For large and medium enterprises, and for micro and small operators already covered by the EU Timber Regulation, the main application date is 30 December 2026. Most other micro and small enterprises have until 30 June 2027. The work should begin with your exact role, product codes, supply routes, and company size, not with a generic checklist.

What Does EUDR Compliance Require in 2026?

The legal starting point is Regulation (EU) 2023/1115 and its Annex I product list. The European Commission’s current explanation of EUDR compliance due diligence separates the operational work into three steps for upstream operators:

1.  Collect the required product, supplier, production, geolocation, and legality information.

2.  Assess the risk that a relevant product does not comply.

3.  Reduce any identified risk to no or only a negligible level before placing the product on the EU market or exporting it.

The deforestation cut-off is 31 December 2020. Relevant commodities must not have been produced on land subject to deforestation after that date. Wood products are also subject to the forest-degradation requirement defined by the Regulation.

This is not only a document-collection exercise. Your system needs to connect product scope, source plots or establishments, supplier evidence, risk criteria, mitigation, approval, and submission. If the required information cannot be collected, or if the risk remains more than negligible, an upstream operator must not place the relevant product on the EU market or export it.

Who Must Act, and by When?

EUDR compliance responsibilities depend on the activity performed in the supply chain. The same corporate group can contain different legal entities with different roles, and one company may hold more than one role.

The Commission’s current explanation of EUDR roles and responsibilities should be used with the legal text, official guidance, and FAQs. Do not assume that the party named as the supplier in a commercial contract is automatically the EUDR operator.

A useful first step is to establish a verified current state and then test it against the applicable date and requirement. VECTRA’s guide to baseline assessments and readiness assessments explains why those are separate management decisions.

What Changed Before the EUDR Compliance 2026 Deadline?

The rules and implementation tools have changed since the original 2023 Regulation was published. A readiness plan based on an early briefing deck may now be incomplete.

The European Commission confirmed in July 2026 that:

•  the Regulation applies from 30 December 2026 for large and medium enterprises and for micro and small operators already covered by the EUTR;

•  it applies from 30 June 2027 for most other micro and small enterprises;

•  the Annex I product scope has been updated;

•  soluble coffee, certain palm oil derivatives, and frozen cattle tongues were added, with those newly added products becoming subject to the Regulation from 30 December 2027;

•  certain hides, skins, leather, re-treaded tyres, soybeans for sowing, specified vulcanized rubber articles, conveyor and transmission belts, and certain vehicle and aircraft seats were removed; and

•  the Information System and its technical rules were updated to support due diligence statements, simplified declarations, and automated submissions.

The Commission’s July 2026 EUDR scope and implementation update provides the current summary, while the August 2026 EUDR implementation FAQ addresses detailed implementation questions. Product decisions should still be made against the current Annex I codes and the facts of the transaction.

The simplifications change how some responsibilities and submissions work. They do not remove the need to confirm product scope, collect the required evidence, identify the responsible legal entity, and follow the rules that apply to its role.

The 7 EUDR Compliance Checks to Complete

1. Confirm Product Scope by CN or HS Code

Begin with the product as traded, not only the commodity it contains. Annex I uses Combined Nomenclature and Harmonized System codes to define relevant products. A product containing wood, rubber, cocoa, or another covered input is not automatically in scope, and a product that appears unrelated at first glance may still be listed.

Create a controlled scope register that records:

•  the product and trade name;

•  the current CN or HS code used for customs and EUDR analysis;

•  the relevant commodity or derived product;

•  the applicable Annex I version and review date;

•  the placing-on-market, making-available, import, or export activity;

•  the legal entity responsible for that activity; and

•  the rationale and reviewer for the scope decision.

Do not copy a product list from a supplier or an old implementation memo without rechecking it. The 2026 product-scope changes make version control essential. If the code or product description is uncertain, obtain customs or legal advice before building the rest of the process around a doubtful classification.

2. Assign the Correct Role, Legal Entity, and Date

Map the transaction from production to the first EU market placement and onward. Identify who imports, who acts as customs declarant, who first places the product on the EU market, who processes it into another relevant product, who trades it, and who exports it.

treat company-group arrangements carefully. EUDR responsibilities attach to the legal entity carrying out the relevant activity. Central systems and shared teams can support the work, but they do not transfer legal responsibility away from the operator.

3. Connect Products to Source Plots and Establishments

Traceability must connect the relevant product to the place where the commodity was produced. For most relevant commodities, that means the geolocation of all plots of land. For cattle, the required location data refers to the establishments where the animals were kept under the applicable rules.

The EUDR Information System allows operators to provide coordinates individually, in bulk, or through GeoJSON files, and supports an API for bulk management. Test both the business data and the submission process. A technically valid file can still be wrong if it contains the wrong plots, an incomplete batch relationship, or mixed origin data.

Data controls matter as much as collection. VECTRA’s guide to stronger FMCG sustainability data and supplier evidence explains how ownership, definitions, validation, and audit trails prevent supplier information from becoming an unverified spreadsheet exercise.

4. Test the Deforestation-Free Evidence

The operator needs adequately conclusive and verifiable information that the relevant products are deforestation-free. A map should be treated as a source for analysis, not as a conclusion by itself.

Satellite imagery, the EU Forest Observatory, public datasets, supplier records, field information, and independent verification may all contribute. None should be treated as infallible. Record the data source, date, reviewer, finding, uncertainty, and decision so another competent person can reproduce the reasoning.

The control also needs to prevent mixing with products of unknown or non-compliant origin. Mass-balance claims, warehouse practices, aggregation points, transport documents, and processor records should be tested against the traceability model used for the due diligence decision.

5. Verify Legality in the Country of Production

EUDR legality is not limited to proof of title or a harvest permit. The relevant legislation of the country of production can cover land-use rights, environmental protection, forest-related rules, third-party rights, labor rights, human rights protected under international law, free, prior and informed consent where relevant, tax, anti-corruption, trade, and customs requirements.

Build a legality register by commodity and country. For each requirement, identify the source law, competent authority, supplier obligation, evidence expected, validity period, translation needs, and escalation route.

This is one reason a general supplier declaration is insufficient. The evidence must apply to the relevant producer, place, activity, product, and time. Where indigenous peoples, workers, or communities may be affected, the risk assessment should consider reliable information about claims, rights, consultation, and access to remedy. VECTRA’s guide to human rights due diligence for supplier impacts provides a separate method for assessing impacts on people. It supports the work but does not replace the EUDR legal test.

6. Document the Risk Assessment and Any Mitigation

If simplified due diligence does not apply, the operator must assess the risk of non-compliance using the Regulation’s criteria. Country benchmarking is one input, not the complete assessment.

The Commission’s country benchmarking guidance classifies countries as low, standard, or high risk. Sourcing only from low-risk countries may allow simplified due diligence where the conditions are met, but the operator must still collect the required information and remain alert to mixing, circumvention, or new concerns.

