Forced Labour Risk in Global Supply Chains: What Every SME Importer Must Act On Before December 2027

Four overlapping regulatory frameworks are making ethical labour risk a market access and legal compliance question — in addition to, not instead of, a reputational one. SME importers have an approximately 18-month window, from a June 2026 planning perspective, to build proportionate controls before the EU Forced Labour Regulation applies on 14 December 2027. In our previous edition,, we examined how the social licence to operate — the informal community-level authority that underpins a retail chain’s ability to operate in its locations — can be withdrawn without formal process and with direct commercial consequences that standard insurance does not cover. This edition turns to a related but distinct class of supply chain exposure: the legal and operational risk that arises when labour practices embedded in a global sourcing chain are not assessed, not mapped, and not governed. Social Due Diligence in Global Supply Chains Why This Matters Now The EU Forced Labour Regulation (Regulation (EU) 2024/3015) entered into force in December 2024. It applies to every product placed on, made available in, or exported from the EU market — with no size threshold and no sector exemption. Application begins December 2027. That date feels distant. It is not. Supplier relationships take months to audit and years to restructure. The US Uyghur Forced Labor Prevention Act (UFLPA) offers a real-time benchmark: from its implementation in June 2022 through November 2025, US Customs and Border Protection (CBP) stopped 65,707 shipments valued at $3.91 billion, denied 24,215, and released 39,829 (CBP, 2026). In fiscal year 2024 alone, 11,778 shipments valued at $1.78 billion were stopped. The electronics sector — covering solar products, integrated circuits, and consumer electronics — accounted for $3.27 billion of total value stopped under UFLPA. These are not multinationals absorbing a regulatory inconvenience. Many affected shipments involve SME importers whose tier-2 or tier-3 sourcing runs through high-risk supply chains they cannot fully see. The scale of the underlying problem is unambiguous. According to the ILO's 2024 updated estimates, 27.6 million people are in forced labour globally, generating US$236 billion in illegal profits annually (ILO, 2024). A further 138 million children remain in child labour worldwide (ILO & UNICEF, 2025). G20 economies imported US$468 billion worth of goods at risk of modern slavery in 2021 (Walk Free Foundation, 2023). These are supply chain realities, not development statistics. The Regulatory Architecture SME Importers Need to Understand Four overlapping frameworks now define the legal terrain — and they interact. EU Forced Labour Regulation (Regulation (EU) 2024/3015) Entered into force December 2024; applies from December 2027 with no size threshold. Any competent authority investigation that finds forced labour was used at any stage of production — extraction, manufacture, processing, or assembly — can ban the product from the EU market and order its withdrawal. The regulation is investigation-led: it does not impose a general due diligence obligation on all operators. However, operators sourcing from high-risk regions or sectors are expected to maintain adequate due diligence processes. Those who cannot demonstrate traceability face both enforcement exposure and the reputational cost of a public proceeding. EU Corporate Sustainability Due Diligence Directive (CSDDD) Directive (EU) 2024/1760, as amended by Directive (EU) 2026/470 (Omnibus I, in force March 2026), applies from 26 July 2029 to companies with more than 5,000 employees and more than €1.5 billion in global turnover. SMEs are not the primary regulatory target. However, CSDDD-subject buyers will cascade due diligence requirements contractually to their tier-1 suppliers — including SMEs. A supplier unable to demonstrate basic social risk controls risks disqualification from approved supplier lists without ever receiving a direct regulatory notice. Germany's Supply Chain Due Diligence Act (LkSG) Extended to companies with 1,000 or more employees from January 2024. The enforcement authority, BAFA, can impose fines of up to 2% of global annual turnover for failures to meet due diligence obligations. The LkSG explicitly requires large companies to apply structured — and proportionate — due diligence information requests to their suppliers. For an SME supplier to a German parent or major German buyer, LkSG-driven questionnaires are already arriving. France's Duty of Vigilance Law (2017) has generated 13 lawsuits and 30 formal notices between 2017 and 2024 (Global Rights Compliance, 2025), with the Paris Appeals Court providing significant enforcement clarification in June 2024. Together, these frameworks create a threefold exposure for SME importers: direct market access risk under the Forced Labour Regulation; indirect compliance pressure via CSDDD contractual cascading; and an audit trail requirement that existing social certification processes typically do not satisfy. How Supply Chain Labour Risk Reaches SME Operations The transmission pathways are specific and traceable. Regulatory channel: The most direct path runs from a forced-labour finding at any tier of production to a market access ban. Under the EU Forced Labour Regulation, this applies at every stage — extraction, manufacture, processing. SMEs importing electronics components, garments, agricultural products, or industrial materials from high-risk regions face this exposure even where their direct (tier-1) suppliers are audited and certified. Commercial and reputational channel: When a CSDDD-subject buyer discovers a labour violation in a shared or proximate supplier, it exits that supplier to protect its own due diligence posture. For an SME dependent on one or two major buyer relationships, supplier disqualification is existential — not merely reputational. CSDDD explicitly permits in-scope companies to seek contractual assurances from direct business partners, including requirements to cascade those assurances through the supply chain (Directive (EU) 2024/1760, Art. 10). SME suppliers with major buyers in automotive, apparel, food retail, and electronics should anticipate increasing due diligence requirements in procurement terms as those regulatory obligations on buyers come into effect. Audit failure channel: The social audit and certification model has documented systemic limitations in detecting forced labour and child labour violations, particularly in multi-tier supply chains. Research into voluntary social audits concludes that input-based reporting says little about whether policies improve labour outcomes (IDOS, 2024). Social audit certificates should be treated as supporting evidence within a broader due-diligence process — not as a substitute for documented risk identification, action, monitoring, and outcome evidence. The CSDDD explicitly permits independent third-party