EU Forced Labour Regulation: what it means for your business

The EU Forced Labour Regulation (EUFLR) represents something genuinely new in the forced labour legislative landscape. 

Unlike the UK Modern Slavery Act or the EU’s Corporate Sustainability Due Diligence Directive — which require companies to report on or conduct due diligence into forced labour risks — the EUFLR is a product ban. Goods made with forced labour anywhere in the world can be prohibited from the EU market, ordered withdrawn, and destroyed.

This distinction matters enormously for how companies need to respond. The EUFLR does not ask whether you have a policy, or whether you have conducted a risk assessment. It asks whether the products you are selling in the EU were made with forced labour. If they were — and an investigation concludes this — those products face a ban.

Full enforcement begins on 14 December 2027. The implementation infrastructure is being built now. Companies that understand how the regulation works, where enforcement will focus, and what due diligence provides the best defence have a narrowing window in which to prepare.

This page explains what the EUFLR requires, how the enforcement process works, who is in scope, what the risk database and investigation system look like, and what companies should be doing to prepare.

For a broader overview of the forced labour legislative landscape, see: Modern slavery legislation: what businesses need to know.

What the EUFLR is — and what makes it different

The EUFLR prohibits economic operators from placing, making available, or exporting products made with forced labour on or from the EU market. This prohibition applies:

• At any stage of production — raw materials, components, and finished goods are all covered
• Regardless of where in the world the forced labour occurred
• Regardless of the size or headquarters of the company selling the product
• Including online sales and distance sales targeted at EU consumers

This is a fundamentally different instrument from existing due diligence legislation. The UK Modern Slavery Act requires disclosure. The CSDDD requires due diligence processes. The EUFLR bans products. The consequence of a finding is not a fine or a reporting obligation — it is the withdrawal of goods from sale and, if already on the market, their destruction or donation.

The regulation also makes explicit something that the broader discourse sometimes obscures: changing one’s supply chain, in the sense of relying on different suppliers, cannot be considered a way to eliminate the forced labour regarding the product concerned. Switching suppliers after a finding does not resolve the violation. Remediation — addressing the forced labour itself — is required.

Who is in scope

The EUFLR applies to all economic operators — defined as any natural or legal person or association of persons — that place or make available products on the EU market, or export products from it. There is no minimum employee threshold, no turnover threshold, and no sectoral carve-out.

This means:

• A UK company selling goods into France is in scope
• A US company selling via an online marketplace to German consumers is in scope
• A Chinese manufacturer exporting goods through the EU is in scope
• An SME selling handmade goods at an EU trade show is technically in scope

In practice, enforcement will be risk-based and will focus first on larger operators in high-risk sectors and geographies. But the legal scope is universal — and the absence of a size threshold is a deliberate design choice reflecting the recognition that forced labour can appear at any point in any supply chain.

The enforcement mechanism: how investigations work

The EUFLR creates a two-stage investigation process, led either by the European Commission or by national competent authorities — designated by each EU member state — depending on where the suspected forced labour is occurring.

Who leads the investigation

The European Commission leads investigations where the suspected forced labour takes place outside the EU. Given that most supply chain forced labour risk is concentrated in non-EU sourcing countries, the Commission will be the primary investigative authority for most cases affecting internationally sourcing companies.

National competent authorities, designated by each EU member state, lead investigations where the suspected forced labour takes place within that member state. EU countries must designate their competent authorities by 14 December 2025. These authorities will be publicly listed on the Forced Labour Single Portal.

All competent authorities coordinate through the newly established Union Network Against Forced Labour Products — a platform for joint investigations, information sharing, and the development of consistent enforcement approaches across member states.

Stage 1: Preliminary assessment

The preliminary assessment stage determines whether there are sufficient grounds to open a formal investigation. Authorities may initiate an assessment on their own initiative, or in response to information submitted by third parties — including civil society organisations, trade unions, workers, or whistleblowers — through the central information submission point on the Forced Labour Single Portal.

