When an authority asks who made a product, your system can already answer.

An implementation checklist.

1. 1.Map each product you sell to the stages upstream of it, not just to the supplier who invoiced you. Article 2(7) reaches forced labour used in whole or in part at any stage of the supply chain, and Article 2(8) defines that chain as all stages upstream. Start with the products that carry the most revenue or the most risk, record the product supplier at each stage with a country and a site where you know it, and mark the stages you cannot yet see. The map does not have to be complete to be useful. It has to make the gaps visible.
2. 2.Score your products and supplier countries against the public risk database. Article 8 puts an indicative, evidence-based database of risk areas and products on the Forced Labour Single Portal, drawn from the ILO, the UN and research bodies, and it is the same map an authority reads under Article 14. Join it to your own supply chain map so that a product touching a flagged area or a flagged product group is a flag on your rows rather than a discovery someone makes during an investigation.
3. 3.Hold your due diligence as evidence, attached to the product and its suppliers. The Regulation adds no due diligence duty in Article 1(3), but Article 17 turns the actions you took on a risk into the reason an investigation does or does not open. A policy in a shared drive does not answer that. Actions recorded against the product, with a date and a document reference, do, and the preliminary phase gives you 30 working days to produce them.
4. 4.Make supplier identity retrievable per product, in the form Article 18(3) asks for. When an investigation opens, you have between 30 and 60 working days to identify the products and their manufacturer, producer, product supplier, importer or exporter. That is a query against a maintained record, not a project. If answering it means calling three teams and reading old purchase orders, the deadline is already working against you.
5. 5.Record identification information on every product, and tie it to the supply chain. Article 20(8) makes a ban recognised across all member states for products with the same identification information from the same supply chain, and Article 27 has customs ask for the same identity. A model, batch or serial number held against the product, and linked to the chain behind it, is what lets you tell whether a ban published on the portal reaches your goods.
6. 6.Put a watch on the Forced Labour Single Portal. Article 12 publishes every decision to ban a product and every withdrawal. A ban on a supplier or a product group two tiers below you can reach your finished goods through Article 20(8). Reading the portal against your supply chain map turns that from an alarming customs call into a check you already ran.
7. 7.Prepare the customs answer before a delegated act names your products. Article 27 lets the Commission require, product group by product group, that the person placing goods under release for free circulation or export give customs the product identity and the manufacturer, producer and product suppliers. The operators who have that ready will clear controls faster, and Article 29 gives customs only four working days, or two for perishables, before an unsuspended product moves.
8. 8.Assign an owner to every flagged stage. A high risk flag with no owner is a finding waiting to happen. The Regulation focuses, in Article 14(4), on the operators closest to the risk with the highest leverage. Knowing which of your own people owns the relationship with a flagged supplier, and what leverage you actually have there, is what turns a flag into an action.
9. 9.Run one exception query every quarter, not one audit a year. Products with an unmapped stage, a stage in a flagged country, a supplier with no site, a due diligence action with no evidence, a flagged stage with no owner: these are the rows that decide how a preliminary request or a customs suspension goes. Finding them on a quiet Tuesday is administration. Finding them when an authority is holding a 30 working day clock is an escalation.

Failure modes, framed so you can plan around them.

