The Omnibus Let Most Companies Off the Hook. The EU Forced Labor Ban Did Not

When the EU's Omnibus I package rewrote the Corporate Sustainability Due Diligence Directive this year, a lot of mid-sized companies quietly took supply chain human rights work off their priority list. That reading was understandable, and it is dangerously incomplete. A separate law, the Forced Labour Regulation, sits alongside the directive with none of its new carve-outs. It has no employee threshold, no turnover threshold and no tier limit, and it starts biting in a little over fourteen months. Law firms have spent September telling clients the same thing: the product ban is coming, and it does not care how big you are.

Two Laws, Two Very Different Scopes

The Omnibus changes to the due diligence directive were substantial. According to Norton Rose Fulbright, the directive now applies to EU companies with more than 5,000 employees and net worldwide turnover above €1.5 billion, and to non-EU companies with more than €1.5 billion of turnover inside the EU. Member States have until July 26, 2028 to transpose it, and most obligations apply from July 26, 2029. The amendments also deleted the requirement to adopt climate transition plans and steered companies toward the adverse impacts that are most likely and most severe.

The Forced Labour Regulation works on a different logic entirely. It is a market access rule, not a governance duty. From December 14, 2027, it applies to all economic operators placing or making products available on the EU market, or exporting them, regardless of company size, and it covers products made wholly or partly with forced labor at any extraction, production or manufacturing stage, according to a September 15 compliance roadmap from Mayer Brown. The European Commission puts it plainly: from that date, no product made with forced labour may be sold in or exported from the EU market. It estimates that 27.6 million people worldwide are in situations of forced labour, drawing on 2022 data from the ILO, Walk Free and the IOM.

The practical consequence is a mismatch. A manufacturer with 1,200 employees may now sit comfortably outside the due diligence directive and still face an investigation into a single component three tiers down its supply chain. The directive shrank. The product ban never had a floor to raise.

What Enforcement Will Actually Look Like

The regulation is enforced product by product. Under the Mayer Brown analysis, the lead competent authority can request information with a 30 working day response window in the preliminary phase, open formal investigations with response periods of 30 to 60 working days, and issue prohibitions with EU-wide effect that require products to be withdrawn, disposed of or delisted online. The authority carries the burden of establishing both the forced labor and its link to the product, but it can rely on direct, indirect and circumstantial evidence, including worker testimony, audit materials and geolocation data.

The Commission's guidelines, summarized by Covington & Burling, show how far that reach extends. Investigations may cover parts, components or entire products, intermediate or final goods, and whole product series or categories. The Commission itself acts as lead authority where the suspected forced labor takes place outside the EU. The guidelines also lay out a five-step penalty methodology whose illustrative models range from 0% to 4% of an operator's annual global turnover, depending on the severity and duration of the violation.

The national penalty rules are not far off either. Member States must adopt their rules on financial penalties and notify them to the Commission by December 14, 2026, according to Sidley Austin, and a public complaints portal opens on the day the regulation applies. A forced labor risk database identifying elevated-risk products, sectors and geographies is still under development, which means companies cannot yet lean on an official list to tell them where to look.

Why Due Diligence Still Matters Without a Mandate

Here is the subtle part. Under the regulation, due diligence itself is voluntary. The guidelines recommend a six-step framework drawn from OECD guidance, tailored to the forced labor context, but no company is fined simply for lacking one. What gets punished is the product. That makes due diligence the only practical defense: a company that cannot show where its inputs came from has nothing to put in front of an investigator during a 30 working day information request.

Brussels is signalling where it expects the pressure to land. The Commission is running webinars through November, including sector sessions for solar, textiles, electronics, agri-food, automotive and fisheries, and it has put out a tender, closing September 28, for pilot contracts on supply chain traceability and risk detection. Those are the categories where component-level evidence will matter first, and where suppliers of every size will be asked to produce it.

The Forced Labor Readiness Playbook

• Stop reading the Omnibus as an exemption: Check your status under the Forced Labour Regulation separately from the due diligence directive. Falling below the 5,000 employee threshold changes nothing about the product ban.
• Map high-risk products to raw materials: Mayer Brown advises supply chain mapping back to raw material sources. Start with products in the sectors the Commission is training first, and trace them past tier one.
• Build an evidence file per product: Bills of materials, facility locations and chain-of-custody records are what an investigator will ask for. Assemble them before the first request, not during a 30 working day window.
• Rewrite supplier contracts now: Add forced labor and transparency clauses that require suppliers to disclose their own sources and cooperate with investigations. Contracts signed today will still be running in December 2027.
• Name a cross-functional response team: Legal, procurement, sustainability and logistics each hold part of the answer. Decide in advance who owns an information request and how fast they can respond.
• Plan for remediation, not just exit: The guidelines define remediation as restoring affected people to as close as possible to where they would have been. Know when you would remediate and when you would responsibly disengage.