The FLR doesn't mandate due diligence – but it rewards it anyway
This is the detail in the EU Forced Labour Regulation that gets missed most often, and it's arguably the most commercially important one. The Regulation states plainly that it does not create a new due diligence obligation. And yet the Commission's own guidance, published 30 June 2026, makes clear that having a credible due diligence system in place is one of the most consequential things a company can do under this law – even though nothing in the text requires it.
The mechanism works at two points in the process. First, at the investigation-trigger stage: when a competent authority is assessing whether a 'substantiated concern' exists sufficient to open a formal investigation, evidence of a functioning due diligence system – one that identifies, assesses and addresses forced labour risk in a structured, ongoing way – is a relevant factor in that assessment. A company that can point to a real system, with evidence, risk indicators and remediation history, is in a materially different position than one that cannot.
Second, at the penalty-calculation stage, for cases where forced labour is ultimately confirmed. The Commission's guidance sets out a methodology built around gravity, duration and aggravating or mitigating factors – leaving the specific numeric formula to individual member states, but establishing the categories that matter. A demonstrable due diligence effort functions as a mitigating factor even where it didn't prevent the underlying finding, because the law is oriented towards incentivising systems, not simply punishing failures.
The reference point the Commission's guidance points companies towards is the OECD's six-step due diligence framework: embedding due diligence into policy and management systems, identifying and assessing adverse impacts, ceasing or mitigating those impacts, tracking implementation, communicating externally and providing for or cooperating in remediation. None of this is written into the Regulation itself – it's soft guidance layered on top of a hard law that otherwise says very little about process.
This creates an unusual legal structure: a strict, product-level ban with almost no prescribed process, next to non-binding guidance that tells you, in some detail, what a defensible process looks like. For a compliance function, that's a genuinely awkward position to be in – you're being evaluated against a standard that isn't technically mandatory, using a methodology the regulator hasn't fully specified either, since the forced labour risk database referenced throughout the guidance is still under development.
The sensible response isn't to wait for the database or the finalised penalty formulas. It's to build a due diligence system now, aligned to the OECD framework the Commission has already pointed to, so that if and when an investigation ever opens, there's a credible answer ready rather than a scramble to construct one under pressure.
This is precisely the gap a certifiable due diligence management system is designed to close – turning the OECD's six steps into an auditable, evidenced system rather than a policy statement. Speeki is an accredited certification body offering independent verification of due diligence management systems; accreditation scope and current certifications are published at speeki.com.