Mapping social and environmental due diligence legislation

Annex A. Summary of expectations against six‑step framework

This annex provides a high-level summary of how due diligence expectations set out in legislative measures interact across the OECD six‑step framework, to identify main areas of commonality and divergence. It also draws on official guidance for the UK, Australian and Canadian modern slavery measures, Germany Supply Chain Act, US Tariff Act and Uyghur Forced Labour Prevention Act (CBP, 2022[4]; 2025[8]; Public Safety Canada, 2025[9]; Attorney-General’s Department, 2023[10]; Home Office, 2025[11]; BAFA, n.d[12]; BAFA, 2025[13]). The analysis is not intended to be comprehensive of all legal requirements or provisions set out in these measures.

Table A A.1. Steps 1 – 3

Legislative measures	Step 1: Policies and management systems	Step 2: Identify and assess impacts	Step 3: Cease, prevent, mitigate
Disclosure
UK Modern Slavery Act (2015)	Policies: disclose policies and due diligence processes in relation to modern slavery (Sec.54(5)) Management systems: referenced in guidance Business relationships: referenced in guidance	Scope: guidance refers to high-level risk assessment and then assessing identified risks (4.2) Assess: disclose due diligence processes and steps taken to assess risk (Sec.54(5)) Prioritise: guidance refers to prioritisation on basis of severity and likelihood (4.2)	Prevent/mitigate: disclose due diligence processes and steps taken to manage risk (Sec.54(5)(c, d)) Involvement framework: not addressed
Australia Modern Slavery Act (2018)	Policies: referenced in guidance Management systems: referenced in guidance Business relationships: referenced in guidance	Scope: guidance references initial scoping (mandatory criterion 3) Assess: disclose risks of modern slavery practices in the operations and supply chains; and actions to assess risk (Part 2, 16(c-d)) Prioritise: guidance references prioritisation (mandatory criterion 4)	Prevent/mitigate: describe actions taken to address risk (Part 2, 16(d)) Involvement framework: guidance explains that risks of modern slavery practices means potential for entity to cause, contribute or be directly linked to modern slavery
Canada Fighting Forced Labour in Supply Chains Act (2023)	Policies: disclose policies and due diligence processes in relation to forced labour (Sec.11(3)) Management systems: referenced in guidance Business relationships: not addressed	Scope: not specified Assess: disclose parts of its business and supply chains that carry a risk of forced labour or child labour and steps taken to assess risk (Sec.11(3)(c)) Prioritise: not specified	Prevent/mitigate: disclose steps taken to manage risk (Sec.11(3)(c)) Involvement framework: not addressed
EU Corporate Sustainability Reporting Directive (2023)	Policies: explicit: disclosure of policy (European Sustainability Reporting Standards (ESRS) 2) Management systems: disclosure of how management and supervisory bodies are informed about material risks and impacts (ESRS 2) Business relationships: not addressed	Scope: undertake and disclose materiality assessment based on a “double materiality” lens across the full list of sustainability matters, taking a full value chain perspective (ESRS 1) Assess: disclose risk assessment; methodologies and assumptions employed (ESRS 2) Prioritise: for impact materiality, disclose how entity prioritised based on severity and likelihood (ESRS 2), criteria used, decision making process. High severity negative impacts are automatically material.	Prevent/mitigate: disclose actions (including action plans) to prevent and mitigate (ESRS 2); disclose information related to payment practices (ESRS G1) Involvement framework: reporting to consider impacts entity is involved with through own operations or as a result of its business relationships
Dodd-Frank Act (2010) – Section 1 502 / SEC Final Rule (2012)	Policies: adoption of a Conflict Minerals Policy; disclosure of Annual Conflict Minerals Report (CMR) to the SEC. Management systems: review of management systems and processes as part of the audit of the CMR (p.211).	Scope: not specified Assess: disclose measures taken to exercise due diligence and chain of custody; products manufactured or contracted to be manufactured that are not DRC conflict free; entity that conducted audit; facilities used to process conflict minerals; country of origin (p. 838) Prioritise: not specified but focus on OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas Annex II risks, in relation to DRC and adjoining countries (covered countries)	Prevent/mitigate: disclosure of measures taken to exercise due diligence and chain of custody (p.838) in the “Covered Countries” Involvement framework: not addressed
