Supply chain due diligence in a changing world

01Why the ground is shifting

Expectations are rising, while the rules are being recalibrated. Three developments matter most:

• The EU’s Corporate Sustainability Due Diligence Directive (CSDDD) was adopted in 2024 and then narrowed by the “Omnibus” simplification package, published in the Official Journal in February 2026. The directive now targets the largest companies: EU-incorporated companies with more than 5,000 employees and more than EUR 1.5 billion in worldwide net turnover, and non-EU companies with more than EUR 1.5 billion of turnover in the EU. Member States must transpose it by 26 July 2028, and it applies from 26 July 2029.
• Smaller suppliers are protected, but not invisible. The amended rules limit how much information large companies may demand from smaller business partners, and the CSRD value-chain cap points to the voluntary VSME standard as the reference for small and mid-sized enterprises. In practice, suppliers will still be asked for data by their customers, banks and insurers.
• Sector and product rules keep arriving. Separate regulations on deforestation-free products, forced labour, batteries and conflict minerals, together with national laws, mean that many businesses face due diligence duties even if they fall outside the CSDDD.

The practical message: the legal threshold has moved up, but the commercial expectation has not. Large buyers still pass requirements down their chains, and a supplier that can demonstrate a credible due diligence process has an advantage.

02The recognised framework: six steps

The OECD Due Diligence Guidance for Responsible Business Conduct, aligned with the UN Guiding Principles on Business and Human Rights, is the reference most laws and buyers rely on. It describes a continuous cycle:

1. Embed responsible business conduct in policies and management systems.
2. Identify and assess actual and potential adverse impacts in your operations and supply chain.
3. Cease, prevent or mitigate those impacts.
4. Track whether your measures work.
5. Communicate how impacts are addressed.
6. Provide for or cooperate in remediation where you have caused or contributed to harm.

03How to start without mapping everything at once

Few companies know every supplier beyond the first tier, and the guidance does not expect them to. It expects a risk-based approach: focus effort where the risk is greatest.

• Map your first tier and the main inputs you buy: spend, country, product category and contract type.
• Screen for risk using country, sector and commodity indicators, such as exposure to forced labour, child labour, deforestation, water stress, conflict-affected areas or weak governance.
• Prioritise the suppliers and categories that combine high risk with high spend or high dependency.
• Go deeper where it counts: questionnaires, documentary evidence, site assessments and third-party audits for the highest-risk suppliers.
• Extend visibility upstream over time, starting with the raw materials that carry the greatest risk.

04Turning findings into action

Identifying a risk is only half the work. Regulators and stakeholders increasingly look at what you did next:

• Write expectations into supplier contracts, including a code of conduct, audit rights and corrective-action terms.
• Agree corrective action plans with deadlines, and follow up.
• Support suppliers with training and fair purchasing practices. Pressing on price while demanding compliance undermines the whole effort.
• Prefer engagement over exit where possible; terminate relationships only when engagement fails or the harm is severe.
• Offer a grievance mechanism that workers and communities in your supply chain can actually reach.

05Common pitfalls

• Questionnaire fatigue: sending long surveys without risk-based follow-up produces paperwork, not insight.
• Relying on certificates alone: audits and certifications are useful inputs, but they have limits and do not replace your own judgement.
• Treating it as a one-off project: due diligence is an ongoing process that must be updated when suppliers, products or contexts change.
• Disconnected data: supplier information held in several systems makes it hard to see the overall risk picture.

06The link to climate and reporting

Due diligence data supports other obligations. Supplier emissions feed Scope 3 inventories under the GHG Protocol; supply chain risks and impacts are part of what companies in scope of the CSRD must report on. Building one coherent supplier data process serves both purposes.