Between 2025 and 2027, a wave of major EU regulations are reshaping how companies manage their supply chains. If your business imports goods into the EU, sources raw materials from global suppliers or simply places packaging on the European market, you are affected.

The challenge is not any single regulation. The EU Deforestation Regulation (EUDR), Corporate Sustainability Reporting Directive (CSRD), Corporate Sustainability Due Diligence Directive (CSDDD), Carbon Border Adjustment Mechanism (CBAM), Packaging and Packaging Waste Regulation (PPWR) and Scope 1, 2 and 3 emissions calculations all demand supply chain data. And their enforcement windows overlap.

The good news: much of the underlying data these regulations require is the same. Geolocation data, embedded emissions, supplier risk assessments and traceability records feed multiple compliance obligations simultaneously. The companies that recognize this - and centralize their data collection - will spend less time duplicating work and more time building resilient supply chains.

This article maps each regulation's supply chain requirements, explains where they overlap and outlines what your procurement and sustainability teams need to do first.

EU supply chain regulations and obligations at a glance

The following six regulations and obligations each place distinct demands on your supply chain. Different data, different deadlines, different teams responsible. But they share a common thread: all of them require visibility into what happens upstream of your business.

EUDR - Deforestation-linked commodities

• Who it applies to: Operators and traders placing covered products on the EU market
• Key supply chain deadline: December 30, 2026 (large/medium); June 30, 2027 (micro/small)

CSRD - Sustainability reporting (incl. value chain)

• Who it applies to: EU companies with 1,000+ employees AND over 450 million euro turnover
• Key supply chain deadline: Wave 2 reporters: 2028 (FY2027)

CSDDD - Human rights and environmental due diligence

• Who it applies to: EU companies with 5,000+ employees AND over 1.5 billion euro turnover
• Key supply chain deadline: Transposition by July 26, 2028; application from July 2029

CBAM - Carbon embedded in imported goods

• Who it applies to: Importers of iron, steel, aluminum, cement, fertilizers, hydrogen, electricity
• Key supply chain deadline: Definitive phase started January 1, 2026; first declaration due September 30, 2027

PPWR - Packaging sustainability and waste reduction

• Who it applies to: All companies placing packaging on the EU market (all sizes, all sectors)
• Key supply chain deadline: August 12, 2026 (first set of requirements)

Scope 1, 2 and 3 emissions - Corporate greenhouse gas footprint

• Who it applies to: All companies reporting under CSRD and SBTi; increasingly required by investors and buyers
• Key supply chain deadline: Dependent on reporting reasons

What does the EUDR require from your supply chain?

The EU Deforestation Regulation (EUDR) requires companies to prove that seven commodities - cattle, cocoa, coffee, oil palm, rubber, soy and timber - and their derived products (leather, chocolate, furniture, paper and more) were not produced on land deforested after December 31, 2020.

Supply chain obligation: Operators and traders placing these products on the EU market must collect GPS coordinates at plot or farm level, verify the country of origin and harvest date, complete a three-step due diligence process and submit deforestation-free declarations via the EU Information System.

The enforcement deadline for large and medium operators is December 30, 2026. Micro and small operators have until June 30, 2027. The European Commission is also required to deliver a simplification review by April 30, 2026, which is expected to deliver mainly practical clarifications.

For a full breakdown of what EUDR means for your operations, read What is EUDR.

What does CSRD require from your supply chain?

The Corporate Sustainability Reporting Directive (CSRD) is the EU's framework for mandatory sustainability reporting. CSRD requires in-scope companies to disclose sustainability performance across their entire value chain using the European Sustainability Reporting Standards (ESRS).

Following the adoption of the Omnibus I Directive (EU) 2026/470 in February 2026, CSRD thresholds have been raised significantly. Sustainability reporting now applies only to EU companies with more than 1,000 employees and 450 million euro in net annual turnover. This reduces the number of companies in scope by roughly 90%.

Supply chain obligation: In-scope companies must collect Scope 3 emissions data from suppliers, conduct a double materiality assessment covering value chain impacts and report under ESRS, including standards like ESRS E1 (climate change), ESRS E4 (biodiversity) and ESRS S2 (workers in the value chain). Companies with fewer than 1,000 employees are protected by a "value chain cap" and cannot be required to provide data beyond voluntary SME standards (VSME).

Wave 1 companies (former NFRD reporters) started reporting on FY2024 data in 2025. Wave 2 reporters will now, under the revised timeline, report in 2028, covering FY2027.

With the November 2025 updates to the ESRS data points, understanding responsibilities is important. Read the amended ESRS overview to get started.

{{custom-cta}}

What does the CSDDD require from your supply chain?

The Corporate Sustainability Due Diligence Directive (CSDDD) requires large companies to identify, prevent and mitigate adverse human rights and environmental impacts across their value chain. CSDDD is a risk-based due diligence obligation that goes beyond disclosure - it demands action. In other words, where a regulation like CSRD only requires a report on negative impacts, CSDDD requires companies to mitigate them.