Due diligence conduct
French Duty of Vigilance Law (2017)	Policies: not addressed, implicitly expected through requirement to publish and implement a vigilance plan Management systems: as above Business relationships: as above	Scope: risk mapping that identifies, analyses and ranks risks in scope (Art.1(4)(1)) Assess: procedures to regularly assess, in accordance with risk mapping, the situation of subsidiaries, subcontractors and suppliers with whom the company maintains an established commercial relationship (Art.1(4)(2)) Prioritise: limited by severity or seriousness	Prevent/mitigate: appropriate action to mitigate risks or prevent serious violations (Art.1(4)(3) Involvement framework: refers to risks resulting directly or indirectly from the operations of the company and the companies it controls, as well as operations of subcontractors or suppliers where there is an established business relationship (Art.1(3))
Norwegian Transparency Act (2021)	Policies: embed responsible business conduct into policies (Sec.4(a)) Management systems: not explicitly required but implicitly required through definition of due diligence Business relationships: not explicitly required but implicitly required through definition of due diligence	Scope: not specified Assess: identify and assess actual and potential adverse impacts on fundamental human rights and decent working conditions (Sec.4(b)) Prioritise: implement suitable measures to cease, prevent or mitigate adverse impacts based on the enterprise’s prioritisation and assessments (Sec.4(c))	Prevent/mitigate: implement suitable measures to cease, prevent or mitigate adverse impacts based on the prioritisations and assessments (Sec.4(c)) Involvement framework: identify and assess risks that entity has either caused, contributed or is directly linked to (Sec.4(b))
German Supply Chain Act (2023)	Policies: issue a policy statement on human rights strategy (Sec.6(2)) Management systems: requires risk management system, determination of person responsible for monitoring system, that senior management seek information about this regularly and that results be communicated to board (Sec.4, 5, 6) Business relationships: contractual assurances from direct suppliers (Sec.6)	Scope: guidance refers to gathering an overview of business area, business relationships in supply chain prior to commencing assessment (4.1; Q2) Assess: appropriate and regular risk analysis (at least yearly) to identify human rights and environmental related risks in own business area and direct suppliers (Sec.5(1)); where there is substantiated knowledge of possible human rights or environmental violation at level of indirect supplier, carry out risk analysis in accordance with Sec.5(1), (Sec.9(3)(1)); ad hoc risk analysis covering both own area of business and direct/indirect suppliers where there are significant changes in business activity or where enterprises must expect a significantly changed or significantly expanded risk situation in the supply chain (Sec.5(4)) Prioritise: identified human rights and environment-related risks must be weighted (separately for own business area and direct suppliers) and prioritised appropriately (Sec.5(2); 9(3)); for appropriateness criteria see Sec.3(2))	Prevent/mitigate: take appropriate preventative measures and remedial action to prevent, end or minimise extent of violation; if violation at direct supplier level cannot be ended in foreseeable future, draw up and implement a concept with a concrete timetable for ending or minimising violation without undue delay (Sec.6(3), 7(1‑2)); adapt risk management system and put in place appropriate preventive measures and implement a cessation concept, where there entity has substantiated knowledge of a violation of a human rights or environment related obligation at level of indirect supplier (Sec.9(2‑3)) Involvement framework: appropriate actions depend on nature of causal contribution of the entity to the risk (Sec.3(2)(4)) Disengagement: temporary suspension while mitigating risk; termination only required for “very serious” violations, where remedy has failed or where entity has no other less severe option and increasing influence has no prospect of success (Sec.7(2‑3))