verification as a component of due diligence (Directive (EU) 2024/1760, Art. 10(5)), but that verification must form part of, not replace, a risk-based process covering identification, prevention, and remediation. Where SME Importers Face the Highest Exposure Sector and country risk are unequally distributed. The highest-risk combinations for SME commerce are well-mapped by public indices. Garments and textiles: Manufacturing operations in Bangladesh, Cambodia, Vietnam, and Pakistan carry persistent risks including living wage gaps, excessive working hours, restrictions on freedom of association, and gender-based discrimination. The UFLPA's highest enforcement category by shipment count is Apparel, Footwear, and Textiles at 27,994 shipments stopped (CBP, 2026). For an SME importing from this sector, a buyer's audit of its supply chain can expose sourcing practices the SME has never independently verified below tier 1. Electronics and components: The solar supply chain — involving polysilicon, silicon wafers, and solar cells — remains among the highest-risk sourcing configurations under UFLPA. Electronics accounts for $3.27 billion of the $3.91 billion total value stopped under UFLPA enforcement (CBP, 2026). Component-level sourcing in electronics frequently runs through tier-3 or tier-4 suppliers that neither the buyer nor the direct importer has mapped. Agriculture and food: Agriculture and food: Seasonal agricultural labour arrangements carry elevated risk for forced labour and child labour, particularly where migrant workers are employed in informal or temporary arrangements. The ILO estimates that 17.3 million people in forced labour are in the private economy, with agriculture among the most difficult sectors to monitor due to seasonal worker mobility and informal employment relationships (ILO, 2024). ILO decent-work programmes targeting agriculture supply chains are active across multiple regions, with documented labour-rights concerns driving active engagement in countries including Colombia, Indonesia, and Malawi (ILO, 2025). Specific country exposure for your supply base should be assessed against ILO country data and public sector risk indices. These risks persist below the tier-1 sourcing level and are unlikely to surface through standard supplier audits. Risk Interpretation Through an ERM Lens Supply chain labour risk is a compliance, operational, and strategic risk simultaneously. Formal governance for this risk category is often underdeveloped in SMEs without a dedicated risk or compliance function. Risk classification: Compliance (legal non-compliance under the Forced Labour Regulation and potential cascade under CSDDD); operational (sourcing disruption if a supplier is investigated, a product is seized, or a buyer terminates a contract); strategic (loss of a key buyer relationship; impact on access to ESG-linked finance or public procurement). Velocity: Medium to high. The December 2027 date creates an approximately 18-month window from mid-2026. UFLPA enforcement data shows that regulatory action, once initiated, scales quickly. Buyer-imposed contractual requirements are already arriving through procurement terms in several sectors. Severity: High for importers with concentrated sourcing in high-risk regions. Market access loss, inventory write-downs on seized goods, and loss of a major buyer relationship can be individually significant for an SME without the financial cushion of a large enterprise. Control gaps: A common starting-point gap for SME importers is the absence of a supplier map below tier 1. Common additional gaps include: reliance on audit certificates that do not on their own satisfy legal due diligence standards under the EU Forced Labour Regulation or CSDDD; no risk-based prioritisation process; no grievance mechanism accessible to supply chain workers; and supplier contracts that omit codes of conduct, sub-contracting notification obligations, or remediation protocols. Under the Three Lines of Defence model, first-line ownership of supplier social risk should be explicitly assigned — its absence is a common gap to test in an SME risk governance review. Practical Action Options The following framework is adapted from the OECD Due Diligence Guidance for Responsible Business Conduct (OECD, 2018) — the six-step methodology directly referenced in CSDDD obligations — and scaled to SME capacity. Immediate — within 30 days Map your tier-1 supplier relationships. List all direct suppliers, their country of origin, and principal product categories. This is the minimum baseline for any social risk assessment and the first document a CSDDD-subject buyer will request when imposing contractual due diligence requirements. Screen against public risk indices. Use the Walk Free Global Slavery Index country risk data and the US Department of Labor’s List of Goods Produced by Child Labor to assign an initial risk score to each sourcing relationship. Public country, product, and sector risk indices provide a proportionate starting point for an initial risk tiering of your supplier base and give you a defensible documented baseline. Medium-term — one to six months Deploy a Supplier Self-Assessment Questionnaire (SAQ) to high-risk suppliers. It should cover ILO core labour standards, working hours, freedom of association, living wage practices, and migrant worker policies. Cross-reference responses against any existing audit reports and flag discrepancies. Review and update supplier contracts. Ensure they include: a supplier code of conduct incorporating ILO core standards; a right to audit clause; sub-contracting notification obligations; a defined remediation protocol with timelines in the event of a labour violation. Strategic — six months and beyond Establish a monitoring cycle and a proportionate grievance channel. Annual SAQ review for all tier-1 suppliers; enhanced third-party verification (appropriate independent third-party verification aligned with the scope requirements of the EU Forced Labour Regulation and CSDDD) for critical suppliers in high-risk country and sector combinations. A grievance mechanism accessible to supply chain workers — a third-party hotline or a confidential email address communicated through your supplier relationships — costs little and significantly strengthens your due diligence posture under both the Forced Labour Regulation and CSDDD expectations. One important caution: the OECD guidance and the CSDDD both recommend responsible engagement over immediate supplier exit as the first response to an identified risk. Abrupt de-listing often transfers harm to workers without resolving the underlying condition. Remediation, with documented timelines and accountability, is the preferred mechanism. Management Questions to Ask Bring these to your next leadership team or board discussion. Do we have a current map of our tier-1 supplier relationships by country of origin and product category? When was it last updated, and does it reflect sourcing changes made in the last 12 months?
