Over the past few years the EU has legislated in detail on how companies must address sustainability in their own operations and in their value chains. The best known instrument is the Corporate Sustainability Due Diligence Directive, but it is far from the only one: the Deforestation Regulation, the Battery Regulation and the Forced Labour Regulation all carry due diligence obligations, directly or indirectly. The EU has, in effect, shifted a substantial burden of proof onto the company: show that you acted with care.
This year China has moved as well — by beginning to define what a company is permitted to prove. That matters to anyone whose supply chain reaches China. Three dates from 2026 set out the picture.
- 31 March 2026. The State Council issued the Regulations on Industrial Chain and Supply Chain Security (Decree 834). Article 13 restricts supply chain investigation and information-gathering activity on Chinese territory.
- 15 May 2026. The Ministry of Justice prohibited Chinese organisations from complying with a European Commission information request in an investigation concerning a Chinese security technology company.
- 5 August 2026. The Ministry of Commerce added six US entities to its countermeasure list. Two of them are the Responsible Business Alliance and Verité.
Read as individual news items these look like trade policy. They are not, because there is legislation behind them — and it reaches exactly the material a company needs in order to comply with EU sustainability regulation.
What was enacted in China this spring
Decree 834 concerns the security of industrial and supply chains. It entered into force immediately on 31 March 2026. Two things matter. First, Article 13, on supply chain information-gathering on Chinese territory. Second, Articles 14 and 15, which give the authorities power to investigate and to direct countermeasures at foreign parties acting contrary to “normal market transaction principles” or causing “material damage” to supply chain stability.
Decree 835 concerns countering improper foreign extraterritorial jurisdiction. It was issued in April 2026, also without a transition period. Under it the Ministry of Justice may declare a foreign measure improper, prohibiting both compliance with it and assistance in complying. The consequences can include placement on a so-called malicious entity list, administrative sanctions, civil claims by Chinese parties and even criminal liability.
It is worth noting that the information-gathering provision in Decree 834 is not a new prohibition. It refers to laws already in force — the data security law, the cybersecurity law, the personal information law and the counter-espionage law. Collecting certain kinds of information without authorisation has been unlawful in China for years. What is new is that this is now said expressly in a supply chain context, in the same instrument as the countermeasure powers. The political weight of the rule and the likelihood of enforcement have changed — and in the Chinese context how a law is applied matters more than what it says.
The audit infrastructure is now on a countermeasure list
From a sustainability perspective the most significant of the three decisions came on 5 August 2026, when the Ministry of Commerce added six US entities to its countermeasure list on the grounds that they had participated in preparing sanctions concerning Xinjiang. The list includes the Responsible Business Alliance, Verité, Altana Technologies, Applied DNA Sciences, Stratum Reservoir and Human Rights in China. Earlier listings have targeted states, banks, defence industry and technology companies. These target the infrastructure of sustainability auditing.
These are the organisations on whose programmes, question sets and laboratory methods significant parts of supply chain human rights work have been built. If a Chinese production site’s ability to host or commission an audit by these actors is in doubt, this is not one service provider’s problem. It is a problem with the method of verification itself.
The Forced Labour Regulation is an obligation of result — which is why evidence decides
The EU Forced Labour Regulation is an obligation of result. In the guidelines published in June 2026 the Commission states that the Regulation does not impose a due diligence obligation on companies, but an obligation as to outcome. A faultless process therefore does not protect a company whose product contains forced labour. So what is the due diligence process for? It produces the evidence with which a company defends itself in an investigation, and which affects how a penalty is measured.
Seen from the Regulation, an inability to produce evidence is itself a risk. Seen from the Chinese system, the information-gathering needed to produce it is a risk — and passing information to a foreign authority may amount to assisting in the enforcement of an improper measure.
Consider the case where a Chinese supplier does provide comprehensive traceability data, so that the company can comply with the Forced Labour Regulation and with the instruments that do require due diligence. The company passes the data to US customs to prevent a shipment being detained, or to an EU authority in an investigation under the Regulation. Is that permitted under Chinese law? Nobody yet knows. No implementing guidance has been issued.
The same goes for terminating a supplier relationship. The common approach has been that if a supplier does not remediate, the relationship ends. Under Decrees 834 and 835 such a decision may be examined either as a discriminatory termination of a normal business relationship or as enforcement of a foreign measure. The OECD Guidelines, for their part, have always treated disengagement as a last resort and the use of leverage as the primary response. Chinese counter-sanctions legislation pushes companies in precisely the direction the responsibility frameworks have recommended — for different reasons, to the same conclusion.
