Navigating overlapping supply chain regulations

Kevin Franklin and Erin Lyon on cutting through the regulatory soup facing global brands

Anyone working in responsible sourcing today is trying to comply with more than 16 overlapping regulations across the EU, US and Asia – CSDDD, CSRD, the EU Forced Labour Regulation, the German Supply Chain Act and the various national Modern Slavery Acts among them. The instinct is to treat each one as a separate project, with its own working group and its own platform. Run it that way and the cost climbs fast.

In this episode, EiQ Content Manager Jenna Thompson speaks with Kevin Franklin, CEO of EiQ, and Erin Lyon, Global Head of Partnerships at LRQA. They discuss what the regulatory environment actually demands of brands in 2026, where the genuine conflicts sit and where it's only overlap, why supply chain rules increasingly turn on access to critical raw materials, how data and privacy law adds another layer, and the first realistic move for a brand building towards compliance across all of it.

Episode length: 19 minutes

Full transcript

JT: Hello and welcome to our session on navigating overlapping supply chain regulations. I'm here with Kevin Franklin, CEO of EiQ, and Erin Lyon, Global Head of Partnerships at LRQA. Would you like to introduce yourselves?

KF: Very happy to. Yes, my name is Kevin. I have two roles at LRQA as Chief Product Officer and also as the CEO of EiQ. My background is very much sustainability, so roughly 30 years. The first part of that was based out of the UK and the last ten years I've been based out of Hong Kong.

JT: Okay. And Erin?

EL: Hello. Yes, I'm Erin, Head of Partnerships at LRQA. In reverse, I spent much of my career in Asia and then ten years ago moved back to London.

JT: Lovely. Okay. Thank you both so much for being here.

Anyone working in responsible sourcing right now is navigating over 16 overlapping regulations across the EU, US and Asia. You've got CSDDD, CSRD, UFLPA, the EU Forced Labour Regulation, the German Supply Chain Act, the various national Modern Slavery Acts, and increasingly the regimes pull in different directions. And the temptation is to treat each one as a separate project with its own working group and its own platform. But the cost of running it that way is enormous.

So today, we're going to be looking at what the regulatory environment actually demands of brands in 2026, where the real conflicts are, and how to build a programme that meets multiple obligations at once, rather than chasing each one in turn.

So, Erin, if I could come to you first, if you ask a sustainability lead what regulation they're worried about right now, you might get a different answer depending on the week. So what's the shape of the regulatory environment a global brand is actually navigating in 2026? And what makes it different from five years ago?

EL: Okay. You could have asked me what makes it different from five days ago, five minutes ago, because it's just changing all the time. And also, I think who you ask within an organisation, you might get a different answer as well.

So what a lot of the larger brands are doing is they're hiring dedicated sustainability lawyers literally to do the job you've just described, which is to monitor and map: what are the regulations? What do we need to comply with? How do we make sure that we're compliant in all jurisdictions? It's a wonder web of different requirements. And what that means for the sustainability lead is they need to engage a lot more internally with different departments so that they can make sure they properly understand the regulations and the impact on their day-to-day activities.

JT: There's a sense that the regimes are starting to pull in different directions in some places while broadly converging in others. So, what are the real conflicts a brand has to navigate? And where is it more about overlapping demands than genuine contradiction?

EL: Yeah. The word conflict is quite difficult, isn't it? Because sometimes it might be, it's not a conflict, there's just a gap that you have to navigate within. So in terms of what is out there and what might be perceived to be conflicting is you have lots of different jurisdictions trying to build their own approach to managing supply chains.

So there's two ways we need to look at this. One is: what is all the legislation that's being mapped out? And the second one is: what is the geopolitical context that those regulations exist within? Because it might be you can understand one by best understanding the other. So if you understand the geopolitical reality of everybody needs access to critical raw materials in hard-to-reach places in order to have very successful, huge companies that rely on those core materials. If you think about our mobile phones, our laptops, the things we drive around in, renewable energy, we need to have access to all those materials. And that's what is creating the geopolitical tensions around, well, who is going to own that and how are they going to own it? That's the context.

The second piece is: how are individual governments shaping the reality about how they can legislate for access to those materials? And one of the ways they're looking to do that is through supply chain regulation. And one of the levers they're looking to pull to give them access to how those goods can move is whether or not they have a nexus with some kind of forced labour, some kind of slavery connected to those supply chains.

So what's happening is different parts of the world are putting in different ways of regulating access to those materials. And what some governments are saying is, we are going to regulate… let me be more specific, not some governments. What you've got is China saying: we want to make sure that we have supply chain protection regulations. So nobody outside of China can make decisions about buying from Chinese suppliers that might have a negative impact on Chinese companies.

