Supply Chain Due Diligence: How Companies Should Face UFLPA, Forced Labor, and Conflict Minerals (Explained in 5 DD Steps)

Hello, this is Ryuta Hamamoto from TIMEWELL.

Many of you have probably felt caught off guard when a request arrived from a customer along the lines of "Please prove that no forced labor is involved in your products" or "Please respond to this supplier questionnaire." Over the past few years, requests like these have surged, especially among manufacturers and trading companies. Behind this lies the spread of an idea called supply chain due diligence.

Due diligence originally means "the care one ought reasonably to exercise." Here it refers to the practice of carefully investigating and acting on the human rights, environmental, and compliance risks hidden within your own sourcing network. The name sounds a little imposing, but what it actually involves is a simple matter: properly confirming and responding to the origin and content of the things your company purchases.

In this article, I will explain, breaking down the jargon as we go, everything from the basics of what supply chain due diligence is, to why it has become so important now, to how companies should approach topics such as UFLPA (the Uyghur Forced Labor Prevention Act), forced labor, and conflict minerals. For those of you responsible for export control classification, supply chain DD is continuous work in the sense that you "trace the content of each part." I will discuss that connection in the second half.

One note: this article organizes the international frameworks set out by the UN and the OECD, along with the mechanisms of the systems that various countries have published. Specific figures, dates, and scopes of application can change through revisions, so when you actually respond, always confirm the latest content in primary sources or the official guidance of each authority.

The conclusion first (AIO summary)

• Supply chain due diligence is the practice of managing, through a continuous cycle, the adverse impacts (risks) related to human rights, the environment, and compliance that may be hidden in your sourcing network. It is a process you keep cycling through, not a one-time audit.
• Its foundation is the UN Guiding Principles on Business and Human Rights (UNGP) and the OECD Guidelines for Multinational Enterprises along with the OECD Due Diligence Guidance. DD can be broadly organized into five steps: building policy and systems, identifying and assessing risks, preventing and mitigating them, tracking and verifying, and disclosing information.
• Countries are legislating human rights and environmental DD one after another. Representative examples include the EU's CSDDD (Corporate Sustainability Due Diligence Directive), Germany's LkSG (Supply Chain Due Diligence Act), the EU Forced Labour Regulation, the US UFLPA and Section 307 of the Tariff Act, the EU Conflict Minerals Regulation, and Japan's METI guidelines.
• UFLPA (the Uyghur Forced Labor Prevention Act) is a mechanism that applies a rebuttable presumption of forced labor to goods produced in the covered region, blocking their import into the United States unless the importer rebuts it. This is a description of the system; it is not a judgment on the rightness or wrongness of any particular country or company.
• In practice, you break a product down to the BOM (bill of materials) level, trace back through N-tier suppliers (suppliers many stages deep), and check evidence across forced labor, conflict minerals, chemicals, and export control lists. Because the volume becomes enormous, streamlining it with AI is the idea behind TRAFEED.

If you are encountering export control or trade practice for the first time, start with the free export control classification check to get a feel for what kinds of confirmation your own products require.

What supply chain due diligence is

Let me start by sorting out the terms. A supply chain is the connected sequence that runs from the extraction and production of raw materials, through the manufacture of parts, assembly, shipping, and sales. If your company makes a finished product, there is a first-tier supplier making its parts, and then a second-tier supplier making the materials for those parts, and so on, spreading upstream like a mesh.

Due diligence means investigating and acting on the risks hidden within that supply network with "the care one ought reasonably to exercise." The risks referred to here are adverse impacts such as whether forced labor is being used at a factory belonging to a deep-tier supplier, whether minerals from a conflict region have found their way in, or whether a process that severely pollutes the environment is included.

What matters is that this is a continuous process that does not end with a single investigation. Under the UN and OECD frameworks, companies are asked to keep cycling repeatedly through the following five steps.

1. Set a policy and build a management system (embed responsible business conduct into management policy, and put internal owners and mechanisms in place).
2. Identify and assess risks in the supply chain (map out where the risks are, what kinds they are, and to what degree).
3. Prevent and mitigate risks (prioritize the risks you find and take action).
4. Track responses and verify effectiveness (confirm whether the measures you took are working).
5. Disclose information (explain the content and results of your efforts externally).