Swiss Ordinance on Due Diligence (2022)	Policies: required (Art.10, 11) Management systems: not addressed Business relationships: include supply chain policy in contracts and agreements with suppliers (Art.10, 11)	Scope: not specified Assess: identify risks in the supply chain and assess them in their risk management plan (Art.15(1)) Prioritise: assess risks according to the likelihood of occurrence and severity of adverse impacts (Art.15(1))	Prevent/mitigate: identified risks in the supply chain shall be eliminated, prevented or minimised according to their likelihood of occurrence and the severity of the adverse impacts (Art.15(2)) Involvement framework: not addressed
EU CSDDD (2024)	Policies: integrate due diligence into policies and have in place a due diligence policy (Art.7) Management systems: integrate due diligence into risk management systems (Art.7(1)); level of responsibility not specified in CSDDD (but at board/directors’ level according to general corporate governance rules) Business relationships: due diligence policy to include code of conduct applicable to direct and indirect business partners (Art.7(2)); appropriate measures include, where relevant, seeking contractual assurances; terms for SMEs to be “fair, reasonable and non-discriminatory” (Art.10(2)(b), 10(4), 10(5); Art.11(3)(c)), 11(5), 11(6)	Scope: scope operations, those of subsidiaries and, where related to chains of activities, those of business partners, to identify general areas where adverse impacts may occur, based on reasonably available information (Art.8(2)(a)) Assess: based on the results of the scoping, carry out in-depth assessments in areas where adverse impacts are identified to be most likely and severe (Art.8(2)(b)) Prioritise: prioritise adverse impacts based on severity and likelihood (Art.9)	Prevent/mitigate: take appropriate measures to prevent and mitigate potential adverse impacts, bring actual adverse impacts to an end, and minimise extent of impact that cannot be brought to end (Art. 10, 11); includes list of mandatory prevention and mitigation measures, where relevant Involvement framework: addresses impacts caused only by company, caused jointly or caused only by business partner (Art.10, 11) Disengagement: where impacts could not be prevented or mitigated, requirements to suspend business relationship, unless negative effects of suspension exceed those of adverse impacts to be addressed, and take steps to prevent, bring to an end the impacts of suspension and provide reasonable notice to business partner (Arts.10, 11)
EU Batteries Regulation (2023)	Policies: required (Art.48) Management systems: requirement to assign oversight responsibilities to top management (Art.49(1)) Business relationships: incorporate policy, risk measures into contracts and agreements (Art.49)	Scope: no distinct requirement Assess: identify and assess risk of adverse impacts in supply chain, with reference to risks listed in annex (Art.50(1)) Prioritise: no distinct requirement	Prevent/mitigate: design and implement strategy, including risk management plan, to prevent or mitigate or otherwise address adverse impacts (Art.50(1)); assess probability of adverse impacts in risk categories listed in Annex of regulation (Art.50(3)) Involvement framework: situations where entities are “directly linked” are not explicitly addressed but may be inferred through definition of due diligence as including risks by suppliers in the supply chain and references to induced, indirect and cumulative environmental and human rights effects (Art.3(1)(42); Annex X) Disengagement: provides for temporary suspension or for discontinuation after failed attempts at mitigation (Art.50(2)(b)(iii))
