Supply chain crackdown: EU, US ramp up traceability rules

Between August and October 2026, key regulatory moves—including the EU’s Digital Product Passport implementation timeline, expanded U.S. Forced Labor Entity List updates, and new CBP import disclosure proposals—crystallized compliance obligations and enforcement expectations. That shift built on a mature U.S. framework: on December 23, 2021, Congress enacted the Uyghur Forced Labor Prevention Act (UFLPA), and on June 21, 2022, its import restrictions became enforceable, creating a rebuttable presumption under 19 U.S.C. § 1307 for goods mined, produced, or manufactured wholly or partly in the XUAR or by listed entities.

What changed in late 2026 was the clarity and intensity of enforcement. On July 31, the Forced Labor Enforcement Task Force, chaired by DHS, added 43 entities to the UFLPA Entity List, the largest single addition since enactment, and the law supports CBP’s enforcement of Section 307 of the Tariff Act of 1930, including detention, exclusion, seizure, and forfeiture, with the burden then falling on the importer. By October, the signal was unmistakable, as lawmakers pressed DHS after Labubu dolls Xinjiang cotton and 43 Companies were added to the UFLPA list, showing that entity-list expansion, customs action, and official scrutiny were converging.

The EU’s two-track regime is turning traceability from a voluntary brand exercise into a market-access condition. Fibre2Fashion says “EU Digital Product Passports could become mandatory for textiles from late 2028 or early 2029,” requiring brands “to provide traceable product, supplier, sustainability and compliance data,” while Delano.lu reports that from 14 December 2027 the EU can ban the sale of products made, even partly, with forced labour, meaning companies must “trace the origin of their products” and “demonstrate” that origin with supporting documentation.

What makes the shift urgent is that regulators are not asking for static paperwork but for evidence that can survive scrutiny across the chain of custody. Delano.lu notes authorities may request supplier information, preventive measures and risk-mitigation steps before opening an investigation, and warns that a company unable to document its supply chain has far fewer grounds to respond; that aligns with Cerfinity’s argument that printed QR codes are insufficient and that compliance-grade traceability must be tamper-proof, embedded at handling points, and tied to a verifiable digital record.

U.S. customs enforcement is tightening because CBP’s Sept. 2 Advance Notice of Proposed Rulemaking would expand disclosure far beyond today’s shipment-by-shipment entry filing into a document-driven test of supply-chain consistency. Logistics Management described the proposal as requiring “new foreign export docs and full supply-chain disclosure,” while Baker Tilly said CBP wants importers to provide or retain export declarations, commercial invoices, packing lists, certificates of origin, export licenses, and transport documents, then compare those records against U.S. entry data to detect discrepancies, undervaluation, fraud, or other violations.

The proposal also raises the granularity of who must be identified and what must be reconciled, showing that CBP is shifting from basic entry data toward upstream accountability. Baker Tilly said CBP views the current Manufacturer/Shipper Identification system as insufficient and is considering full legal names and addresses for manufacturers, producers, shippers, exporters, sellers, and possibly distributors; Jorge Torres said the rule centers on foreign export documentation reconciliation, comprehensive party identification, and technological tracing, with a 90-day comment window ending Dec. 1 to respond to 64 specific questions about implementation.

The disruption is no longer theoretical: Retail Insider captured the scale in the headline “Canadian Retail Supply Chains Face Scrutiny as $63.3B in Imports Linked to Labour Risk,” showing that compliance exposure already sits across a vast import base. At the company level, TrusTrace data reported by Green Retail World shows why that exposure is so hard to contain: while 75% report reliable information about their tier 1 factories, visibility falls to 33% at tier 3, and only 20% of respondents hold trusted data at tier 4, covering raw materials and farm-level sourcing.

That weak upstream visibility is already translating into operational and commercial risk, not just audit anxiety. Green Retail World reports that among brands selling into the US that have not experienced detention, 58% still consider it a realistic near-term risk; nearly half (48%) of US-selling respondents have yet to screen suppliers against US government forced labour entity lists; and only 21% of brands run continuous, automated compliance monitoring across suppliers, while 17% still rely on spreadsheets and email, leaving a large share of import flows exposed to avoidable disruption.