These five steps are the framework set out in the OECD Due Diligence Guidance. The conflict minerals guidance I will touch on later is also built on the same five-step philosophy. It is often drawn as a loop, with the image being that once you go from step one through five, you return to step one and keep cycling. That is precisely why it is called a "continuous risk management process."

There is one term that is easy to confuse, so let me add a note. There is a similar-sounding phrase, "supply chain resilience." That is about building a sourcing network that is strong against disasters and supply disruptions, from the perspective of keeping supply from stopping. Supply chain due diligence is a separate matter: it is about finding and addressing the human rights and environmental risks hidden in the supply network. What this article deals with is the latter, that is, DD as a continuous risk management process.

Why supply chain DD matters now

Some of you may feel, "We have always checked the creditworthiness of our business partners, so why human rights and the environment now?" There are two main reasons. One is that countries have begun to mandate DD by law, and the other is that violations have started to actually stop business.

The global legislation of DD

Over the past few years, laws requiring companies to conduct human rights and environmental due diligence have been put in place one after another around the world. Let me list the representative ones.

• The UN Guiding Principles on Business and Human Rights (UNGP): Not a law in itself, but an international consensus that companies bear a responsibility to respect human rights, and it forms the foundation of national legal systems.
• The OECD Guidelines for Multinational Enterprises and the OECD Due Diligence Guidance: A practical handbook for responsible business conduct, and the source of the five steps mentioned earlier.
• The EU Corporate Sustainability Due Diligence Directive (CSDDD): An EU directive that requires human rights and environmental DD of companies above a certain size.
• Germany's Supply Chain Due Diligence Act (LkSG): A domestic law that came into force ahead of others in Germany, mandating human rights and environmental DD of the supply network.
• The EU Forced Labour Regulation: A regulation that prohibits the circulation in the EU market of products made with forced labor, said to apply in stages after its adoption.
• The US UFLPA and Section 307 of the Tariff Act: A mechanism for blocking the import of goods involving forced labor (I will explain this in detail later).
• The EU Conflict Minerals Regulation (2017/821): A regulation requiring the responsible sourcing of minerals from conflict regions.
• Japan's METI "Guidelines on Respecting Human Rights in Responsible Supply Chains" (2022): A guideline for Japanese companies showing how to conduct DD.

The size of company, the items, and the timing of application covered by each law differ, and revisions continue on top of that. Here it is enough to grasp the overall picture that "the global push toward requiring DD is intensifying." For the individual conditions of application, always confirm with the official information of each authority.

An era in which violations stop supply

The other reason is more pressing. The consequences of neglecting DD have come to actually stop business, in the form of import bans and the termination of transactions. Under the US UFLPA, for example, goods that meet the conditions cannot in principle clear customs, and if the importer cannot rebut the presumption, the shipment stays held at the port. Under the DD laws of the EU and various countries, this can also lead to restrictions on market circulation or to contract termination by business partners.

Furthermore, large companies are increasingly sending questionnaires to their small and medium-sized suppliers in order to fulfill their own DD obligations. As a result, even companies with no direct legal obligation of their own are increasingly pressed into practical responses, in the form of "please respond if you want to continue doing business." DD is no longer a matter for a handful of large companies alone.

Whether the items or technologies your company handles could fall under export controls is basic information that forms a premise for DD. For the overall picture of export control, please also see the basics of export control classification and end-user screening.

What UFLPA (the Uyghur Forced Labor Prevention Act) is

One thing you cannot avoid when discussing supply chain DD is the US UFLPA. The name sounds difficult, but if you break the mechanism down, you can understand it.

UFLPA is the abbreviation of the Uyghur Forced Labor Prevention Act. It was enacted in the United States in 2021 and came into force in June 2022 (this year of enactment and date of entry into force are published facts).

