A small company in Nantes has been importing cotton work gloves made in Pakistan for ten years, and since 2023 tool handles machined in Malaysia from rubberwood. Its contract with each of the two manufacturers runs to four pages and says nothing about where the inputs come from. In 2027, it will probably receive two kinds of demands: from its retail customers, who send it a forty-page compliance questionnaire, and, for the wooden products, the requirements of the EU Deforestation Regulation, which falls due on 30 December 2026 for large operators and on 30 June 2027 for most small ones. If one of the cotton supply chains is ever targeted by a forced labour investigation, it is the Nantes importer, not the manufacturer in Sialkot, that the authority will question.
This page presents the two EU regulations that turn the supply chain from a commercial matter into a compliance matter: Regulation (EU) 2024/3015 on products made with forced labour and Regulation (EU) 2023/1115 on deforestation. It looks at who is covered, what is required, what the importer risks and what the purchase contract can still do for it, and places these texts in relation to the duty of vigilance, with which they are often wrongly equated.
1. A new logic: the product, the operator, and nothing in between
The two regulations share a feature that confuses purchasing departments. They do not impose an obligation of means on large companies, as the duty of vigilance does; they make the product’s access to the EU market conditional. A product that does not meet their requirements can be neither placed on the EU market, nor made available on it, nor exported from it, whatever the size of the company selling it.
The obligation rests on the European operator that places the product on the market, the importer first and foremost, because that is the only one the European authority can reach. The foreign manufacturer is subject to no direct obligation. The result is an asymmetry that the classic purchase contract ignores: whoever holds the information (the supplier and its own suppliers) is not the one answerable for compliance.
No clause can reverse this asymmetry. None. A statement by the supplier guaranteeing that its products “comply with all applicable regulations” changes nothing about the importer’s obligation towards the authority; at most, it gives the importer a warranty claim, whose value depends on the supplier’s solvency and on whether a judgment can be enforced in its country. The contractual stakes shift entirely: the aim is no longer to transfer the risk, but to obtain the means to respond to it.
2. The forced labour regulation: a ban with no threshold
Regulation (EU) 2024/3015 of 27 November 2024 prohibits economic operators from placing or making available on the EU market products made with forced labour, and from exporting such products (Regulation (EU) 2024/3015, Art. 3). Forced labour is understood within the meaning of Article 2 of International Labour Organization Convention No. 29, including forced child labour, and the regulation also covers state-imposed forced labour within the meaning of Convention No. 105 (Art. 2(1) and (2)).
An economic operator is any person who places products on the EU market, makes them available on it or exports them. A product is any item that can be valued in money and is capable of forming the subject of commercial transactions. There is no turnover threshold, no headcount threshold and no list of sectors. An SME importing gloves falls within the text just as much as a car group importing batteries. Forced labour may occur at any stage of production, including the extraction of raw materials.
The regulation applies from 14 December 2027. Some provisions have applied since 13 December 2024, in particular those requiring the Commission to set up an indicative database of areas and products at risk of forced labour (Art. 8) and to publish, by 14 June 2026 at the latest, guidelines for operators on due diligence in relation to forced labour (Art. 11). For an importer, these two tools are the first lens through which to read its exposure.
The regulation does not impose on the importer a formal due diligence obligation with a reporting requirement. But the procedure it sets up makes due diligence indispensable: that is what the operator will be questioned on.
3. The procedure: thirty working days to answer
The competent authority does not start with a penalty. Before opening an investigation, it sends the economic operators concerned a request for information on the measures they have taken to identify, prevent, mitigate or bring to an end the use of forced labour in their operations and value chains. Operators have 30 working days to reply, and the authority then concludes the preliminary phase within 30 working days (Art. 17).
If it finds a substantiated concern, it opens an investigation into the products and operators concerned (Art. 18). It endeavours to decide within nine months (Art. 20(1)). Where it cannot gather the information it needs, it may establish the violation on the basis of any other information available (Art. 20(2)). An operator that does not answer, or answers that it does not know, is therefore exposed to a decision based solely on the authority’s evidence.
