What is the EU Forced Labour Regulation? A Guide to the FLR

Most supply chain regulations ask companies to prove they looked. The EU Forced Labour Regulation asks something harder: it bans the product outright if forced labour touched it anywhere along the way, and it does not care how big your company is or what industry you are in. There is no size threshold. There is no sector carve-out. A five-person import business and a multinational retailer face exactly the same rule.

The regulation, formally Regulation (EU) 2024/3015, entered into force on 13 December 2024 and applies from 14 December 2027. That date sounds distant. It is not, because the evidence a company needs to defend a product in 2027 has to be built into sourcing decisions made well before then. This post covers what the FLR actually does, how an investigation unfolds, and what companies should be doing now.

What the FLR Actually Bans

The Forced Labour Regulation prohibits placing or making available products made with forced labour on the EU market, and prohibits exporting them from it. It follows a product-based approach, similar in spirit to the EU Deforestation Regulation: the product itself is banned, at any stage of extraction, harvesting, production, or manufacturing, anywhere in the world, inside or outside the EU. Online marketplaces and distance sellers are covered too. If a website or app targets EU end-users, products sold through it are in scope.

The regulation defines forced labour using the International Labour Organization's Forced Labour Convention (No. 29): work or service extracted from a person under threat of penalty, for which the person has not offered themselves voluntarily. It is aimed at an estimated 27.6 million people in forced labour worldwide, according to ILO figures.

Two features distinguish the FLR from most supply chain rules companies already know. First, there is no minimum size threshold and no sector exemption. Second, and more unusually, the FLR does not create a new due diligence obligation of its own. Companies are not required to file a compliance statement or run a prescribed due diligence process under this regulation specifically. What the FLR does is far blunter: if authorities determine, through their own investigation, that a product was made with forced labour, that product is banned, withdrawn, and disposed of, regardless of what due diligence the company did or did not do beforehand. The practical effect pushes companies toward due diligence anyway, because due diligence evidence is what keeps an investigation from concluding against them in the first place.

How an Investigation Actually Unfolds

The FLR splits enforcement between the European Commission, which investigates suspected violations outside the EU, and national competent authorities, who handle cases inside their own territory. Every member state must designate at least one competent authority, and decisions are recognized across all member states under a principle of mutual recognition. There are four stages.

1. Risk assessment. Authorities gather information on potential violations from a range of sources: submissions from civil society, an EU-wide database of forced labour risk areas and products that the Commission maintains, and companies' own due diligence disclosures. They apply a risk-based approach, weighing the scale and severity of suspected forced labour, the volume of affected products on the EU market, and the share of any suspect component in the finished product. State-imposed forced labour is treated as likely to rank high on scale and severity.
2. Preliminary phase. If the initial assessment suggests a likelihood of violation, the lead authority opens a preliminary phase, generally by requesting information directly from the economic operator, unless doing so would jeopardize the process (for example, if evidence might disappear or a parallel criminal investigation could be compromised). The company has 30 working days to respond. The authority then has 30 working days from receiving that response to decide whether a "substantiated concern" exists. If not, the matter is closed.
3. Formal investigation. Where a substantiated concern is found, a formal investigation opens. The company is notified of the scope and reasons within 3 working days and given between 30 and 60 working days to submit further information and evidence. Authorities can request extensive documentation: supply chain maps covering direct and indirect suppliers, chain-of-custody certificates, bills of materials, certificates of origin, facility geolocation data, purchase orders and shipping records, and production capacity evidence to check that input and output volumes are consistent. National authorities can conduct inspections, including unannounced ones where national law permits; the Commission may, in exceptional circumstances and with the necessary consents, inspect outside the EU too. Authorities aim to conclude within nine months, though this is a target rather than a hard deadline, and complex cases can run longer.
4. Decision and enforcement. If the authority concludes the product was made with forced labour, it issues a decision prohibiting the product from the EU market (or from export), and requires the economic operator to withdraw units already in the distribution chain and dispose of them, by recycling or donating them or, failing that, destroying them. Compliance deadlines run from 30 working days for non-perishable goods to 10 working days for perishable goods. Where only a replaceable component is implicated, and the company can show precisely which units contain it, that part may be extracted and replaced rather than disposing of the whole product. For supply chains of strategic or critical importance, authorities may instead order the product withheld until the forced labour has been shown to have ended, rather than disposed of outright. Decisions can be appealed for review.

