Purchasing practices: the part of due diligence you cannot outsource

Sustainability annexes have become demanding documents. They require a living wage, prohibit forced and child labour, cap working hours, grant audit rights and allow termination for a sustainability breach.

They are usually carefully drafted, and they describe comprehensively what the supplier must do. They are also, usually, one-directional.

Due diligence is not supplier policing. It is a process that begins with an assessment of your own operations — and purchasing is your own operation, as much as HR or production is.

Purchasing practices are the part of due diligence you cannot pass down in a contract annex, because they are decisions you make yourself.

Purchasing is own conduct

The interpretive guide to the UN Guiding Principles gives an example of buyer contribution: changing product requirements at the last minute without adjusting the delivery time or the price, so that the supplier breaches labour standards in order to deliver on schedule.

The mechanisms recur. A price below the cost of production. A short planning horizon. Late changes to specification or order volume. An unreliable forecast. Invoices paid after terms. Material from the ILO, Fair Wear, the European Ethical Trading Initiatives and the Better Buying Institute points at the same consequences: overtime, unauthorised subcontracting, deferred investment in occupational safety.

Anyone who works in purchasing recognises that list immediately. That is the whole point: the information is already in the building. It has simply not been treated as a human rights question.

And this is what makes the subject unusual. Where your own ordering behaviour is concerned, the ball is in your court. Fixing it does not require the cooperation that value-chain due diligence normally depends on.

Contributing is not the same as being linked

International standards, and the EU legislation that follows them, distinguish three levels of involvement. A company may cause a harm on its own, contribute to it together with others, or be linked to a harm caused solely by a business partner.

The distinction is not academic. Being linked to a harm creates a duty to use leverage. Contributing to it creates a duty to participate in remediation.

The UN interpretive guide classifies a last-minute change without an adjustment to price or schedule as contribution — not as a situation where the company is merely linked to someone else’s harm.

The legal literature draws a further conclusion worth taking seriously. Where a company operates in a low-wage, high-risk supply chain with asymmetric bargaining power, has done nothing about its purchasing practices — no assessment, no changes — and a harm materialises in the chain, that omission is a strong signal that the company contributed. The presumption is rebuttable: where the supplier is the stronger party and dictates prices, the buyer’s pricing policy does not credibly undermine the supplier’s ability to pay wages.

Read the other way, this is good news. A documented assessment — including one that concludes that no changes are needed — is precisely the material that rebuts the presumption.

It is also the reason to run the assessment before something happens. An account written after the fact, explaining that purchasing practices were fine, is weak evidence. One written in advance is strong.

The same requirement arrives by four routes

Purchasing practices are easily filed under “CSDDD”, and therefore under “not us” — after Omnibus I the directive reaches a much smaller group of very large companies. That is a mistake, because the same requirement arrives from four directions and only one of them has a scope threshold.

The standard. The OECD Guidelines and the UN Guiding Principles require a company to assess the impacts of its own conduct. They have no scope and no size threshold. They matter nonetheless: the standard is what customers, financiers, assessment frameworks and tenders measure you against, and most companies committed to it years before any statute did.

The directive. Purchasing practices are named expressly in the CSDDD. Its recitals say that practices should contribute to living wages and should not incentivise adverse impacts. Application begins on 26 July 2029, but the content will sharpen well before that: the Commission consulted between 12 June and 24 July 2026 on guidelines that expressly cover the adaptation of purchasing practices and model contractual clauses. Omnibus I narrowed the scope but left the contracting architecture — shared responsibility rather than downward transfer — intact.

The Forced Labour Regulation. This is the newest route and the least noticed, and it has no size threshold at all. The Regulation applies to every economic operator that imports, sells or exports products in the EU, and obligations start on 14 December 2027.

