The definitive phase of the Carbon Border Adjustment Mechanism (CBAM) began on 1 January 2026. The EU Deforestation Regulation (EUDR) will apply from 30 December 2026 for large and medium operators and traders, and the amended Corporate Sustainability Due Diligence Directive (CSDDD) must be transposed by 26 July 2028 with application from 26 July 2029. T

These regulatory frameworks increasingly affect overlapping supply chains, creating new demands for supplier information, traceability and documentation. Traditional procurement systems may not be equipped to manage the different types of evidence required, from installation-level emissions data under CBAM to plot-level geolocation information under EUDR.

For EU manufacturers and importers, supplier lifecycle management is therefore becoming more than a procurement discipline. It is an important part of managing regulatory compliance and supply chain risk.

The five phases of supplier lifecycle management are qualification, onboarding, data collection, performance monitoring and offboarding and provide a practical framework for managing these responsibilities. When connected through a consistent supplier record, they help businesses organise information, reduce duplicate data requests and maintain a clearer audit trail. Without this structure, the same supplier may be assessed multiple times, information may be collected inconsistently, and important evidence may become difficult to retrieve during an audit or assurance review.

‍

Why 2026 breaks the procurement-led approach to supplier compliance

Traditional procurement processes were primarily designed to manage commercial relationships. Supplier master records typically contain information about payment terms, lead times, contractual arrangements and quality certifications. While this information remains important, it does not necessarily cover the additional data required under today's sustainability regulations.

Consider the requirements introduced by four key EU frameworks: CSRD, CSDDD, CBAM and EUDR

CBAM introduces installation-level emissions reporting.

The definitive CBAM regime applies from 1 January 2026. Importers of covered goods must report their embedded emissions and surrender the corresponding number of CBAM certificates. For goods imported during 2026, the first annual CBAM declaration must be submitted by 30 September 2027. Importers can use either the European Commission's default values or actual emissions data. Where actual values are used, they must be supported by verified information from the installation where the goods were produced. This creates a need for reliable emissions information from suppliers, particularly manufacturers operating outside the EU. Procurement spend or general industry averages cannot replace the installation-specific information required when actual emissions are reported.

EUDR introduces plot-level traceability requirements.

The EUDR addresses deforestation and forest degradation linked to seven commodities: cattle, cocoa, coffee, oil palm, rubber, soya and wood, as well as specific products derived from them. Following the December 2025 amendment, the main application dates are 30 December 2026 for large and medium-sized operators and traders, and 30 June 2027 for most other micro and small enterprises. Micro and small enterprises already covered by the EU Timber Regulation must comply from 30 December 2026. The Regulation requires businesses subject to due diligence obligations to collect information demonstrating that relevant products are deforestation-free and legally produced. This includes geolocation information identifying the plots of land where the commodities were produced. The European Commission also updated Annex I in 2026, changing the list of covered products. Newly added products are subject to the Regulation from 30 December 2027. Businesses must therefore check the applicable product classifications rather than assume that every product containing a relevant commodity is covered.

CSDDD introduces structured human rights and environmental due diligence.

The amended Directive (EU) 2026/470 significantly narrowed the scope of the CSDDD. It primarily covers EU companies with more than 5,000 employees and net worldwide turnover exceeding EUR 1.5 billion. Non-EU companies are covered where their net turnover generated in the EU exceeds EUR 1.5 billion. For companies within scope, Articles 7, 8 and 9 establish requirements relating to the integration of due diligence into company policies, the identification of actual and potential adverse impacts, and the assessment of those impacts. This requires more than maintaining a list of direct suppliers. Companies need processes for identifying relevant risks and impacts across their chain of activities, including relationships with business partners.

CSRD adds further supplier information requirements.

The Corporate Sustainability Reporting Directive (CSRD) requires companies within its scope to report on relevant sustainability matters, including material impacts, risks and opportunities across their value chains. Depending on the reporting requirements and materiality assessment, this may involve collecting environmental, social and governance information from suppliers. Businesses may use supplier-provided data, activity data and, where appropriate, reasonable estimates. Taken together, these frameworks demonstrate why procurement information alone may no longer be sufficient. Businesses need a more structured approach to managing supplier information and ensuring that relevant evidence can be retrieved when required.

