A Practical Roadmap for compliance with the EU Forced Labour Regulation

The EU Forced Labour Regulation (“EUFLR”) has entered into force and will apply from 14 December 2027. It prohibits economic operators from placing or making available on the Union market, or exporting from the Union market, products made with forced labour. Our previous Legal Update covers EUFLR compliance questions for general counsel. On 3 September 2023, the European Commission (“Commission”) published a set of non-binding EUFLR Guidelines in the EU’s Official Journal (“the Guidelines”). 

In this Legal Update, we present the essential practical takeaways from these Guidelines in so far as they provide the clearest indication to date of how authorities may assess risk, evidence, traceability, and cooperation. We translate the existing legal framework into practical workstreams, with particular emphasis on product-level traceability, investigation readiness, and responsible responses in the event of an identified forced labour risk in a company’s supply chain. This Legal Update also discusses whether compliance with US forced labour requirements may serve as the basis for EUFLR compliance.

Key Takeaways

The EUFLR imposes an obligation of result: a product made with forced labour may not be placed, made available on, or exported from the EU market, even if the operator has adopted an otherwise sophisticated compliance programme involving extensive due diligence.

Due diligence, traceability, responsible purchasing, certification, and worker-driven monitoring are key elements to ensuring compliance with the EUFLR, because they can reduce risk, help prevent forced labour, and enable companies to demonstrate what they have done in order to ensure compliance.

Timely Preparation is Essential

The EUFLR sits alongside, rather than replaces, other EU and national measures addressing supply chain transparency, sustainability, and human rights. The Regulation itself does not impose additional due diligence obligations beyond those already required by EU or national law. At the same time, the Guidelines describe due diligence as one of several practical ways to identify, prevent, mitigate, bring to an end and remediate forced labour risks. Companies can therefore leverage any existing Corporate Sustainability Due Diligence Directive (“CSDDD”), EU Deforestation Regulation (“EUDR”), sectoral and US forced labour compliance programmes as a foundation for EUFLR compliance.

Several developments serve as indications that the preparation phase has moved from planning to implementation:

• The Forced Labour Single Portal says preparation starts now and lists webinars organized by the European Commission beginning on 14 September 2026, including SME sessions and sector sessions for solar, textiles, electronics and semiconductors, agri-food, automotive, and fisheries. The Portal also confirms that the Single Information Submission Point for suspected violations will be available from 14 December 2027. 
• Implementing Regulation (EU) 2026/903 has also established the forced labour module in ICSMS, the information system through which the Commission, competent authorities and customs authorities will share information relevant to assessments, investigations, decisions, and enforcement.
• The Forced Labour Risk Database remains in development and is expected to contain indicative, non-exhaustive, evidence-based, and independently verifiable information on products and geographic areas. 
• The Commission has published a tender for supply chain traceability and forced labour risk-detection pilots that has a 28 September 2026 submission deadline.

Companies should expect authorities, civil society organisations, workers, trade unions, customs authorities, and other stakeholders to use increasingly structured information about products, facilities, and geographic risks in their efforts to counteract instances of forced labour. 

The market is therefore moving toward a model in which a company must be able to answer two questions quickly: 

• What products that feature in my supply chain could be affected, and 
• What evidence may be relied upon to prove that those products are not connected to the alleged forced labour practice?

Proportionality and a risk-based approach form essential elements of an EUFLR compliance program. Companies can adopt different, and more-or-less stringent compliance architectures, depending on the applicable level of risk for a particular company. However, every company should be able to explain its product scope, its highest-priority risks, the limits of its current visibility, and the steps it is taking to close the most consequential gaps.

The EUFLR’s Coverage and Scope

Article 3 of the EUFLR prohibits economic operators from placing or making available on the Union market products made with forced labour, or exporting such products. “Placing on the market” means the first making available of a product on the Union market, whereas “making available” refers to supplying a product for distribution, consumption, or use in commercial activity, whether for payment or free of charge. 

