Quick Read

The EU Forced Labour Regulation (2024/3015) prohibits placing, making available, or exporting products made wholly or partly with forced labour on the EU market, applying to all economic operators regardless of size or sector, with full enforcement beginning December 2027. Unlike due diligence legislation, the FLR operates through product-level investigation and consequence rather than mandating an ongoing governance process, though the European Commission has pointed organizations toward the OECD's six-step due diligence framework as the reference structure for demonstrating credible practice. Speeki's Due Diligence Management System Standard (SPK DDMS2000:2026) and Speeki Sentinel provide a certifiable framework for operationalizing the governance and supply chain controls needed to comply with the Regulation's market-access prohibition.

Executive Summary

Regulation (EU) 2024/3015 — the Forced Labour Regulation (FLR) — introduces a market-access prohibition unlike anything else in the EU's recent sustainability and governance legislation. Rather than imposing an ongoing due diligence obligation on defined categories of company, it bans a specific outcome: placing, making available, or exporting products made wholly or partly with forced labour, applied to any economic operator regardless of size, sector, or location.

The Regulation entered into force in December 2024 and applies in full from 14 December 2027. Member states must notify the European Commission of national penalty frameworks by 14 December 2026. The Commission published its first substantive interpretive guidance on 30 June 2026, pointing organizations toward the OECD's six-step due diligence framework as the reference structure for demonstrating credible practice, without making that framework a binding legal requirement.

This paper sets out the legal mechanism, its scope, its relationship to adjacent instruments such as the CSDDD, and the operational implications for organizations placing products on or exporting from the EU market. It closes by mapping the Commission's expectations against SPK DDMS2000:2026, Speeki's Due Diligence Management System Standard, and Speeki Sentinel, the certifiable system organizations can adopt to operationalize that standard.

1. What the Regulation Actually Does

The FLR's operative rule is narrow and severe: products made wholly or partly using forced labour may not be placed on the EU market, made available on the EU market, or exported from the EU. There is no reporting obligation attached to this rule, no annual disclosure requirement in the manner of CSRD, and — critically — no due diligence process mandated by the text of the law itself. Article 1(3) is explicit that the Regulation does not create new due diligence obligations.

Instead, the FLR operates through investigation and product-level consequence. A competent authority — a national authority where the risk is linked to activity within a member state, or the European Commission where the risk originates outside the EU — may open an investigation where a substantiated concern exists that forced labour has been used somewhere in a product's supply chain. Where forced labour is confirmed, the consequence attaches to the product itself: withdrawal from the market, recall from distribution, and a block on further placement or export. Existing stock must be disposed of, or, where remediation of the offending component is feasible, brought into compliance before re-entry.

This is a materially different liability model from due diligence legislation. A company can maintain excellent governance and still have a specific product pulled from the market if forced labour is found in its supply chain, because the ban follows the product rather than the adequacy of a company's process. Conversely, as later sections set out, the adequacy of that process still matters enormously — both in whether an investigation is opened at all, and in how any penalty is calculated once a violation is confirmed.

2. Scope: No Threshold, No Exemption

The Regulation applies to any 'economic operator' — a term drawn broadly enough to capture any natural or legal person that places a product on the EU market, makes it available on that market, or exports it from the EU, in the course of a commercial activity. There is no minimum size, turnover, or headcount threshold, and no sector carve-out.

This places the FLR in a different category from most recent EU sustainability legislation. The CSDDD, even before the Omnibus I package narrowed its scope further, applies only to large companies above defined employee and turnover thresholds. CSRD phases in by company size and listing status. The FLR does neither. A small importer bringing a single shipment of components into an EU port carries the same legal exposure as a multinational manufacturer selling finished goods across twenty member states.

Geographic scope is equally broad. The Regulation is not limited to EU-domiciled companies: a manufacturer based outside the EU that exports into the Union market is squarely within scope, as is a non-EU company using the EU as a re-export hub. Sector coverage is unrestricted — every product category placed on or exported from the EU market falls within the same prohibition, in contrast to instruments like conflict minerals regulation that target specific commodities.

The practical implication is that 'we are too small' or 'this is not a high-risk sector for us' are not defensible positions once the Regulation applies in full. The Commission's risk-based enforcement approach will naturally concentrate early investigations on higher-risk geographies and product categories, using the forced labour risk database once operational, but legal exposure itself is universal.

3. Distinguishing the FLR from the CSDDD

Because both instruments touch supply chains and human rights, they are frequently conflated — a mistake that leads organizations to either over-build in the wrong place or leave a genuine gap uncovered.