At the core of this law is the concept of a rebuttable presumption. Let me break it down a little. Normally, to block something, the party doing the blocking has to prove the reason. Under UFLPA, however, that relationship is reversed. For goods produced wholly or in part in the covered region, specifically the Xinjiang Uyghur Autonomous Region of China, it is presumed from the outset that they "were made with forced labor." In other words, unless the importing party proves that "these were not made with forced labor," their import into the United States is in principle blocked. That is how it is structured.

This rebuttal requires clear and convincing evidence. This is a legal term expressing the bar for proof, and you should understand it as requiring a fairly high standard of evidence. The party carrying out enforcement is CBP (US Customs and Border Protection), which actually holds and inspects goods at the port.

Here, let me make the stance of this article clear. UFLPA is a mechanism of the system, and it is not a judgment on the rightness or wrongness of a particular country or region, or of a company based there. Falling under a regulatory category does not mean that the company committed any wrongdoing. If anything, in practice, legitimate civilian manufacturers that have conducted their business properly face the heavy burden of having to trace back deep into their supply networks and prove that "no forced labor is involved." This article is written with the framing of being a practical resource that helps such parties trace and explain their own supply networks. I place importance on the distinction of describing the system accurately as fact, while adding no value judgments.

The definition of forced labor itself

Let me also cover what forced labor, the thing UFLPA seeks to prevent, actually is. The foundation of the international definition is the concept set out by the ILO (International Labour Organization). Roughly speaking, it refers to a state in which a person is compelled to perform labor that they did not offer of their own free will, under the menace of a penalty or the like.

In the United States, as a mechanism for stopping the import of goods involving forced labor, there has been a provision called Section 307 of the Tariff Act since before UFLPA. What is issued under it is a WRO (Withhold Release Order), an order to hold the import of particular goods when they are judged to be suspected of forced labor. You get a clearer overall picture if you understand UFLPA as layering, on top of this Section 307 framework, a rebuttable presumption for the covered region. Forced labor is a representative human rights risk that supply chain DD should identify and prevent.

Conflict minerals are also a domain of DD

The risks that supply chain DD addresses are not limited to forced labor. Another representative one is conflict minerals.

Conflict minerals are minerals whose extraction or trade can generate funds that become financing for the activities of armed groups, the representatives being 3TG (tin, tantalum, tungsten, and gold) and cobalt. 3TG is a way of referring to them by the initials of Tin, Tantalum, Tungsten, and Gold, and they are used widely in smartphones, electronic boards, solder, cutting tools, and more.

The response to conflict minerals is also a continuous DD process in line with the OECD's five-step philosophy. Section 1502 of the US Dodd-Frank Act and the SEC rules based on it, along with the EU Conflict Minerals Regulation (2017/821), are representative legal frameworks, and companies are charged with the responsibility of investigating the origins of the minerals they source.

In practice, you use standard survey templates provided by the RMI (Responsible Minerals Initiative). These are the CMRT (Conflict Minerals Reporting Template) for 3TG, and the EMRT (Extended Minerals Reporting Template) for cobalt and mica. Using these templates, information on countries of origin and smelters is passed along the supply chain. Conflict minerals investigation has its own knacks, such as the unit of reconciliation being the "smelter." I explain this in detail in conflict minerals and 3TG, CMRT and EMRT in practice, so please read that as well.

Both forced labor and conflict minerals, when pushed to their essence, arrive at the same task: "break the product down and trace the content and origin of each part." This is the axis that runs through the practice of supply chain DD.

How to actually run the OECD five steps

So let me look concretely at how you actually run the five steps, in line with the practice of supply chain DD. If you keep the image of "break the product down and trace each and every part" in mind, the discussion becomes easier to connect.

Step 1: Building policy and management systems

The first thing to do is decide the company's policy and build the system that runs it. You set a policy at the management level, such as "This is how our company approaches the risks of forced labor and conflict minerals," and you sort out who is responsible for what across the procurement, quality, and export control departments. If this is vague, every subsequent step becomes ad hoc.