A documented risk assessment should address, as relevant:

•  country classification and local deforestation conditions;

•  forests and the presence or rights of indigenous peoples;

•  reliable claims concerning ownership or use of production areas;

•  corruption, falsified documents, weak law enforcement, conflict, or sanctions;

•  the reliability and consistency of the Article 9 information;

•  supply-chain complexity and the ability to connect products to origin;

•  mixing, circumvention, unknown-origin, and prior non-compliance risks; and

•  any other information indicating possible non-compliance.

Separate the initial exposure from the effect of verified controls. VECTRA’s supplier risk assessment checklist explains how to distinguish inherent risk from residual risk and connect a finding to a decision. For EUDR, the final threshold remains specific: the operator can proceed only where the risk is no or negligible.

Where the risk is not negligible, require additional information, conduct surveys or audits, strengthen traceability, support supplier capacity, change controls, or take another proportionate measure. Record why the measure addresses the identified risk and how its effectiveness was checked. A planned action does not reduce risk until it has been implemented and verified.

7. Test Governance, Submission, Retention, and Response

An EUDR process is not ready until it works under realistic operating conditions. The person approving a product should be able to see the scope decision, evidence status, risk conclusion, mitigation result, and applicable submission before the product moves.

Use the Information System acceptance environment to test registration, user access, data upload, review, submission, and exception handling before relying on the production environment. The Commission distinguishes clearly between the two: acceptance submissions have no legal value, while production submissions do.

Supplier expectations should also be reflected in contracts, operating instructions, and controlled evidence requests. VECTRA’s guide to moving a supplier code of conduct from policy to practice explains how to connect requirements to evidence, monitoring, corrective action, and escalation.

What Should Non-EU Suppliers Prepare?

Most non-EU producers do not have direct EUDR obligations unless they directly place relevant products on the EU market. They can still determine whether an EU buyer can comply on time.

Suppliers should be ready to provide accurate and consistent information covering:

•  the producing entity and relevant intermediaries;

•  product description, commodity, quantity, and production period;

•  production country and, where relevant, subnational region;

•  plot coordinates or required cattle-establishment information;

•  documents supporting the right to produce or use the land;

•  evidence that the commodity is deforestation-free;

•  evidence of compliance with relevant laws in the country of production;

•  chain-of-custody and segregation information; and

•  prompt notification if any information changes or becomes unreliable.

EU buyers should explain why each item is requested, define the format, protect sensitive information, allow realistic time for correction, and avoid asking smallholders for multiple inconsistent templates. Supplier capacity-building can be a legitimate risk-mitigation measure when it addresses a defined gap and the result is verified.

VECTRA’s Pre and Post Audit Assistance service can support readiness testing, evidence review, gap closure, and re-testing. For organizations that need to connect product scope, supply-chain data, supplier risk, mitigation, and regulatory controls, VECTRA’s Compliance, Risk & Due Diligence service provides the primary commercial route.

SUMMARY

Who

Large and medium enterprises carrying out covered activities, and micro and small operators already covered by the EUTR, face the 30 December 2026 application date. Most other micro and small enterprises follow on 30 June 2027. Non-EU suppliers may need to provide the evidence their EU customers require.

What

Covered products must satisfy the deforestation-free and legality conditions, follow the applicable due diligence process, and be covered by the required statement or declaration before the relevant market action.

When

The deadline depends on company size, role, prior EUTR coverage, and whether a product was newly added for 30 December 2027. Due diligence must be completed before the product is placed on the EU market or exported.

Where

The rules govern relevant products placed or made available on the EU market or exported from it. The evidence reaches back to the countries, plots, establishments, suppliers, and intermediaries connected to production.

Why

The business needs a defensible decision that covered products meet the Regulation, not a collection of disconnected declarations. Strong preparation also reduces border delay, blocked product, rushed supplier requests, and inconsistent decisions across legal entities.

Start With One Real Product Flow

Choose one relevant product expected to move soon after the applicable date. Trace it from the responsible legal entity back to every required plot or establishment, then forward through risk assessment, approval, Information System submission, customs, and downstream records. Record every missing connection. That exercise will show whether the immediate problem is scope, role, data, evidence, risk judgment, supplier capacity, or system control.

Frequently Asked Questions

What is the EUDR compliance deadline?

The Regulation applies from 30 December 2026 for large and medium enterprises and for micro and small operators already covered by the EU Timber Regulation. It applies from 30 June 2027 for most other micro and small enterprises. Newly added products identified in the 2026 scope update are subject from 30 December 2027.

Which commodities does the EUDR cover?

The seven commodities are cattle, cocoa, coffee, palm oil, rubber, soy, and wood. Annex I defines the relevant products by CN or HS code. Check the current Annex rather than assuming every product containing a covered commodity is included.

Does a low-risk country remove the need for due diligence?

No. An operator sourcing only qualifying products from low-risk countries may use simplified due diligence if the conditions are met. It must still collect the required information and act if new information indicates possible non-compliance or circumvention.

Is certification enough to prove a product complies?

No. Certification and third-party verification can contribute information, but the responsible operator must ensure that the evidence meets the Regulation’s requirements and supports the product-specific conclusion. The legal responsibility is not transferred to the certifier.

Do non-EU suppliers have direct EUDR duties?

Generally, a producer or supplier outside the EU does not have a direct obligation unless it directly places relevant products on the EU market. It may still need to provide geolocation, legality, traceability, and product data to the operator responsible for compliance.

How long must EUDR records be kept?

Operators must retain due diligence documentation for five years from the date the relevant product is placed on the EU market or exported. Downstream operators and traders also have five-year record-keeping duties for specified supplier, buyer, and reference information.

View Related Posts

• Preparing for the EU Digital Product Passport: Governance, Traceability, and Compliance Readiness in 2026

•  PPWR Compliance 2026: What Applies Now and What to Fix First

•  Why Operational Resilience Is More Than a Dashboard

VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.

Chaussée de Wavre 1517B, 1160 Brussels, Belgium.

A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.

The post EUDR Compliance 2026: 7 Checks to Complete Before 30 December appeared first on VECTRA International.

The practical test is simple: can procurement, the supplier, an assessor, and an affected worker read the code and understand what must happen next? If the document cannot guide onboarding, evidence requests, monitoring, escalation, and improvement, it is a statement of intent rather than a working control.

What Is a Supplier Code of Conduct?

A supplier code of conduct is a documented set of behavioral, social, environmental, ethical, and governance requirements that a company expects suppliers to meet. It may apply to direct suppliers only, or it may also require suppliers to communicate equivalent expectations to subcontractors, labor providers, and other relevant business partners.

The code should support a wider due diligence system. The OECD Due Diligence Guidance for Responsible Business Conduct describes a risk-based cycle that includes embedding responsible-business commitments, identifying and assessing impacts, acting on findings, tracking results, communicating, and supporting remediation where appropriate. A code helps establish the expectations within that cycle. It does not complete the cycle by itself.

That distinction matters. Asking a supplier to sign a document does not prove that workers understand it, that controls operate at the relevant site, or that problems are identified and corrected. The signature establishes acknowledgement. Implementation, evidence, monitoring, and response establish whether the requirement is real.

A supplier code is also not a substitute for:

•      applicable law or qualified legal advice;

•      product specifications, quality requirements, or technical standards;

•      a contract and its remedies;

•      a supplier risk assessment checklist that evaluates the risks connected to a specific relationship;

•      a supplier capability assessment that tests whether a supplier can deliver the required scope; or

•      human rights, environmental, compliance, or other due diligence processes.