• Treating this as a due diligence reporting exercise. Article 1(3) is explicit that the Regulation creates no new due diligence obligation, which leads some teams to conclude there is nothing to build. The opposite is true. Because enforcement runs through investigations rather than filings, the thing that protects you is not a report but the ability to produce, on demand and within a fixed deadline, the suppliers behind a product and the actions you took on the risk. That is a data capability, and it takes longer to build than a policy takes to write.
• Mapping tier one and stopping. The supplier who invoices you is the easy part and rarely where the risk sits. Article 2(7) reaches any stage of the supply chain, and the risk database in Article 8 tends to flag raw materials and early processing, which are several tiers upstream. A map that ends at the party you pay leaves exactly the stages the Regulation is aimed at unseen, and an authority following the risk-based approach in Article 14 will look past your first tier to find them.
• Keeping the risk map and the supplier record in different places. The public database in Article 8 is only useful if it meets your own supply chain map on the same rows. Held apart, a flag on a region is a document someone read once, and a supplier in that region is a record someone else maintains, and nobody connects the two until an investigation does it for you. The value is in the join, which is why it belongs in the record rather than in a briefing.
• Confusing a certificate with traceability. A supplier attestation that its own operations are free of forced labour is worth having, but it is not a map of the stages behind that supplier, and Article 18(3) asks for the manufacturer, producer and product suppliers, not for a signed statement. A stack of certificates can coexist with a supply chain nobody has actually traced, and the gap only shows when an authority asks who made the input two tiers down.
• Underrating the facts available rule. Article 20(2) lets an authority establish a violation on other facts available where an operator refuses, delays, gives incomplete or incorrect information to block the investigation, or otherwise impedes it. An operator that cannot answer because the data does not exist can find silence read as impeding rather than as innocence. The deadline in Article 18(4) is not the risk. The empty answer at the end of it is.
• Ignoring a ban that names someone else. Article 20(8) recognises a decision across all member states for products with the same identification information from the same supply chain. A ban on a component maker or a mill you share with a competitor can reach your finished product without your name ever appearing in the decision. Without identification information tied to your supply chain, you learn about that reach at a customs suspension rather than at your desk.
• Leaving the customs data to the day a delegated act lands. Article 27 will require, for named product groups, the product identity and the manufacturer, producer and supplier details at release for free circulation or export. The delegated acts will build on the risk database, so the product groups most likely to be named first are the ones already flagged. Waiting until your product group is named means assembling supplier identity under a customs deadline rather than ahead of it.
• Designing only for products entering the Union. The prohibition in Article 3 covers making products available on the Union market and exporting them, and it applies whether the product was made inside or outside the Union. A model built only around imports misses domestically produced goods and misses the export leg, both of which Article 3 reaches and Article 15 splits between the Commission and member state authorities depending on where the forced labour is located.
• Building it once and letting it drift. Suppliers change, sites move, the risk database updates and new bans appear on the portal. A traceability record captured for a launch and never refreshed is accurate on the day it is made and stale within a quarter. The exception query is what keeps it honest, and running it on a schedule is cheaper than rebuilding the map after an authority finds it out of date.
• Owning it nowhere. This record sits across procurement, supplier master data, trade and customs, compliance and finance systems, which is exactly the seam where responsibilities fall between teams. The preliminary phase in Article 17 and the investigation in Article 18 both run on fixed working day clocks, and a clock is not the moment to discover that no single owner can pull the answer together.

What this asks of the data model.

• The supply chain is a graph, not a field. Each product links to product suppliers at each upstream stage, and each supplier link carries a country, a site where known, and a stage. A single supplier column answers who you paid. It cannot answer who made the input two tiers down, which is what Article 18(3) asks for and where the risk in Article 8 usually sits.
• The risk score is a join, kept current, not a one time tag. The database in Article 8 updates, so a supplier stage that was low risk can become flagged when the map changes. Hold the score as a derived value against the stage, recomputed when the database or the supplier changes, so a new flag surfaces as an exception rather than waiting for the next manual review.
• Due diligence actions are data with evidence attached. An action recorded against a product, with a date and a document reference, is what answers the preliminary request in Article 17. A policy that applies to everything in general answers nothing in particular. The link from the action to the specific product and supplier is the part that carries weight.
• Identification information belongs on the product and links to the chain. Article 20(8) and Article 27 both turn on being able to say which product, identified how, came from which supply chain. A model, batch or serial number, and where one exists a digital product passport identifier, held on the product and tied to its stages, is what connects a ban or a customs query to your specific goods.
• Retrievability is a property worth measuring. Article 18(4) gives an operator 30 to 60 working days to identify suppliers, and Article 17 gives 30 working days in the preliminary phase. A record that holds the data but cannot return it inside those windows fails the test in practice. Track, per product, whether the supplier identity is actually retrievable, so a partial answer is visible before an authority asks.
• The record spans entering, domestic and leaving. Article 3 reaches products placed or made available on the Union market and exported, made inside or outside the Union. Model the product and its chain once, and carry the market and the customs direction as attributes, rather than building separate answers for imports, home production and exports and reconciling them later.
• Ownership and leverage are fields, not folklore. Article 14(4) points enforcement at the operators closest to the risk with the highest leverage. Recording who owns a flagged supplier relationship, and what leverage you have there, turns that principle into something you can act on, and tells you where a remediation under Article 20(5) or Article 21 is even possible.
• The portal is an input, watched not just read. Article 12 publishes bans and withdrawals. Matching them against your supply chain map by identification information and chain, on a schedule, is how a decision naming someone else becomes a flag on your product before it becomes a suspension at the border.
• Confidentiality and provenance ride along. Much of this data comes from suppliers under commercial terms, and some of the risk information carries source and confidence. Hold the provenance and the sensitivity with the value, so the record can be shared with an authority where required under Article 18 without exposing what should not travel with it.