‍

{{product-tour-injectable}}

The five phases that determine whether supplier evidence holds up

Supplier lifecycle management can be organised into five phases: qualification, onboarding, data collection, performance monitoring and offboarding. These phases are not a formal regulatory framework prescribed by EU legislation. Instead, they provide a practical structure for organising supplier relationships and managing the information needed to support regulatory compliance. Each phase should contribute to a consistent evidence record that can be used across relevant compliance processes.

Qualification

Supplier qualification is the stage at which businesses assess whether prospective suppliers meet their commercial, operational and compliance requirements before entering into a business relationship. For companies subject to the CSDDD, this may involve screening suppliers based on their sector, geographical location and potential human rights or environmental risks. The OECD Guidelines for Multinational Enterprises on Responsible Business Conduct provide an important reference for this approach. For businesses affected by the EUDR, qualification may also involve assessing the risk classification of the country or region of production and whether suppliers can provide the necessary traceability information. The OECD  due diligence framework emphasises the importance of integrating responsible business conduct into company policies and management systems from the outset. Screening suppliers at this stage helps identify potential compliance gaps before contractual commitments are made or sourcing begins.

‍

Onboarding

Onboarding translates qualification requirements into contractual responsibilities and operational processes. For companies within scope of the CSDDD, Article 7 requires due diligence to be integrated into all relevant policies and risk management systems.

Supplier contracts should clearly address:

• CBAM: Installation-level emissions data.

• EUDR: Plot-level geolocation and production information.

• CSDDD: Cooperation in identifying and addressing human rights and environmental risks.

• CSRD: Sustainability information needed for reporting.

Contracts should also establish responsibilities for providing accurate information and cooperating with audits or verification activities.

‍

Data collection

Data collection involves obtaining and maintaining the information needed for supplier management and regulatory compliance. Key requirements include:

• CBAM: Embedded emissions data from production installations.

• EUDR: Plot-level geolocation, production details and legality evidence.

• CSDDD: Information on actual and potential human rights and environmental impacts.

• CSRD: Supplier and value chain data relevant to sustainability reporting.

Collecting this information through separate questionnaires can create unnecessary administrative work. A central supplier record allows businesses to organise and reuse relevant data across compliance processes, provided it meets each regulation's requirements.

‍

Performance monitoring

Performance monitoring assesses whether suppliers meet their commitments and whether identified adverse impacts are being addressed. Under SCDDD Recital 61, companies must periodically assess the implementation and effectiveness of their due diligence measures. Businesses can monitor supplier performance through regular reviews, documentation checks and follow-up assessments. Any identified issues should be documented, with corrective measures implemented and their effectiveness monitored.

‍

Offboarding

Offboarding involves formally ending a supplier relationship while ensuring that relevant compliance records and outstanding issues are documented. Where a relationship ends because of compliance concerns, businesses should retain evidence of the identified issues, actions taken and reasons for termination. For companies subject to the CSDDD, suspension or termination decisions must be considered in accordance with applicable due diligence requirements. Maintaining complete supplier records supports future compliance reviews and ensures that relevant documentation is retained in line with legal requirements.

‍

Three approaches to supplier lifecycle management in 2026

Businesses evaluating supplier lifecycle management solutions generally consider three approaches: extending existing procurement systems, adopting a standalone due diligence platform or implementing an integrated ESG and supply chain compliance system. The most suitable approach depends on the complexity of the supply chain, the number of applicable regulations and the type of supplier information the business needs to manage.

1. Procurement-extension model

The procurement-extension model keeps supplier records within an existing enterprise resource planning (ERP) system and adds questionnaires or additional information fields to the established supplier qualification process. This approach can be suitable for businesses with relatively straightforward supply chains and limited requirements for collecting complex supplier-level data. However, as regulatory requirements expand to include installation-level emissions information, plot-level geolocation and documented human rights and environmental risk assessments, existing procurement systems may require additional functionality. Businesses should assess whether their current systems can support the collection, validation and storage of this information, as well as provide the necessary traceability for future compliance reviews.

2. Standalone due diligence platform

A standalone due diligence platform provides a dedicated environment for managing supplier risk assessments, adverse-impact identification and due diligence documentation. Depending on the platform's functionality, it can support legal and compliance teams in organising assessments under the CSDDD, including the identification and assessment of relevant risks and impacts under Articles 8 and 9. However, businesses may need additional integrations or systems to manage other regulatory requirements, such as CBAM emissions reporting, EUDR geolocation data and CSRD disclosures. Where information is managed across several disconnected platforms, companies may face challenges maintaining consistent supplier records and retrieving supporting evidence.