The European Union are saying companies: you have to do a lot more due diligence. You have to know exactly where all of your products, services, raw materials come from, and you have to be able to document that. You have to be able to evidence that, and you have to make sure that you have a clean supply chain that's slavery free.

What the US is saying is we're going to have a tariff situation where, one, we are not going to allow… countries who want to trade with us have to have a forced labour ban and they have to enforce it. Otherwise they are subject to tariffs if they want to import into our country. And second of all, they're going to use decades-old legislation to enforce the fact that you cannot bring goods into the US if they can show it's been made with forced labour, or if you can't prove that it's not.

So that's the sort of contradictions that we have. And there's a lot more detail and a lot of different European regulation with respect to specific goods as well, such as batteries. That creates a conflict when we're talking about access to raw materials. But in terms of what companies should be doing is mapping: well, where do those gaps exist? Where am I trading? What am I moving from where to where, and where are the different legislations, and what do they require me to do? So that you've got a very clear view of the map of potential gaps and maybe conflicts, and then prioritise, well, what is the key priority goods that I need to move, and what do I need to focus on, and where do I need to do that due diligence? Document your processes. I’m making this sound really easy, it’s really not. Document all your activities, what you've achieved, what information you've asked for, what you haven't been able to collect, and then what best efforts you've made to make sure that you properly understand your supply chain.

KF: If I can maybe just add another layer of complexity to that, because you've spoken about basically how a lot of this is founded in national security, economics, geopolitics, and then a lot of what we've reflected there is linked to the sustainability-related regulations, how they're linked to all of those things and the different jurisdictions. But there's actually a whole layer of other regulation that is now interfacing as well, such as regulation around data, data privacy. Or privacy, GDPR, personal information. So it's not even that simple. It's all of that. Plus now in another layer to the matrix, another dimension, which is other regulations that overlap with all of the regulatory soup that you've just outlined.

JT: Yeah, I was going to say it doesn't sound like it's easy at all. It sounds really, really complicated.

Kevin, you've described regulatory alignment as the single biggest positioning task for the industry right now. So why has the responsible sourcing world been slower to anchor itself in regulatory drivers than say the financial or food safety worlds have been?

KF: That's a great question. And I think it's really because it's happened very fast. The regulatory landscape in responsible sourcing or in sustainability has been one that started really slowly and then all of a sudden happened really quickly.

Some of the very early elements, like modern slavery acts or the California Supply Chain Transparency Act, you know, they go back maybe 15-20 years, some of them. But they were quite isolated, they applied in small areas or jurisdictions, relatively, and they didn't have the kind of teeth that regulation has today.

We're also starting to see more of these sorts of penalties be imposed across businesses in other jurisdictions. Regulation in France as well, and obviously some of the forthcoming European forced labour regulation and the EU deforestation and then battery. There'll be a lot more penalties that'll drive, I think, a lot more seriousness around this in the foreseeable future.

EL: I think as well, it's almost deliberate by design. Because 20-30 years ago… there's parallels to how we look at regulating the internet now in terms of: let's not do it because it's voluntary and it's enough for it to be voluntary in terms of sustainability. That was the sort of pact all those years ago is: actually let's rely on a soft law approach where we as business, say this is in our better interest. So therefore we'll comply with these softer voluntary regulations and all will be well.

But we've seen how that's gone. And those sort of compacts and those agreements haven't necessarily been successful. So they've had to shift to a hard law position. But I think within that process of the creation of the hard law, they're seeing pushback, which is why you've almost got to a compromise position with some of this, some of the regulation that isn't as hard as it was going to be maybe three years ago.

KF: Yeah, it's a really good point, actually, because a lot of it at the beginning was maybe more reputational. And then we coupled the reputational with the investor interest. And now we're looking at compliance regulation penalties and fines. And yeah, it has taken 20 to 30 years for that to get progressively tightened.

EL: Yeah.

JT: Okay. So if we could take a specific obligation, just as an example, say CSDDD’s requirement to identify adverse impacts in the supply chain. When you look at a responsible sourcing programme, some of it satisfies that requirement directly, some produces the evidence to show it's been done, and some supports the wider duty without being the control itself. So why does that distinction matter? And where do brands tend to confuse the three?