Thirty working days is six weeks. That is not much time to obtain from a Pakistani manufacturer the identity and practices of its spinning mills, and from those mills the origin of their cotton. An importer that discovers the question when the request arrives has no chance of answering usefully. In six weeks it would have to identify its supplier’s factories, get the supplier to question its own mills or sawmills, translate documents written in a language it does not read, and judge the value of certifications whose scope it does not know. It would then have to present to a European authority, which has the Commission’s database and perhaps reports from non-governmental organisations, a coherent file on practices it has never checked. And every one of those steps depends on the goodwill of a supplier that owes that authority nothing and sometimes has every interest in keeping quiet. It will not manage to answer. An importer that has mapped its tier 1 and tier 2 suppliers, secured a contractual right to information and audit, and documented its checks, has a file.
4. The consequences: prohibition, withdrawal, disposal
When the authority establishes the violation, it adopts without delay a decision prohibiting the placing, making available and export of the products concerned, ordering the operators to withdraw those already placed on the market and to dispose of them; where only some parts of a product are at issue and those parts are replaceable, the order may cover those parts (Art. 20(4)). Disposal takes place in accordance with the rules laid down in the regulation (Art. 25). By way of derogation, where the product belongs to a supply chain of strategic or critical importance to the EU, the authority may order it to be withheld for a set period instead of disposed of (Art. 20(5)).
Failure to comply with the decision is penalised under a regime set by each Member State, taking into account in particular the seriousness and duration of the infringement, the operator’s cooperation and the financial benefits gained (Art. 37). Member States must notify that regime to the Commission by 14 December 2026 at the latest. As of the date of this page, the French regime is not known, and we can only reason on the basis of the European text.
For the importer, the real cost is not the fine in the first place. It is the blocked stock, the products withdrawn from customers, the supply line to rebuild, and the question of who pays for all of it. Without a clause, the answer has to be found in the warranty rules of the law governing the purchase contract, often the seller’s law, with an uncertain outcome.
5. The deforestation regulation: prior due diligence, product by product
Regulation (EU) 2023/1115 of 31 May 2023 works differently. It covers seven commodities (cattle, cocoa, coffee, oil palm, rubber, soya and wood) and the derived products listed in its Annex I, identified by their customs nomenclature code: leather, chocolate, furniture, paper, tyres and many others. These products may be placed on the market, made available or exported only if they meet three cumulative conditions: they are deforestation-free, they were produced in accordance with the relevant legislation of the country of production, and they are covered by a due diligence statement (Regulation (EU) 2023/1115, Art. 3).
Unlike the forced labour regulation, this text therefore requires a prior process for each placing on the market: gathering information, including the geolocation of the plots of land where the commodities were produced, assessing the risk, mitigating it, then filing a statement in the EU information system. Fines imposed on legal persons must be able to reach at least 4% of their total annual EU turnover (Art. 25(2)(a)).
After two postponements, Regulation (EU) 2025/2650 of 19 December 2025 set the date of application of the obligations at 30 December 2026, and at 30 June 2027 for micro and small enterprises that had that status on 31 December 2024. It also refocused the statement obligation on the operator that places the product on the market for the first time, with downstream operators keeping the reference number of the initial statement. In its review report of 4 May 2026, the Commission expressly declined to propose further amendments to the basic act, confining itself to a draft delegated act on the scope of the products in Annex I (COM(2026) 191 final). Companies waiting for a third postponement are making a bet that nothing in the texts supports.
The Nantes SME is directly concerned for its rubberwood handles, since wood is one of the commodities covered, provided their customs code falls within Annex I in its applicable version. It needs to establish that now.
6. Duty of vigilance and the EU directive: the knock-on effect
The two regulations are often confused with the duty of vigilance, which follows a different logic. The French law of 27 March 2017 requires companies employing at least five thousand people in France, or ten thousand in France and abroad, to draw up and implement a vigilance plan covering serious harm to human rights and the environment resulting from their activities and those of their subcontractors and suppliers with which they have an established commercial relationship. Since 1 January 2025, the obligation has been set out in Article L. 225-102-1 of the French Commercial Code, former Article L. 225-102-4 having been renumbered by Ordinance No. 2023-1142 of 6 December 2023.