The CSDDD is a due diligence obligation: in-scope companies must run an ongoing process to identify, prevent, mitigate, and account for adverse human rights and environmental impacts across their own operations and chain of activities, with civil liability attached to failure. It is thresholded by size and turnover, and — following Omnibus I — those thresholds were raised and the effective application date pushed to 2029.

The FLR creates no such ongoing procedural obligation. It is a market-access ban triggered by a factual finding, with no size threshold, applying in full from December 2027 — two years ahead of the CSDDD's revised timeline. Liability under the FLR attaches to the product, independent of whether the company had a due diligence programme in place, though a demonstrated programme materially affects how an investigation proceeds and how penalties are calculated.

Organizations that are below the CSDDD's size threshold, and therefore not required to build a CSDDD-compliant programme, remain fully exposed under the FLR. The two instruments need to be tracked and resourced separately, even where they draw on a shared evidentiary base — an organization preparing for CSDDD compliance by 2029 should not assume that work covers FLR exposure that begins in 2027.

4. Due Diligence as Unwritten Expectation

The most commercially significant feature of the FLR is one the text of the law does not state directly: while no due diligence obligation is imposed, having a credible due diligence system materially changes an organization's position at two distinct points in the process.

First, at the investigation-trigger stage. When a competent authority assesses whether a 'substantiated concern' exists sufficient to open a formal investigation, evidence of a functioning due diligence system — one that identifies, assesses, and addresses forced labour risk in a structured, ongoing way — is a relevant factor in that assessment.

Second, at the penalty-calculation stage, where the Commission's June 2026 guidance sets out a methodology built around the gravity and duration of a confirmed violation, plus aggravating and mitigating factors, with the specific numeric formula left to individual member states. A demonstrable due diligence effort functions as a mitigating factor even where it did not prevent the underlying finding.

The reference structure the Commission's guidance points organizations toward is the OECD's six-step due diligence framework: embedding due diligence into policy and management systems; identifying and assessing adverse impacts; ceasing, preventing, or mitigating those impacts; tracking implementation and results; communicating externally how impacts are addressed; and providing for or cooperating in remediation. None of this is written into the Regulation itself — it is soft guidance layered on top of a hard law that otherwise prescribes almost no process.

5. The June 2026 Guidelines and Remaining Gaps

On 30 June 2026, the Commission published its Guidelines on the Forced Labour Regulation alongside an online information portal, together with a provisional list of national competent authorities that remains subject to change as member states finalize their institutional arrangements.

Several elements remain unresolved even after this guidance. The forced labour risk database — intended to give companies and authorities a shared reference point on high-risk geographies, sectors, and products — remains under development with no confirmed launch date. The evidentiary threshold constituting a 'substantiated concern' sufficient to trigger an investigation is not defined in operational terms; organizations must infer, from the OECD-framework reference and general enforcement principles, what a credible risk assessment needs to demonstrate.

There is an external dimension adding urgency to closing these gaps: the United States is conducting an active Section 301 investigation examining whether trading partners — including EU member states, among roughly sixty economies under review — adequately block forced-labour-linked imports, with potential tariffs of up to 12.5% attached to that assessment. This creates institutional incentive on the EU side to demonstrate a credible enforcement architecture ahead of full application.

6. How an Investigation Unfolds

Jurisdiction splits geographically: national competent authorities lead where the forced labour risk is linked to activity within a member state; the Commission leads where the risk originates outside the EU, reflecting the limited practical reach of national authorities into supply chains that never touch EU territory until the finished product arrives. A 'Union Network Against Forced Labour Products' coordinates activity across member state authorities and the Commission to prevent duplicated investigations and inconsistent enforcement.

Investigations are triggered by a substantiated concern, built from complaints, risk indicators, and, once operational, the forced labour risk database. Once opened, the investigating authority gathers information from the economic operator and potentially from other points along the supply chain — the stage at which existing due diligence records become operationally decisive.

Where forced labour is confirmed, the consequence is product-specific — withdrawal, recall, and a block on further placement or export, with disposal or remediation required for existing stock. Customs authorities sit at the operational front line, empowered to block products at the EU's external border. Penalties, calculated under the gravity/duration/mitigating-factors methodology, sit on top of the product consequence.