In the Commission’s June 2026 guidelines, purchasing practices appear in four separate places. Section 4.5.1.1 names responsible purchasing practices as one way of demonstrating that a product was not made with forced labour. Section 6.4.1.3 asks companies to assess features of their own operations and commercial practices that may inadvertently contribute to risks, or create an obstacle to the supplier’s own ability to conduct due diligence. Section 6.4.2.4 lists updating contract terms and purchasing practices among immediate actions — before changing audit protocols. Section 6.4.3 counts purchasing practices and order scheduling expressly among the business practices to be adapted.

The Forced Labour Regulation is an obligation of result. It imposes no due diligence duty at all. The Commission still mentions purchasing practices four times. When the concept travels into the guidance on an instrument that does not require due diligence, that says something about how settled a part of due diligence it has become.

The same guidelines define contribution so that a company contributes to a risk also where its conduct causes, facilitates or incentivises another company to cause it. Price is an incentive. Award criteria are an incentive. That is their entire purpose.

Contracts. The fourth route is the one by which the requirement actually reaches most companies. When a customer inside the scope tightens its sustainability annex, the requirement travels down the chain. A mid-sized company is typically both a buyer and a supplier: the requirement arrives from above and is passed on below. Only one of those two movements is within its own control.

What the annex does not say

If the sustainability annex requires a living wage from the supplier, but the agreed price does not cover even minimum wages, statutory on-costs and occupational safety — let alone the supplier’s margin — the annex demands something that it does not itself fund.

Both the sector’s most common framework, the Common Framework for Responsible Purchasing Practices, and the Responsible Contracting Project’s buyer code apply the same basic test: does the price cover the cost of the standards you require?

As a matter of contract drafting the position is awkward. You have recorded a requirement whose fulfilment your own commercial terms have made unlikely. If the risk materialises, the annex exists and shows that you identified the risk.

The remedy is conceptually simple and, in practice, unusual: a two-way code of conduct. The Responsible Contracting Project’s Schedule Q is exactly that — a buyer’s code in which the buyer commits on its own side. Change orders are confirmed in writing. The effect of a change on the supplier’s ability to meet the standards is assessed before it is implemented. Payment terms run to no more than 60 days. A supplier that refuses performance on justified human rights grounds is not blacklisted. Exit is a last resort, and costs already incurred are paid.

Some of these terms are demanding from a buyer’s point of view. It is fair to say so out loud. They are also the only way to turn a sustainability annex into a document that says something about both parties — and therefore into a document that is credible as due diligence.

What to do in the purchasing function

• Take one prioritised category from your human rights risk assessment and check whether responsible purchasing practices have been accounted for. This is the important one.
• Look at the weighting of your award criteria. If selection is made on price and quality, you have instructed the supplier to optimise price and quality.
• Count how many orders changed less than three months before delivery.
• Look at actual payment behaviour against agreed terms.
• Document the assessment even where it leads to no change. The difference between never having assessed purchasing practices and having assessed them and concluded, with reasons, that they carry no risk, is decisive for due diligence.

Finally

Due diligence is usually discussed as something done to the supply chain. Most of it is. But the part that is entirely in your own hands is also the cheapest to fix and the easiest to prove you have done.

That part is the purchase order.

I wrote about responsible contracting from a proactive perspective in my doctoral thesis, and the same material informs the client work. If responsible purchasing practices are on your agenda, let’s talk.

// Juho Saloranta, Nexus Legal

Sources

• UN Guiding Principles on Business and Human Rights and the Interpretive Guide
• OECD Due Diligence Guidance for Responsible Business Conduct
• Directive (EU) 2024/1760 (CSDDD)
• Directive (EU) 2026/470 (Omnibus I)
• Commission Communication C(2026) 4386 final, guidelines on the application of Regulation (EU) 2024/3015, 26 June 2026
• Common Framework for Responsible Purchasing Practices, version 1, June 2022
• Responsible Contracting Project, Responsible Purchasing Code of Conduct – Schedule Q, Buyer Code, version 1.0
• Daniel Schönfelder & Michaela Streibelt, Responsible purchasing and responsible procurement as part of HREDD