Supply chain due diligence is the process a company uses to find, prevent and put right harm to people and the environment in its operations and supplier network. In the EU it is now law, with a revised timetable.
It is a central part of ethical business in fashion, where garments pass through many factories, farms and mills before reaching a shop.
What due diligence means in practice
Due diligence is not a single audit or a certificate. It is an ongoing management cycle. The text of the EU directive describes that process as integrating due diligence into policies and management systems, identifying and assessing adverse human rights and environmental impacts, preventing, ceasing or minimising them, monitoring and assessing the effectiveness of measures, communicating, and providing remediation.
The idea reaches well beyond the EU. The International Labour Organization promotes a declaration that, in its own words, provides clear and comprehensive guidance to multinational and national enterprises on how they can contribute to decent work. The same organisation says it is uniquely positioned to promote decent work in supply chains. For a clothing brand, that translates into asking concrete questions about wages, working hours, safety, child labour and freedom of association at the places where its products are made.
A key phrase in the EU rules is the chain of activities. The directive defines it to include the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of products on the upstream side, plus certain downstream activities such as distribution, transport and storage. In a garment context, that covers fibre growing, spinning, weaving, dyeing, cutting and sewing, and the logistics in between.
Visibility is the hard part. Many fashion brands know their final assembly factory well but have little information about the mills, dye houses and farms further back. Due diligence pushes companies to map those layers gradually, starting where risk is highest, rather than pretending the whole chain can be seen from day one.
The steps a company is expected to follow
The cycle starts with policy. A company sets out its approach to human rights and environmental impacts, often in a code of conduct, and builds it into procurement, risk management and day-to-day decisions. Without that, supplier checks tend to be isolated exercises with no consequences.
Next comes mapping and assessment. The company looks at where adverse impacts are most likely to arise, for instance in particular countries, tiers or processes such as dyeing and finishing, and gathers information from suppliers, workers, trade unions and other stakeholders.
Because no business can fix everything at once, the directive allows prioritisation. It states that where it is not feasible to address all identified impacts together, companies prioritise adverse impacts based on severity and likelihood, then move on to the less severe and less likely ones within a reasonable time.
Prevention and correction follow. Typical measures include supplier contracts with clear expectations, training, support to improve a factory, changes to the buyer’s own purchasing practices such as unrealistic deadlines, and, as a last resort, suspending or ending a relationship. Where harm has already happened, the company is expected to bring it to an end or reduce it and to provide remediation.
Further parts keep the cycle honest. Companies must run a notification mechanism and complaints procedure so that workers and others can raise concerns, and must monitor whether their measures work and communicate publicly about their approach.
Which companies the EU directive covers
The directive is aimed at very large businesses, not at every shop or label. According to the European Commission, large EU companies and partnerships fall in scope with at least 5000 employees and EUR 1.5 billion net turnover worldwide, while large non-EU companies fall in scope with at least EUR 1.5 billion net turnover in the EU. Franchising and licensing arrangements may also bring companies into scope where royalty and turnover thresholds are met.
Micro companies and small and medium-sized enterprises are not covered directly. That does not mean they are untouched, as the next sections explain. Thresholds and scope have been the subject of amendment, so anyone relying on them should check the Commission page and the national law of the relevant country.
Timeline and amendments at the time of writing
The directive on corporate sustainability due diligence is Directive (EU) 2024/1760. The Commission states that it entered into force on 25 July 2024 and has since been amended by the Omnibus I simplification initiative, including Directive (EU) 2025/794, which postponed certain application dates, and Directive (EU) 2026/470, which introduced substantive amendments.
According to the same page, Member States must adopt and publish national transposition measures by 26 July 2028 and apply them from 26 July 2029, except for the reporting measures, which apply for financial years starting on or after 1 January 2030. The Commission also lists its main guidelines as due by 26 July 2027 and additional ones by 26 July 2028. These dates are those on the Commission page at the time of writing and could change again, so the page itself is the place to confirm them.
The Commission also notes that, following the Omnibus I amendments, companies may focus on areas where impacts are most likely and most severe, based on reasonably available information. In plain terms, the amended approach leans on risk-based prioritisation rather than a demand to inspect every supplier equally.
Enforcement and liability
Enforcement works at national level. The Commission page says Member States will designate authorities to supervise and enforce the rules, including through injunctive orders and fines, with the maximum limit for pecuniary penalties set at 3% of net worldwide turnover for the most serious violations. It adds that where a company is held liable under national law for damage caused by a failure to comply, affected persons have a right to full compensation.
Penalties and compensation rights are only part of the picture. A clear, documented process is easier to defend than a collection of unrelated statements, and the Commission lists better risk management, more resilience and greater customer trust among the benefits for companies.
Those provisions explain why companies in scope tend to take supplier information seriously. A documented process is the main evidence that a company took appropriate measures.
What it means for smaller fashion businesses
A small label or workshop that sells to a large buyer may receive questionnaires, contract clauses and audit requests even though the law does not apply to it directly. The Commission page says the directive provides protective measures for smaller business partners, including limits on information requests, guidance and model contractual clauses.
The rules also sit alongside other frameworks. Reporting duties are covered in the guide to corporate sustainability reporting, which concerns what companies disclose, while due diligence concerns what they do. Voluntary schemes such as b corp certification assess company practices, but they are not a substitute for legal compliance.
For any business, practical habits help regardless of size: keep a list of suppliers and the processes they carry out, write down the main risks, ask suppliers the same clear questions every season, and keep records of the response. This page is general information, not legal or compliance advice, and businesses with obligations should consult qualified advisers.
Frequently asked questions
Is due diligence the same as a supplier audit?
No. An audit is a snapshot of a site at a point in time, while due diligence is the full cycle of policy, assessment, action, monitoring, complaints handling and reporting. Audits can be one input among many.
Does the EU directive apply to small brands?
Micro companies and small and medium-sized enterprises are not covered directly, according to the European Commission. They may still be asked for information by larger customers.
Do the dates stay the same?
Not necessarily. The timetable was amended and the Commission page is the reference at the time of writing. Check it for the latest position before making plans.
Does due diligence guarantee a harm-free supply chain?
No. It is about taking appropriate, risk-based steps and responding when problems are found, not about promising that nothing will ever go wrong.