EU Conflict Minerals Regulation (2017)	Policies: adopt and communicate policy (Art.4(a, b)) Management systems: structure internal management systems to support supply chain due diligence (Art.4(c)) Business relationships: incorporate policy into contracts and agreements with suppliers (Art.4(d))	Scope: no distinct requirement Assess: identify and assess the risks of adverse impacts in mineral supply chain, consistent with Annex II of the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas (Art.5) Prioritise: not specified, but focus on minerals originating from Conflict-Affected and High-Risk Areas	Prevent/mitigate: implement a strategy to respond to the identified risks to prevent and mitigate adverse impacts (Art.5) Involvement framework: not addressed Disengagement: provides for temporary suspension during mitigation efforts; disengagement after failed attempts at mitigation (Art.5(1)(b)(ii‑iii))
EU Digital Services Act (2022)	Policies: terms and conditions of intermediary service providers shall include information on restrictions in relation to use of information including policies, procedures, measures and tools used for the purpose of content moderation Management systems: establish compliance function with authority, stature, resources and access to the management body of the provider (Art.41) Business relationships: providers of very large online platforms and search engines shall provide recipients with concise summary of terms and conditions (Art.14)	Scope: not specified Assess: providers of very large online platforms and search engines shall identify, analyse and assess systemic risks (Art.34) Prioritise: focus is on systemic risks, taking into consideration severity and probability (Art.34)	Prevent/mitigate: providers of very large online platforms and search engines put in place reasonable, proportionate and effective mitigation measures that are tailored to the specific systemic risks (Art.35) Involvement framework: not addressed
EU AI Act (2024)	Policies: strategy for regulatory compliance as part of quality management system (Art.17(1)(a)) Management systems: for high-risk AI systems, establish and implement a risk management system (Art.9(1‑3)); put in place quality management system (Art.17(1)) Business relationships: not addressed	Scope: for high-risk AI systems, identification and analysis of reasonably foreseeable risks (Art.9) Assess: for high-risk AI systems, estimation and evaluation of risks that may emerge during use and reasonably foreseeable misuse; evaluation of other risks possibly arising (Art.9(2)(a-c); for general-purpose AI with systemic risk, identify and mitigate systemic risks (Art.55) Prioritise: for high-risk AI systems, focus on reasonably foreseeable risks (Art.9(2))	Prevent/mitigate: for high-risk AI systems, adoption of appropriate and targeted risk management measures (Art.9(2(d), 4); measures such that residual risk is judged to be acceptable (Art.9(5)(a-c)); for general-purpose AI with systemic risk, mitigate systemic risk (Art.55); take corrective action following reporting of serious incident (Art.73(6)) Involvement framework: not addressed
Korea AI Basic Act (2025)	Policies: indirectly required through risk management plan (Art.34) Management systems: build monitoring and risk management system (Art.32); ensure human supervision and oversight (Art.34) Business relationships: not addressed	Scope: conduct preliminary assessment to determine whether AI systems qualify as high-impact AI (Art. 33) Assess: implement measures to identify and assess risks at each stage of the AI life cycle (Art. 32); assess in advance impact on human rights for high-impact AI (Art.35) Prioritise: focus is on high-impact or high-risk AI (not defined)	Prevent/mitigate: for AI business operators, where the AI system meets a specified threshold of computing capacity, implement measures to identify, assess and mitigate risks at each stage of the AI lifecycle (Art.32); for high-risk AI, develop and implement a risk management plan and user protection plan (Art. 34) Involvement framework: not addressed
UAE Due Diligence Regulations for Responsible Sourcing of Gold (2022)	Policies: adopt a gold supply chain policy (1.1) Management systems: establish internal governance system to implement due diligence (1.2) Business relationships: integrate policy into contracts and agreements, and strengthen company engagement (1.4)	Scope: not specified Assess: identify and assess risks (2.1) Prioritise: identify potential red flags and conduct enhanced due diligence for high-risk elements (2.2; 2.3)	Prevent/mitigate: evaluate and respond to identified risks through risk management strategy and risk control plan (3.1; 3.2) Involvement framework: not addressed Disengagement: disengage for at least three months where suppliers do not comply with mitigating measures; disengage entirely if controls are not feasible or acceptable (3.2)
