Norwegian Consumer Authority issues substantial updates to Transparency Act guidance

In this article, we highlight five developments we consider particularly noteworthy. These include the guidance’s stronger emphasis on meaningful stakeholder engagement, some relevant clarifications regarding the scope and content of due diligence, an explicit warning against outsourcing due diligence obligations, greater focus on collaborative approaches to follow-up measures, and a clearer recognition that a company’s connection to adverse impacts may evolve over time.

Many companies are now in the process of updating their annual Transparency Act reports. The new input from the Consumer Authority provides helpful guidance to be taken into account in the report and for companies' Transparency Act work more generally. 

Meaningful stakeholder engagement

The updated guidance places significantly greater emphasis on meaningful stakeholder engagement throughout all steps of the due diligence process.

Meaningful dialogue is described as having four key characteristics: it should be continuous (not one‑off consultations), two‑way (not just information sharing), conducted in good faith (with a genuine willingness to respond to concerns), and responsive (taking stakeholder views into account in decision‑making). The guidance also underlines that dialogue must be safe, accessible and appropriate for stakeholders, with particular attention paid to vulnerable groups, including women, children and marginalised persons.

Building on this, the guidance embeds stakeholder engagement requirements across the due diligence process. Companies are expected to engage with stakeholders when conducting risk assessments, to give affected parties meaningful input into the design of measures and action plans, and to verify whether affected parties consider both the remediation process and its outcome to be satisfactory.

This approach reflects the recognition that those directly affected often have the best information about actual conditions and effective solutions, and that affected persons are rightsholders entitled to participate in decisions impacting their rights.

Risk-based identification, assessment and prioritisation 

In terms of methodology, the guidance reiterates that companies must first carry out a high‑level identification of areas with the greatest and most serious risk, which will depend on the nature of each company’s operations. Companies should then conduct more detailed assessments of their most significant risk areas and prioritise their efforts accordingly.

In this context, the guidance cautions against sending standardised questionnaires to all suppliers and business partners as a primary information‑gathering tool. According to the Consumer Authority, such an approach often lacks the necessary focus and may place an undue burden on recipients. While such self‑assessment questionnaires remain a valid tool, companies are encouraged to consider a wider range of methods and carefully reflect on which methods may provide the most relevant information for identifying, prioritising and addressing their principal risk areas.

Importantly, the guidance clarifies that due diligence does not require complete oversight of all activities of every supplier, sub‑supplier and business partner.

Warning against outsourcing due diligence

The revised guidance further warns against outsourcing due diligence work entirely to external parties. While companies may draw on external expertise to support their processes, the Consumer Authority makes clear that due diligence obligations cannot simply be delegated to consultants or third‑party service providers. Responsibility must remain firmly anchored in the company’s own organisation and decision‑making structures.

This warning reflects concerns that some companies may seek superficial compliance by commissioning consultants to produce reports, without genuinely integrating human rights and decent work considerations into their business model, procurement practices or strategic decisions.

Realistic expectations and collaborative approaches 

On follow-up measures, the guidance places particular emphasis on collaboration, for instance where companies have contributed to harm together with suppliers or other business partners. Companies should ensure that their requirements and expectations are realistic and achievable. As an example, the Consumer Authority notes that it is not realistic to expect a supplier to be in a position to confirm it has no connection whatsoever to adverse impacts. 

The updated guidance also highlights the need to consider how a company's own practices, such as short delivery deadlines, low price requirements or lack of predictability (e.g., in placing orders), may make it difficult for suppliers and business partners to meet its requirements while safeguarding human rights and decent working conditions. Appropriate follow-up measures will be context-dependent. In some cases, support and capacity-building may be more effective in achieving genuine improvements than imposing strict, one-sided demands. 

Dynamic connection to adverse impacts

The fifth key development is the clarification that a company’s connection to adverse impacts is dynamic and may change over time.

A company’s connection to adverse impacts may take three forms: causing harm, contributing to harm, or being directly linked to harm through its business relationships. The updated guidance emphasises that “connection to harm and risk is not static, but can change if the situation or the relationship with other companies develops or changes” (our translation). A company that is initially only “directly linked” to harm may, over time, be found to “contribute to” the continuation of that harm, depending on the due diligence assessments it conducts and the measures it implements.

Companies therefore cannot simply categorise themselves as only “directly linked” to harm and assume more limited obligations. If they do not take appropriate action, their connection to the harm may strengthen and their responsibility increase.

This dynamic understanding of connection to adverse impacts aligns with recent enforcement practice. In its Equinor decision, the Consumer Authority underlined that both risk and a company’s connection to risk may change over time, and that companies must continuously review their processes and make necessary adjustments in light of internal and external developments.

Practical implications

Companies subject to the Transparency Act should consider reviewing their existing due diligence frameworks against the updated guidance and assessing where targeted improvements would have the greatest impact. In practice, for many this may mean building more structured channels for dialogue with affected stakeholders. The basics have not changed, however, and companies should continue to allocate resources towards higher‑risk areas and strengthen the integration of human rights considerations into commercial decision‑making. 

The guidance’s continued focus on risk‑based prioritisation underlines that efforts are best concentrated where potential harm is most severe or most likely, rather than spread thinly across all business relationships. At the same time, the emphasis on collaboration and realistic expectations suggests that companies may achieve better outcomes through support and capacity-building with business partners, rather than relying solely on strict, one-sided demands, particularly where the company's own practices, such as short delivery deadlines, pricing pressure or lack of predictability, may be contributing to the challenges suppliers face in upholding human rights and decent working conditions.

For companies that rely heavily on external consultants, the updated guidance is also a reminder that effective due diligence cannot be outsourced. External expertise may support implementation, but strategic direction and day‑to‑day ownership must remain within the business. Some companies may therefore wish to reinforce internal capacity, including through procurement training, upskilling compliance resources and closer board‑level oversight.

The Consumer Authority’s message is clear: meaningful due diligence requires sustained commitment, real engagement with those affected by a company's activities, and recognition that a company’s responsibility will evolve in line with how it responds to emerging risks.