From Disclosure to Interdiction: What Forced-Labour Border Enforcement Demands of Compliance Architecture

I. TWO GENERATIONS OF LAW, ONE UNPREPARED COMPLIANCE MODEL

The legal architecture governing forced labour in supply chains has divided into two generations that make fundamentally different demands of the companies subject to them. The first generation, typified by Section 54 of the UK Modern Slavery Act 2015 and Canada's Fighting Against Forced Labour and Child Labour in Supply Chains Act, obliges companies to prepare an annual account of what they are doing [6][8]. The second generation, operative in the United States since June 2022 and applicable across the European Union from December 2027, interdicts the goods themselves, at the border or on the market, and requires evidence of provenance [1][4][5]. Most corporate compliance architecture was designed for the first generation, and the record of the past four years indicates that the capabilities the second generation tests are not the ones that architecture built.

The scale of the shift is measurable. The Uyghur Forced Labor Prevention Act (UFLPA), enacted on 23 December 2021, established from 21 June 2022 a rebuttable presumption that goods mined, produced, or manufactured wholly or in part in the Xinjiang Uyghur Autonomous Region, or by an entity on the UFLPA Entity List, are prohibited from importation into the United States under Section 307 of the Tariff Act of 1930 [1][10]. By early 2026, U.S. Customs and Border Protection (CBP) had reviewed more than 18,000 shipments under the statute, with an aggregate value of approximately USD 3.81 billion [3]. In fiscal year 2025 alone, CBP stopped roughly 7,325 shipments for UFLPA review, more than 50% above the prior fiscal year, and only about 6.5% of those shipments were ultimately released [3]. On the European side, Regulation (EU) 2024/3015, which entered into force in December 2024 and applies from 14 December 2027, prohibits placing, making available, or exporting products made with forced labour on or from the Union market [4][5]. A company trading across the Atlantic now faces both regimes simultaneously, alongside the disclosure statutes that remain in force.

II. WHAT DISCLOSURE ASKED, AND WHAT IT TOLERATED

The disclosure model's demands were narrative. Section 54 of the Modern Slavery Act requires a commercial organisation above the turnover threshold to prepare a slavery and human trafficking statement for each financial year, describing the steps taken to ensure that slavery and human trafficking are not taking place in its business or supply chains [6]. The statute's own text defines the floor: a compliant statement may consist of a statement that the organisation has taken no such steps [6]. Enforcement is confined to civil proceedings by the Secretary of State for an injunction [6]. The Home Office's updated statutory guidance of March 2025 refined expectations for the quality of statements, but the underlying architecture remains disclosure-based [7].

Canada's Fighting Against Forced Labour and Child Labour in Supply Chains Act follows the same logic with a reporting obligation owed to government rather than to the market. Public Safety Canada received 4,313 reports on or before the 31 May 2025 deadline in the Act's second reporting cycle [8]. The department's 2025 annual report to Parliament records that 82.3% of reporting entities had identified forced labour or child labour risks in their operations or supply chains or had started the process, against 77% the prior year, while 5.0% indicated that they had taken remediation measures [8]. In the same cycle, no orders were made under section 18 of the Act and no charges were laid under section 19 [8]. Two full cycles of mandatory reporting have therefore produced a substantial body of self-description, and the most recent cycle closed without a single enforcement action.

The point is not that disclosure statutes failed on their own terms, since their mechanism was always market and reputational pressure rather than direct sanction. The consequence for compliance architecture is what matters here: a decade of disclosure obligations trained companies to produce statements, policies, and risk narratives on an annual cycle. The capability that regime built, and the capability it tolerated as sufficient, is reporting. It did not require any company to prove, against a live shipment and a running clock, where the inputs in a specific consignment came from.

III. WHAT INTERDICTION ASKS: THE EVIDENTIARY RECORD OF THE UFLPA

The UFLPA inverted the operational posture. Because the presumption attaches to goods produced wholly or in part in the covered region or by listed entities, the burden at the border sits with the importer, and the currency of compliance is documentary [1][10]. Practitioner analysis of CBP's detention practice describes the expected submission as transaction-specific and product-specific documentation, including detailed bills of materials, processing flowcharts, technical specifications, and supplier-level and location-level evidence tracing inputs back to origin [3]. A policy, a code of conduct, or a published statement carries no evidentiary weight in that posture. The question CBP asks is not whether the importer has a programme but whether the importer can reconstruct the provenance of this shipment.

The perimeter of the presumption has widened as the UFLPA Entity List has grown. In a single action in January 2025, the Forced Labor Enforcement Task Force expanded the list by 37 entities [3], spanning cotton processing, mining and metals, and silicon production, and bringing the consolidated list to 144 entities [9]. The sectoral centre of gravity has moved with successive enforcement priorities: the Task Force's August 2025 strategy update designated lithium as a high-priority sector, extending scrutiny into battery and energy-storage supply chains [3]. Documented importer behaviour has followed the evidentiary demand, with companies in the cotton, automotive, solar, and flooring sectors tracing materials to the raw-material level to avoid detention [2].

The enforcement apparatus has also matured procedurally. On 9 June 2026, CBP published its Forced Labor Enforcement Operational Guidance for Importers, replacing guidance in place since June 2022 and consolidating the agency's approach across the UFLPA, Section 321A of the Countering America's Adversaries Through Sanctions Act, and Section 307 of the Tariff Act [11]. The 2026 guidance includes process maps distinguishing the agency's enforcement pathways and expanded appendices on supply-chain documentation and isotopic testing [11]. An enforcement model that began as a single-region presumption is becoming a general operational method for verifying provenance at the border.

