On this page
Key takeaways
- Supply chain due diligence is a process of finding, preventing, stopping and reporting harm to people and the environment in your supply chain.
- The EU's CSDDD, as amended in 2026, applies from 26 July 2029 to EU companies with 5,000 or more employees and more than 1.5 billion euros turnover, and to non-EU companies with over 1.5 billion euros turnover in the EU.
- The revised rules use a two step risk approach: scope first, then deep assessment where harm is most likely and most severe.
- McKinsey's 2025 survey found 95 percent of companies see tier-one supplier risks but only 42 percent extend that to tier two or beyond.
- Keep evidence. If you cannot show what you did and why, a regulator will treat it as not done.
Free PDF: Supply chain due diligence risk mapping tracker. Get it below
A procurement director at a large electronics group receives a letter from a regulator. It asks how the company identified risks of forced labor in the sourcing of one component, and what it did about them. The director knows the first tier supplier well. She does not know where that supplier gets its raw material. The honest answer to the letter is "we did not ask", and that is the answer that regulators now treat as a failure.
This is an invented scene, built from the way these duties are described in public guidance. The question it raises is the one this guide answers: what do you have to look at, and how far.
Supply chain due diligence is an ongoing process by which a company identifies, prevents, mitigates and accounts for adverse impacts on human rights and the environment in its own operations and across its supply chain.
Which laws apply?
Several regimes exist, and they differ in scope. We give an orientation, not legal advice, and you should confirm your position with counsel.
| Regime | Where | Core idea |
|---|---|---|
| EU Corporate Sustainability Due Diligence Directive (CSDDD) | EU member states | Risk-based duty to identify, prevent and address adverse impacts, as amended by the 2026 Omnibus |
| German Supply Chain Due Diligence Act | Germany | Duty for large companies to run a due diligence process in their own operations and supply chain |
| Norwegian Transparency Act | Norway | Duty to carry out due diligence and answer public information requests |
| US forced labor import controls | United States | Goods made with forced labor can be blocked at the border, so traceability matters |
Do not read the table as complete. The list grows, and national laws interact with EU rules.
What changed in the EU in 2026?
The Omnibus amendments to the CSDDD were published in the EU Official Journal in early 2026. The main changes, as reported by Covington, are these. Scope is narrower: EU companies must have 5,000 or more employees and more than 1.5 billion euros net worldwide turnover, and non-EU companies must have over 1.5 billion euros net turnover generated in the EU. One application date, 26 July 2029, replaces the staggered schedule, and member states must transpose the rules by 26 July 2028.
Risk assessment became a two step process: a scoping exercise first, then in-depth assessment where impacts are most likely and most severe. Requests for information from business partners with fewer than 5,000 employees are limited to what is necessary. Ending a business relationship is no longer a mandatory last resort. The EU-wide civil liability regime was removed, leaving it to national rules, with a review due by July 2031. Maximum fines must be capped at 3 percent of net worldwide turnover. The requirement to adopt a climate transition plan was deleted.
A narrower scope does not mean less work for suppliers. Large buyers that fall in scope will still ask their suppliers for information, even if that information is limited to what is necessary.
What are the six steps?
- Set the policy and assign ownership. A board approved statement, a named executive and clear roles in procurement, legal and sustainability.
- Map and scope. List suppliers and categories. Score each for the likelihood and severity of harm by country, sector and product. This is the scoping exercise.
- Assess in depth where the risk is highest. Use questionnaires, third-party data, site visits and worker voice. Go beyond tier one for the priority categories.
- Act. Prevent harm through contract terms, training and supplier support. Address harm through corrective plans. Escalate when suppliers do not act.
- Track and verify. Measure whether actions worked. Repeat assessments at set intervals.
- Report and keep records. Document what you did, what you found and what you decided, and why.
Free PDF
Supply chain due diligence risk mapping tracker
A tracker to score categories for likelihood and severity, record tier-two suppliers, log information requests and keep the evidence a regulator may ask for.
- Category scoping grid
- Tier two supplier map
- Information request log
- Evidence checklist
How far down the chain do you need to look?
McKinsey's 2025 survey of 100 companies found 95 percent have visibility into at least tier-one supplier risks. Only 42 percent extend it to tier two or beyond, and 58 percent have mapped tier-two suppliers, with fewer than half in regular contact with them. Most of the severe harm in supply chains sits further down. The revised EU approach reflects this by asking you to prioritize where impacts are likely and severe, not to map everything equally.
In practice, start with raw materials and processing steps for your three highest risk categories. Ask each tier-one supplier for the names and countries of its critical suppliers and the steps they perform. Accept that the first map will have gaps and record them.
What evidence should you keep?
| Item | Why it matters |
|---|---|
| Risk map with scoring method | Shows how you chose priorities |
| Supplier information requests and replies | Shows you asked and what you learned |
| Assessment and audit reports | Shows what you found |
| Corrective plans and verification | Shows you acted and checked |
| Decisions log with reasons | Shows judgment, especially when you chose not to exit |
| Contract clauses and training records | Shows prevention |
What goes wrong?
- Treating it as a questionnaire exercise. Replies are not due diligence unless you act on them.
- Spreading effort evenly. Prioritize by severity and likelihood.
- Leaving procurement out. Suppliers sit with buyers, so buyers must be in the process.
- Forgetting that purchasing practices cause harm. Late changes, price cuts and short lead times push suppliers to cut corners.
- Keeping thin records. A decision with no reason on file is a decision you cannot defend.
For onboarding a single vendor, see the vendor due diligence checklist, which covers a different job. For the labor focus, read ethical sourcing, and for the wider programme see sustainable procurement. The overall plan is in procurement strategy.
Sources
- Covington, EU CSDDD and CSRD Omnibus published in the Official Journal: scope, dates, risk assessment, penalties as quoted above.
- McKinsey, supply chain risk survey: 100 companies, December 2025. Tier-one and tier-two visibility figures.
- References to the German and Norwegian laws and to US forced labor import controls are general. Confirm scope and current status with counsel before relying on them.
Frequently asked questions
What is supply chain due diligence?
It is an ongoing process of identifying, preventing, mitigating and accounting for adverse impacts on human rights and the environment in your own operations and across your supply chain.
When does the EU CSDDD apply?
As amended in 2026, it applies from 26 July 2029, with member state transposition due by 26 July 2028. It covers EU companies with 5,000 or more employees and over 1.5 billion euros turnover, and non-EU companies with over 1.5 billion euros turnover in the EU.
What are the steps of supply chain due diligence?
Set policy and ownership, map and scope risks, assess in depth where risk is highest, act to prevent and address harm, track and verify results, and report and keep records.
How far down the supply chain do you need to look?
Prioritize by likelihood and severity of harm rather than by tier. McKinsey found only 42 percent of companies extend risk visibility to tier two or beyond, yet severe harm often sits deeper.
What is the difference between vendor due diligence and supply chain due diligence?
Vendor due diligence checks a single supplier before onboarding. Supply chain due diligence is an ongoing legal duty to identify and address harm across your whole chain.