The Regulation uses the ILO Convention No. 29 concept of forced labour: work or service exacted under the menace of a penalty and not offered voluntarily. The Guidelines identify practical indicators such as forced recruitment, deception, debt, restrictions on movement, retention of identity documents, wage withholding, threats, violence, hazardous or degrading conditions, and abuse of vulnerability. State-imposed forced labour and forced child labour are also covered. Companies should therefore assess not only conventional labour rights controls, but also structural and state-linked risks that may not be visible through ordinary supplier audits.

A product falls with the EUFLR’s scope if forced labour was used in whole or in part at any stage of extraction, harvest, production, manufacture, working or processing, wherever that stage occurred and whether the affected input is a major or minor part of the finished product. Forced labour used in the provision of services is not covered as such. The EUFLR explicitly notes that forced labour at the stage of a product’s transport, warehousing, or logistics handling does not mean that the product itself has become “made with forced labour”. However, the use of forced labour during working or processing incidental to a product’s extraction, harvest, production, or manufacture will inevitably lead to a finding that a product has been “made with forced labour”.

The EUFLR’s prohibition therefore extends to producers, manufacturers, importers, exporters, distributors, retailers, and other economic operators that place or make products available on the EU market or export them. 

Article 4 of the EUFLR explicitly covers products offered online or through other distance sales where the offer is targeted at end users in the EU. The assessment is case-specific. Shipments to the EU, Member State languages or currencies, regional payment methods, a Member State domain name, and an ordering and shipping system may indicate targeting of EU end users, but mere accessibility of a website in the EU is not enough. 

The EUFLR does not contain any “grandfathering” assumption, keeping certain products out of the Regulation’s temporal scope of application. Indeed, products placed or made available on the EU market, or exported, on or after 14 December 2027 must be capable of being supported as compliant, even if the product or a component was produced or imported earlier.

Companies are therefore advised to review inventory, bonded and unbonded warehouse arrangements, distributor stock, and any online listings.

The EUFLR’s Investigation Process 

The EUFLR is administered through an administrative investigation and enforcement framework. The Regulation does not require a prior criminal investigation, and a decision establishing a violation of the forced labour ban can proceed on an evidentiary record that is formed in the context of an administrative procedure. 

Who Leads and What Systems Connect

Where suspected forced labour occurs outside the EU, the Commission acts as lead competent authority (“LCA”). Where it occurs in a Member State, the relevant Member State competent authority leads. The authorities coordinate through the Union Network Against Forced Labour Products and the ICSMS forced labour module. Companies should assume that information provided in one context may inform wider coordination between and among authorities.

Prioritization of Cases: Risk-Based Approach

The LCA will apply a risk-based approach. The Guidelines identify the following factors as relevant considerations:

• Scale and severity of the suspected forced labour, 
• The quantity or volume of products, 
• The share and significance of the suspected tainted input, 
• Proximity to the alleged forced labour, 
• The operator’s leverage to prevent or end it,
• The operator’s size and resources, and 
• The complexity of the supply chain as relevant considerations. 

The approach is designed to focus scarce resources on cases with the greatest potential impact, but it also means that a small component can be important if it is functionally or economically significant or difficult to trace.

The Preliminary Phase

Before opening a formal investigation, the LCA will conduct an initial assessment and preliminary phase. It may request information from the operator under assessment and from other product suppliers, including suppliers outside the EU that have no direct relationship with the market of the EU. 

A preliminary request may require a response within 30 working days. The company may explain why the concern of forced labour does not relate to its products, provide traceability and other evidence, and describe actions taken to prevent, mitigate, end or remediate the forced labour risk. If the concern has been addressed, the LCA may decide not to open a formal investigation or may allow a reasonable period for corrective action.

Formal Investigations and Evidence

If a substantiated concern remains, the LCA may open a formal investigation and must give the operator an opportunity to be heard. Formal information requests will generally allow at least 30 working days and no more than 60 working days for the operator to provide information, subject to the Regulation and the circumstances of the case.

The EUFLR provides for a nine-month timeline as the target for concluding the formal investigation or adopting a decision. This is not a binding deadline, however. 

Authorities may use credible direct, indirect and circumstantial evidence, including worker testimony, grievance records, social-audit materials where credible, payroll and production records, geolocation, laboratory testing, trade and customs data, public reports and product-level traceability. The LCA bears the burden of establishing both the forced labour and the link to products placed or made available on or export from the Union market.