Supply chain obligation: In-scope companies must conduct risk-based due diligence on Tier 1 suppliers, identify and address actual or potential adverse human rights and environmental impacts, implement corrective action plans where risks are found and embed sustainability clauses into supplier contracts. A two-step scoping process requires companies to first identify general risk areas, then assess specific impacts at the business partner level.

Post-Omnibus thresholds apply to EU companies with more than 5,000 employees and 1.5 billion euro in net worldwide turnover. Non-EU companies generating 1.5 billion euro or more in revenue within the EU are also in scope. The requirement to adopt and implement a climate transition plan has been removed from CSDDD, though CSRD requirements to disclose transition plans (where a company has one) remain.

EU member states must transpose the directive by July 26, 2028, with application beginning from July 2029 for the largest companies. Penalties for non-compliance are capped at 3% of net worldwide turnover.

What does CBAM require from your supply chain?

The Carbon Border Adjustment Mechanism (CBAM) is a carbon pricing tool that applies to imports of iron, steel, aluminum, cement, fertilizers, hydrogen and electricity into the EU. CBAM prices the embedded carbon in these goods to level the playing field between EU producers (who pay for emissions under the EU Emissions Trading System) and importers.

The definitive phase began on January 1, 2026. Importers must register as authorized CBAM declarants - the application deadline is March 31, 2026.

Supply chain obligation: Importers must collect verified embedded emissions data for all in-scope goods at the installation level, using either actual verified values or EU default values. Production routes and energy sources at each facility must be documented. Third-party verification is mandatory when reporting actual emissions. No certificate purchases are required in 2026, but imports made this year generate financial liability. CBAM certificate sales begin on February 1, 2027, with the first annual CBAM declaration and certificate surrender due by September 30, 2027.

A de minimis exemption applies: importers bringing in 50 tonnes or less of CBAM-covered goods annually are exempt from all CBAM obligations. This covers around 90% of importers but only about 1% of covered emissions. Non-compliance carries a penalty of 100 euro per excess tonne of CO2.

For a practical look at how CBAM affects your import costs, use our CBAM cost calculator.

What does PPWR require from your supply chain?

The Packaging and Packaging Waste Regulation (PPWR) - Regulation (EU) 2025/40 - is a directly applicable EU regulation that replaces the former Packaging Directive. PPWR establishes uniform rules for all packaging placed on the EU market, regardless of material, sector or company size.

Most provisions become legally binding on August 12, 2026.

Supply chain obligation: All economic operators placing packaging on the EU market must ensure packaging complies with strict design and minimization requirements - double walls, false bottoms and unnecessary layers are prohibited. PFAS (per- and polyfluoroalkyl substances) in food-contact packaging are banned. Manufacturers must perform conformity assessments, issue declarations of conformity and maintain technical documentation. Importers must verify these declarations exist before importing. Further requirements - including mandatory recycled content targets, harmonized labeling and reuse systems - will be phased in between 2028 and 2040.

There is no general exemption for small companies. All economic operators placing packaging on the EU market must comply, including manufacturers, importers, distributors and online marketplaces.

What do Scope 1, 2 and 3 emissions require from your supply chain?

Scope 1, 2 and 3 emissions are the three categories defined by the Greenhouse Gas (GHG) Protocol to classify corporate greenhouse gas emissions.

Scope 1 covers direct emissions from sources a company owns or controls (fuel combustion, company vehicles, on-site processes). Scope 2 covers indirect emissions from purchased electricity, heating or cooling.

Scope 3 covers all other indirect emissions across the value chain - both upstream (suppliers, purchased goods, logistics) and downstream (product use, end-of-life treatment).

Supply chain obligation: Under the GHG Protocol, companies must account for emissions across all 15 Scope 3 categories. The supplier-specific approach produces the most accurate results, using primary data collected directly from suppliers on energy consumption, fuel use and production processes. Most companies start with spend-based estimates for lower-impact categories and prioritize collecting primary data from their highest-volume suppliers first.

The practical challenge: Scope 1 and 2 are relatively straightforward to measure from internal data. Scope 3 is not. It requires supplier-level data - energy consumption, fuel use, production methods, transport distances - that many companies still collect manually through surveys, spreadsheets and disconnected tools. Companies starting their Scope 3 journey typically begin with spend-based calculations for Category 1 (purchased goods and services) and gradually transition to supplier-specific primary data for their highest-impact categories.

How do these regulations overlap - and where does your data work twice?

This is where supply chain compliance gets strategic. Several of these regulations require similar underlying data - and companies that recognize the overlaps can consolidate collection efforts, reduce supplier fatigue and save time.

Geolocation and commodity traceability (EUDR + CSRD + CSDDD)

• Plot-level data collected for EUDR feeds biodiversity disclosures under ESRS E4 and supports environmental risk assessments required by CSDDD.

Embedded emissions and Scope 3 data (CBAM + CSRD + GHG Protocol)

• CBAM requires embedded emissions per tonne of imported goods. CSRD requires Scope 3 data across your supplier base under ESRS E1. Both draw from the same supplier-level emissions collection process.

