Skip to main content
    QHSEtech
    Updated 4 October 2026
    Software Guide · Reviewed 22 September 2026

    Supply chain due diligence: scope to the law in force

    The buying risk in this category changed in 2026 and a lot of published advice has not caught up. The EU due diligence directive's deadlines moved substantially under the Omnibus package, pushing application several years out — while the German and Norwegian national laws were already in force. Scoping a platform against the deferred obligation means paying now for a configuration that will be out of date before it applies. Scope against what binds you today, and buy the ability to extend.

    Jump to the 10 products

    Editorial responsibility: Dimitris Mitsios (Founder of The QHSE Standard; product marketing at Tekmon) · Tekmon pays for sponsored placements on this site (disclosure) · How pages are made · LinkedIn · Content date: 4 October 2026

    On this page (8 sections)

    What actually binds you, and when

    As set out by the European Commission and checked on 22 September 2026, the Omnibus I amendments require Member States to adopt and publish national transposition measures by 26 July 2028, with the rules applying from 26 July 2029 — except the Article 16 reporting measures, which apply for financial years starting on or after 1 January 2030. Commission guidelines are due by 26 July 2027, with further guidance by 26 July 2028. Confirm the current position and your national transposition before treating any of this as settled; this area has already moved more than once. European Commission: corporate sustainability due diligence

    That is several years away, and it is the part of the market most heavily marketed today. The obligations that bind now are national: the German supply chain act and the Norwegian transparency act have been in force since 2023 and 2022 respectively, and neither was deferred by the EU timetable. Germany's enforcement has nonetheless changed: BAFA's reporting page says it stopped reviewing company reports under sections 12 and 13 and closed its submission route in anticipation of an amendment the Federal Cabinet passed on 3 September 2025. The Bundestag's own report records a first reading of the government bill on 16 January 2026, followed by referral to committee, and we found no record that it has since been passed or has entered into force; its procedure register could not be read in full on 4 October 2026, so check the current position. If you are in scope of either law, check its current text and enforcement practice, then let that decide your first configuration. BAFA: reporting obligation under the German Supply Chain Due Diligence Act Deutscher Bundestag: first reading of the Supply Chain Due Diligence Act amendment, 16 January 2026

    Both national regimes, and the EU directive behind them, derive their structure from the same international instruments: a risk-based, iterative process of identifying risks, prioritising them, taking preventive action, tracking whether it worked, communicating and remediating. Building to that structure rather than to any single statute is what makes a configuration survive the next legislative change. OECD Due Diligence Guidance for Responsible Business Conduct; UN Guiding Principles on Business and Human Rights

    What the process needs from software

    Supplier register and prioritisation

    A defensible record of who your suppliers are and why some were prioritised over others. The prioritisation rationale is the part an auditor examines, and it is the part spreadsheets lose first.

    Risk signals and screening

    Media, sanctions and index screening, usually licensed from third parties. Establish which data sources are included, how often they refresh, and what happens to your costs if a source is dropped.

    Findings, action and evidence

    An adverse finding needs an owner, an agreed measure, a date and evidence that it changed something. Ask to see a finding that was not resolved — cessation and disengagement have to be recordable too.

    Researched scope for supplier work

    "Supplier engagement" means different things here: emissions data collection, quality events and human rights due diligence are three different processes that share a word. Each note records where that vendor's own documentation draws its scope; not ranked, not equivalents, not tested hands-on.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    Same rule for every product: tagged “Supplier Due Diligence”, “Supplier Sustainability”, “Supplier Evaluation”, “Supplier Management” or “Supplier Data”, with a sourced supplier due-diligence or risk capability in its record, or one the vendor stated to us, labelled as vendor-stated. 10 qualify; the first 8 are shown here. The directory below continues with the other 2 tagged profiles, 2 of which also meet the rule.

    Run one supplier through the whole process

    1

    Onboard a real supplier with incomplete data

    Use one of your own, with the gaps your records actually have. A demonstration on a complete sample record proves nothing about the 80% of your register that is partial.

    2

    Prioritise, and record why

    Have the platform place the supplier in a risk tier and establish where the reasoning is stored. If the rationale exists only as a score, you cannot explain the decision later, which is what an auditor asks for.

    3

    Raise an adverse finding from a screening hit

    Establish which third-party sources produced it, when they last refreshed, and whether the hit is retained if the source later drops it. A finding that silently disappears is a records problem.

