In brief
- As supply chain risks increasingly become matters of regulatory scrutiny, litigation exposure and market access, organisations are under pressure to show more than the existence of robust due diligence processes and procedures.
- The next stage of maturity asks more demanding questions — not just whether controls exist, but whether they are capable of identifying foreseeable harms, and driving effective prevention, mitigation and remediation.
- With confidence in processes vastly outstripping evidence of effectiveness, recent research suggests that many organisations are ill-prepared for this shift in emphasis.
- Enhancing visibility into real-world conditions, particularly beyond Tier 1 suppliers, is critical to closing that gap.
- That visibility is more likely to increase under more relational approaches to supply chain management — ones that recognise mutual responsibilities, and set expectations of support and collaboration when issues are flagged.
How is supply chain risk evolving?
The regulatory direction of travel
Eleven years after its introduction in 2015, the central mechanism of the UK Modern Slavery Act (MSA) remains the requirement of large organisations to publish an annual statement, disclosing steps taken to ensure that modern slavery is not occurring in its own business or supply chain.
Built on the assumption that transparency drives change — that by enabling scrutiny by investors, customers and civil society, companies are incentivised to improve their practices — this disclosure-based theory of accountability has long since been overtaken by developments elsewhere.
Instruments such as the EU Corporate Responsibility Due Diligence Directive (CSDDD) have imposed mandatory due diligence obligations on large organisations, including a duty to prevent, mitigate or end actual and potential harms. The Deforestation Free Products Regulation (EUDR) and Forced Labour Products Regulation have gone further still, by aiming to prohibit products linked to those harms from finding their way onto the EU market in the first place.
Belatedly, it would seem, the UK is now seeking to catch up. For example:
- Coming into force on 1 September 2025, the failure to prevent to prevent fraud offence introduced by the Economic Crime and Corporate Transparency Act, is emblematic of an increasing focus on ensuring that companies implement systems and procedures capable of identifying and preventing foreseeable risks.
- On 23 June 2026, UK Nature Minister Mary Creagh announced the Government's intention to finally move forward with the introduction of forest risk commodities regulation. For the first time, coffee and rubber appeared on the list of regulated commodities, indicating a desire to align more closely with the EUDR.
- Published on 30 June 2026, the Immigration and Asylum Bill includes proposals for reforming reporting obligations under the MSA, including new mandatory content for modern slavery statements, penalties for non-compliance, and updated approval and certification requirements.
- Recognising the need to go further, on 4 November 2026, the Government announced plans to introduce a mandatory human rights supply chain due diligence regime. This would require large UK businesses with more than £350 million turnover (and non-UK businesses generating more than £350 million turnover in the UK) to carry out due diligence in line with the OECD Guidelines for Responsible Business Conduct and the UN Guiding Principles on Business and Human Rights. The regime would also give a regulator power to investigate businesses suspected of selling products made with forced labour. Such products could be withdrawn from the market, where due diligence obligations have not been met and forced labour is identified.
Growing litigation risk
Adverse environmental and human rights impacts overseas are also becoming an increasing area of litigation risk, with English courts showing growing willingness to assume jurisdiction over claims involving UK-based companies that are deemed to have exercised sufficient control over relevant operations and supply chains.
In Vedanta v Lungowe, the Supreme Court accepted in principle that a parent company may owe a duty of care for harm caused by a subsidiary — a logic that has since been extended beyond group companies to third‑party suppliers. In Limbu v Dyson, the Court of Appeal unanimously ruled that the claims of 24 migrant workers for abuses in Malaysian factories within Dyson’s supply chain should be heard in the English courts. Similar jurisdictional openness is evident in climate and environmental claims, including those linked to the Mariana dam disaster.
Are we witnessing a new era of corporate accountability?
The emerging trend
Taken individually, the developments outlined above concern very different issues, from modern slavery and deforestation to fraud and corporate liability. Taken together, however, they point towards a fundamentally different model of accountability.
Under the traditional compliance-based model, organisations have demonstrated responsible conduct through policies, audits, certifications, and public reporting. While these activities remain necessary, they are increasingly viewed as evidence of effort rather than evidence of impact.
The more mature approach now emerging asks a different question — not just whether controls exist, but whether they are capable of identifying foreseeable harms, creating meaningful visibility into value chains, and driving effective prevention, mitigation and remediation.
At the same time, the consequences of failure are changing. Historically, inadequate supply chain oversight was often treated primarily as a reputational issue, carrying the risk of adverse publicity and stakeholder pressure. Increasingly, however, organisations face litigation, enforcement action, financial penalties and, in some cases, restrictions on access to key markets.
Seen through this lens, visibility into value chains shifts from being a desirable aspect of corporate responsibility to a core business capability.
