The EU Forced Labour Regulation: From Due Diligence to Product-Level Liability
Photo: Gettyimages
For years, the standard of care in responsible sourcing has been defined by effort: documented processes, supplier assessments, demonstrated risk awareness. The EU Forced Labour Regulation (EU) 2024/3015, applying from 14 December 2027, shifts that logic entirely. The question is no longer whether a company followed the right procedures, but whether a specific product was made with forced labour at any stage of its value chain. As the Commission has put it, all EU companies – regardless of size – must ensure that products made with forced labour do not enter or leave the EU market, and: “How this is achieved is up to them.”
Reading time 6 minutes
In late June 2026, the EU Commission released its official implementation guidance and launched an information portal. This article examines what the guidance means in practice, how it can inform due diligence frameworks, and how businesses should be preparing. The Regulation is marked EEA relevant and is expected to be incorporated into Norwegian law through the standard EEA incorporation procedure.
New dimensions in traceability and human rights due diligence
The EU Forced Labour Regulation (EUFLR) operationalises forced labour as a product-level legal risk: if a product was made with forced labour at any stage of its supply chain, it must be withdrawn from the market. The commercial consequence is concrete – a prohibition order, mandatory withdrawal, and disposal of stock at the company's expense. Competent authorities may also issue fines.
Full supply chain traceability, once a leading-practice aspiration, is now the basis on which that risk is managed. And unlike previous EU instruments targeting specific sectors (EU Deforestation Regulation) or large companies (EU Corporate Sustainability Due Diligence Directive), this Regulation applies to every economic operator placing or exporting products on the EU market, regardless of size or sector. Distance sales and online sales targeted at EU consumers are also explicitly included.
EU forced labour database and implementation guideline
On 26 June 2026, the Commission published its implementation guidelines for the Regulation. The guidelines introduce a publicly available database of products and geographic areas associated with documented forced labour risks. Its primary function is to calibrate enforcement priorities, guiding authorities in deciding where to focus investigations. The database is still under development and is expected to be released shortly.
For businesses, the database will be equally important: if products, suppliers, or sourcing regions appear in the database, it is the clearest available signal of where exposure lies, and the new guidelines confirm that traceability gaps in those flagged products and areas weigh negatively in any evidentiary assessment.
What does the Regulation prohibit?
Forced labour is defined by reference to ILO Convention No 29, encompassing both privately imposed forced and child labour and state-imposed forced labour. This distinction is particularly relevant in jurisdictions where systemic state-directed labour practices exist.
No new compliance obligations – but a serious enforcement risk
An important feature of the Regulation is what it does not do: the Regulation creates no new due diligence obligations. Companies are not required to certify, declare, or prove compliance before placing products on the market.
However, for companies that fall below the thresholds of mandatory frameworks such as the CSDDD or the Norwegian Transparency Act, this offers less comfort than it appears. The Regulation imposes an obligation of result, and without supply chain traceability, a company has no pathway to assess its exposure, respond to an authority's information request, or – in case of an investigation – demonstrate to the competent authority the steps the company has taken to address the forced labour risk. The absence of a mandatory obligation to build those systems simply means the risk of not having them falls entirely on the company.
How investigations work and what that means for companies
In the preliminary phase, the competent authority may request information from companies under assessment of a product on what actions they have taken to identify, prevent, mitigate, or end risks of forced labour in their operations and supply chains. Once the companies' responses have been received, the authority has 30 working days to conclude whether there is a substantiated concern that the forced labour ban has been violated. If no substantiated concern is found, or if the reasons that motivated the existence of such a concern have been eliminated — for instance because due diligence has been applied in a way that mitigates, prevents and brings to an end the risk of forced labour — no investigation is initiated.
Where a substantiated concern exists, a formal investigation opens. Companies may be required to submit detailed information on their products, supply chains, manufacturers, and suppliers, with deadlines of between 30 and 60 working days. Authorities may also conduct on-site inspections. The investigation aims to close within nine months.
For companies that obstruct or fail to cooperate with an investigation, the authority may find a violation based on whatever evidence it already holds, an adverse inference mechanism that adds a significant practical incentive to engage transparently.
Photo: from EU : What is the Forced Labour Regulation and how does it work? - Internal Market, Industry, Entrepreneurship and SMEs
How the Forced Labour Regulation interacts with the Norwegian Transparency Act and the CSDDD
The due diligence frameworks under the Norwegian Transparency Act and the CSDDD are complementary to the Forced Labour Regulation but operate on fundamentally different logic. The new regulation asks not whether a company had the right procedures, but whether a specific product was made with forced labour at any stage of its value chain. If a product was made with forced labour, the ban applies regardless of how thorough the company's due diligence was.
The new guidelines address a real tension between existing due diligence frameworks. International best practice – the UN Guiding Principles, the ILO, the OECD – treats disengagement as a last resort and favours engagement and remediation. The EUFLR now rewards this through a grace period mechanism: companies that can demonstrate active remediation steps during the preliminary investigation phase may be granted additional time before a formal investigation is opened. However, for cases of state-imposed forced labour disengagement may be the only viable path. The commercial and legal consequences of that choice require careful navigation.
The Regulation is marked EEA-relevant and is expected to apply in Norway through the standard EEA incorporation procedure.
What companies should be doing now
With application from 14 December 2027, there is time to prepare, but the groundwork should begin well in advance.
Companies that have already established robust human rights due diligence processes under the Transparency Act will be well placed to build on those foundations. For others, the compliance uplift may be more substantial, requiring risk assessments, risk-based procedures, effective oversight of third parties, as well as the implementation of relevant contractual rights and obligations.
In practice, companies who have not already established human rights due diligence should consider the following steps:
- Map supply chain exposure focusing on geographic areas and sectors flagged for heightened forced labour risk.
- Review and strengthen existing due diligence processes, ensuring they are documented and capable of demonstrating that risks have been identified, assessed, and addressed.
- Identify suppliers in high-risk regions and engage with them directly on forced labour risks, requesting transparency around labour practices and production conditions.
- Pay special attention to geographies with suspected state-imposed forced labour.
The value of on-the-ground presence in high-risk regions
The Forced Labour Regulation is, in practice, as much a supply chain transparency challenge as it is a legal compliance question. For companies sourcing from regions where forced labour risk is elevated, the ability to gather reliable, first-hand information from the source country is critical. In China, that task has become materially more complex.
In April 2026, China's State Council issued two regulations: Decree No. 834, the Provisions on Industrial and Supply Chain Security, and Decree No. 835, the Provisions on Countering Improper Extraterritorial Jurisdiction. Together, they create legal conflict with what the Forced Labour Regulation requires. Supply chain investigations, audits, and information gathering directed at Chinese suppliers may constitute prohibited activities under Article 13 of Decree 834, which bans unauthorised supply chain information-gathering within China, an additional legal basis for action that sits on top of existing data security and national security legislation.
More acutely, implementing measures required by the Forced Labour Regulation — including withdrawing products, demanding remediation, or terminating a Chinese supplier on forced labour grounds — may risk being characterised as implementing improper extraterritorial jurisdiction under Decree 835. Terminating a supplier may simultaneously trigger Decree 834, the Anti-Foreign Sanctions Law, and the Unreliable Entity List regime.
Further questions?
Our team is closely monitoring implementation developments, including the Commission's guidelines and the build-out of the risk database, and advising clients on supply chain risk assessment, due diligence frameworks, and investigation readiness. We have significant expertise in human rights due diligence, and have for years been advising clients on cross-border supply chain compliance. Do not hesitate to contact us if you have questions about how the Regulation affects your business.