The evidence to keep.

• The product to supply chain map for the products in scope, showing each upstream stage, the product supplier at that stage, the country and site where known, and the stages that remain unmapped, which is the starting point for any answer to an authority under Article 18(3).
• The risk scoring, showing how each supplier stage was scored against the public database referred to in Article 8, the version of the database used, and the date, so a flag can be explained and reproduced rather than asserted.
• The due diligence file per product, holding the actions taken to identify, prevent, mitigate, bring to an end or remediate forced labour risk under Article 17, each with a date and a document reference, and the framework relied on.
• The identification register, showing the model, batch or serial number, the customs code and any digital product passport identifier for each product, linked to its supply chain, which is what Article 20(8) and Article 27 turn on.
• The preliminary response pack for the higher risk products, the material an operator would hand to a lead competent authority within the 30 working day window in Article 17(2), assembled in advance rather than on receipt of the request.
• The portal watch log, showing which published ban decisions and withdrawals were checked against the supply chain map, when, and whether any matched a product by identification information and chain under Article 20(8).
• The remediation record for any flagged stage where action was taken, tied to the product and the supplier, which is what would carry a request for review under Article 21 or a decision to withhold rather than dispose under Article 20(5).
• The customs readiness extract for product groups likely to be named under Article 27, showing that the product identity and the manufacturer, producer and supplier details are available for a release for free circulation or export declaration.
• The ownership and leverage record, showing who owns each flagged supplier relationship and what leverage the operator has there, which is the practical reading of the focus in Article 14(4) on the operators closest to the risk.

Questions worth asking in your own review.

• For our highest revenue product, can we name the product suppliers at each upstream stage, or does our record stop at the supplier who invoiced us?
• Have we scored our products and supplier countries against the public risk database in Article 8, and would a flagged region show up as a flag on our own rows?
• If an authority asked today what we did about forced labour risk on a specific product, could we produce the actions with dates and evidence within 30 working days?
• Could we identify the manufacturer, producer and product suppliers for a named product within 30 to 60 working days, from a maintained record rather than from purchase orders?
• Do our products carry identification information, a model or batch or serial number, tied to the supply chain, so we could tell whether a ban published on the portal reaches our goods?
• Who reads the Forced Labour Single Portal against our supplier map, and how often?
• For the product groups already flagged in the database, is the customs identity information ready for a release for free circulation or export declaration?
• For each flagged supplier stage, who owns the relationship, and what leverage do we actually have to change it?
• Does our model cover exports and domestically produced goods, or only products entering the Union?
• Who owns this end to end across procurement, master data, trade, compliance and finance, or does it fall between them?

What this adds up to.

The compliance question is narrow. Do not place, make available or export a product made with forced labour, and be able to answer an authority that asks about the suppliers behind it. The deadlines are fixed, the process is written down, and the risk map is public. None of it is hard to understand.

The operating question is the more interesting one, and it outlasts any single request. An operator that can state, for a product, who made it and its inputs at each stage, where those suppliers sit against the risk map, what was done about any risk and how the product is identified has built something worth more than a defence. It can answer a preliminary request in days rather than weeks, which is usually the difference between a matter closing and an investigation opening. It can tell whether a ban published on the portal reaches its goods before a customs officer does. It can make a sourcing decision knowing where the risk actually sits rather than guessing, and it can show its work to an authority without a scramble. The same record serves the deforestation rules, the customs identity a carbon levy needs and the supplier due diligence other laws already require.

If there is one place to start, it is a single product that matters, mapped upstream until the map runs out, with each stage placed against the public database. That exercise takes a few days and it usually surprises people, because the point where the map ends is exactly the point the Regulation is aimed at. Everything else in this article is built on top of that first map. The application date is still far enough away that the record can be built as the relationships are understood, rather than reconstructed under a deadline once a request has already arrived.

Sources.