The Guidelines emphasise that “the complete lack of, or inability to provide, traceability information where a product, raw material or component may have been mixed with one at high risk of forced labour, may weigh negatively in the overall assessment of evidence”. This underscores the Commission’s expectation for companies to be able to provide product traceability information at a granular level. 

According to the Guidelines, availability of product traceability information will be of major importance for the investigations and reviews of the decisions, as well as for customs clearance of products with an identification similar to that of the products under the decision: 

• During the investigation or review, traceability information may need to be submitted to the lead competent authority to demonstrate that the product is not connected to the investigated forced labour practices; 
• Lack of traceability information may weigh negatively against the company being assessed by the LCA; and
• Once a decision is adopted, traceability information may need to be submitted to the customs or the competent authorities to demonstrate that the products are not in scope of the decision.

As explained in the Guidelines, the LCA may request the economic operator under investigation/assessment as well as “other product suppliers” to provide information on the product under assessment concerning not only identification of the product as such, but also product traceability information, i.e., information with respect to supply chain structure and actors, production facilities and locations, and transactional and logistical records as well as production and capacity, including: 

• Product identification information, including information on the manufacturer, producer, product supplier,  importer, or exporter of the product or parts thereof; 
• Product traceability evidence (chain-of-custody certificates, raw-material traceability data); 
• Documentation linking the finished product to its raw-material source; 
• Bills of materials; 
• Information gathered with traceability tools and with trade, customs, and shipping data; 
• Description of the supply chain, covering key stages of production, manufacturing, or mining;
• List of manufacturers, producers and suppliers with regard to key production steps;
• Supply chain maps covering tiers and sub-tiers and showing both direct and indirect suppliers;
• Identification of locations and facilities at key extraction, harvest, production, manufacturing, or mining stages and supporting location evidence such as satellite imagery, GPS coordinates, or other geolocation data; 
• Various transactional and logistics records, including those that map the product’s journey from production site(s) to the EU (such as transport documentation, supplier, and buyer inventory records, including dock/warehouse receipts); 
• Evidence related to the production process, such as production orders, factory production-capacity reports, evidence demonstrating consistency between input volumes and output volumes for the product(s) extracted, harvested, manufactured, produced, or mined. 

Contents of a Decision

A decision establishing a violation (“ban-violation decision”) will impose a product-specific prohibition with EU-wide effect. It will prevent release for free circulation or export, require withdrawal of products already made available, require disposal of products or affected parts, and require online sellers or intermediary services to remove listings or restrict access under applicable law.

Where a supply chain is of strategic or critical importance to the EU, withholding may be ordered instead of immediate disposal while forced labour is eliminated. Penalties for non-compliance with a decision are set by Member State law and must be effective, proportionate, and dissuasive.

Cooperation and Remediation

Cooperation is required from a practical perspective. If an operator refuses to provide requested information, misses the deadline without justification, provides incomplete or misleading information, or otherwise impedes the investigation, the LCA may rely on other facts available. Non-cooperation is itself relevant evidence, although a violation must still be supported by credible evidence.

The Guidelines recognise that action taken during the preliminary phase may eliminate the existing concern and bring to an end and remediate forced labour or, where continued leverage is not realistic, a responsible disengagement plan that accounts for affected workers and downstream consequences.

Operational Consequences

The commercial impact may extend beyond the entity that receives the request. A decision can identify products, components, manufacturers, producers, suppliers, importers and exporters so that other operators and customs authorities can identify the affected goods. This can interrupt distribution, inventory release, customer commitments, online sales and export flows.

A company that has reliable batch, component and facility records may be able to distinguish unaffected products and seek review of an overly broad decision. Conversely, a company that cannot trace mixed inputs may face a broader operational risk.

A Short Practical Illustration of a Simplified Scenario

Consider an example with EU importer “A” selling a finished product that incorporates an intermediate sourced from non-EU entity “B”. A credible submission by an NGO, public risk information, and shipping records point to forced labour at an upstream processing stage. Within 30 working days, the importer “A” may need to identify the relevant product families, batches, suppliers, facilities, volumes, inventory, and channels, and explain its actions.