A second problem concerns smaller companies, which have less leverage available. The Commission’s guidelines expressly encourage small operators to rely on sector and multi-stakeholder initiatives rather than their own mapping, because proportionality permits lighter means. The Responsible Business Alliance is exactly such an initiative. It is now on China’s countermeasure list.
On the due diligence directive side the tension takes a different shape, though it is not obviously easier. Under the CSDDD the obligation attaches to conduct rather than to outcome, which sounds like the milder position. It is worth thinking through the consequence, however: where parts of the process cannot be carried out in a particular jurisdiction, it is not clear that a sound outcome cures the gap, since it is the conduct that the duty is measured against. How much weight supervisory authorities will place on that in practice remains to be seen.
Why this reaches a mid-sized supplier too
First, the Forced Labour Regulation has no scope threshold. After Omnibus I the CSDDD reaches a small number of very large companies. The Forced Labour Regulation reaches every importer and exporter.
Second, export-driven industrial economies — Finland among them — sit unusually precisely in the supply chains both legislators treat as strategic. Under Article 20(5) of the Forced Labour Regulation an authority may order products belonging to a chain of strategic or critical importance to the Union to be withheld rather than destroyed, for a period within which the forced labour is to be eliminated. The assessment draws, among other things, on the Critical Raw Materials Act and the Net-Zero Industry Act. The battery value chain, extractives and the technology sector are on those lists — and the same chains are the most likely core of the key-sector list under China’s Decree 834.
Third, a mid-sized supplier is typically the party that receives its sustainability requirements in a customer’s contract annex rather than from a statute. When the customer tightens that annex because of the Forced Labour Regulation, the requirement travels down a chain at the far end of which access to information has just become harder. The contract clause does not know about that problem unless it has been written into it.
What follows from this
Supply chain due diligence concerning Chinese suppliers does not stop. China has historically used its counter-sanction powers sparingly in commercial situations, and the political target has been the United States, not a European mid-sized manufacturer. Due diligence built on international standards and scaled reasonably remains clearly lower-risk activity than broad data collection or on-site investigation.
No implementing guidance has been issued for the Chinese rules either, and the central concepts — “normal market transaction principles”, “material damage”, “appropriate connection” — are undefined. What follows will show where the lines fall from a due diligence point of view. In any event, dialogue with Chinese suppliers about sustainability matters is important, both to avoid misunderstanding and to build the cooperation on which any remedy depends.
What to do
- Establish whether you have a China connection at all. You know your first-tier suppliers. The question concerns the second and third tier, and particularly raw materials such as cotton, battery minerals and aluminium. A properly conducted risk assessment pays for itself here.
- Read your contracts again, two-directionally. Audit rights, termination for a sustainability breach and force majeure clauses are standard; alongside them, consider proactive clauses aimed at building cooperation on sustainability matters. Look at contracts through a new lens.
- Do not apply a global sustainability policy mechanically. A rule applied identically everywhere is easier to characterise as enforcement of a foreign measure than a decision reasoned case by case. Targeted, prioritised measures are the key.
- Have open conversations with your supplier about sustainability. That is how you find out what the supplier is permitted to give, and where things can be improved. Do not assume.
- Document also what you could not find out, and why. This is the most important point under the Forced Labour Regulation. Where a breach can be established on the basis of a lack of cooperation, the difference between “we did not look into it” and “we looked into it, did not obtain the information, and here is the reason” is material.
If you would like to discuss the situation in China, the Forced Labour Regulation, or building and implementing a due diligence process, get in touch.
// Juho Saloranta, Nexus Legal
Sources
- Regulation (EU) 2024/3015 on prohibiting products made with forced labour on the Union market, 27 November 2024 – applies from 14 December 2027.
- Commission Communication C(2026) 4386 final, guidelines on the application of Regulation (EU) 2024/3015, 26 June 2026.
- OECD Due Diligence Guidance for Responsible Business Conduct (2018).
- Regulations on Industrial Chain and Supply Chain Security, State Council Decree No. 834, in force 31 March 2026.
- Regulations on Countering Foreign Improper Extraterritorial Jurisdiction, State Council Decree No. 835, April 2026.
- Ministry of Justice Announcement No. 5/2026, 15 May 2026.
- Ministry of Commerce Decision No. 2/2026 on countermeasures, 5 August 2026.