Its job is narrower and essential: state the rules clearly enough that they can be communicated, applied, tested, and enforced.

Why Do Supplier Codes Fail in Practice?

Most weak codes fail at the connection points between policy and daily decisions. The language may be polished, but the organization has not decided how the requirements affect supplier selection, contracting, orders, evidence, monitoring, corrective action, or exit.

Common failure modes include:

•      copying a long industry template without checking whether the requirements fit the company’s products, services, countries, and risk profile;

•      using broad phrases such as “respect human rights” without describing the expected controls or evidence;

•      applying the same monitoring method to every supplier, regardless of risk or criticality;

•      requiring the supplier to pass expectations down the supply chain without defining which subcontractors or tiers matter;

•      treating a signed acknowledgement as proof of compliance;

•      setting requirements that the buyer’s own purchasing practices make difficult to meet;

•      omitting grievance, escalation, remediation, and responsible disengagement routes;

•      changing the code without updating contracts, training, questionnaires, audit criteria, or supplier guidance; and

•      allowing serious exceptions to disappear inside an average supplier score.

The last point is especially important. A supplier can perform well across many routine requirements and still have one issue that requires immediate escalation. Forced labor, bribery, a severe safety hazard, deliberate falsification, retaliation, or an illegal discharge cannot be balanced away by strong performance elsewhere.

What Should a Supplier Code of Conduct Include?

The exact content depends on the relationship, sector, countries, products, services, and applicable law. A defensible code usually covers the following areas and explains how they will be implemented.

The ILO Declaration on Fundamental Principles and Rights at Work provides an authoritative reference for five fundamental categories: freedom of association and collective bargaining, elimination of forced labor, abolition of child labor, elimination of discrimination, and a safe and healthy working environment. The UN Guiding Principles on Business and Human Rights provide the broader global reference for preventing and addressing business-related human rights impacts.

Those references establish principles. Your code still needs language that people can apply. For example, a prohibition on recruitment fees should identify who is covered, what costs are prohibited, how the supplier checks labor agents, what happens when fees are found, and how workers are repaid. VECTRA’s guide to human rights due diligence for supplier impacts explains how to identify affected people, assess severity, and choose an appropriate response.

How Should You Define Scope and Flow-Down Requirements?

Define scope before drafting detailed clauses. The code should identify the legal entities, supplier types, sites, activities, and business relationships it covers. If the same document applies to manufacturers, recruitment agencies, logistics providers, cloud services, and professional advisers, some requirements will need tailored schedules or guidance.

Avoid saying that the code applies to the “entire supply chain” unless the company has decided what that means operationally. A more workable approach is to require suppliers to:

1.    identify subcontractors and labor intermediaries that are material to the supplied product or service;

2.    communicate equivalent requirements to those parties;

3.    obtain approval before using specified high-risk or critical subcontractors;

4.    retain evidence of monitoring and corrective action; and

5.    notify the buyer of material changes, incidents, or unapproved outsourcing.

The required depth should reflect risk. A packaging supplier’s office-cleaning contractor may not need the same visibility as a labor provider supplying migrant workers to the production site. State the rule and the reason. This makes the expectation easier to defend and less likely to become an impossible data request.

Flow-down also needs commercial support. If the buyer changes specifications late, compresses lead times, or sets unrealistic prices, the supplier may respond through overtime, informal subcontracting, or labor practices that undermine the code. Responsible purchasing practices therefore belong in implementation, not in a separate conversation.

How Do You Write Requirements That Can Be Verified?

Write each material requirement so a reviewer can identify four things: the expected outcome, the responsible party, the evidence, and the response when the requirement is not met.

Consider the difference between these two statements:

Suppliers should provide a safe workplace.

Suppliers must identify workplace hazards, maintain controls proportionate to the risk, train affected workers in a language they understand, record incidents, investigate root causes, and verify corrective action.

The second version still needs legal and technical review, but it creates a clearer basis for evidence and follow-up. It does not prescribe one identical system for every supplier. It defines the operating result that must be demonstrated.

Use “must” for mandatory requirements and reserve “should” for guidance or improvement expectations. Define specialized terms once. Avoid clauses that conflict with the contract or promise a remedy the organization cannot deliver. If the code references another policy or standard, control the version and confirm that suppliers can access it.

Every requirement should also pass a proportionality test:

•      Is it relevant to the supplier relationship?

•      Can the supplier understand what it requires?

•      Can the buyer explain why it matters?

•      Is there a reasonable form of evidence?

•      Does the buyer have a response when evidence is absent or a breach occurs?

If the answer to the last question is no, the clause is not ready for publication.

How Do You Implement a Supplier Code of Conduct?

Implementation should follow a controlled sequence rather than a mass email asking suppliers to sign.

1. Approve the Requirements and Ownership

Assign one code owner and identify the functions responsible for labor, environment, integrity, privacy, quality, and other technical areas. Legal review should confirm how the code interacts with contracts and local requirements. Procurement should confirm how it will affect sourcing and supplier management.

Record which body approves the code, who may grant exceptions, and how decisions will be retained. An exception without an owner, expiry date, or compensating control can become a permanent gap.

2. Segment the Supplier Population

Use risk and criticality to determine the implementation path. Factors may include country and sector exposure, workforce model, proximity to people or natural resources, data access, product or safety significance, use of subcontractors, and the impact of failure.

This is where the code connects to the wider cluster without becoming another risk-assessment article. The code defines the expectations. The assessment decides where deeper evidence, monitoring, or escalation is justified.

3. Update Contracts and Procurement Controls

Decide how the code is incorporated into requests for proposal, onboarding, purchase terms, contracts, renewals, and change approvals. The contract should address order of precedence, audit or information rights, notification duties, corrective action, confidentiality, data use, and available remedies.

Do not assume a website link automatically creates an enforceable obligation in every jurisdiction. Obtain qualified advice for contractual and legal wording. The operational goal is consistency: the code, contract, supplier portal, questionnaire, and monitoring process should not ask for different things.

4. Communicate and Train

Send suppliers a short implementation guide that explains what changed, who is covered, what evidence may be requested, how to raise questions, and when the requirements take effect. Translate or adapt materials where language, literacy, disability, or workforce access would otherwise limit understanding.

Train internal buyers as well. A supplier code cannot work if procurement teams do not know when to escalate a refusal, a missing disclosure, an unapproved subcontractor, or a serious incident. Training should use realistic decisions rather than a slide-by-slide reading of the document.

5. Establish Acknowledgement and Evidence Routes

Capture acknowledgement from the authorized supplier entity, but do not confuse it with verification. Define secure routes for submitting evidence and concerns. Retain the code version, signatory, date, covered entity, and relevant contract or supplier record.

Where teams need a common due diligence foundation, VECTRA’s Due Diligence in Supply Chain course provides a practical learning route across policy, risk analysis, action, grievance management, and reporting.

6. Monitor Proportionately

Monitoring can include declarations, document review, data checks, interviews, supplier meetings, worker or community input, site visits, audits, certification validation, and targeted independent review. Select the method based on risk, uncertainty, and the consequence of relying on the claim.

