Getting audit-ready for FLR before 2027
Full application of the EU Forced Labour Regulation arrives on 14 December 2027. That may sound distant, but the practical evidence base an organisation needs to be genuinely audit-ready doesn't build itself in a few months – and the Commission's own guidance makes clear that the quality of a company's due diligence system, not just its existence, is what matters when an investigation opens.
Audit-readiness under the FLR isn't about having a policy document on file. It's about being able to produce, on request, a coherent evidentiary trail: a risk assessment methodology that identifies where forced labour risk plausibly sits in the supply chain; records of how that risk was investigated and addressed at the supplier level; a remediation process for affected persons that's distinct from simple supplier disengagement; and monitoring records showing the system operates on an ongoing basis rather than as a one-off exercise conducted for a single audit.
The OECD's six-step due diligence framework – embed, identify and assess, cease or mitigate, track, communicate, remediate – is the structure the Commission's June 2026 guidelines point companies towards, and it's a reasonable backbone to build an internal system against, even in the absence of a finalised risk database or binding legal requirement to follow it. Building to that structure now means a company isn't reverse-engineering a defensible system under investigation pressure later.
One of the most consequential preparation steps is simply documentation discipline: due diligence only functions as a mitigating factor at the penalty stage, and only helps avoid a full investigation being opened, if it can be evidenced. A genuinely good risk process that exists only as institutional knowledge, without records, is largely invisible to an investigating authority and carries little practical weight compared with a documented, auditable one.
Independent verification adds a layer beyond internal documentation. A due diligence management system that has been assessed and certified by an accredited, independent third party carries a different evidentiary weight than a self-declared internal process – both in how quickly it can satisfy an investigating authority's initial information requests, and in how it functions as a mitigating factor if a violation is ultimately found elsewhere in the supply chain despite a genuinely functioning system.
With member state penalty frameworks due by December 2026 and full application in December 2027, the realistic preparation window is now measured in months, not years. Organisations that begin building and evidencing their due diligence system today will have a functioning, audit-tested process well before enforcement begins; those that wait will be building under time pressure, against penalty frameworks and risk database details that are still being finalised even as investigations begin.
Speeki is an accredited certification body providing independent assurance and certification of due diligence management systems relevant to the EU Forced Labour Regulation and adjacent frameworks. Current accreditation scope and certification details are available at speeki.com.