• Regulation (EU) 2024/3015 of the European Parliament and of the Council of 27 November 2024 on prohibiting products made with forced labour on the Union market and amending Directive (EU) 2019/1937. Downloaded from EUR-Lex and read directly, article by article, rather than through a summary. Source for every requirement described here: the subject matter and the statement in Article 1(3) that it creates no additional due diligence obligations; the definitions in Article 2 of forced labour, product, product made with forced labour, supply chain, product supplier, substantiated concern and lead competent authority; the prohibition in Article 3; the competent authority information deadline of 14 December 2025 in Article 5(3); the risk database in Article 8; the single information submission point in Article 9; the guidelines in Article 11; the Forced Labour Single Portal in Article 12; the risk-based approach and its evidence sources in Article 14; the allocation of investigations in Article 15; the preliminary phase and its 30 working day clocks in Article 17; the investigation and the supplier identity it requires in Article 18; decisions, the facts available rule and cross-border recognition in Article 20; review and withdrawal in Article 21; customs controls, additional information, suspension, release and refusal in Articles 26 to 30; and the application date of 14 December 2027 in Article 39.
• The recitals of the same Regulation, read directly. Source for the design intent behind the operative articles: the recital explaining that the Commission establishes an indicative and non-exhaustive database of forced labour risks in specific geographic areas or products, made public through the Forced Labour Single Portal, to help operators identify risks in their supply chains; the recital setting out the risk-based approach, under which the Commission and competent authorities weigh the share of the suspected part in the final product, the quantity and volume concerned, the scale and severity of the suspected forced labour, and the complexity of the supply chain, and focus on operators closest to the risk with the highest leverage; and the recital on customs information, which anticipates that operators provide the manufacturer or producer and the product suppliers, with details including name, contact, a unique identification number and, where available, an Economic Operators Registration and Identification number, or the unique identifier of a digital product passport.
• European Commission, single market for goods, the Forced Labour Regulation. Official page confirming that the Regulation applies from 14 December 2027, that a preparedness package including the Forced Labour Single Portal was launched at the end of June 2026, and that the guidelines and the risk database sit among the tools published for operators, competent authorities and customs authorities to use ahead of application.
• Covington and Burling, European Commission Publishes Forced Labour Regulation Guidelines: Key Takeaways for Companies, July 2026. Practitioner analysis, used here for the confirmation that the Commission published its implementation guidelines in June 2026, launched the Single Portal and set out a provisional list of national competent authorities, and for the reading that the guidelines lean on existing due diligence frameworks rather than creating a new one.
• Latham and Watkins, European Commission Publishes Guidelines on the EU Forced Labour Regulation, 2026. Practitioner analysis, used here as corroboration of the June 2026 guidelines and portal, and of the point that the guidelines describe due diligence and supply chain traceability as the practical way an operator reduces the likelihood of an investigation and answers one when it comes.
• Dentons, The Commission publishes new guidelines on the application of the EU Forced Labour Regulation (2024/3015), August 2026. Practitioner analysis, used for the enforcement mechanics: the preliminary phase and the investigation, the role of the risk database and the risk indicators, and the way a decision by one lead competent authority reaches products with the same identification information from the same supply chain across the Union.
• Squire Patton Boggs, EU Forced Labour Regulation: What You Need to Know. Practitioner overview of the Regulation and its timeline, used here for general background on scope, the split of competence between the Commission and member state authorities, and the customs enforcement route, not for anything normative, which is taken from the text itself.

Every normative statement here was read directly from the text of Regulation (EU) 2024/3015, downloaded from EUR-Lex and read article by article rather than through a summary. That covers the subject matter and the no new due diligence duty in Article 1, the definitions in Article 2, the prohibition in Article 3, the competent authorities in Article 5, the risk database in Article 8, the submission point in Article 9, the guidelines in Article 11, the Forced Labour Single Portal in Article 12, the risk-based approach in Article 14, the allocation of investigations in Article 15, the preliminary phase in Article 17, the investigation in Article 18, decisions and their reach in Article 20, review and withdrawal in Article 21, the customs articles 26 to 30 and the application date in Article 39. The June 2026 launch of the portal, the publication of the guidelines and the status of the risk database are drawn from the European Commission single market page and from practitioner analyses published after the launch, which are attributed as such. The names, countries and codes in the worked record are placeholders for shape rather than real data, and nothing in it is a benchmark of any kind. No embedded posts from X appear here, because no public post on this topic could be verified as current, relevant and authentic at the time of writing, and an unverified embed is worse than none. Nothing here is legal advice for a specific organisation, and the obligations that apply to any operator come from the Regulation and its implementing measures as they take effect, not from this article.