IV. THE EU REGULATION GENERALISES THE MODEL BEYOND ONE JURISDICTION

Regulation (EU) 2024/3015 extends interdiction logic to the world's largest single market, without a regional presumption and without a size threshold. The prohibition in Article 3 is categorical: economic operators shall not place or make available on the Union market products that are made with forced labour, nor export such products [4]. The regulation applies to all economic operators regardless of size and to all products regardless of origin or sector [13]. Investigations are allocated by the location of the suspected forced labour, with the European Commission leading where the suspected forced labour occurs outside the Union and Member State authorities leading within it [4]. Products found to violate the prohibition face orders for their withdrawal, removal, and disposal [13], and Member States must establish effective, proportionate, and dissuasive penalties under Article 37 [4].

The formal burden of proof distinguishes the EU instrument from the UFLPA. The Commission's guidelines of 26 June 2026 state that the lead competent authority bears the burden of establishing a violation, on credible evidence both that forced labour was used and that the operator placed the products on the Union market [12]. The operational reality for companies is less asymmetric than that allocation suggests. Investigations will draw on an evidence-based risk database indicating forced-labour risks by geographic area and by product, decisions must be published on the Forced Labour Single Portal, and operators are expected to cooperate with the competent authorities during investigations [12]. The regulation imposes no new due diligence obligation, but the same guidelines devote a full section to due diligence guidance for economic operators, on the premise that the practical means of avoiding and responding to an investigation is a functioning due diligence system [12]. The Commission launched its preparedness package, the Single Portal, and guidelines in all official languages on 26 June 2026, eighteen months ahead of the application date [5][12].

V. ENFORCEMENT TEMPO IS CYCLICAL, AND THE ARCHITECTURAL DEMAND IS STRUCTURAL

The UFLPA record since 2025 demonstrates that interdiction enforcement fluctuates with administration priorities, and that the fluctuation is no basis for architectural relief. Detentions fell to an unprecedented low of 14 shipments in July 2025, and the Entity List saw no additions between January 2025 and at least early 2026 [2][3]. Yet fiscal year 2025 as a whole ran more than 50% above fiscal year 2024 in shipments stopped [3], and the first half of 2026 brought four new withhold release orders, against five in all of 2025 and two in 2024, together with the consolidated June 2026 operational guidance [11]. A compliance function that recalibrates its evidentiary readiness to each quarter's enforcement statistics is calibrating to noise. The statutes persist across administrations, the Entity List and the risk database persist as standing instruments, and the EU application date arrives in December 2027 regardless of any single agency's tempo.

The underlying condition the statutes address is similarly durable. The International Labour Organization's most recent global estimates place 28 million people in forced labour worldwide [14]. Against that scale, the direction of regulatory travel has been one-way for a decade: from voluntary frameworks, to disclosure, to mandatory due diligence, to border interdiction. The prediction this analysis supports is specific. By 14 December 2027, the operative compliance question for any multinational with EU or U.S. market exposure will be what the organisation can prove about the provenance of a specific consignment, and organisations still calibrated to disclosure statutes will discover the gap at the border, in the form of detained goods and interrupted revenue, rather than in an audit.

VI. THE LEADERSHIP IMPERATIVE: EVIDENCE AT SHIPMENT SPEED

The transition from disclosure to interdiction moves supply-chain compliance from an annual reporting exercise to a continuous evidentiary capability, and that reclassification is a governance matter rather than a procurement one. A detention interrupts revenue, strands inventory, and forces disposition decisions under time pressure, and under the EU regulation non-compliant products face orders for withdrawal, removal, and disposal [13]. The exposure is therefore operational and financial before it is reputational, and it belongs on the same board agenda as any other single point of failure in the revenue chain.

The architecture that serves this environment already has an authoritative template. The OECD Due Diligence Guidance for Responsible Business Conduct structures the discipline in six measures: embedding responsible business conduct into policies and management systems, identifying and assessing adverse impacts, ceasing, preventing, and mitigating them, tracking implementation and results, communicating how impacts are addressed, and providing for or cooperating in remediation, with prioritisation ordered by the severity and likelihood of harm [15]. A due diligence system built to that standard generates, as a by-product of its ordinary operation, precisely the records an interdiction regime demands: supplier identity, input origin, risk assessment, and corrective action. Companies that treated the international standard as the design specification, rather than the statutory minimum of whichever disclosure law applied, hold the evidentiary position today. The pattern parallels the conclusion this publication reached on European due diligence after the Omnibus recalibration: infrastructure built above the statutory minimum remains the most defensible posture when the statutory environment moves.

VII. CONCLUSION

Forced-labour regulation has completed a structural shift from asking companies what they do to stopping goods until companies prove what they did. The UFLPA has operationalised that model at scale, with more than 18,000 shipments reviewed and an evidentiary practice that a policy document does not satisfy [3]. The EU Forced Labour Regulation generalises the model to every operator and every product in the Union market from 14 December 2027, supported since June 2026 by guidelines, a risk database, and a decisions portal [4][5][12]. The disclosure statutes remain in force, but they now define the floor that interdiction regimes were enacted to raise, not the standard.

For boards and executive teams, the working test is concrete. If a consignment of the company's highest-risk product line were detained tomorrow, the organisation either could or could not produce supplier-level and location-level evidence of provenance within the response window. Compliance architecture that can answer that question was built for the enforcement environment that now exists. Architecture that answers with a policy document was built for the one that is closing.