During the preliminary assessment, authorities assess the information available against risk indicators, the forced labour risk database, and other relevant sources. If substantiated concerns remain after this initial review, authorities may request information from the economic operators involved. Economic operators have 30 working days to respond to information requests during the preliminary phase.

Stage 2: Formal investigation

Where the preliminary assessment identifies substantiated concerns, a formal investigation is launched. The economic operator is informed of the investigation’s scope and reasons, and has the opportunity to submit further evidence and documentation.

Competent authorities are required to complete their investigation and reach a determination within nine months of initiating a formal investigation. Where cases are complex, this may be extended.

If a violation is confirmed, the competent authority issues a decision that covers the full lifecycle of the affected products across three dimensions:

• Prohibition — a ban on placing or making available the products concerned on the EU market, and on exporting them from it. This applies to products that have not yet entered the market.
• Withdrawal — an order for relevant authorities to withdraw from the EU market any products that have already been placed or made available — meaning goods already in circulation on shelves, in warehouses, or in distribution are not exempt.
• Disposal — an obligation to donate, recycle, or destroy the withdrawn products and any remaining stocks held by the economic operator, entirely at that operator’s expense.

The scope is therefore comprehensive: it covers products yet to enter the market, products already in circulation, and stocks held at any point in the distribution chain.

Where only specific components of a product are found to be made with forced labour, authorities may require replacement of those components rather than withdrawal of the entire product. For strategically or critically important products, disposal may be postponed while the forced labour issue is addressed.

Decisions by one national competent authority are recognised and enforced across all EU member states — a finding in one jurisdiction applies across the whole of the EU single market.

Review and appeal

Economic operators affected by a decision can request a review at any time, provided they submit substantial new evidence demonstrating compliance. Authorities must respond to review requests within 30 days. Cooperation with the investigation — including providing accurate and complete information — is expected and taken into account; refusal to cooperate or submission of misleading information can result in adverse decisions.

The risk database and the Forced Labour Single Portal

Two tools central to how the EUFLR will operate in practice are still being built, with publication due by 14 June 2026:

The forced labour risk database

The Commission is establishing a public database identifying forced labour risks in specific geographic areas, products, and sectors. The database will:

• Signal to companies where forced labour risks in their supply chains are concentrated
• Guide competent authorities on where to prioritise enforcement
• Identify areas of widespread and severe forced labour, including state-imposed forced labour, as a priority
• Be regularly updated as new information becomes available

The database is expected to draw on ILO data, the US Department of Labor TVPRA list, civil society research, and other credible sources. Its publication will significantly clarify enforcement priorities — companies sourcing from areas or sectors featured in the database face materially elevated investigation risk.

The Forced Labour Single Portal

The Single Portal will be the central public access point for the EUFLR framework. It will publish:

• The list of designated national competent authorities
• The Commission’s compliance guidelines
• The forced labour risk database
• The single information submission point through which third parties can flag suspected violations
• Decisions to ban products, and the withdrawal of any bans following review

The Portal is a significant transparency instrument. Civil society organisations, trade unions, investors, and journalists will have direct access to investigation decisions and risk data — making the regulatory process substantially more transparent than existing national frameworks.

The compliance guidelines

By 14 June 2026, the European Commission will issue guidelines on compliance, covering due diligence, risk indicators, and best practices. These guidelines are being developed through a structured consultation process: the Commission opened a call for evidence in February 2026 (which closed in March 2026) and is conducting targeted stakeholder consultations through Q1–Q2 2026 ahead of publication.

The guidelines will cover three main areas:

For competent authorities: Risk benchmarks, standards of evidence, penalty calculation frameworks, and guidance on investigations.

For economic operators: Due diligence processes relevant to forced labour — including guidance specific to different types of suppliers along the supply chain and different sectors — alongside best practices for eliminating and remediating forced labour, and guidance on engagement during investigations.

Other matters: Customs aspects, the process for third-party information submission, and the penalty frameworks member states must establish by 14 December 2026.