One detail matters more than it first appears: penalties are not imposed for the underlying forced labour violation itself. They are imposed for failing to comply with a ban-violation decision, meaning penalties apply if a company keeps selling a banned product, fails to withdraw or dispose of it, fails to replace an implicated component, or fails to comply with a withholding order. Member states set these penalties, which must be effective, proportionate, and dissuasive, and were required to notify their penalty rules to the Commission by 14 December 2026.

Why Traceability Is the Whole Game

The FLR does not use a rebuttable presumption the way the US Uyghur Forced Labor Prevention Act does for goods connected to Xinjiang, where the burden shifts to the importer to prove the negative. Under the FLR, the burden sits with the investigating authority to establish that a product was made with forced labour. In practice, that distinction matters less than it sounds, because the Commission's implementation guidelines, published in mid-2026, are explicit that a company's complete lack of traceability information, or its inability to produce it, can weigh against it in the overall assessment of evidence, especially where inputs may have mixed with high-risk components. Authorities can also act on the information available to them if a company simply fails to cooperate.

The guidelines are equally direct that documentation from ordinary due diligence work is exactly the kind of evidence that can resolve an authority's concerns during the preliminary phase, potentially heading off a formal investigation altogether. They also note that due diligence is not the only accepted route: product traceability, responsible purchasing practices, certification schemes, and worker-driven monitoring are all named as effective approaches. What the guidelines caution against is treating supplier contracts and assurances as sufficient on their own, without follow-up and independent verification. A signed code of conduct is not traceability. A dated, geolocated, independently verified record of conditions at the source is.

How the FLR Relates to the CSDDD

Companies preparing for the EU's Corporate Sustainability Due Diligence Directive sometimes assume the FLR is redundant with it. It is not, and the difference is worth being precise about. The CSDDD imposes an affirmative due diligence obligation on a relatively narrow set of very large companies, with civil liability and administrative fines tied to whether that due diligence was properly carried out. The FLR imposes no size threshold and no due diligence obligation of its own; instead, it bans a product outright once forced labour is established, regardless of company size or which due diligence steps were or were not taken. A company entirely outside the CSDDD's scope, with a handful of employees, is squarely inside the FLR's scope the moment it places a product made with forced labour on the EU market. The two regulations are best understood as complementary layers: the CSDDD asks large companies to build a due diligence system, and the FLR makes the evidence that system produces the difference between a closed preliminary inquiry and a product recall, for companies of any size.

How Earth PBC Helps

Earth PBC is a public benefit corporation built to close exactly the traceability gap the FLR's guidelines describe. The platform combines four capabilities that map directly onto what an FLR investigation actually asks for.

Community monitoring

Frontline workers and communities at the commodity source report conditions directly from smartphones, in their own languages, in more than 100 countries. Reports are timestamped and geolocated. This is the ground-level layer that a supplier questionnaire or contractual assurance cannot replace, and it is precisely the kind of independent, worker-driven monitoring the FLR guidelines name as an effective approach.

Satellite verification

Through our partnership with Planet Labs, we verify conditions at the commodity source from orbit, with more than 200 satellite passes daily and more than 3 million square kilometers of coverage every day. Satellite imagery cannot be edited by a supplier, and it corroborates community reports independently, at scale, across sourcing regions no audit program could physically visit on a meaningful cycle.

AI-powered reporting

Community reports and satellite observations are compiled into structured, dated evidence files: what was observed, where, when, and by whom. When a preliminary inquiry lands, or a formal investigation requests supply chain maps and traceability data within a 30-to-60 working day window, the difference between having that record already assembled and building it from scratch under deadline pressure is the difference between a closed case and a product ban.

Direct payments

We pay communities directly for verified monitoring work through stablecoin payments reaching more than 100 countries. Where remediation is genuinely needed, payments can reach affected people directly, which is worth doing on its own terms and also generates exactly the documented record of corrective action that an authority looks for when deciding whether a substantiated concern has been resolved.

None of this requires a company to be large, EU-based, or otherwise in scope of any other regulation. The FLR reaches any company placing products on the EU market, and traceability is the one thing that determines how an investigation ends.

What to Do Before December 2027

The practical question is not whether your company is big enough to worry about the FLR. It almost certainly is in scope if it sells into the EU at all. The question is whether you can show, for your highest-risk products and sourcing regions, what you know about the people who produced them, and how you know it. If a preliminary inquiry landed on your desk tomorrow, would you have 30 working days' worth of answers, or 30 working days of scrambling? Talk to our team at earthpbc.com/contact, and we will walk through how continuous, worker-reported, satellite-verified monitoring builds the traceability record the FLR asks for, well before an investigation ever opens.