Depending on who will rely on the findings, compliance may be reviewed through internal audit or independent assurance (link to upcoming post 3). 

The current ISO 20400 guidance on sustainable procurement is relevant to integrating sustainability into procurement decisions and processes. It does not supply a universal code template, but it reinforces the need to connect sustainability expectations with procurement management.

7. Correct, Verify, and Escalate

For each material gap, state the requirement, evidence, root cause, action, owner, due date, and verification method. VECTRA’s ESG gap analysis and pre-audit remediation plan provides a practical structure for turning findings into controlled actions.

Closure should require more than an uploaded policy. Verify whether the corrected control operates. When repeated findings point to a deeper operating weakness, use a supplier improvement roadmap rather than reopening the same action after every review.

How Often Should the Code Be Reviewed?

Set a scheduled review, then define event triggers. Review may be needed when laws, customer requirements, products, countries, subcontracting models, data access, or business priorities change. A serious incident, recurring finding, acquisition, or new sourcing region can also expose a gap in the code or its implementation.

Version control matters. Keep the approval date, effective date, owner, prior version, summary of changes, and supplier communication record. When the code changes, update the related contract language, training, questionnaire, evidence list, audit criteria, and system fields.

Use a baseline assessment and readiness assessment for different decisions. A baseline shows how the current code and controls operate. A readiness assessment tests whether they meet a defined buyer, audit, legal, or internal requirement.

Start With the Decision the Code Must Control

Choose one supplier decision, such as onboarding a labor provider, renewing a high-risk manufacturer, or approving a subcontractor. Trace how the proposed code affects the requirement, contract, evidence request, review, corrective action, and final approval. Any broken connection identifies the first implementation gap.

For organizations that need help aligning supplier expectations with risk assessment, monitoring, and improvement, VECTRA’s Compliance, Risk & Due Diligence service provides a practical commercial route from requirements to controlled action.

Frequently Asked Questions

Is a supplier code of conduct legally binding?

That depends on how it is incorporated into the contractual relationship and the applicable law. A signature or website reference does not create the same effect in every jurisdiction. Obtain qualified legal advice and make the code, contract, purchase terms, and remedies consistent.

Should every supplier receive the same code?

The core standards can be consistent, while implementation and monitoring should reflect the supplier’s activities and risk. Sector, country, labor model, product safety, data access, environmental exposure, and subcontracting may require tailored schedules or guidance.

Is a signed code proof that the supplier complies?

No. A signature proves acknowledgement by the signatory. Compliance requires relevant and current evidence that the requirements are implemented across the assessed entity, site, product, service, and period.

How long should a supplier code of conduct be?

Use the length needed to state the requirements clearly and make them workable. A short code with defined evidence, responsibilities, and response rules is stronger than a long document copied from multiple frameworks. Put technical detail in controlled guidance or schedules where appropriate.

What is the difference between a supplier code and a supplier audit?

The code defines the expected standards. An audit or assessment tests selected criteria against evidence. A code can guide the audit scope, but publishing or signing the code does not provide assurance about implementation.

Should suppliers be terminated after a breach?

Not automatically. Consider severity, legal and safety requirements, affected people, cooperation, leverage, remediation, recurrence, and the consequences of disengagement. Some conditions require immediate restriction or exit. Others are better addressed through verified corrective action.

View Related Posts

• UFLPA Compliance in 2026: Can Your Evidence Stand Up to CBP Scrutiny?
• Pre-Audit Support: How to Catch Findings Before the Auditor Does
• Sustainability KPIs: How to Choose Metrics That Drive Action

VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.

Chaussée de Wavre 1517B, 1160 Brussels, Belgium.

A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.

The post Supplier Code of Conduct: 7 Steps From Policy to Practice appeared first on VECTRA International.

You can still talk about environmental performance. The rules simply require precision. The harder task is finding every version of a claim across products, markets, channels, and stock, then keeping it tied to the evidence. Legal, marketing, packaging, sustainability, procurement, and retail teams therefore need one controlled claims record.

What is Greenwashing?

Greenwashing happens when a business makes a product, service, or brand appear more environmentally responsible than the evidence supports. This can include using vague terms such as “green” or “eco-friendly,” highlighting one environmental benefit while hiding a larger impact, or displaying a sustainability label without credible verification. Under the EU greenwashing rules 2026, you need to make your environmental claims specific, accurate, properly qualified, and supported by relevant evidence. 

What EU greenwashing rules apply from 27 September 2026?

The 27 September deadline comes from Directive (EU) 2024/825, the Directive on Empowering Consumers for the Green Transition, often shortened to ECGT or EmpCo. It amends two consumer directives. EU Member States had to transpose it by 27 March 2026, and their national measures apply from 27 September.

Do not wait for the separate proposed Green Claims Directive. It is not the source of this deadline, and its negotiations are on hold, according to the European Parliament’s legislative tracker. The rules that apply in September are already adopted.

The rules tighten controls on generic environmental statements, sustainability labels, offset-based product climate claims, future promises, and comparisons. National authorities enforce them. The European Commission’s June 2026 Q&A is useful but not legally binding, so your legal team still needs to check the law in each EU market where you make a claim.

Does your business need to act, and which communications are covered?

The harmonized Unfair Commercial Practices Directive covers business-to-consumer practices before, during, and after a transaction. Pure business-to-business communication sits outside that scope, though other laws may apply. Ask not only who you wrote the content for, but who may see it. A distributor asset can later become consumer-facing.

Your review needs to cover more than campaign copy. Text, pictures, symbols, labels, company names, brand names, and product names can all state or imply an environmental benefit. Green leaves, water drops, and similar design elements are not banned on sight, but the full context may turn them into an implied claim or trust mark.

Review every place a consumer can encounter the claim: packaging, labels, product names, certification marks, websites, apps, retailer and marketplace listings, advertisements, social media, point-of-sale materials, QR-linked content, and distributor assets. Whichever version they see, the approved meaning needs to remain the same.

Which claims must change under the EU greenwashing rules 2026?

You don’t need to remove every environmental statement. Your response depends on the type of claim, what the average consumer is likely to understand, and whether your evidence supports that full impression.

Keep any qualification where consumers can see it and connect it clearly to the main statement. In its Q&A on the greenwashing rules 2026, the European Commission explains that any qualification of a generic claim must be clear and prominent on the same medium. A QR code can provide supporting detail, but it will not repair an unclear front-of-pack claim on its own. 

Why your old stock belongs in the environmental claims audit

If you printed packaging before 27 September 2026, it is not automatically exempt when you continue to offer the product to consumers after that date. The Commission’s guidance expressly includes products or packaging already manufactured, ordered, distributed, or placed on retail shelves before the rules begin to apply.

That turns your copy review into an inventory task. A compliant new artwork file does not fix cartons in your warehouse, products held by a distributor, or listings controlled by a retailer. You need to know where affected stock sits, which markets it serves, and what practical intervention is possible.

The Commission says practical responses may include stickers or point-of-sale information. An authority may consider whether you made reasonable and proportionate efforts to comply, but that is not a general exemption. Record the decision, affected stock, action taken, and proof the correction reached consumers.