The guidelines will be consistent with other relevant EU law — including the CSDDD due diligence framework — and will be regularly updated. They are a critical document for companies preparing for the December 2027 enforcement date: they will define what “appropriate due diligence” looks like under the EUFLR, and therefore what constitutes the strongest defence against investigation and enforcement action.

How due diligence interacts with enforcement

The EUFLR is a prohibition, not a due diligence law. It does not require companies to conduct due diligence — it bans products made with forced labour. However, due diligence is the most credible and practical way to demonstrate that a product was not made with forced labour, and is explicitly referenced in the regulation as relevant to the assessment of a case.

Several implications follow:

Due diligence reduces investigation risk. Companies that can demonstrate robust, documented forced labour due diligence — including supply chain mapping, risk assessment, supplier engagement, and worker voice mechanisms — are better positioned both to identify and address forced labour before enforcement action, and to provide evidence during an investigation that mitigates the risk of an adverse decision.

CSDDD-standard due diligence is the relevant benchmark. The compliance guidelines will be consistent with CSDDD requirements, and CSDDD-standard due diligence is the most credible operational standard available before the EUFLR guidelines are published. Companies already building CSDDD-aligned due diligence programmes are developing the foundation they need for EUFLR compliance — even where they fall outside CSDDD scope.

Third-party submissions drive reactive investigations. Civil society organisations, trade unions, and whistleblowers can submit information to the Forced Labour Single Portal triggering a preliminary assessment. Companies with documented forced labour risks in their supply chains — particularly in high-profile sectors and geographies — face elevated risk of third-party triggered investigations. Strong due diligence and transparent remediation reduce this risk.

State-imposed forced labour carries distinct treatment. Where forced labour is state-imposed — as in Xinjiang — companies cannot conduct the standard due diligence needed to verify conditions are free from forced labour. The risk database will identify such areas as high priority, and enforcement is likely to focus on products from these regions early in the enforcement cycle. Swift disengagement from state-imposed forced labour contexts is expected, consistent with the position under the UFLPA and the CSDDD.

The EUFLR and the UFLPA: comparison and interaction

Companies with both EU and US market exposure need to understand both the EUFLR and the US Uyghur Forced Labor Prevention Act (UFLPA), which operate on different logics.

Scope. The UFLPA is geographically focused — it targets goods produced wholly or in part in the Xinjiang Uyghur Autonomous Region of China, or by entities on the UFLPA Entity List. The EUFLR is geographically unlimited — it applies to goods made with forced labour anywhere in the world, with no country or region carve-out.

Presumption and burden of proof. The UFLPA operates on a rebuttable presumption: goods from Xinjiang are presumed to have been made with forced labour, and the burden falls entirely on the importer to demonstrate otherwise to a very high evidential standard. The EUFLR does not apply a blanket presumption — instead, competent authorities must establish a violation through a risk-based investigation process, during which the economic operator is required to cooperate and provide evidence.

Enforcement mechanism. Under the UFLPA, goods are detained or denied entry at the US border. Under the EUFLR, enforcement takes the form of a product withdrawal and disposal order following a formal investigation — applying to goods already in circulation as well as those yet to enter the market.

Who it applies to. Both regulations apply to all companies selling into their respective markets regardless of where those companies are headquartered. Neither has a minimum size or turnover threshold.

Timeline. The UFLPA has been in force since June 2022 and is actively enforced. The EUFLR enters full enforcement on 14 December 2027.

The practical implication for companies with both EU and US exposure is that Xinjiang sourcing triggers both regimes simultaneously — the UFLPA's rebuttable presumption for US imports, and the EUFLR's expected high-risk database designation for EU market access. Companies in this position need consistent documentation and traceability evidence that is robust enough to satisfy both frameworks.

What companies should be doing now

With enforcement beginning December 2027, the preparation window is open but not long. Building the supply chain visibility, due diligence systems, and documentation needed to withstand an investigation takes time — and the companies best positioned for enforcement are those that start now rather than in 2027.