If it cannot distinguish the affected input from other sources, the authority may use indirect evidence and facts available to assess the nexus. The result could restrict release for free circulation or export, require withdrawal of EU stock, removal of online listings, and affect distributors “C”, retailers “D”, downstream EU processors “E” and their distributors “F” and retailers “G” that were not themselves investigated.

Practical Compliance Roadmap

We recommend, on the basis of the Guidelines, to develop a proportionate roadmap with clear owners among business functions, and the establishment of a “response team” that can swiftly react in case of an investigation.

We have identified below a selection of relevant workstreams that may be deployed to ensure operational readiness.

Scope Products, Channels, and Inventory

Companies should create a single inventory of products, components, and raw materials that may be placed or made available in the EU or exported from it. Each item should be linked to its product family, Harmonized System (“HS”) or Combined Nomenclature (“CN”) code where relevant, manufacturing and processing locations, EU entities, importer and exporter roles, sales channels, and planned movements after 14 December 2027. This exercise should identify not only what is sold, but also where control over the product and the relevant records lies within the business.

Screen and Prioritize Risks

Companies should screen products, suppliers and geographies against the Guidelines’ forced labour indicators, the Forced Labour Single Portal, the risk database once it becomes available, credible NGO and stakeholder information, public reporting, trade and customs data, and existing due diligence materials under, for example, the EUDR, the CSDDD, or sector-specific due diligence regimes such as, for example, the EU Batteries Regulation.

The prioritization of risks should reflect the severity and likelihood, product volume, the significance of the suspected input, leverage, supply chain complexity, and the feasibility of remediation of the forced labour concern.

Map Direct Suppliers and Supply Chains

The supply chain should be mapped far enough upstream to identify the facilities, geographies, sectors, and inputs that drive the risk. In this regard, Tier 1 lists should be treated as a starting, rather than an end, point. For higher-risk products, companies should trace key inputs through processors, traders, raw-material sources, and relevant subcontractors, and identify and note where materials are mixed, transformed, mass-balanced, or re-labelled. Specific input on the product, production facilities, and geographies should form the basic elements of the analysis so that a future investigation can be answered with more precision than a company-wide supplier statement.

Build Product-Level Evidence Files and Data Rooms

We recommend companies to create evidence files for each priority product group. It should allow the response team to retrieve bills of materials, supplier and sub-tier lists, facility addresses and geolocation, chain-of-custody and raw material data, purchase orders, invoices, packing lists, payment and shipping records, inventory and warehouse records, production orders, capacity and input-output data, policies, training, audits, grievance and worker-engagement records, and corrective-action evidence.

A consistent naming, versioning, translation, and privilege protocol will matter as much as the existence of the documents. The file should be usable by a response team that did not build it themselves.

Close Traceability Gaps and Test the Process for High-Risk Products

Traceability is key in ensuring EUFLR compliance and companies are strongly advised to regularly test the traceability of products, rather than assume that it can be done on an ad hoc basis. We recommend companies to select representative high-risk products and run batch-level or component-level exercises from finished product back to the relevant facility and input, then reverse the exercise from a product’s source to its entry on the market of the EU.

Traceability in and of itself will not suffice to establish that forced labour is absent, and a certificate or audit is not a safe harbour. However, it will assist companies in demonstrating whether a suspected practice is connected to a particular product and may support a narrower response.

Update Supplier Contracts and Codes

A key element of ensuring EUFLR compliance, as well as readiness, lies in ensuring that contractual relationships with suppliers reflect the relevant requirements. We recommend companies to review and update supplier codes and contracts to address forced labour, transparency, access to records and facilities where possible, notification of allegations or investigations (including in non-EU jurisdictions), corrective-action plans, and suspension or termination rights.

Response Team and Protocol

Companies are advised to assign a senior owner and a cross-functional response team covering functions such as procurement, trade and customs, logistics, sales, e-commerce, sustainability, legal, compliance, communications and internal audit. We also recommend adopting dedicated response protocols that can be used in the event of an investigation.