Start with offset-based product claims, unsupported labels, high-volume generic claims, and statements used across several markets. For each affected stock line, decide whether to relabel, add information, redirect, or withdraw it, then keep that decision with the claim record.

How to build one claims inventory across packaging and digital channels

An approved-copy folder is not enough. The same wording may be accurate for one product and misleading for another because the composition, supplier, certification, calculation boundary, or destination market is different.

Build your inventory where decisions are made. Connect each claim to the product or SKU, component, market, language, channel, version, stock location, and owner. If product data moves across teams and systems, VECTRA’s Digital Product Passport readiness guide shows how governance and traceability support one controlled record. Then classify the claim as generic, specific, comparative, forward-looking, offset-related, label-based, or implied through design.

Record the impression a consumer is likely to take from the claim. “Made with recycled material” could refer to the whole product, one component, or the packaging. If your evidence covers only one component, the wording and visual hierarchy need to make that limit clear.

Give each claim a status: approve, qualify, replace, remove, or hold pending evidence. That stops an old phrase from returning through a retailer template, scheduled campaign, or reused packaging file.

What evidence do you need behind each environmental claim?

Keep the evidence pack proportionate to the claim, but make it traceable. For each claim, record the approved wording, environmental benefit, product, component, market, channel, reporting period, calculation boundary, method, assumptions, source data, and limitations.

Apply the same test to supplier evidence. A company-wide certificate may not prove the recycled content of a particular SKU. An annual factory-emissions figure may not support a product-footprint comparison. A certification logo may be current while its scope excludes the facility, material, or claim being promoted.

Your procurement team needs to trace material claims to the relevant product specification, chain-of-custody document, certificate, test result, production record, or calculation. Sustainability and technical teams check the method and boundary. Legal or compliance approves the consumer meaning. Marketing and packaging then use only the controlled wording.

VECTRA’s Greenwashing 2.0 article shows how supplier claims can create downstream exposure in the UK. For the EU rules, take the control one step further: connect every consumer claim to the correct product evidence, approval decision, and channel version.

Every claim also needs an owner, approval date, review date, and expiry trigger. Review it again when a certificate expires, a supplier, formula, or sourcing location changes, or new evidence changes the conclusion.

How do marketing, legal, procurement, and sustainability approve claims together?

Give each team one question to answer. Marketing defines the intended consumer meaning. Product and sustainability teams define the benefit and test the method. Procurement obtains the evidence. Legal or compliance checks national rules and approves the wording. Packaging, e-commerce, and channel owners release only the approved version.

Do not let the workflow end with an email approval. Before publication or print, check that the wording, visual context, evidence, product, market, language, and channel all match the approved record. VECTRA’s pre-audit support guide gives you a practical evidence test: sample a claim, follow it to the source, assign any gap, and retest it after correction. Apply the same control to retailer and distributor content, not only the channels you own.

Give one person ownership of the claims register and responsibility for coordinating changes. Technical work can remain distributed, but each claim needs a complete route from evidence to approval, release, monitoring, and withdrawal before it goes live.

What does your team need to complete before 27 September?

Use the time before 27 September to move from discovery to controlled release:

1.    Inventory the claims. Find environmental wording, labels, product names, imagery, and future promises across SKUs, markets, channels, and old stock.

2.    Classify and prioritize. Put prohibited or high-exposure claims first, especially offset-based product claims, unsupported labels, broad statements, and high-volume stock.

3.    Trace the evidence. Connect each material claim to the correct product, supplier record, method, boundary, certificate, and validity period.

4.    Decide and implement. Approve, qualify, replace, remove, or hold the claim, then update packaging, listings, campaigns, retailer content, and old-stock controls.

5.    Test the release process. Sample products across markets and channels, confirm that the approved version is live, train relevant teams, and document final sign-off.

This is not about creating more review paperwork. It is about stopping environmental claims from moving faster than the evidence behind them.

Summary

Who

The European Union, through the European Parliament and the Council, adopted new consumer-protection rules for businesses making environmental and sustainability claims to EU consumers. 

What

Directive (EU) 2024/825 strengthens the EU’s rules against greenwashing by restricting vague environmental claims, unsupported sustainability labels, misleading whole-product claims and certain carbon-neutral claims based on offsetting. Businesses must review claims across packaging, labels, product names, websites, advertisements, retailer listings and existing stock. 

When

The directive was adopted on 28 February 2024 and published on 6 March 2024. EU Member States were required to transpose it into national law by 27 March 2026, with the new measures applying from 27 September 2026. 

Where

The rules apply through national consumer-protection laws across EU Member States and affect business-to-consumer claims presented to EU consumers, including those made by non-EU businesses operating in the EU market. 

Why

The new EU greenwashing rules 2026 directive is intended to protect consumers from environmental claims that are vague, misleading or unsupported and ensure that purchasing decisions are based on clear, reliable and verifiable information. It also means businesses cannot assume that packaging or stock produced before the application date is automatically exempt

Frequently asked questions

Is the Empowering Consumers Directive the same as the Green Claims Directive?

No. The rules applying from 27 September 2026 come from Directive (EU) 2024/825, the Directive on Empowering Consumers for the Green Transition. The separate Green Claims Directive remains a proposal, and its negotiations are on hold.

Are words such as “green,” “sustainable,” or “eco-friendly” completely banned?

No. The rules do not ban those words in every context in the EU greenwashing rules 2026. They prohibit a generic environmental claim unless you can show relevant recognized excellent environmental performance. In plain terms, you need credible proof that supports the full claim. Otherwise, replace it with a specific, prominent statement your evidence supports.

Is packaging or stock produced before 27 September 2026 exempt?

No. If you continue to offer existing products or packaging after 27 September, review the claims they carry. Your response may include stickers, corrected wording, or supplementary point-of-sale information. Keep evidence of what you changed, where, and when.

Can a product be called carbon neutral because the company bought offsets?

No. You cannot base product claims of neutral, reduced, or positive greenhouse-gas impact on purchased offsets. You can communicate environmental investments separately, provided the wording does not imply that the investment removed the product’s lifecycle impact.

Do the rules apply to business-to-business claims?

The harmonized Unfair Commercial Practices Directive covers B2C practices, not pure B2B communication. Even so, other EU instruments and national rules may govern B2B advertising, and material you create for business customers may later reach consumers. Check the actual audience, channel, and applicable national law.

View Related Posts

• Greenwashing 2.0: The CMA’s Holistic Supply Chain Accountability
• Preparing for the EU Digital Product Passport: Governance, Traceability and Compliance Readiness in 2026
• How the EU’s Ecodesign and Energy Labelling Plan Will Reshape Global Supply Chains

VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.

Chaussée de Wavre 1517B, 1160 Brussels, Belgium.

A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.

The post EU Greenwashing Rules Start 27 September 2026: What Affects You? appeared first on VECTRA International.

Most audits don’t fail because a company was hiding something. They fail because evidence is scattered, ownership is unclear, and preparation started too late. The OECD’s Responsible Business Outlook 2026 found the pattern at scale: across the largest 10,000 listed companies, commitments and management systems were common, but an implementation gap remained between what was documented and what was actually in control. Pre-audit support exists to close that gap before it shows up as a finding.

