A Destination, Not a Law

On November 4, the UK government committed to legislate mandatory human rights due diligence and a power to pull forced labor goods from the market. Within 48 hours commentary had settled on a script: a lighter CS3D combined with a cousin of the EU Forced Labor Regulation (EUFLR) means it is time to start your gap analysis.

We read it differently. A ministerial statement is the seed of what might one day grow to become a law. What matters now is less what the statement says, which generates more questions than answers, than the world in which it was written. The UK is the first major economy to outline the contours of a due diligence statute after the EU's Omnibus retreat, after China's countermeasure decrees, after Washington's forced labor tariffs, and after the English courts opened their doors to supply chain forced labor claims. Those forces will likely shape the ultimate text of a bill, and perhaps a law—and the compliance program it will demand.

This note makes three points. First, the proposal is a concept note, and its few fixed points already depart from existing models. Second, it is another sign that due diligence regulation is fragmenting along national lines, while China's countermeasures and English tort law add pressures no current statute resolves. Third, the practical answer is the same if and/or when Parliament enacts whatever it might enact: one risk-based program, grounded in the UN Guiding Principles and documented to an evidentiary standard that can answer regulators, customs authorities and courts at once.

The many unknowns of the UK's approach

In 2015, the UK, borrowing a statutory framework from California, adopted its Modern Slavery Act. Slowly, and then very quickly, human rights regulations—strengthening sustainability disclosures, mandating due diligence and limiting the importation of forced labor goods—were proposed, adopted, or enhanced around the globe. Yet the UK largely stood firm with its first-generation transparency law despite non-compliance and undercompliance, bilateral pressure from the US and others, and public criticisms.

While there are few certainties of the UK's proposed regulation, it contemplates closing those regulatory gaps with one multi-faceted bill. According to the announcement, the law would reach UK businesses with global turnover above £350 million and non-UK businesses with UK turnover above the same mark. It will be risk-based, proportionate, and aligned with the OECD Guidelines and the UN Guiding Principles. A regulator will be able to investigate and direct the withdrawal of forced labor goods from the Great Britain market. Northern Ireland gets the EUFLR instead, under the Windsor Framework.

Beyond that, little is known. No regulator is named. There is no bill and no penalty regime. Its degree of alignment with the CS3D, or any other statute, is unstated. It is not clear whether any of the restrictions would apply to public agencies. The only timing signal is that the regulator's withdrawal power will apply no earlier than December 2027. Nothing says how far upstream the duty runs, or whether breach carries civil liability.

The only hard law in motion sits elsewhere. The Immigration and Asylum Bill, introduced on June 30, would put mandatory content and financial penalties behind section 54 of the Modern Slavery Act. That is the near-term compliance event, seeking to catch up to more recent modern slavery acts with such provisions. The bill cleared Commons committee in early November and awaits report stage. Cross-party new clauses, re-tabled for report, would add a duty to prevent slavery across value chains, subject to a "reasonable and proportionate steps" defense, and let ministers designate goods presumed to involve forced labor. Neither is government policy. The due diligence regime itself is a design brief, and design briefs can be influenced.

Three notable signals

Sparse as it is, the statement shows the UK is trying to forge its own path and not copying any existing instrument. Three features stand out.

Due diligence as a shield. As announced, the regulator may order goods off the market where forced labor is identified and due diligence duties have not been met. The UFLPA presumes forced labor based on product origin. The EUFLR and US Tariff Act ban the product no matter the company's efforts to identify and address forced labor. Virtually every other forced labor ban adopted across the world draws a similar bright line. The UK appears to make inadequate diligence an element of the case against the goods. If the bill holds that line, the model is closer to the Bribery Act's "adequate procedures" than to an import ban, and it departs from the outright ban requested by the Joint Committee on Human Rights. It also contemplates an awkward posture that policymakers may not be likely to embrace: permitting goods to remain on the market if they are found to be tainted by modern slavery, because the company can prove it conducted reasonable due diligence. Moreover, English law already cuts against it, as the Court of Appeal has held that goods made with forced labor can be criminal property under the Proceeds of Crime Act, and that paying a fair price does not cleanse them.

Company- not product-level enforcement. The EUFLR and Tariff Act reach any product from any operator. The UK power sits inside a regime for businesses above £350 million. Forced labor-linked goods sold by a smaller importer would seem outside its scope. We question whether the distinction will survive policymaker review, effectively blessing the inflow of forced labor goods into the UK by small and mid-sized companies. Another open question is whether the proposed regime will affect the UK's tariff designation by the US Trade Representative. The UK sits in the 10% tier of the Section 301 forced labor tariffs, as we set out in From Two Regimes to Many, and USTR's test is an import prohibition that is effectively enforced.