Product and market-based measures
US Tariff Act, Section 307 (1930)	Prohibits the import of goods, wares, articles and merchandise mined, produced or manufactured wholly or in part by forced labour; provides for regulations to be made enforcing this provision No direct obligation to conduct due diligence Documentation on due diligence may be considered in enforcement proceedings CBP’s (2025[8]) Withhold Release Order (WRO) and Finding Modification Guide sets out an identify, correct and prevent approach to address forced labour
US Uyghur Forced Labor Prevention Act (2021)	Establishes a rebuttable presumption that the import of goods related to the Xinjiang Uyghur Autonomous Region (XUAR) are prohibited under section 307 of the US Tariff Act (Sec.3(a)) Presumption can be overcome through compliance with official guidance, responding to information requests and through evidence that goods were not produced by forced labour (Sec.3(b)) No direct obligations to conduct due diligence, but due diligence is referred to as part of guidance to be established (Sec.2(d)(6)) Documentation on due diligence may be considered in enforcement proceedings Operational Guidance recommends mapping supply chain, assessing forced labour risk and putting in place internal controls to prevent or mitigate forced labour and remediating forced labour
UK Environment Act (2021)		Scope: identify and obtain information about forest risk commodities (Sch.17, Part 1.3(2)) Assess: assess risk that relevant local laws were not complied with (Sch.17, Part 1.3(2)) Prioritise: not specified	Prevent/mitigate: mitigate risks in relation to forest risk commodities (Sch.17, Part 1, 3(2)) Involvement framework: not addressed
EU Deforestation Regulation (2023)	Policies: have in place adequate policies (Art.11(2)) Management systems: requirement for entities to have in place adequate controls and procedures to manage risks; appointment of compliance officer at management level of non-SME operators (Art.11(2)) Business relationships: not addressed	Scope: not specified Assess: carry out risk assessment on basis of information and documentation (Art.10(1)); option to exercise simplified due diligence in certain instances (Art.13) Prioritise: not specified	Prevent/mitigate: have proportionate policies, controls and procedures in place to mitigate (Art.11); no distinct prevention requirement Involvement framework: not addressed, emphasis is on products being free from deforestation risk rather than on linkage between entity and risk
EU Prohibits Forced Labour Regulation (2024)	Prohibits economic operators from placing and making available on the Union market or exporting from the Union market products made with forced labour (Art.1(1)) No direct obligation to conduct due diligence Documentation of due diligence may be considered during preliminary investigation phase when forced labour is suspected (Art.17). Due diligence in relation to forced labour is defined as incorporating “practices to identify, prevent, mitigate or bring to an end the use of forced labour” (Art.2(3)) Guidance on due diligence and best practice on bringing to an end and remediation forced labour planned (Art.11)

Note 1: Revisions to the European Sustainability Reporting Standards (ESRS) (delegated regulation 2023/2 772 setting out the reporting requirements of the CSRD) are currently ongoing, and this report therefore refers only to reporting provisions covered in both the delegated regulation and the simplified draft submitted to the European Commission in 2025.

Note 2: The term “business relationships” in the first column is used to refer to provisions that expect covered business enterprises to incorporate RBC expectations and policies into their engagement with suppliers and other business relationships (e.g. through contracts, pre‑qualification processes). See Step 1.3 of the RBC Guidance, OECD (2018[2]), OECD Due Diligence Guidance for Responsible Business Conduct, https://doi.org/10.1787/15f5f4b3-en.