3. Integrated ESG and supply chain compliance system

An integrated ESG and supply chain compliance system aims to consolidate supplier information and make it accessible across different regulatory workflows. Where the platform supports the necessary integrations and data structures, businesses can reuse relevant supplier information across CSRD, CSDDD, CBAM and EUDR processes. For example, supplier qualification can be managed through a shared process, while emissions data, geolocation information and risk assessments are collected and maintained in a centralised environment. This can reduce duplicate information requests, improve consistency and give internal compliance teams and external assurance providers a more complete view of relevant supplier information. Companies already managing requirements under the Packaging and Packaging Waste Regulation (PPWR) face similar challenges when mapping suppliers and managing packaging-related information. For further guidance, see Coolset's PPWR compliance checklist.

‍

{{custom-cta}}

What auditors and competent authorities will actually check

Although each regulation has its own compliance and enforcement mechanisms, businesses should be prepared to demonstrate that the information supporting their regulatory obligations is accurate, traceable and appropriately documented. This means being able to identify where information originated, when it was collected, which supplier or production facility it relates to and how it was assessed or verified where required.

The specific expectations differ between regulations.

CBAM: emissions information and verification

Under the definitive CBAM guidance, authorised CBAM declarants must submit their first annual declaration by 30 September 2027, covering goods imported during 2026. The declaration must report the embedded emissions of the relevant imported goods and the corresponding number of CBAM certificates. Importers can use the European Commission's default values or actual emissions data. Where actual values are used, they must be supported by verified information from the installation where the goods were produced. The corresponding CBAM certificates must also be surrendered. Certificate prices are linked to EU Emissions Trading System (EU ETS) allowance prices, with quarterly averages applying during 2026 and weekly averages from 2027 onwards.

EUDR: geolocation and due diligence evidence

Under the EUDR, operators must be able to demonstrate that relevant products are deforestation-free and legally produced. The due diligence process requires information identifying the production areas, including the geolocation coordinates of the relevant plots of land. Businesses must also retain the supporting information and evidence used to assess compliance. Due diligence statements and simplified declarations are submitted through the EUDR Information System, which operates within the TRACES platform. The Regulation's December 2025 revision simplified certain downstream obligations but did not remove the underlying requirements concerning deforestation-free production and legality. Competent authorities can request supporting information and conduct checks to establish whether businesses have fulfilled their obligations.

CSDDD: due diligence processes and corrective measures

Under the amended CSDDD, supervisory authorities are responsible for monitoring compliance with the national laws implementing the Directive. The amended framework provides for financial penalties, with the maximum pecuniary penalty capped at 3% of worldwide net turnover under Article 27(4). The Directive also retains the core requirements concerning the integration of due diligence into company policies, the identification of adverse impacts and their assessment under Articles 7, 8 and 9. The EU's Omnibus I simplification package removed the former Article 22 obligation to adopt and implement a climate transition plan. However, this did not remove the core human rights and environmental due diligence requirements.

CSRD: sustainability reporting and external assurance

Companies subject to CSRD must ensure that their sustainability statements are prepared in accordance with the applicable reporting requirements. Sustainability information is subject to external assurance at the applicable level. This means businesses need appropriate documentation and supporting information for the material disclosures included in their reports. Supplier information may form part of this evidence, particularly where value chain impacts, risks and opportunities are relevant to the company's sustainability reporting.

The OECD framework: a common foundation for due diligence

Across these different regulatory frameworks, the OECD's six-step due diligence framework provides a useful foundation for organising responsible business conduct. The six steps are:

1. Embed responsible business conduct into policies and management systems.
2. Identify and assess actual and potential adverse impacts.
3. Cease, prevent or mitigate adverse impacts.
4. Track implementation and results.
5. Communicate how impacts are addressed.
6. Provide for or cooperate in remediation where appropriate.

Although the EU regulations do not all follow an identical due diligence process, these steps provide a practical reference for managing supplier relationships and maintaining consistent documentation.

‍

Deciding what to build, buy or consolidate before Q1 2026

Choosing the right supplier lifecycle management approach requires businesses to consider how many regulations affect their supplier base and whether the necessary information is already being collected and managed effectively. The decision should be based on the company's actual compliance gaps, rather than software features alone.