The key problem
The current compliance-based model is clearly reaching its limits, as illustrated by the Social Risk Report 2026, recently published by British Standards Institute (BSI) and the Chartered Institute of Procurement & Supply (CIPS). Among the paradoxical headline findings:
- Almost all survey respondents (96 per cent) said they had found instances of modern slavery, forced labour or serious labour rights violations in their supply chains in the last year; and yet
- 97 per cent believed their due diligence approach would satisfy a regulatory inspection or enforcement action;
- 77 per cent believed they has sufficient evidence to prove that their supply chains were free from modern slavery;
- 67 per cent were confident that their current practices would meet the requirements of future legislation in their markets; and
- Almost half (45 per cent) were extremely confident that their data reflects real-world conditions.
In short, businesses have become good at proving they have systems. But when the test of those systems is not regulatory compliance, but whether they reflect real-world conditions and can demonstrate improved outcomes, things start to break down. As the report states, "confidence in due diligence processes consistently exceeds confidence in the evidence underpinning them."
What might a shift from due diligence activity to due diligence effectiveness require in practice?
The uncomfortable implication is that many organisations may be optimising for compliance at precisely the moment when regulators and courts are increasing their focus on effectiveness. The question is no longer simply whether a company can demonstrate that it has undertaken due diligence, but whether that due diligence is producing meaningful visibility into real-world conditions, and enabling effective prevention, mitigation and remediation of harms.
Meeting that challenge is unlikely to be achieved through additional policies, audits or reporting alone. Instead, it points towards a number of deeper shifts in how businesses think about risk, accountability and relationships within their value chains.
See uncovering harms as a sign of success, not of failure
Under an effectiveness-based model, the key point is that the objective is not to surface zero instances of harm. It is to create the visibility necessary to find them, understand their root causes, and respond effectively.
Famous for its mission to make slave-free chocolate the norm, the approach of Tony's Chocolonely is instructive. In the past, the business has attracted criticism for working directly with farmers in Ghana and Ivory Coast, on the basis that sourcing from those countries almost inevitably means that instances of modern slavery will be found in its supply chains.
However, as ex-CEO Henk Jan Beltman explains, "We deliberately chose to work with farmers in Ghana and Ivory Coast, not because it is easy, but precisely because it is hard. If you simply ignore the problems in West Africa, or switch sourcing elsewhere, you're never going to fix things. That's why we go to where the problems are — so we can help solve them."
Treat visibility as a relationship issue, not just an information issue
Another telling insight from the Social Risk Report 2026 is how significantly visibility erodes the further up the supply chain you go. While 38 per cent of respondents claimed to have comprehensive visibility of their direct suppliers (Tier 1), that figure drops to 26 per cent for Tier 2 (their suppliers' suppliers), and to just 18 per cent for Tier 3 and beyond.
While this is often framed as an information problem, it is also likely a relationship problem. Traditional procurement models are frequently transactional in nature. Buyers establish expectations, suppliers are obliged to comply, and audits and investigations are used to verify performance. The implicit assumption is that information can be extracted purely through contractual requirements and monitoring processes.
In practice, the incentives are often more complicated. Suppliers may have little reason to surface problems if doing so risks commercial penalties, reputational damage, or loss of future business. Where transparency is punished, concealment becomes rational. In contrast, visibility is likely to improve when suppliers can expect the flagging of issues to trigger dialogue, support, and collaborative effort on remediation, rather than immediate sanction.
This distinction matters because effective due diligence depends upon understanding what is actually happening within often long and complex supply chains. If businesses want greater visibility, they will need to focus more on creating the conditions of trust, under which information can be shared more freely.
Focus on business model risk drivers, not just supplier conduct
A more relational approach to contracting — more reflective of mutual responsibilities for identifying and addressing adverse impacts — also challenges the assumption that supply chain harms are primarily the result of supplier behaviour.
As Shift's business model red flags help to illustrate, there are multiple ways in which a company's own procurement practices can undermine the human rights of workers and communities in its supply chain. Decisions that were once viewed as purely commercial are now increasingly relevant from a supply chain due diligence perspective — for example, how aggressive pricing strategies or lead times may make it difficult for suppliers to respect labour rights.
As the focus of accountability begins to move from activity to outcomes, including understanding root causes of harms, it is increasingly pertinent for businesses to ask questions not just about supplier conduct, but also how their own business model and value chain arrangements may be contributing factors.
How can Mishcon de Reya help?
Mishcon Purpose — our interdisciplinary ESG and sustainability practice — advises corporates and private interests on evolving ESG risks and opportunities, and development and implementation of strategy and governance frameworks to address them. By combining expert lawyers and sustainability professionals, our team balances compliance with strategic foresight, not only helping clients to mitigate risk, but also to seize opportunities to lead and benefit from sustainable transition.
ESG-related reputational and legal risks are various, extending to workers' rights issues, alleged human rights abuses, potential environmental harms, or greenwashing. In practice, the area of greatest risk is often an organisation's relationships with third parties, with supply chain issues regularly presenting the trigger for investigations. In an environment where regulators, courts and markets increasingly expect organisations to demonstrate the effectiveness of their controls, our award-winning Investigations team helps clients to generate the evidence needed to withstand scrutiny, strengthen supply chain visibility, and build resilience against future disruption.
To discuss your biggest challenges and ways we can help, get in touch.