What pre-audit support covers

A good pre-audit support engagement is narrow and practical. It matches every metric and claim you’ll be audited on to a source file, so anything without a traceable source gets flagged now rather than on audit day. It samples those numbers and follows them back to raw data, because a trail that breaks in the rehearsal is one you can still fix. It puts a name against every metric and every gap, because an unassigned gap remains a task without a driver. And it leaves a remediation runway: time to fix what turns up, then a re-test to confirm it held.

That’s the core of VECTRA’s Audit Assistance work. If you want the full step-by-step of getting ready, our complete guide to preparing for ESG audits walks through it. This post is about a narrower decision: when to run that prep yourself, and when to bring someone independent in.

Self-run prep vs supported pre-audit support

You can prepare for an audit on your own, and plenty of teams do. The difference is what gets caught.

Neither approach is wrong. If your audit is low-stakes and your evidence is already clean, self-prep is fine. The case for support gets stronger as the cost of a surprise finding rises.

When to bring in help

The case for independent help gets stronger in four situations. The first is a multi-tier supply chain, where evidence comes from suppliers and sub-suppliers you don’t control directly and consistency is hard to guarantee. The second is a first CSRD or ESRS reporting cycle, which brings disclosure expectations you’ve never been tested on. The third is repeat findings: if the same issue came back last cycle, the prep meant to close it clearly didn’t hold, and that’s a process problem rather than a paperwork one. The fourth is a new buyer or certification requirement, such as a customer contract or a scheme like SMETA, where “we think we’re ready” isn’t good enough.

What it changes

The point of pre-audit support isn’t a tidier binder. It’s fewer findings, no surprises, and a clear head on audit day.

And when the rehearsal does turn something up, that’s the win, not the failure. A gap found in private becomes an owned action with a deadline and a way to verify it held.

That’s how a finding stops coming back, which we cover in the supplier improvement roadmap and in post-audit corrective action plans. It also connects to the numbers themselves: our companion post on choosing sustainability KPIs that drive decisions shows how to make each metric specific and owned in the first place.

Where the root cause sits inside a factory’s own operations, Factory, Farm & Mine Performance Improvement fixes the capability, not just the record.

Start here

Try one test this week: pick the claim you’re least confident about and ask whether you could trace it to the source in ten minutes. If the answer is no, you’ve found your first pre-audit task.

If you’d rather not run the rehearsal alone, VECTRA’s Audit Assistance puts an independent reviewer on your evidence before the auditor does. Twenty years, 500+ companies, one job: help you get in control.

Frequently asked questions

What is pre-audit support? 

It’s an independent review of your audit evidence before the external audit, run by someone who didn’t collect the data. It checks that every claim and KPI has a traceable source, tests a sample back to raw data, confirms ownership, and leaves time to fix what it finds.

Is a pre-audit the same as a mock audit?

A mock audit is one part of it: a full dry run of the audit process. Pre-audit support is broader. It includes the dry run, plus fixing the gaps it exposes and re-testing before the real audit.

When should pre-audit support start?

Early enough to fix what you find. A light evidence check can take days. Repairing a broken data trail or an unclear ownership line usually needs 30 to 90 days.

Do we need pre-audit support if we’ve passed audits before? 

Not always. But passing once doesn’t mean the same evidence holds under new rules, a new buyer, or a new auditor. Repeat findings or a first CSRD cycle are the clearest signals to bring in independent help.

What’s the difference between pre-audit support and just preparing internally?

Independence. Preparing internally catches the gaps you already suspect. An independent reviewer catches the ones you can’t see because you’re too close to the evidence.

View Related Posts

• Sustainability KPIs: How to Choose Metrics That Drive Action
• How to Prepare for ESG Audits: A Complete Guide for Global Supply Chains

VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.

Chaussée de Wavre 1517B, 1160 Brussels, Belgium.

A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.

The post Pre-Audit Support: How to Catch Findings Before the Auditor Does appeared first on VECTRA International.

SA8000:2026 deadlines at a glance: Certified organizations must complete the required training and self-assessment by December 31, 2026. Certification and recertification to SA8000:2014 end on January 1, 2027, and every certified organization must hold SA8000:2026 certification by May 31, 2029.

What is SA8000 certification?

SA8000 certification is independent verification that a business has implemented a management system to protect workers’ rights and support decent work. It applies across industries and countries and covers the people affected by a business’s operations and relationships, not only its directly employed workforce.

The standard covers children and young workers, freedom of association, recruitment and employment, hours, wages and benefits, discrimination, health and safety, and privacy. Its management criteria cover leadership, worker and stakeholder involvement, risk, planning, grievances, monitoring and improvement. Social Accountability International (SAI) says it supports ethical conditions for more than 2.8 million workers.

Certification is voluntary unless a buyer or contract requires it. It is different from using SA8000 as an internal reference. Only a conformity assessment body (CAB) accredited through the SA8000 system can grant an official certificate. Keep that distinction clear when describing your status to customers.

What actually changed in SA8000:2026?

Let us start with what did not change. SAI says businesses that genuinely meet SA8000:2014 are likely to meet most of the 2026 decent-work criteria already. The revision is not a reason to rebuild every labour policy from zero. It is a reason to check whether your management system can show how the policy works in practice.

The biggest structural change is that management systems now come first. Ten criteria take your team from leadership commitment and worker involvement through risk assessment, implementation, monitoring, grievance handling and strategic review. Several expectations that were previously spread across supplementary material are now clearer in the standard itself. This makes ownership and evidence harder to treat as an appendix prepared just before an audit.

Responsibility is also clearer. Your system must consider workers affected through your activities and business relationships. The test is not whether every supplier receives the same questionnaire. It is whether you identify the most severe and likely risks, understand whether your business caused, contributed to or is directly linked to them, and respond in line with that responsibility. This is consistent with OECD risk-based due diligence, which focuses effort on the most significant impacts across operations, supply chains and business relationships.

The decent-work section now describes the outcome you should achieve rather than prescribing one method for every workplace. This gives businesses more flexibility, but it also raises the quality of evidence expected. A procedure is not enough if worker interviews, payroll records, grievance data or day-to-day practice tell a different story.

Privacy is the clearest new topic. Your business now needs to examine how it collects, uses, stores and shares workers’ personal data, including information produced by monitoring and workplace technology. The question is not only whether access is technically restricted. You need to show that data practices respect workers’ dignity and rights.

Finally, the revised structure enables progressive evaluation of performance and maturity. Do not chase a headline score. Find the weak controls, prioritise the gaps that expose workers to the greatest harm and show improvement over time. SAI’s official comparison of the 2014 and 2026 Standards explains these changes in detail.

Which SA8000 transition dates matter?

In July 2026, SA8000:2026 audits are becoming available as CABs receive approval. Your next action depends on your recertification date, but every certified business has work due this year.

Source: Social Accountability International transition timeline

One rule is easy to miss: you can move from SA8000:2014 to SA8000:2026 only during a recertification audit, not during surveillance. If your 2026 recertification remains under the 2014 Standard, you may need an earlier recertification before the final 2029 deadline. Discuss the timing with your CAB before you lock the audit plan.