Table A A.2. Steps 4 – 6

Legislative measures	Step 4: Track implementation and results	Step 5: Communicate	Step 6: Remediate
Disclosure
UK Modern Slavery Act (2015)	Disclose effectiveness of ensuring slavery and human trafficking is not taking place, measured against performance indicators (Sec.54(5)(f))	Publish modern slavery and human trafficking statement on website; if organisation does not have a website, provide copy of statement to anyone who makes a written request for one (Sec.54(6‑7))	Remediate: guidance refers to disclosure of remediation policies and processes (4.4) Grievance mechanism: guidance refers to disclosure of grievance mechanisms (4.4)
Australia Modern Slavery Act (2018)	Disclose how reporting entity assesses effectiveness (Part 2, 16(e))	Submit annual report, approved by governing body, to government public registry (Sec.12, 18)	Remediate: describe actions taken, including remediation process (Part 2, 16(d)) Grievance mechanism: guidance references grievance mechanisms (mandatory criterion 4)
Canada Fighting Forced Labour in Supply Chains Act (2023)	Disclose how entity assesses effectiveness (Sec.11(3)(g))	Publish annual report, approved by governing body, on website and submit to government registry (Sec.11, 13, 22)	Remediate: disclose measures to remediate forced or child labour; measures to remediate loss of income resulting from measures to eliminate forced or child labour (Sec.11(3((d-e)) Grievance mechanism: guidance references tracking of grievance mechanism cases (Mandatory Information, Requirement G)
EU Corporate Sustainability Reporting Directive (2023)	Disclosure of changes to the material impacts, risks and opportunities compared to previous reporting period (ESRS 2) Disclosure of metrics and tracking of effectiveness (ESRS 2)	Submit sustainability information as part of management report to member state’s Officially Appointed Mechanism and publish on website (Art.29g(1))	Remediate: requirement to describe policies and actions taken to remediate adverse impacts (ESRS 2) Grievance mechanism: requirement to disclose whether it has grievance mechanisms for own workforce, value chain workers, affected communities, consumers and end users (ESRS S1‑S4)
Dodd-Frank Act (2010) – Section 1 502 / SEC Final Rule (2012)		Submit Annual Conflict Minerals Report (CMR) to the Security Exchanges Commission (SEC) (p. 838)
Due diligence conduct
French Duty of Vigilance Law (2017)	Monitoring scheme to follow measures implemented and assess efficiency (Art.1(4(5))	Vigilance plan and implementation report to be publicly disclosed (Art.1(5))	Remediate: not specified, however judicial enforcement could lead to provision of remedy Grievance mechanism: alert mechanism that collects reporting of existing or actual risks (Art.1(4)(4))
Norwegian Transparency Act (2021)	Track the implementation and results of measures (Sec.4(d))	Publish an account of due diligence (Sec.5)	Remediate: provide for or co‑operate in remediation and compensation where required (Sec.4(f)) Grievance mechanism: any person has the right to information from an enterprise regarding how the enterprise addresses actual and potential adverse impacts; information shall be provided in reasonable time (Sec.6, 7)
German Supply Chain Act (2023)	Effectiveness of remedial action must be reviewed once a year, or on an ad hoc basis if there are a significant changes (Sec.7(4))	Annual report on due diligence made publicly available for free on website (Sec.10(2))	Remediate: if violation has occurred or is imminent, take appropriate remedial action to prevent, end or minimise its extent of this violation (Sec.7(1)) Grievance mechanism: ensure appropriate internal complaints procedure is in place (Sec.8(1), 9(1))
Swiss Ordinance on Due Diligence (2022)	Evaluate results of measures; regularly review effectiveness (Art.10(1)(d); 11(1(d); 14(2))	Prepare a consolidated report for those entities preparing consolidated financial statements (Art.17)	Remediate: not specified Grievance mechanism: establish early-warning mechanism for risk identification; reporting procedure that allows all interested parties to raise reasonable concerns (Art.14)
EU CSDDD (2024)	Periodic assessments of implementation, adequacy and effectiveness of measures to identify and address adverse impacts at least every 5 years Ad hoc assessments if a significant change occurs and whenever there are reasonable grounds to believe that the measures are no longer adequate or effective, or that new risks of the occurrence of impacts have arisen or may arise (Art. 15)	Publish annual statement on website; entities in scope of the CSRD are exempted from this reporting requirement (Art.16) For companies not in scope of CSRD: reporting guidance foreseen to align with ESRS as appropriate (Art.16)	Remediate: required where company has caused or jointly caused an adverse impact; company may provide voluntary remediation where adverse impact caused by business partner (Art.12). Grievance mechanism: requires entities to establish procedure for listed persons and entities to submit complaints where they have “legitimate concerns” (Art.14(1))