    4

    Agree a preventive measure and let it fail

    Assign a measure with an owner and a date, then record that it did not work. Confirm escalation, and that cessation or disengagement can be recorded as an outcome rather than only successful remediation.

    5

    Produce the report and the evidence behind it

    Generate the public-facing summary, then trace one statement in it back to the underlying finding, measure and date. Confirm the trace is exportable and readable without a licence.

    Questions that separate candidates

    Where is the prioritisation rationale stored, beyond the score?
    Which third-party risk data sources are included, and how often do they refresh?
    What happens to a finding if its source data is later withdrawn?
    Can cessation or disengagement be recorded as an outcome?
    Does the platform handle a grievance or complaints channel, or is that separate?
    How are tiers beyond tier one represented, if at all?
    Can the configuration extend from one national regime to another without a rebuild?
    Is supplier engagement licensed software, a service line, or our work?
    How is supplier-provided data distinguished from screened or estimated data?
    Can a published statement be traced to its evidence in an export?

    Sources and evaluation limits

    5 sources, checked 22 Sep – 4 Oct 2026

    EU status and dates: European Commission: corporate sustainability due diligence, checked 22 September 2026. German enforcement and bill: BAFA: reporting obligation under the German Supply Chain Due Diligence Act; Deutscher Bundestag: first reading of the Supply Chain Due Diligence Act amendment, 16 January 2026, both read 4 October 2026. Process structure: OECD Due Diligence Guidance for Responsible Business Conduct; UN Guiding Principles on Business and Human Rights.

    We do not publish a figure for how many suppliers a company of a given size has. The previous version of this page carried one; it was not sourced, and the range is wide enough between sectors to be useless as a scoping input. Count your own register before sizing a platform.

    Nothing here is legal advice, and whether you are in scope of any regime is a determination for the people accountable for it, not for a software guide. Regulatory dates in this area have moved more than once and may move again — confirm the operative position before committing. Product notes come from each profile's researched sources, each linked with its source; no product was tested hands-on and none is ranked.

    More researched products for this process (2)

    The rest of the list above: every other catalogue profile meeting the same tag-and-capability rule, in the same order, checked against the vendor's own documentation on the date shown. Not a recommendation or a complete market map; confirm the module and workflow with the vendor.

    Software categories to explore

    Use this Process to define the work, then explore these software types. Confirm the exact workflow and module with each vendor.

    See all software categories

    Related Guides

    Modern Slavery SoftwareEUDR Compliance SoftwareWhistleblower Management SoftwareSupplier Management SoftwareCSRD Compliance SoftwareBest ESG & Sustainability Software

    More related guides

    Frequently Asked Questions

    When does the EU due diligence directive actually apply?
    Later than most published guidance says. Following the Omnibus I amendments, the Commission states that Member States must adopt and publish national transposition measures by 26 July 2028, with the rules applying from 26 July 2029, and the Article 16 reporting measures applying for financial years starting on or after 1 January 2030. Guidelines are due by 26 July 2027. Confirm the current position and your national transposition rather than relying on any secondary summary, including this one.
    Should we buy now or wait?
    It depends entirely on whether a national regime already binds you. The German and Norwegian acts have been in force since 2023 and 2022 and were not deferred by the EU timetable, although BAFA has stopped reviewing German company reports in anticipation of an amendment that we found no record of being in force, so if you are in scope of either, check its current requirements before deciding. If your only exposure is the EU directive, you have time — and buying a configuration now against requirements that will be clarified by guidelines in 2027 and 2028 risks paying to rework it.
    Does due diligence software mean human rights, emissions or quality?
    All three use the phrase supplier engagement and they are different processes. Emissions platforms engage suppliers for activity data. Quality platforms raise supplier events against specifications. Human rights due diligence identifies and prioritises risks to people and records preventive measures. A vendor strong in one is not automatically useful for another, so name which process you are buying before comparing.
    What does an auditor actually look at?
    Less the register than the reasoning. Why these suppliers were prioritised and others were not, what was done about an adverse finding, whether anyone checked that it worked, and what happened when it did not. Systems that store a risk score but not the rationale behind it, or that can only record successful remediation, leave you unable to answer those questions.
    How do we avoid rebuilding when the law changes?
    Configure to the underlying process rather than to a single statute. The OECD guidance and the UN Guiding Principles set out the same risk-based, iterative cycle that the national and EU regimes each express in their own language. A platform that models identify, prioritise, prevent, track, communicate and remediate will map to the next regime; one configured around a specific statute's report format will not.