Northern Ireland sharpens the point. From December 14, 2027, the EUFLR will apply there to every product and operator, with no turnover threshold, and diligence is no defense once forced labor is established. The government expects supply chain risks to be resolved in Great Britain before goods move on. In effect, any product distributed UK-wide must satisfy both regimes, and the stricter one sets the floor.

Broader and narrower than CS3D. After the Omnibus, CS3D reaches only companies with 5,000 employees and €1.5 billion in turnover. A £350 million test sweeps in far more. But the UK duty covers human rights alone, with no environmental due diligence. "CS3D-lite" is an inaccurate label on both counts: the UK regime reaches more companies and covers less ground.

Fragmentation amidst convergence

The UK proposal signals fragmentation, not convergence. States increasingly share a vocabulary for due diligence, drawn from the UN Guiding Principles and the OECD Guidelines. They share little else: scope, enforcement, and liability are being set capital by capital. There is no longer a single European model to align with. The Omnibus deleted CS3D's EU-wide civil liability regime and left liability to 27 national laws, due by July 2028. Switzerland's draft Sustainable Corporate Governance Act would add a dedicated supervisory authority, with two parent-liability options still on the table.

The movement is not only European. Thailand's Ministry of Justice is drafting a responsible business conduct act, and Indonesia has a proposal on a fast track. South Korea's National Assembly has two bills in committee, one of which bars companies from unfairly shifting diligence costs onto suppliers.

Two consequences follow for program design. No single statute is a safe template. What carries from one jurisdiction to the next is the due diligence process they all borrow from the UN Guiding Principles. And suppliers upstream are becoming duty-bearers under their own law, not just recipients of requirements cascaded to them by contract.

The China challenge

National laws do not only diverge. Some now collide. CS3D, the German Supply Chain Act, and the UFLPA were drafted before Beijing had an answer. The UK's drafters have no such luxury. Decree 834 puts supply chain information-gathering in China under closer scrutiny and authorizes countermeasures against foreign companies. Decree 835 targets what Beijing deems improper extraterritorial jurisdiction. In August, MOFCOM designated the Responsible Business Alliance and Verité (among others), a move with profound implications for the conduct of supply-chain due diligence and regulatory compliance.

Sustainability due diligence is not prohibited in China. But the verification infrastructure is now a target, and that raises questions a UK bill must answer. What is adequate diligence where on-site verification is legally constrained? Is it a relative test—reasonable under the circumstances? Does a due diligence shield reward a file that cannot be tested? Could a UK regulator's forced labor finding itself be treated as an improper extraterritorial measure, exposing the company that complies with it? A statute that stays silent hands the conflict of laws to companies.

The open liability question

Regulators are not the only enforcers. The statement is silent on civil liability. The Joint Committee wanted a civil "duty to prevent." The common law has not waited for either.

English courts have shown that corporate parents can be held liable for harm abroad most closely linked to their foreign subsidiaries, and that claims over their suppliers will be heard, including claims of forced labor in the supply chain. A UK parent can owe a duty of care to people harmed by a subsidiary's operations, and its group-wide policies and public commitments may themselves ground that duty. In 2025 the High Court held parent companies liable at trial for a dam collapse overseas. The Court of Appeal has also accepted jurisdiction over a forced labor claim by a supplier's workers against a UK brand, and the High Court ordered early disclosure of the brand's dealings with that supplier before the claim settled.

A statutory duty will change the calculus whatever Parliament says about private claims. It will supply the standard of care and generate the paper trail. The old dilemma, in which more oversight meant more exposure, dissolves once knowing is mandatory.

Five lessons for companies

None of this argues for standing pat. Fragmenting national laws, a conflicting Chinese regime, and live tort exposure all point to the same program design whatever the UK might do in the end.

1. Build to the common core, not any specific regulation. The UN Guiding Principles process is the constant across every regime above. Run the turnover test now, and treat the coming consultation as the main event. One prioritized program beats one per jurisdiction, as we argued for import bans.
2. Treat due diligence as evidence. If diligence is the shield, the record is the defense. The same file must answer a UK regulator, the EUFLR, CBP and an English disclosure order. Build it to the documentary standard, and settle privilege before you need it.
3. Engineer for the China conflict. Do not rest verification on a single organization that can be designated. Ring-fence supply chain data, record why a step was or was not feasible, and base supplier exits on neutral commercial criteria.
4. Merge trade compliance and human rights. The duty is entity-level. The consequences are product-level: withdrawal, detention, tariffs. Two functions with two evidence bases will fail the same investigation twice.
5. Rewrite upstream contracting. Cascading clauses upstream will not carry a due diligence defense, and suppliers increasingly have statutory duties of their own. Move to shared responsibility, purchasing practices and the capacity to remedy.

The UK has told us where it may be going. We will see if it gets there, but companies that wait for the route may find it was drawn without them.