Prepare Remediation and Responsible Disengagement

We recommend companies to consider and define the actions they will undertake when a risk of forced labour is substantiated. Depending on the facts, the response may include stopping new orders or sales, holding affected inventory, engaging the supplier on a corrective-action plan, protecting affected workers, reimbursing recruitment fees or other worker losses where appropriate, replacing a tainted component, and documenting the effectiveness of the remedy.

If forced labour persists and leverage is ineffective, the EUFLR requires companies to engage in responsible disengagement that considers worker safety, notice, alternative sourcing, customer continuity, disposal or withdrawal requirements, and the risk that abrupt termination may displace rather than reduce harm.

The US Forced Labour Framework: Practical Lessons for EUFLR Readiness

Companies with exposure to US forced labour controls should treat them as a foundation, not a template, for EUFLR readiness. The practical objective is to carry across the disciplines that already work, such as end-to-end tracing, importer response, supplier engagement and documentary control, while adapting the legal analysis to the EU’s broader product and distribution framework.

Under 19 U.S.C. § 1307, U.S. Customs and Border Protection (“CBP”), must deny entry into the United States “all goods, wares, articles, and merchandise mined, produced, or manufactured wholly or in part in any foreign country by convict labor or/and forced labor or/and indentured labor. . . .” Critically, the prohibition applies to goods made wholly or in part with forced labor. This means that even if only an upstream raw material or intermediate input was produced with forced labor, downstream finished products incorporating that input are also subject to the prohibition. Under the statute’s implementing regulations, a Withhold Release Order prohibiting importation of goods is issued when information “reasonably but not conclusively indicates that merchandise” produced with forced labor “is being, or is likely to be, imported[.]”¹

The Uyghur Forced Labor Prevention Act (“UFLPA”) creates a rebuttable presumption that any good mined, produced, or manufactured wholly or in part in the Xinjiang Uyghur Autonomous Region (XUAR) of China—or by entities on the UFLPA Entity List—is prohibited from entry into the United States under 19 U.S.C. § 1307.² In other words, the UFLPA removes the requirement under the regulations implementing 19 U.S.C. § 1307 that CBP must have “reasonable” information that the subject merchandise is being produced with forced labor, replacing it with the aforementioned rebuttable presumption.

U.S. Forced Labor Law is administered primarily at the border and compliance is determined on a shipment-specific basis – meaning that a US importer must be able to demonstrate (if requested by CBP) that any given importation into the United States has no trace of forced labor. CBP’s June 2026 Forced Labor Enforcement Operational Guidance for Importers consolidates process maps, step-by-step response pathways, recommended documentation, sector appendices, and sample notices. It encourages importers to trace inputs, evaluate risk, communicate with suppliers, and maintain thorough documentation. Companies should use that guidance to strengthen the evidence disciplines described above, including raw-material-to-finished-product mapping, production-capacity checks, input-output consistency, and a documented explanation for gaps. The same evidence may be useful in an EUFLR assessment, but it should be reorganized around EU products, channels, inventory, and export flows.

The EUFLR is broader in product and operator scope as it covers all origins and sectors, reaches exports from the EU, and can affect products already in commercial distribution channels after 14 December 2027. It has no UFLPA-style geographic rebuttable presumption. Instead, the LCA conducts an administrative investigation and bears the burden of establishing the violation on credible evidence, including indirect and circumstantial evidence. The EUFLR also emphasises remediation and responsible disengagement, rather than focusing only on whether a particular shipment may be released at the border.

In practice, the most effective cross-border model is one global evidence architecture with jurisdiction-specific playbooks. A company can leverage US experience by preserving supplier and shipment records, designing clear importer response processes, and maintaining a defensible chain of custody. It should add EU market and export mapping, online-sales analysis, distributor and inventory controls, product-level segregation, and a plan for engagement with the LCA.

How Mayer Brown Can Help

Mayer Brown can help companies convert the EUFLR into a practical operating plan. Our support can include EUFLR scoping across products, entities and channels; risk assessment and prioritization; product-level evidence data rooms and traceability testing; supplier engagement and contract remediation; governance, training and investigation-response protocols; customs, market-surveillance, and online-sales response planning; US-EU forced labour alignment; and remediation, responsible disengagement, review, and investigation strategy. We can also help management translate the applicable requirements under the EUFLR into a proportionate roadmap for the business.