Supply chains are about to become the next big thing in sustainability compliance. However, many organizations still lack the data and assurance capabilities to track sustainability and human rights activities across their extended supply chains – which is required by the EU’s Corporate Sustainability Due Diligence Directive (CS3D). Many others that fall out of scope of the directive may not realize that, as part of the supply chain, they will need to provide a host of new data to their larger clients. 

CS3D must be incorporated into EU member states’ national laws by July 2026. It introduces a corporate due diligence duty for large companies to identify and address “adverse human rights impacts” and environmental impacts not only in their own operations, but also in those of their subsidiaries and in their chain(s) of activities. Large companies are also obliged to put into action a transition plan for mitigating climate change. 

The directive’s requirements are comprehensive, and all in-scope (and many out-of-scope) organizations will need to invest substantially to put in place the processes they will need to compile the data, obtain assurance, and to create improvement plans. Any that have not yet begun to identify what they will need to do, the data they will need to collect and the way they will process it are already falling behind. 

The expectations are ambitious given that just last month the BBC reported that McDonald’s and some of the largest U.K. supermarkets failed to spot that they, or a common supplier, were employing 16 Czech slaves for four years up to 2019, despite numerous red flags that should have led to internal investigations. 

Meanwhile, some countries are behind schedule on the EU Corporate Sustainability Reporting Directive (CSRD).In September, the EU said that it sent a letter of formal notice to 17 member states which have not yet fully transposed CSRD into their national laws – even though large public interest organizations are due to report under it in 2025.  

While some of the work being done to report under CSRD rules is likely to support work towards CS3D, organizations should not put off undertaking the due diligence preparations until it passes into national law. Gaining the information required from suppliers will take time, and it may not be in a usable or comparable format. Contracts may need to be changed and organizations may need independent assurance. Some may decide to change suppliers if they cannot get the required assurance. 

In general, climate reporting data is more likely to be available than data on issues such as biodiversity and social metrics, because more firms have been working on climate reporting for longer. The “comply and explain” approach means that companies have an option of explaining why data is unobtainable, but they will need to prepare comprehensive and transparent explanations.