process. A section on fundamentals comes first: it sets out the principles of sustainable procurement and draws on the core subjects of ISO 26000.

The full list of principles and the detailed guidance are in the standard itself. For the seven principles and seven core subjects of ISO 26000:2010, and how they map to the CSR charter of the CGEM (Morocco’s employers’ confederation), see our guide to the CGEM CSR label and ISO 26000.

Applying the ISO 26000 core subjects to your purchasing

The ISO 26000 core subjects work as a lens for procurement risks. The table gives examples seen at Moroccan manufacturers and the evidence to ask for.

How do you build sustainability into each step of procurement?

By asking, at each step of the purchasing cycle, a sustainability question in proportion to the risk of the spend category. The method below is the one we apply; it follows the logic of ISO 20400 without reproducing its text.

1. Map your spend. Group purchases by category (raw materials, packaging, outsourced labour, transport, energy, services) and cross two criteria: sustainability risk and your leverage over the supplier.
2. Challenge the need. Before buying, check the real need and think in total cost: purchase, use, maintenance, end of life.
3. Write the specification. Include measurable criteria: recycled content with evidence, verifiable social compliance, batch traceability.
4. Select suppliers. Weight sustainability criteria in the selection grid, with a supplier ESG assessment in proportion to risk.
5. Contract. Include the code of conduct, the right to audit, the duty to cascade commitments to subcontractors, how non-conformities are handled and how the relationship ends.
6. Manage performance. Indicators, periodic reviews, targeted audits, corrective action plans with evidence of closure.
7. Learn and review. Review the risk map, policy and criteria with management every year.

On contract clauses, one date matters: the CSDDD requires the Commission to adopt guidance on voluntary model contract clauses by 26 July 2027 (Article 18). Contracts from your European customers will draw on it; your own supplier clauses will be easier to align if they use the same vocabulary.

How do you assess suppliers’ ESG performance without drowning them in questionnaires?

By matching the effort to the risk and reusing evidence. A low-risk supplier signs the code of conduct and completes a self-assessment; a high-risk supplier gets an on-site audit and a corrective action plan.

The CSDDD itself sets a proportionality rule. Since Directive (EU) 2026/470, a group in scope may request information from a direct business partner only where it is necessary and, for a partner with fewer than 5,000 employees, only where it cannot reasonably be obtained by other means (Article 8(2a)). Where the group has a small or mid-sized supplier’s commitments verified by an independent third party, it bears the cost, and a supplier that pays part of it may share the result with other customers (Article 10(5)). Apply the same restraint to your own suppliers: a short, targeted grid gets real answers; a hundred-question questionnaire gets ticked boxes.

Two typical cases show the approach. A citrus packer in the Souss region of Morocco that uses labour intermediaries for seasonal workers rates that category high risk: a contract with each intermediary, checks on social security filings, worker interviews during audits. A corrugated packaging maker near Casablanca that buys recycled paper rates its paper supplier medium risk: a recycled content declaration with evidence and annual follow-up. The choice between self-assessment, second-party audit and third-party social audit is set out on our supply chain due diligence page; to organise audits at your suppliers, see audits and inspections.

Can you get ISO 20400 certification?

No. ISO states that, like ISO 26000, ISO 20400 is a guidance standard rather than a certification standard: companies cannot be certified for compliance. It is a common benchmark for sustainable procurement, not the basis for a certificate.

Some bodies offer “ISO 20400 assessments” or maturity attestations. They can help you benchmark yourself, but they are not ISO certifications: check what they cover before showing one to a customer. What can be certified are the management systems your procurement sits in.

In practice, the most effective route is to build your ISO 20400 approach into the procurement procedure of your quality, health, safety and environment system: it is then audited every year with the rest of the system, with no extra certificate. If you are aiming for the CGEM CSR label, the same procedure feeds its supplier section.

Where should you start with sustainable procurement?

With a review of your purchases and of the requests you receive, then a short policy signed by management. The rest is built category by category, starting with the most exposed.

Take a typical case: an automotive parts supplier in the Kenitra area of Morocco receives three codes of conduct from European customers in one year. It starts by listing the commitments it has signed, then checks which ones it can cascade to its top twenty suppliers: outsourced transport and industrial cleaning come first. The sustainable procurement policy fits on two pages; supplier clauses mirror customer commitments. When a customer later asks how suppliers are assessed, the answer already exists. For the questionnaires themselves, see our page on CSRD, VSME and ESG questionnaires.

Go through this list with management, procurement, quality, HR and legal:

• Due diligence commitments signed with customers are listed, with those you must cascade to your suppliers.
  
• Purchases are grouped by category, with a sustainability risk level and your leverage.
  
• A sustainable procurement policy is signed by management and shared with buyers and requisitioners.
  
• A supplier code of conduct exists, consistent with your customers’ codes.
  
• Specifications for high-risk categories include measurable sustainability criteria.
  
• The supplier selection grid weights those criteria.
  
• Contracts provide for the right to audit, cascading to subcontractors, handling of non-conformities and exit.
  
• High-risk suppliers have been audited or their audit is scheduled.
  
• Each non-conformity has an action, an owner, a deadline and evidence of closure.
  
• Buyers and requisitioners have been trained.
  
• Management reviews the risk map, policy and results every year.