Step 2: Identifying and assessing risks (mapping and prioritization)

Next, you map out where in your supply network the risks are and what kinds they are. The key here is mapping (visualizing) the supply chain. You trace, to the extent possible, which first-tier supplier the parts and raw materials you purchase come from, and where the second-, third-, and N-tier suppliers beyond them are located.

That said, investigating every supplier to the same depth is not realistic. So you use the concept of being risk-based. This is the idea of prioritizing where the risk is high. For example, you prioritize items sourced from high-risk countries or regions, items that include processes said to be prone to forced labor, and parts that use conflict minerals, and you investigate those in depth first. In other words, you concentrate your limited people and time where the effect is greatest.

Step 3: Prevention and mitigation (supplier surveys and identifying origins)

Once the high-risk areas come into view, you take action. At the center of this are supplier surveys. You send questionnaires to your business partners and have them respond on their labor environment, sourcing policies, and the origins and smelters of the minerals they use. For conflict minerals, the CMRT and EMRT mentioned earlier are these questionnaires.

From the information obtained through the survey, you identify the origins of raw materials and, for minerals, the smelters. And if a problematic risk is found, you ask the supplier for improvement, work with them on corrective measures, and in some cases reconsider your sourcing. Here too, a neutral stance matters; rather than cutting off the transaction outright, the international frameworks emphasize the approach of first prompting correction and lowering the risk together.

Step 4: Tracking and verifying effectiveness

Once you have taken action, you confirm whether it is actually working. You track whether the supplier carried out the improvements they promised and whether the risk actually decreased, and if necessary you bring in a third-party audit. In the case of conflict minerals, the mechanism for confirming whether a smelter has received third-party certification corresponds to this. Verify the measures you took and reflect them in the next cycle. This repetition is what makes DD a "continuous process."

Step 5: Disclosing information

Finally, you explain the content and results of your efforts externally. You disclose your policy, the risks you found, the measures you took, and their effects, in the form of reports and responses to business partners. This fulfills accountability and at the same time forms the foundation for gaining the trust of business partners and the market. Many national DD laws either mandate or encourage this disclosure.

And once you have progressed to disclosure, you return to step one, review your policy and systems, and keep cycling. Since both the systems and the supply network keep changing, there is no "completion" for DD; the act of continuing to cycle is itself the substance of the effort.

The idea of checking evidence across the board (the TRAFEED perspective)

By reading this far, I think you have come to see that the practice of supply chain DD is the work of gathering and reconciling numerous pieces of evidence. Forced labor (responding to UFLPA), conflict minerals (3TG and cobalt), chemicals (SDS and chemical composition), export control lists (whether a business partner or item is subject to sanctions or regulation), and, depending on the product, new disclosure requirements such as the battery passport. These are each separate systems, but the object being confirmed is the same: "the parts and raw materials that make up your own product."

Here is the recurring theme that TRAFEED values. Supply chain due diligence is, in essence, the view that it is a continuous process of breaking down parts and raw materials one by one, all the way to the BOM (bill of materials) level, and, for each one, checking evidence across the board: whether forced labor is involved, whether conflict minerals are used, whether there is a dangerous chemical composition (SDS, safety data sheet), and whether it touches an export control list.

For chemicals, for example, you trace the SDS (safety data sheet) and the CAS number (a number that uniquely identifies a chemical substance) to confirm what substances a part contains and whether they touch any regulations. I explain this way of thinking in detail in SDS (safety data sheets) and export control. For products that include batteries, a new framework for electronically disclosing information on raw materials and manufacturing processes has also begun to move, and I cover this in the EU battery passport. Furthermore, for products involving AI and advanced technology, discussion of new regulations on export and use itself is spreading, which I touch on in the moves in US AI regulation. This article is positioned as a hub for supply chain DD that ties together these individual topics (conflict minerals, SDS, the battery passport, and AI regulation).

The problem is that the number of parts and pieces of evidence involved becomes enormous in practice. A single product has hundreds to thousands of parts, each connected to suppliers down to the N-tier, and on top of that there are multiple perspectives to confirm: forced labor, conflict minerals, chemicals, and export control. To keep cycling through all of this by hand alone, and continuously at that, is frankly at its limit.