What should your business do next?

First, confirm your certification cycle and your CAB’s approval status. A business due for recertification in 2026 has a different decision from one due in 2027 or 2028. Put the transition date, training requirement and recertification window in one plan. Doing so keeps the compliance team, site management, and CAB fully aligned, preventing them from operating under conflicting assumptions.

Complete the Getting Started with SA8000:2026 and Due Diligence training and the self-assessment by 31 December 2026. If an audit is scheduled this year, both must be completed before it. SAI says a missed requirement will prevent an audit from being assigned in its database, so this is an operating deadline, not optional background learning.

Then run a focused gap analysis. Compare the 2026 criteria with the way your business actually works, not only with the documents you have. Follow a small number of important labour risks from policy to decision, action and proof. For example, trace an overtime concern from time records to worker feedback, management review, corrective action and follow-up. A guide on how to conduct a supply chain due diligence assessment can help you structure the risk-mapping and prioritisation part of this work.

Pay particular attention to worker involvement, grievance mechanisms, privacy and third-party labour. These are areas where a policy can look complete while the lived process remains weak. Test whether workers know how to raise a concern, whether they trust the channel, who reviews patterns and whether the response reaches procurement or site leadership when a business relationship is involved. VECTRA’s article on human-rights early-warning systems shows how grievance and operational data can support continuous oversight between audits.

Close gaps in the operating system, not just the audit folder. Assign unclear ownership. Retrain supervisors who apply rules differently, then observe the work. If supplier evidence is late or unverifiable, fix the request, escalation and review process. VECTRA’s Factory, Farm & Mine Performance Improvement support is designed for this implementation layer, where policies, management systems and site practice must line up.

How do you prepare without creating another audit scramble?

Do not turn the transition into a separate SA8000 project that sits beside normal operations. Use the same owners, meetings and evidence routes that already manage wages, hours, safety, recruitment, worker data, suppliers and complaints. The standard should make those controls clearer, not create a second version of them.

Before the audit, test a few claims end to end. If your policy says workers can report concerns confidentially, follow a sample concern through receipt, protection, investigation, remedy and trend review. If your risk assessment identifies recruitment fees, check contracts, worker interviews and repayment evidence. That is more useful than collecting another hundred files no one has tested.

Keep the roles clear as well. Your CAB makes the certification decision. An implementation partner can help you interpret requirements, find gaps, improve controls and prepare evidence, but it should not promise the certificate. If your team needs structured support before recertification, explore VECTRA’s Audit Preparation service and begin with the management-system gaps that carry the greatest risk for workers and the business.

Frequently Asked Questions

Is SA8000:2026 mandatory for every business?

No. SA8000 is a voluntary international standard. It becomes a practical requirement when you seek or maintain certification, or when a customer or contract requires certified social-accountability controls. From 1 January 2027, every new certification and recertification must use SA8000:2026.

When must a certified business move to SA8000:2026?

Every SA8000-certified business must hold certification to the 2026 Standard by 31 May 2029. Earlier deadlines still apply: the required training and self-assessment are due by 31 December 2026, and SA8000:2014 recertification stops from 1 January 2027.

Can you transition during a surveillance audit?

No. SAI permits the formal transition only during a recertification audit. A surveillance visit may help confirm progress, but it cannot replace the recertification event needed to issue an SA8000:2026 certificate.

What should an SA8000:2026 gap analysis cover?

It should compare the new criteria with your policies, responsibilities, risk assessment, worker involvement, grievance process, privacy controls, supplier and contractor oversight, monitoring and management review. Evidence should show that these controls work in practice, not simply that documents exist.

View Related Posts

How to Conduct a Supply Chain Due Diligence Assessment

Human Rights Early Warning Systems: Moving Beyond Annual Audits

VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.

Chaussée de Wavre 1517B, 1160 Brussels, Belgium.

A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.

The post SA8000:2026: What Changed and How to Prepare appeared first on VECTRA International.

Their largest customer sent the questionnaire anyway.

That gap between what the law now requires and what the market still demands is where operational control earns its keep. Operational control is an organization’s ability to govern, evidence, and improve how work gets done across its own operations and its supply chain, consistently enough to satisfy customers, lenders, and auditors without slowing the business down.

For operations, procurement, and compliance leaders at companies of roughly 250 to 1,000 employees, this is an awkward middle: large enough that informal process and personal knowledge have quietly stopped holding, but not large enough to fund a dedicated ESG function to replace them. The headlines about Brussels simplifying everything make that position feel more comfortable than it is.

What actually changed in 2026

The Omnibus I Directive, Directive (EU) 2026/470, was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. It rewrote both the CSRD and the CSDDD in a single act.

Three changes matter for a growing business:

●      CSRD mandatory scope narrowed sharply. Reporting now applies only to companies with more than 1,000 employees and net turnover above €450 million. The original second wave moved to 2028 (covering financial year 2027). Listed SMEs, the old third wave, dropped out of mandatory scope entirely.

●      CSDDD narrowed and delayed. Due diligence obligations now reach only companies above 5,000 employees and €1.5 billion turnover. Member States must transpose by 26 July 2028, and in-scope companies comply from 26 July 2029.

●      A statutory ceiling on supplier data requests appeared. In-scope companies can no longer require business partners with fewer than 1,000 employees to disclose sustainability information beyond the Voluntary Standard, where the request relates to CSRD reporting.

All of which reads like a reprieve, and for anyone whose only concern was filing a report, it is one. For anyone who sells to large customers, the pressure has not disappeared so much as changed address.

Why being out of scope is not the same as being off the hook

Your CSRD-reporting customers still have to account for their value chains, and that obligation does not dissolve because your own company falls below the reporting thresholds. It travels down the chain until it reaches you, usually as a spreadsheet with a deadline attached.

The value chain cap gives suppliers under 1,000 employees a statutory right to refuse requests that exceed the Voluntary Standard for SMEs, which the Commission endorsed by recommendation in July 2025 and moved to codify through a draft delegated act on 6 May 2026, with adoption expected during the year. The protection is real, and most suppliers who open a 200-question survey have no idea they are entitled to decline it. But it is also narrower than the headlines suggest, in four ways that matter commercially.

It does not cover requests made for other reasons. The ceiling applies only to data requested for CSRD reporting purposes, which leaves a great deal sitting outside it: a customer running supplier due diligence, a bank pricing a loan, a tender evaluation, or an EcoVadis assessment.

It does not cover everyone. The cap protects undertakings below 1,000 employees, while CSRD scope requires more than 1,000 employees and more than €450 million turnover. A company with 1,200 employees and €200 million turnover therefore falls into neither category, which leaves it neither required to report nor protected from being asked. Check where your own headcount and turnover actually place you before assuming the cap covers you.

It does not remove the commercial consequence of a slow answer. A supplier who can produce clean energy, emissions, and workforce data within a fortnight tends to keep the contract, while one who needs two months tends to find the renewal quietly going elsewhere. The cap limits what a customer may demand of you, but nothing in it obliges them to keep buying from you.