EU Batteries Regulation (2023)	Requirement to monitor and track performance of risk-mitigation efforts (Art.50(1)(b)(iii))	Publish an annual report on due diligence policy that identifies the batteries concerned, the data and information on steps taken to comply with the due diligence requirements of the regulation, summary of verification report, and other information set out in article where relevant (Art.52(3))	Remediate: requirement for grievance mechanism (including remediation) to be provided for either through direct provision, collaboration with other operators or facilitation of recourse to external body (Art.49(1)(f)) Grievance mechanism: requirement for grievance mechanism as above, includes early-warning risk-awareness system
EU Conflict Minerals Regulation (2017)	Monitor and track performance of risk-mitigation efforts; report back to senior management (Art.5(b)(iii))	Publicly report on supply chain due diligence policies and practices for responsible sourcing (Art.7(3))	Remediate: not specified Grievance mechanism: establish a grievance mechanism as an early-warning risk-awareness system or provide such mechanism through collaborative arrangements; recourse to external body (Art.4(e))
EU Digital Services Act (2022)	Very Large Online Platforms required to undertake independent audit of risk assessment and mitigation measures (Art.37) Compliance function will monitor compliance and ensure risks are identified and reported on, and that effective risk-mitigation measures are taken (Art.41)	Providers shall make publicly available at least annually a comprehensible report on any content moderation that they engaged in (Art.15; 42)
EU AI Act (2024)	Keep track of, document and report relevant information to AI Office as appropriate (Art.55(1)(c)) Testing of high-risk AI Systems to identify most appropriate and targeted risk management (Art.9(6‑7), 60) Establish and document a post-market monitoring system (Art.72)	Requirements for transparency and provision of information to deployers (Art.13) Draw up and keep up-to-date the technical documentation of the model; report relevant information to AI Office (Art.53(1)(a); 55(1)(c))
Korea AI Basic Act (2025)	Build a monitoring and risk management system (Art.32)
UAE Due Diligence Regulations for Responsible Sourcing of Gold (2022)	Review results of mitigation measures on regular basis; carry out ongoing risk monitoring; assess if further measures are required (3.2; 3.3)	Submit Comprehensive Management Report, including disclosure of information on management systems, risk identification and assessment, and risk management (5)	Remediate: not specified Grievance mechanism: implement a grievance mechanism (1.5)
Product and market-based measures
US Tariff Act, Section 307 (1930)	Prohibits the import of goods, wares, articles and merchandise mined, produced, or manufactured wholly or in part by forced labour; provides for regulations to be made enforcing this provision No direct obligation to conduct due diligence CBP’s (2025[8]) WRO and Finding Modification Guide sets out an identify, correct and prevent approach to address forced labour
US Uyghur Forced Labor Prevention Act (2021)	Establishes a rebuttable presumption that the import of goods related to the XUAR are prohibited under section 307 of the US Tariff Act (Sec.3(a)) Presumption can be overcome through compliance with official guidance, responding to information requests and through evidence that goods were not produced by forced labour (Sec.3(b)) No direct obligation to conduct due diligence, but due diligence is referred to as part of guidance to be established (Sec.2(d)(6)) Operational Guidance recommends mapping supply chain, assessing forced labour risk and putting in place internal controls to prevent or mitigate forced labour and remediating forced labour
UK Environment Act (2021)		Prepare an annual report on actions taken to implement due diligence system (Sch.17. Part 1, 4)
EU Deforestation Regulation (2023)	Requirement to review risk assessments and risk mitigation, and due diligence system annually; update in response to new developments (Art.10(4); Art.11(3); Art,12(2))	Annual public reporting of due diligence system (Art.12(3))
EU Forced Labour Regulation (2024)	Prohibits economic operators from placing and making available on the Union market or exporting from the Union market products made with forced labour (Art.1(1)) No direct obligation to conduct due diligence Due diligence in relation to forced labour is defined as incorporating “practices to identify, prevent, mitigate or bring to an end the use of forced labour” (Art.2(3)) Documentation of due diligence may be considered during preliminary investigation phase when forced labour is suspected (Art.17)

Note: Revisions to the European Sustainability Reporting Standards (ESRS) (delegated regulation 2023/2 772 setting out the reporting requirements of the CSRD) are currently ongoing and this report therefore refers only to reporting provisions covered in both the delegated regulation and the simplified draft submitted to the European Commission in 2025.