1. Map your supply chain to understand EUFLR exposure

The EUFLR applies to all components of a product, not just final assembly. A product manufactured in a low-risk country may contain inputs from high-risk geographies. Understanding your full supply chain — including raw materials and components at Tier 2, 3 and beyond — is the starting point for assessing exposure, and for prioritising where to focus due diligence effort.

2. Monitor the forced labour risk database

When the risk database is published in June 2026, it will identify the geographic areas, sectors, and products that enforcement is likely to focus on first. Reviewing your supply chain against the database at that point — and regularly thereafter as it is updated — should become a standard part of your due diligence cycle.

3. Build CSDDD-aligned due diligence now

Even for companies outside CSDDD scope, building due diligence aligned to CSDDD standards is the most credible preparation for the EUFLR compliance guidelines (also due June 2026). This means: embedding forced labour risk assessment into procurement and supplier management processes; engaging suppliers on responsible recruitment and working conditions; creating and maintaining worker voice mechanisms; and documenting your due diligence processes and findings.

4. Prepare for the investigation process

Understanding how the two-stage investigation process works — who leads it, what information is requested, what timelines apply — means that if a preliminary assessment is triggered, your company is not navigating an unfamiliar process under pressure. Designating internal ownership of EUFLR compliance, establishing processes for responding to information requests within the required 30-working-day window, and knowing which internal and external experts to engage are all part of preparation.

5. Address state-imposed forced labour exposure urgently

The enforcement risk for products with Xinjiang or other state-imposed forced labour exposure is acute and does not wait for December 2027. The UFLPA is already enforced; the EUFLR risk database is likely to feature these geographies prominently from publication. If your supply chain has potential exposure to state-imposed forced labour contexts, this warrants urgent attention rather than monitoring.

Frequently asked questions

Does the EUFLR apply to my company if we are headquartered outside the EU? Yes. The EUFLR applies to all economic operators that place or make available products on the EU market, or export from it — regardless of where they are headquartered. A UK, US, Australian, or Chinese company selling products in the EU is in scope.

We are a small business. Does the EUFLR apply to us? In principle, yes — there is no minimum size threshold. In practice, enforcement will be risk-based and will prioritise larger operators in higher-risk sectors and geographies. SMEs selling products with no significant forced labour risk exposure are unlikely to be early enforcement targets. However, SMEs that are suppliers to larger companies may face due diligence requirements cascaded down from in-scope buyers.

What is the difference between the EUFLR and the CSDDD? The CSDDD is a due diligence directive: it requires in-scope companies to identify, prevent, mitigate, and account for human rights and environmental impacts in their value chains. The EUFLR is a market access measure: it bans products made with forced labour from the EU market and creates an investigation and enforcement mechanism. They operate in parallel. CSDDD-standard due diligence is the most credible preparation for EUFLR compliance, but they have different scopes, different obligations, and different enforcement mechanisms.

Can I avoid the EUFLR by switching to a different supplier after a finding? No. The EUFLR explicitly states that switching suppliers cannot be considered a way to eliminate the forced labour regarding the product concerned. The violation relates to specific products already placed on the market. Remediation — addressing the forced labour in the supply chain — is required, alongside withdrawal of the affected products.

What should we do if we receive an information request during a preliminary assessment? Respond fully, accurately, and within the 30-working-day window. Cooperation with the investigation is explicitly taken into account — cooperation can support a more favourable outcome, while refusal to cooperate or misleading responses can result in an adverse decision regardless of the underlying facts. Engaging legal counsel with EUFLR expertise early in the process is advisable.

When will we know what “appropriate due diligence” means under the EUFLR? The Commission’s compliance guidelines, due by 14 June 2026, will define this. Until then, CSDDD-aligned due diligence is the strongest available benchmark. Companies that have been building their due diligence infrastructure to CSDDD standards — including supply chain mapping, risk assessment, supplier engagement, and worker voice — are well-positioned for the June 2026 guidelines.

Further reading in this cluster

Modern slavery legislation: what businesses need to know
How to identify forced labour in your supply chain
High-risk sectors and sourcing regions for forced labour
Remediation: what to do when forced labour is found
Forced labour & modern slavery: a complete guide for business