The myth of the safe sourcing market: why reputation does not equal risk data

For decades, "Made in Italy" carried an implicit promise. Heritage, craftsmanship, and a manufacturing base assumed to be clean. Many risk assessments reflected that assumption, scoring Italy as a low-risk sourcing country.

Inside the factories, the reality was different. Since 2024, Milan prosecutors have placed several luxury brands under court-appointed administration following investigations into subcontractors accused of worker exploitation, with the supply chains of a dozen or more brands reported to be under scrutiny.

The Italian government has moved to protect the "Made in Italy" label: in October 2025, Industry Minister Adolfo Urso proposed measures to create voluntary legal certification of fashion companies' supply chains. But certification protects a reputation. It does not, on its own, fix what the investigations exposed.

This is not a story about Italy. It’s a story about the gap between how a country looks on paper and what is actually happening at the factory level – and why that gap is one of the most dangerous blind spots in responsible sourcing.

Why did "low-risk" Italy turn out to be high-risk?

The answer is in where the data comes from. Public and desktop risk indices tend to rate Italy as low risk across labour and social issues. Yet EiQ's onsite audit data tells a different story, and has done for years.

At issue level, EiQ's data has flagged Italy as extreme risk for migrant worker exposure and high risk for forced labour and unauthorised subcontracting, with the forced labour index rating Italy high-risk since 2020. These are not retrospective findings added after the headlines, but signals that were visible in the audit data well before prosecutors acted.

We covered Italy's risk profile in detail in our analysis of the "Made in Italy" investigations.

The discrepancy comes down to method. Desktop indices rely on public information and voluntary corporate disclosure, and they are not updated frequently enough to catch fast-moving change on the ground. When risk ratings are built on self-reported data, a country can look compliant long after the reality has shifted.

Italy may be the clearest current example, but it’s not the only one. In May 2026, the UK's anti-slavery commissioner reported modern slavery at record levels and warned the trend is set to worsen, while a parliamentary committee found the UK's framework on forced labour in supply chains inadequate. The pattern repeats: an established market, a strong reputation, and on-the-ground signals that the public picture is not keeping up.

The risk that hides in the deep tiers

Luxury supply chains concentrate risk in the places that are hardest to see, and subcontracting is the mechanism. A brand contracts a tier-one supplier; that supplier outsources to facilities that are less visible, less monitored, and less aligned to responsible sourcing standards. Production moves, and oversight does not move with it.

EiQ's adverse media analysis of the luxury sector underlines how concentrated this exposure is. In a scan of 1,049 entities in the luxury goods supply chain, EiQ detected 2,107 incidents, of which 41.4% were rated high or extreme risk. Labour-related incidents were the single largest category at 36.6%, with extreme exposure clustering around forced labour allegations, workplace fatalities, and acute health and safety events. 67% of incidents were concentrated in just five sourcing countries.

The deeper you go into the supply chain, the more the risk changes shape. EiQ's incident breakdown by supply chain activity shows that the high and extreme share of incidents differs across raw materials, processing, and assembly stages, with wages and benefits, humane treatment, and strikes dominating at the assembly stage. Tier-one audits matter, but they rarely give the full picture. The risks that surface in headlines and enforcement actions often sit deeper, in places a tier-one audit never reaches.

Why this matters more now

The cost of treating a market as safe because it looks safe is rising sharply. In our 2026 industry survey of 600 responsible sourcing professionals, more than half reported that their supply chain had been directly hit by penalties or fines for responsible sourcing violations in the past three years, whether from their own operations or their suppliers. For almost one in five, it had happened more than once. Supply chain risk is no longer only a reputational concern. It is increasingly translating into financial penalties, shipment detention, regulatory scrutiny and commercial loss.

Two regulatory developments are set to raise that exposure further. The EU Forced Labour Regulation (Regulation (EU) 2024/3015) entered into force on 13 December 2024 and applies from 14 December 2027. From that date, any product linked to forced labour at any stage of production, from raw material to finished goods, can be barred from the EU market. The regulation applies regardless of origin or sector, and the European Commission is due to publish guidelines and a database of high-risk products and regions ahead of application.

Luxury's risk sits in exactly the places this regulation reaches: the deep tiers and subcontractors a tier-one audit never sees. A regulation that follows the product to every stage of production leaves nowhere for that risk to hide.

In parallel, the US Section 301 investigations into forced-labour trade practices have moved markets that were long assumed to be low-risk, including the EU and the UK, into active scrutiny. In June 2026, the US Trade Representative issued determinations across 60 economies and proposed additional tariffs, not yet in effect, tied to whether those economies effectively police forced-labour imports. The direction of travel is clear: "established market" is no longer a defence.

What brands can do before the next headline

The shift required is not from auditing to monitoring. It is from periodic snapshots to continuous visibility, with audits and adverse media monitoring working together. Supply chains change faster than an annual audit cycle can capture, and the Italian investigations are a case study in what gets missed in between.

Practical starting points:

• Stop letting reputation set your risk budget. A country's standing is not a substitute for facility-level risk data. Score markets on what the audit evidence shows, not on what the label implies.
• Extend visibility beyond tier one. If your risk picture stops at your direct suppliers, it stops short of where exposure often concentrates. Map risk through the subcontracting nodes and lower tiers, not just the suppliers you contract with directly.
• Combine audit data with continuous monitoring. Onsite audits establish the baseline; adverse media and incident scanning catch the changes between cycles, before they escalate into disruption or a regulator's attention.
• Build the evidence trail now. Both the EU Forced Labour Regulation and Section 301 scrutiny reward brands that can demonstrate, with data, where and how they identified and acted on risk.

The brands now under court administration did not lack good intentions. They lacked visibility into the parts of their supply chains they had stopped looking at. Too many responsible sourcing programmes still mobilise only after the investigation, the detention or the public allegation, when the warning signs were in the data long before any of it reached the headlines.

Want to see where luxury sourcing risk actually concentrates? Our Supply Chain Risk Pulse: Luxury Sector Risk Hotspots report maps the highest-risk markets, the labour issues driving exposure, and the hidden risks beyond tier one.

To see how EiQ surfaces these signals across your own supply chain, request a demo or contact us at eiq@lrqa.com.