7. Remediation Is Not Disengagement

The Commission's guidance draws an explicit distinction between disengagement — ending a supplier relationship where forced labour is found — and remediation, which means providing for or cooperating in remedy for the affected individuals themselves: back payment of wages, return of confiscated documents, safe repatriation where relevant, or other appropriate restitution.

Disengagement alone resolves a company's own market exposure while leaving the underlying harm to workers untouched. The guidance frames 'responsible disengagement' as the standard where a relationship does need to end — conducted so as not to cause additional harm through sudden loss of livelihood, and ideally in parallel with, not instead of, remediation for the period during which harm occurred.

This has direct implications for system design. A supplier de-listing workflow and an affected-persons remediation process are not the same activity, and treating them as one often means remediation is quietly skipped once the commercial relationship ends. Any due diligence management system built with FLR exposure in mind needs remediation for affected persons as a standalone, auditable requirement.

8. Penalties and the December 2026 Deadline

Member states must notify the Commission of national penalty rules by 14 December 2026 — a full year ahead of the Regulation's full application on 14 December 2027. This sequencing gives the Commission time to review member state approaches for consistency before enforcement begins, and gives organizations a concrete, dated signal of how seriously each jurisdiction is treating the Regulation.

Penalty frameworks are expected to reflect gravity, duration, and aggravating or mitigating factors, with the specific calculation left to national law. This means the financial consequence of a violation may vary meaningfully across member states for what is, in substance, the same underlying violation — a relevant consideration for organizations operating across multiple jurisdictions.

For compliance planning, the practical takeaway is to track the December 2026 deadline independently of the 2027 application date. That is when the financial stakes of non-compliance become concrete and jurisdiction-specific, well ahead of full enforcement.

9. Operationalizing Readiness: SPK DDMS2000:2026 and Speeki Sentinel

The FLR's structure — a strict, product-level ban paired with non-binding but consequential guidance on process — leaves organizations needing a defensible due diligence system without a prescriptive legal template to build it from. SPK DDMS2000:2026, Speeki's Due Diligence Management System Standard, is designed to close exactly this gap: a certifiable management system standard structured around risk-tiered due diligence across subject categories, including supply chain, labour, and third-party relationships relevant to forced labour exposure.

DDMS2000:2026's planning clauses require organizations to translate inherent risk factors — geography, sector, transaction and relationship value, red-flag indicators, and prior adverse findings — into a defined due diligence tier per subject, then to plan concrete actions calibrated to that tier. This mirrors the risk-based logic the Commission's own guidance describes, while giving it an auditable, evidenced structure rather than leaving it to internal judgement alone.

The standard's subject-specific modules address the distinct due diligence contexts relevant to FLR exposure — counterparties, sites, facilities, and vendors — with tiering criteria calibrated to each context rather than a single undifferentiated risk score. An Applicable Obligations Register requires organizations to document, on a governed and auditable basis, which legal obligations apply to their operations — including instruments like the FLR — rather than leaving that determination implicit.

Speeki Sentinel™ is the certifiable system organizations can adopt to operationalize a DDMS2000-conformant due diligence management system. Adoption of Speeki Sentinel™ and certification against DDMS2000 are each optional and independent of one another: an organization may adopt the standard, adopt Sentinel, both, or neither, and may seek certification at any stage. Speeki does not operate due diligence on behalf of any client, whether or not that client uses Sentinel™ — due diligence execution remains the client's own function. This separation is structural, not incidental: it is what preserves Speeki's independence as a certification body, and what makes a Speeki certification a credible, independent signal to a regulator rather than a self-assessment.

For organizations preparing for FLR exposure ahead of the December 2027 application date, that independent signal is the practical value: a DDMS2000-certified due diligence management system gives an investigating authority a documented, auditable, third-party-verified basis for assessing whether a substantiated concern should proceed to investigation, and gives the organization itself a mitigating-factor case that exists as evidence rather than assertion.

10. Conclusion

The EU Forced Labour Regulation is a law with a narrow legal text and a wide practical footprint. It imposes no due diligence obligation, yet makes the presence and quality of a due diligence system decisive in how investigations open and how penalties land. With member state penalty frameworks due by December 2026 and full application from December 2027, organizations placing products on or exporting from the EU market have a defined but narrowing window to build and evidence that system.

SPK DDMS2000:2026 and Speeki Sentinel™ exist to give that system a certifiable, auditable structure, built for the risk-based logic the Commission's own guidance describes. Speeki is an accredited certification body providing independent assurance and certification of due diligence management systems, including against SPK DDMS2000:2026. Current accreditation scope and certification details are available at speeki.com.