KF: So the way I think of this is: imagine a very long list of all of the regulations and all of the respective clauses in those regulations. It's a very long list now. And then imagine that in a matrix where the columns in that matrix are different parts of your responsible sourcing programme. So for example, audit or risk assessment or corrective actions or training. Each of those different elements of your responsible sourcing programme should somehow map to exactly what you just outlined. A degree of, let's say, satisfaction or a degree of completeness with respect to that regulation.

Some of them will discharge the regulation fully, right? If you have an audit report, hopefully that says there's no child or forced labour in a factory, hopefully that should be, in its own right, enough to show that you're compliant. Other parts may be evidence that supports a pack of evidence you submit to evidence that you are compliant, and the way in which those combinations of fully discharging plus evidence come together will depend on the specific regulation, how stringent it is, how tough the regulator is going to be. And this is exactly what we need the legal professionals in place to be doing and why we have dedicated teams doing that now in some responsible sourcing organisations.

JT: So final question. For a brand starting from a reasonably mature programme today, what's the realistic first move towards genuine compliance and evidence across the obligations they're facing?

EL: No, I'm just thinking through in terms of how you would decide you had a reasonably mature programme and what does that mean? That question, even tomorrow, might be different from what it is today.

So say you've been actively employing a dedicated team of people to look at your supplier base for ten years to understand where are my risks, mitigate them, remediate them. You're sitting in a position now and you say, is that fit for purpose for this alphabet soup that we've just described and discussed? The answer is probably not because the context has changed, the requirements have changed. So it would be a question of conducting that mapping, looking at your existing programme, and where does… it what are we… how can we evidence that the activities we have meet the requirements? And then looking at that gap in the middle and saying what is the additional information or activities we need to conduct to suggest that it is fit for purpose?

Probably the position most people are in is: we've had a blanket audit programme for maybe a decade, maybe longer. And nothing's changed. So the question would be, what do we need? What activities or where should we be auditing? What needs to be different? So it needs to be much more a look at how do we implement a risk-based programme to understand where is the likelihood of the highest risk, and what activities am I doing in those places. And very likely the activities don't go deep enough and don't look in the right dark corners to make sure you've made absolute best efforts to fill that gap that you've identified in the middle.

KF: Yeah, I would agree with all of that. I would also say start by looking at what regulations you're subject to. And that's an important question because if you're not present in a country, if you have no product in a country, then maybe you're not subject to that regulation.

So it may be that, let's say there's 16-20, right, that are key. And only six of those really impact your business. So it could be firstly: do that activity to understand which regulations you're subject to based on the geographies in which you operate and the size of your company and the nature of your business. Because a lot of the regulations are also linked to company size, turnover in different markets, etc. So that is step number one.

And then I fully agree with you Erin. I think it's all about understanding your business, mapping it to the regulations you're subject to through that lens of risk. I think that risk assessment is super important because if you're procuring palm oil or another one of the listed commodities, then you're going to be subject to EUDR. And if it's coming from one of those high-risk countries, then it's red, red, red. So this is something that you need to be actively looking at. So I think it's a combination of all of the above.

JT: Thank you so much. I think it's a really complicated topic, isn't it? And I think that's helped to make it an awful lot clearer. Is there anything either of you would add that you think people should take away?

EL: One thing to add, maybe, is don't underestimate the amount of time it takes to prepare to be compliant. Even if it seems that deadline is three, four years away, it will come round really quickly and it's a change process, and it's a change for an activity that people are quite resistant to, quite often. And that takes quite a long time. So if the legislation's coming in in 27/28, you're ready too late because you will likely have to change systems. You will need to collect information. You will need to know who is accountable for doing what activity. So you're already starting too late. So you need to be moving quickly.

KF: Absolutely right. Particularly something that is linked to data. If you have to host your data in one country or another and you've never actually looked at your data through that perspective, then you really need to start actioning that immediately because it could take you a year or longer to prepare your data assets and to figure out how to then ensure the right data is hosted in the right environments to comply with respect to regulation.

One other thing I would add to this is to Erin's point right at the beginning, these things are changing every day. So it requires a constant watch. It requires a constant watch to see whether some of the forthcoming regulation has maybe published a guidance note, or published some insight into what's new, an increased scope, a decreased scope, a change in scope, etc. Constant watch. And then also through that constant watching, I think a constant re-evaluation of your programme and whether it's aligned with where the regulation is going. So there needs to be essentially a real-time management of this in terms of not just tracking and preparing, but also programme design, making sure your programmes are designed and fit for future.

JT: Thank you so much, Kevin and Erin, for joining us. A really complicated topic that I think has been made considerably clearer. If you'd like to find out more, you can go to eiq.com, you can follow us on LinkedIn, and I hope to see you again for another one of these sessions very soon.