The EU corporate sustainability due diligence directive was substantially narrowed by Directive (EU) 2026/470 of 24 February 2026, known as the Omnibus directive: it will cover only companies with more than 5,000 employees and more than 1.5 billion euros in net worldwide turnover, with transposition by 26 July 2028 at the latest and application from 26 July 2029.
For an SME or a mid-sized company, these texts create no direct obligation. Their effect is indirect, but very real: large customers pass their own obligations down through questionnaires, audits, supplier codes of conduct and compliance clauses that often provide for immediate termination. An SME caught between customers subject to the duty of vigilance and foreign suppliers must make sure that what it promises downstream, it has obtained upstream. The firm’s analysis of the duty of vigilance examines this framework in detail.
7. What the purchase contract can still do
The contract does not transfer compliance. What it can do is bring together the three things the importer will need: information, cooperation and recourse.
Information first, because without it the importer can neither answer the authority on forced labour nor draw up the due diligence statement required by the deforestation regulation. Cooperation next, because the useful information often sits with the supplier’s own suppliers, and the European procedure leaves the importer short deadlines. Recourse last, for the day an authority bans the product and someone has to decide who bears the blocked stock, the withdrawals from customers and the rebuilding of the supply line.
None of these three areas can be handled with a standard clause. Their scope depends on the products, the countries of production, the depth of the chain and the balance of power with the supplier; their wording depends on the law governing the contract. A foreign supplier will refuse commitments it considers disproportionate, and a termination clause triggered by a mere allegation can be challenged, or even backfire on the buyer. The trigger, the response time and the financial guarantee are the three points on which the negotiation is won or lost.
One precaution must accompany all of this: an importer that obtains information about forced labour practices and keeps buying anyway worsens its position. An audit clause is useful only if the company is ready to act on what it finds.
How the firm can help
The firm advises companies on international trade law and customs law, auditing their purchase contracts and preparing for these deadlines. You can tell us about your situation.
Frequently asked questions
Does the forced labour regulation apply to products bought before 14 December 2027?
The regulation prohibits placing on the market, making available and exporting from its date of application, 14 December 2027 (Regulation (EU) 2024/3015, Art. 3). Making available covers any supply of a product on the EU market in the course of a commercial activity, which includes reselling stock built up earlier. A product imported in 2026 and still being sold in 2028 may therefore be caught by a decision taken after that date. The purchasing calendar does not protect the importer; only the traceability of its products does.
Is a small business exempt from the forced labour regulation?
No. The regulation sets no size threshold: the prohibition covers every economic operator, whatever its size (Regulation (EU) 2024/3015, Art. 2 and 3). Small businesses can, however, rely on the guidelines the Commission was due to publish by 14 June 2026 at the latest (Art. 11) and on the database of areas and products at risk (Art. 8) to calibrate their checks. A very small business importing textiles is covered just like a large retailer.
Who files the due diligence statement when I buy cocoa from a Dutch importer?
Since the amendment made by Regulation (EU) 2025/2650, the obligation to file the due diligence statement lies with the operator that places the product on the EU market for the first time, in this case the Dutch importer. Downstream operators no longer file a separate statement, but the first of them must keep and pass on the reference number of the initial statement. The French buyer should therefore require that reference from its seller in the contract, and check that it matches the batches delivered.
Is a certification such as a fair trade label or FSC enough to satisfy these regulations?
No, not on its own. A certification is useful information for assessing risk, but neither regulation gives it the effect of discharging the operator. For deforestation, the operator is still required to gather the prescribed information, including geolocation, and to draw up its own statement. For forced labour, the authority looks at the measures the operator actually took, and a certification whose scope does not cover the most exposed stages of production does not answer the question being asked.
In the same series, for the overall map of risks: International supply chains: the legal risks for a company that buys abroad; on supplier default: Foreign supplier stops delivering: avoidance, substitute purchase and damages; on leaving the relationship: Ending a relationship with a foreign supplier: notice, abrupt termination and governing law.