Supply chain due diligence and risk assessments (all six regulations)

• Every regulation in this article requires some form of supplier verification, risk assessment or data collection. A single supplier engagement survey can serve all six obligations at once.

Packaging composition and material data (PPWR + CSRD)

• Recycled content and material composition data collected for PPWR compliance supports circular economy disclosures under ESRS E5.

The practical takeaway: compliance is not six separate workstreams. Treating it as one data challenge - with a centralized supplier engagement process - reduces duplication and makes the entire effort more manageable.

What data do you need to collect from your suppliers?

Below is a consolidated checklist of the supplier data each regulation requires. Use it to map your current data gaps and prioritize outreach.

For EUDR

• GPS coordinates or geolocation polygons at plot/farm level
• Country of origin and harvest date
• Proof of deforestation-free status
• Data for the risk assessment at local and national level

For CSRD (Scope 3 / value chain)

• Primary emissions data from key suppliers (energy consumption, fuel use)
• Spend-based or activity-based data for Tier 1 suppliers
• Supplier sustainability certifications (ISO 14001, FSC, etc.)
• Evidence to back up claims that negative or positive impacts are being worked on

For CSDDD

• Supplier self-assessment questionnaires on human rights and environmental practices
• Evidence of corrective action plans where risks are identified
• Contracts with sustainability clauses covering Tier 1 suppliers

For CBAM

• Actual embedded emissions per tonne of goods (preferred) or EU default values
• Production routes and energy sources used at the facility
• Third-party verification where actual values are reported

For PPWR

• Packaging material composition and recycled content percentage
• Recyclability test results and classification
• Declaration of conformity and technical documentation

For Scope 1, 2 and 3 emissions calculations

• Scope 1 data: Fuel consumption, process emissions, refrigerant use from owned or controlled sources
• Scope 2 data: Purchased electricity, heating, cooling and steam consumption (both location-based and market-based)
• Scope 3 data: Supplier-specific emissions factors, energy mix at production facilities, transport distances and modes, waste treatment methods and product use-phase energy consumption
• Supporting documentation: Emission factor sources, calculation methodology, percentage of primary vs. estimated data

How does software help you manage multi-regulation supply chain compliance?

The most common pattern across companies preparing for these regulations: different teams collecting similar data in separate spreadsheets, email threads and disconnected tools. Procurement tracks supplier origins for EUDR. The sustainability team gathers Scope 3 data for CSRD. Trade compliance handles CBAM emissions reporting. The result is duplicated supplier requests, inconsistent data and gaps that only surface at audit time.

Centralized supply chain compliance software solves this by connecting data collection, due diligence workflows and reporting into a single platform. At Coolset, this means EUDR shipment tracking with geolocation data collection and deforestation-free statement generation, certified Scope 1, 2 and 3 emissions measurement with supplier-level granularity connected to relevant ESRS datapoints and PPWR packaging compliance tracking.

The goal is practical: ask your suppliers once, use the data across every regulation that needs it and maintain an audit-ready trail.

Want to see how it works? Request a personalized walkthrough to see how Coolset can help you stay ahead of multi-regulation compliance.

{{product-tour-injectable}}

FAQ

Which EU regulations apply to my supply chain?

It depends on your industry, company size and the goods you import or sell. PPWR applies to all companies placing packaging on the EU market. EUDR applies to seven specific commodities and their derivatives. CSRD, CSDDD and CBAM each have turnover and employee thresholds.

What is the difference between EUDR and CSDDD?

EUDR targets deforestation risk for seven commodities and requires plot-level geolocation data. CSDDD is a broader human rights and environmental due diligence obligation covering a company's entire value chain. Both require supplier engagement, but EUDR is commodity-specific while CSDDD is risk-based across all sectors.

What is the difference between CSRD and CSDDD?

CSRD is a reporting directive - it requires companies to disclose sustainability data under ESRS, including value chain impacts. CSDDD is an action directive - it requires companies to identify, prevent and mitigate adverse impacts in their supply chain. CSRD tells you what to report. CSDDD tells you what to do about it.

Do CSRD and CBAM require the same emissions data?

Partly. CBAM requires embedded emissions data for specific imported goods (steel, aluminum, cement, fertilizers, hydrogen, electricity). CSRD requires Scope 3 Category 1 data across your full supplier base. The data collection processes overlap significantly - aligning your Scope 3 and CBAM workflows reduces duplication.

When do CBAM certificate payments start?

CBAM certificate sales open on February 1, 2027. The first annual CBAM declaration and certificate surrender is due by September 30, 2027, covering emissions from 2026 imports. No certificate purchases are required during 2026, but imports made in 2026 generate the financial liability.

Why is Scope 3 the hardest part of emissions reporting?

Scope 3 covers all indirect emissions across your value chain - from raw material extraction to product end-of-life. It often represents 70-90% of a company's total footprint but relies on supplier data that companies do not directly control. Most companies start with spend-based estimates and gradually transition to primary data from their highest-impact suppliers.