Companies with CBAM and EUDR exposure

Businesses managing suppliers affected by both CBAM and EUDR face particularly immediate challenges. CBAM entered its definitive phase on 31 January 2026, while the EUDR's main obligations apply to large and medium-sized operators and traders from 30 December 2026. Companies therefore need to manage CBAM emissions reporting while preparing the supplier traceability and geolocation systems required under the EUDR. If supplier information is already fragmented across procurement, sustainability and compliance systems, consolidating these processes should be a priority.

Companies primarily exposed to CSDDD

Companies within the amended CSDDD scope have additional time before the Directive applies. Directive (EU) 2026/470 entered into force on 18 March 2026. Member States must transpose the amended Directive by 26 July 2028, with application beginning on 26 July 2029. This gives affected businesses an opportunity to review their supplier qualification, risk assessment and onboarding processes ahead of the application date. However, the additional time should be used to establish clear responsibilities and improve the quality of supplier information, rather than postponing preparation until national implementation is complete.

Companies also affected by the Forced Labour Regulation

Businesses preparing for the CSDDD should also consider the EU Forced Labour Regulation. Regulation (EU) 2024/3015 applies from 14 December 2027 and prohibits products made with forced labour from being placed or made available on the EU market or exported from it, regardless of the sector. The Regulation introduces a separate enforcement framework, but the information needed to identify potential forced labour risks may overlap with supplier records and human rights due diligence processes maintained under the CSDDD. Businesses exposed to both frameworks should consider how supplier information, risk assessments and supporting documentation can be organised consistently.

‍

Where to start this quarter

Businesses preparing for the changing regulatory landscape should begin by reviewing their existing supplier management processes and identifying where important compliance information is missing or difficult to retrieve. A useful starting point is to map current supplier records against the five lifecycle phases: qualification, onboarding, data collection, performance monitoring and offboarding. This exercise can help identify which processes need improvement and whether existing systems can support the information requirements of the relevant regulations. Companies should then prioritise the most immediate gaps. For businesses importing CBAM goods or sourcing EUDR-covered commodities, this means ensuring that emissions and geolocation information can be obtained and managed appropriately. For companies within the amended CSDDD scope, attention should also be given to supplier risk assessment, contractual arrangements and the integration of due diligence into internal policies and management systems. The objective is to establish a consistent approach to supplier information that supports compliance today while remaining adaptable as additional regulatory requirements come into effect.

‍

Frequently asked questions

What are the five supply chain processes relevant to compliance?

In a supplier lifecycle management context, the five key processes are qualification, onboarding, data collection, performance monitoring and offboarding. Each phase supports a different part of the supplier relationship, from initial risk assessment to ongoing monitoring and the retention of relevant records. Together, they provide a practical framework for organising information that may support compliance with CSRD, CSDDD, CBAM and EUDR.

What are the three stages of supplier due diligence under CSDDD?

The CSDDD does not prescribe a simple three-stage supplier due diligence model. However, the OECD framework provides a useful way to understand the process through identifying adverse impacts, preventing or mitigating them, and tracking the effectiveness of the measures taken. The Directive (EU) 2024/1760  itself sets out specific requirements, including integrating due diligence into company policies, identifying adverse impacts and assessing their severity and likelihood under Articles 7, 8 and 9.

What are the four components of supply chain compliance in 2026?

The four key regulatory frameworks businesses increasingly need to consider are:

• CBAM: Reporting embedded emissions in certain imported goods and managing the associated certificate obligations.
• EUDR: Demonstrating that relevant commodities and derived products are deforestation-free and legally produced.
• CSDDD: Identifying, assessing and addressing actual and potential adverse human rights and environmental impacts.
• CSRD: Reporting material sustainability information, including relevant information about the company's value chain.

Each framework has different requirements, but all can influence how businesses collect, manage and document supplier information.

When does the amended CSDDD apply?

Under Directive (EU) 2026/470, CSDDD must be transposed by Member States by 26 July 2028 and applies to in-scope companies from 26 July 2029. The revised scope primarily covers EU companies with more than 5,000 employees and net worldwide turnover exceeding EUR 1.5 billion, as well as non-EU companies with net turnover generated in the EU exceeding EUR 1.5 billion.

What is the first CBAM declaration deadline under the definitive regime?

The first annual CBAM declaration is due by 30 September 2027 and covers relevant goods imported during 2026. Importers can report embedded emissions using the European Commission's default values or actual emissions data. Where actual values are used, they must be supported by verified emissions information from the installation where the goods were produced. The corresponding CBAM certificates must also be surrendered by the applicable deadline.

‍