FLR vs CSDDD: Two very different legal instruments
Since both the EU Forced Labour Regulation and the Corporate Sustainability Due Diligence Directive touch supply chains and human rights, it's tempting to treat them as two versions of the same obligation. They aren't. Understanding the difference matters because the compliance response to each is different, and conflating them leads organisations to either over-build in the wrong place or leave a genuine gap uncovered.
CSDDD is a due diligence obligation. It requires in-scope companies to establish an ongoing process – identifying, preventing, mitigating and accounting for actual and potential adverse human rights and environmental impacts across their own operations and their chain of activities. It carries civil liability exposure for companies that fail to meet that standard and cause harm as a result. Critically, it only applies to companies above defined size and turnover thresholds, and – following the Omnibus I package – those thresholds were raised and the effective application date pushed out to 2029.
The FLR is not a due diligence obligation at all. Article 1(3) of the Regulation is explicit that it does not create new due diligence duties. It is a market-access ban that operates through investigation and product-level consequence: if forced labour is confirmed anywhere in a product's supply chain, that specific product is withdrawn, recalled or blocked at customs. There's no ongoing procedural obligation baked into the law itself – the obligation, if you want to call it that, is simply: don't let forced-labour products reach the EU market.
The scope difference is just as sharp. CSDDD is thresholded – only large companies are caught, and the effective date has moved to 2029 after Omnibus I. The FLR has no threshold at all and applies in full from December 2027, two years earlier. An organisation that is comfortably below CSDDD's size threshold, and therefore not required to build a CSDDD-compliant due diligence programme, can still have a single product pulled from the EU market under the FLR with no size-based defence available.
Liability also runs differently. CSDDD liability attaches to the company for failing to meet its due diligence duty and thereby causing or contributing to harm. FLR consequence attaches to the product itself, triggered by a factual finding of forced labour, independent of whether the company had a due diligence programme in place at all – though, as covered elsewhere in this series, having one materially affects how an investigation unfolds and how any penalty is calculated.
The practical implication is that these two instruments need to be tracked and resourced separately, even though they'll often draw on the same underlying supply chain data. A company preparing for CSDDD compliance by 2029 should not assume that work covers its FLR exposure from 2027 – the FLR arrives first, applies more broadly, and is triggered by a different legal test entirely.
Organisations serious about getting ahead of both instruments need a due diligence architecture that can serve multiple legal obligations from a single evidentiary base, rather than building parallel, siloed compliance programmes for each. Speeki is an accredited certification body supporting organisations in exactly this kind of multi-obligation due diligence governance; current accreditation scope is listed at speeki.com.