That is precisely why streamlining it across the board with AI is the idea behind TRAFEED. TRAFEED is an export control AI agent compliant with METI standards. It reflects each country's laws and regulations on the day, and based on a knowledge graph of more than 200 million records, it is designed to investigate information on parts and business partners across the board. It supports multiple languages, and as for the accuracy of its AI judgments, joint verification with Okayama University and our own research have yielded a result of 95% or higher (this is a figure within the range we have officially confirmed). The design assumes a division of roles in which AI handles the primary screening of an enormous number of cases, and people concentrate on the judgment of the high-risk portions.

Here I must add without fail that the final judgment is made by people. Whether for export control classification or for supply chain DD risk assessment, the final classification and the decision on how to respond are made by your company's export control officer. AI is, in the end, a tool for gathering and organizing enormous amounts of information and reducing oversights. Keeping to this division of roles is the premise for using AI safely in practice.

Since supply chain DD and export control are adjacent fields, in areas with strong item-specific characteristics, such as the chemical industry, there are also industry-specific knacks. For export control in the chemical field, please also refer to export control in the chemical industry.

For SMEs and companies just getting started

Some of you may have felt, "This is a story about large companies and has nothing to do with us." But as I touched on earlier, the situations in which you are asked for a practical response, in the form of a customer questionnaire, are steadily increasing. That does not mean you need to build a perfect system all at once, though.

The realistic approach is to prioritize on a risk basis and start where you can. First, among the items your company handles, map out the ones that seem high-risk (the regions you source from, the minerals or chemicals they contain, the technologies that might touch export controls), and trace the supply network from there. Put your policy into a single document, and set up a flow for responding to questionnaires. The accumulation of such small steps ends up leading to trust from your business partners, and it also serves as preparation for when regulations are strengthened.

What matters is capturing DD not as a "do it once and you are done" task, but as a process you keep cycling through while gradually raising its precision. It is fine to be rough at first. As you cycle, you come to see where the risks are concentrated and which suppliers' information is lacking, and you become able to take action in the next cycle.

Summary

Let me organize the key points of this article at the end.

• Supply chain due diligence is the practice of managing, through a continuous cycle, the human rights, environmental, and compliance risks hidden in your sourcing network. It is separate from "resilience," which is about keeping supply from stopping; it is a "continuous risk management process" of finding and addressing risks.
• Its foundation is the UN Guiding Principles (UNGP) and the OECD guidance, and it keeps cycling through the five steps of building policy and systems, identifying and assessing risks, preventing and mitigating them, tracking and verifying, and disclosing information.
• Countries are legislating DD one after another (CSDDD, LkSG, the EU Forced Labour Regulation, UFLPA and Section 307 of the Tariff Act, the EU Conflict Minerals Regulation, Japan's METI guidelines, and more), and violations lead directly to import bans and the termination of transactions. Confirm the individual conditions of application with each authority's official sources.
• UFLPA is a mechanism that applies a rebuttable presumption of forced labor to goods from the covered region, blocking their import unless the importer rebuts it with clear and convincing evidence. This is a description of the system; it is not a judgment on the rightness or wrongness of any particular country or company. The parties concerned bear the heavy burden of tracing back through their supply networks to prove compliance, and this article is written with the framing of supporting that practical work.
• The practice comes down to breaking a product down to the BOM level, visualizing it up to the N-tier suppliers, and checking evidence across forced labor, conflict minerals, chemicals, and export control. Because the volume is enormous, streamlining it with AI is the idea behind TRAFEED, but the final classification and the decision on how to respond are made by your company's export control officer.

Supply chain due diligence looks formidable at first, but if you break it down and organize it, it lies on the extension of your daily procurement work. When you are unsure where to start, please consult the TRAFEED team. We will think through everything with you, from how to set priorities, in line with the items you handle and the shape of your supply network.

Looking ahead, I expect that national DD laws will spread further and that the electronification of disclosure and AI-driven cross-checking will become standard, but this is merely my own view. Since the systems keep moving, I hope you will keep cycling through the DD process while always confirming the latest content in primary sources.

---

References and primary sources