It does not do the work for you. The Voluntary Standard’s Basic Module runs to roughly 50 data points, which sounds modest until you try to assemble them across four sites from spreadsheets that nobody owns.

The CSDDD cascade behaves the same way. Very large companies only start formal due diligence in July 2029, but they will spend the years before that getting ready, and supplier questionnaires are how that preparation reaches you. The deadline belongs to them; the work arrives at your desk well ahead of it.

Where growth without operational control breaks down

A weak process is easy to miss while a business is growing, because growth pays for it. Something falls through, somebody works a late night and catches it, and the fix never gets written down anywhere. Nobody minds, because the numbers are good.

That arrangement holds until the business crosses a line it does not notice at the time: a second site, a new tier-2 supplier, a first enterprise customer whose procurement team asks its questions in writing and expects them answered the same way twice. Improvisation stops scaling at roughly that point, and the failures start becoming visible to people outside the company:

●      Customer onboarding stalls because nobody can evidence a supplier screening process

●      The same ESG questionnaire is answered three different ways by three different people

●      An audit finding at tier 2 surfaces a subcontractor nobody knew existed

●      A tender is lost on a documentation gap rather than on price or quality

●      Decisions slow down because ownership is unclear

●      A lender asks for structured sustainability data and receives a PDF of good intentions

What catches leadership teams off guard is that none of these is a compliance failure. They are commercial ones, and for a mid-sized business today, weak operational control shows up on the P&L long before it ever shows up in an enforcement letter.

What operational control looks like in practice

None of this requires a governance department, which is the objection we hear first. Four capabilities carry most of the weight, and a mid-sized team can build all four.

Governance you can evidence

This comes down to clear ownership, documented decision rights, and one named person accountable for supplier data. The test is whether you can produce it on demand: when a customer asks who signed off on a supplier assessment, the answer should take seconds rather than an afternoon spent excavating old email threads.

Risk awareness that reaches past tier 1

Most real exposure sits at tier 2 and below, in the suppliers you have never met. Mapping dependencies before you need them is the difference between managing a disruption and discovering one. Our work on operational visibility as supply chains scale covers how that mapping holds up under growth.

Standard processes that survive turnover

A process that lives only in someone’s head walks out of the building when they resign, which is why the unglamorous work of writing things down repays itself the first time you lose a good operations manager. Simple and repeatable beats sophisticated and undocumented, every time.

Technology applied to the data burden

The recurring cost for a mid-sized supplier is rarely any single questionnaire; it is answering the same underlying question in eleven different formats for eleven different customers. Digital tools earn their place by letting you collect once and answer many times, so that one structured data set, aligned to the Voluntary Standard, absorbs most incoming requests before they turn into projects. We cover the multi-framework version of this problem in how companies can reduce ESG data fatigue.

What operational control returns

Operational maturity now shows up in outcomes a CFO recognizes. Companies that build it early get through compliance audits without a fire drill, and they score better on EcoVadis and customer scorecards, which increasingly decide who gets onto an enterprise supplier list in the first place. When a bank or an investor asks a sustainability question, they answer with structured data rather than narrative, and when they move into a regulated market they do it without a twelve-month remediation program standing in the way.

Reporting voluntarily under the Voluntary Standard is becoming a sales asset rather than an overhead for much the same reason: a completed report answers a customer’s questions before they think to ask them, and gives a lender something concrete to underwrite.

How VECTRA International Helps

At VECTRA International, we work as an end-to-end resilience partner. Our ecosystem connects advisory expertise, human-centric technology, and practical capability building, sized for organizations that do not have a governance department to spare.

Our integrated solutions include:

●      Compliance, risk, and due diligence advisory, including CSRD compliance services and supply chain due diligence

●      Sustainability and ESG reporting support for CSRD, ESRS, and Voluntary Standard readiness

●      Management system risk assessments

●      Audit preparation and assistance

●      Virtual and onsite training for internal capability building

For more than 20 years we have helped organizations turn operational complexity into resilient performance, supporting 450+ clients with programs validated against recognized standards such as SMETA and IRMA. As an ESG strategy consulting and sustainability consulting partner, we work across supply chains in more than 35 countries.

Teams that want to build the capability in-house can start with our Supply Chain Risk Management course on the VECTRA Marketplace.

Turning complexity into capability

The businesses that win the next procurement cycle will not be the ones that read the Omnibus headlines and relaxed, but the ones that recognized the breathing room for what it was and spent it. Simplification moved the deadline without moving the demand, and the questionnaires are still arriving.

Build your team’s capability. Explore our Marketplace courses on supply chain risk, due diligence, and operational resilience.

Check where you stand. Contact our experts for a specialist assessment of your operational and supplier risk position.

Frequently Asked Questions

What is operational control in a business?

Operational control is an organization’s ability to govern, evidence, and improve how work gets done across its own operations and its supply chain. It covers ownership and decision rights, risk identification, standardized processes, and the data needed to prove all three to customers, lenders, and auditors.

Are mid-sized businesses still in scope for CSRD after the Omnibus?

Most are not. Under Directive (EU) 2026/470, mandatory CSRD reporting applies only to companies with more than 1,000 employees and net turnover above €450 million. Companies in the original second wave now report from 2028 covering financial year 2027, and listed SMEs were removed from mandatory scope.

What is the CSRD value chain cap?

The value chain cap is a legal ceiling on the sustainability data that CSRD-reporting companies may require from smaller business partners. Companies with fewer than 1,000 employees have a statutory right to refuse requests that go beyond the Voluntary Standard for SMEs, where the request relates to CSRD reporting. The Commission published a draft delegated act codifying the cap on 6 May 2026.

Can we refuse ESG data requests from a large customer?

You can refuse requests that exceed the Voluntary Standard when they are made for CSRD reporting purposes and your company has fewer than 1,000 employees. The cap does not cover requests tied to due diligence, lending, tenders, or third-party ratings such as EcoVadis, and refusing does not oblige a customer to continue buying from you.

When does the CSDDD apply?

The amended CSDDD applies from 26 July 2029, with Member States required to transpose it by 26 July 2028. It now covers only EU companies with more than 5,000 employees and net worldwide turnover above €1.5 billion, or non-EU companies with EU turnover above €1.5 billion. Smaller suppliers are affected indirectly, through the due diligence their large customers must perform.

How can a mid-sized business build operational control without a large budget?

Start by mapping supplier dependencies past tier 1, naming a single owner for supplier data, and assembling one structured data set aligned to the Voluntary Standard that can answer most incoming requests. Training an existing team is usually faster and cheaper than a consulting program. VECTRA’s Marketplace courses and specialist assessments are built for exactly this. 

View Related Posts

How European SMEs Can Prepare for CSRD Reporting Requirements

Why Operational Visibility Matters More as Supply Chains Scale

Why Is Operational Resilience More Than Just a Dashboard

VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.

Chaussée de Wavre 1517B, 1160 Brussels, Belgium.

A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.

The post Why Do Mid-Sized Businesses Need Operational Control to Scale Sustainably? appeared first on VECTRA International.

The post How Agribusinesses Can Prepare for the Final EUDR Compliance Deadline appeared first on VECTRA International.