Which of our sourcing countries or product categories would be classified as high-risk under public indices such as the Walk Free Global Slavery Index or the US Department of Labor's List of Goods Produced by Child Labor? Have we conducted enhanced diligence on those suppliers in the last 12 months? If a key buyer imposed social due diligence contractual requirements on us today — including a supplier code of conduct, right to audit, and annual SAQ — how quickly could we demonstrate compliance? What gaps would we face? Do our supplier contracts include a right to audit, sub-contracting notification obligations, and a remediation protocol for labour violations? The EU Forced Labour Regulation applies from December 2027 with no size threshold. Have we assessed which of our imported products are sourced from regions or sectors flagged as high-risk for forced labour? What is our plan if one of those products is identified in a CBP or EU enforcement investigation? How would labour conditions in a tier-2 or tier-3 supplier reach us? If workers in one of our suppliers' facilities were experiencing forced overtime or withheld wages, would that information surface before a buyer audit or enforcement action did it for us? Conclusion The EU Forced Labour Regulation's December 2027 application date is a regulatory deadline, not a distant aspiration. The UFLPA demonstrates that enforcement scales quickly once the legal infrastructure exists: 65,707 shipments stopped, $3.91 billion in value affected in under three and a half years. The regulatory environment for supply chain labour risk has changed: inaction now carries real commercial consequences, not just ethical ones. For SME importers, the proportionate response is not a comprehensive ERM framework. It is a supplier map, a risk-based prioritisation of that map, a targeted SAQ process for high-risk relationships, and contract terms that reflect the commercial reality of the current regulatory environment. These are achievable without a dedicated compliance function. The window to act is open. It will not stay open indefinitely. If your business sources internationally and you want a structured approach to assessing your supply chain labour risk exposure, Amaranth Brose offers a proportionate SME risk diagnostic. Book a consultation at amaranthbrose.com. Key Takeaways The December 2027 deadline is a compliance obligation, not a distant milestone. The EU Forced Labour Regulation carries no size threshold and no sector exemption — SME importers are in scope by default. Four frameworks, one direction. EU Forced Labour Regulation, CSDDD, UFLPA, and ECGT are converging on the same standard: documented, risk-based due diligence with evidence of identification, prevention, and remediation. Supplier mapping is the prerequisite for everything. You cannot prioritise, assess, or remediate risk you cannot see. Tier-1 visibility is the starting point, not the end state. Risk tiering makes due diligence proportionate. Country, sector, and product-level public indices allow SMEs to direct resources toward the highest-exposure relationships without enterprise-level compliance infrastructure. Social audit certificates are supporting evidence, not proof of compliance. They belong inside a risk-based process — not as a substitute for documented identification, action, monitoring, and outcome evidence. Governance is the multiplier. Supplier engagement, SAQ processes, and contract cascades only work if someone owns social risk — explicitly, with defined escalation paths and board visibility. Strategic Implication SME importers that treat supply chain labour risk as a concern for larger organisations will face the same enforcement environment as their peers — without the compliance infrastructure to respond when a shipment is detained or a major buyer exits. The regulatory deadline is fixed. The governance gap is not. Boards of SMEs with international sourcing exposure should require a supplier map, a risk-prioritisation framework, and a documented SAQ process as standard items in the annual risk review — before December 2027 removes the option to prepare and replaces it with the obligation to respond. What's Next in Brave Horizons In our next edition, we examine the environmental footprint of last-mile delivery — the final stage of the logistics chain that is becoming one of the most regulated segments of SME supply chain operations. As urban emissions zones expand, fleet electrification mandates tighten, and carbon pricing extends to transport, last-mile logistics is moving from a cost management question to a risk and opportunity question for SMEs across retail, food service, and B2B distribution. Follow Amaranth Brose on LinkedIn or subscribe to the Brave Horizons newsletter to receive the next edition directly on publication.