Who Is Accountable for the Supply Chain: Responsibility Allocation Under Mandatory Human Rights Due Diligence

I. THE REGULATORY ARCHITECTURE IN FORCE

Six instruments now describe the same substantive obligation in different jurisdictions and at different points of legal force.

The United Nations Guiding Principles on Business and Human Rights, unanimously endorsed by the UN Human Rights Council in June 2011, set out the three-pillar framework that has anchored every subsequent regulatory regime in this domain. Pillar II, the corporate responsibility to respect human rights, requires every business enterprise to identify, prevent, mitigate, and account for adverse human rights impacts with which it is involved, whether the involvement is direct, through a business relationship, or through products or services [1]. The instrument is soft law in itself; it has become the substantive content of mandatory law across jurisdictions.

The OECD Due Diligence Guidance for Responsible Business Conduct, published in 2018 under the OECD Guidelines for Multinational Enterprises, operationalizes the UNGP obligation as a six-step risk-based process: embed responsible business conduct into policies and management systems; identify and assess actual and potential adverse impacts; cease, prevent, or mitigate adverse impacts; track implementation and results; communicate how impacts are addressed; and provide for or cooperate in remediation when appropriate [2]. The framework applies across human rights, employment and industrial relations, environment, bribery, consumer affairs, and information disclosure. Sector-specific OECD guidance documents, including the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas, apply the same six-step methodology to specific risk domains [7].

The European Union's Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760) entered into force on July 25, 2024. The directive requires in-scope companies to conduct due diligence across their own operations, their subsidiaries, and their chains of activities, including direct and certain indirect business partners. Following the Omnibus I simplification package adopted in 2025-2026, the in-scope threshold has been raised to companies with more than 5,000 employees and EUR 1.5 billion in net worldwide turnover; non-EU companies are in scope if they generate EUR 1.5 billion in net turnover within the European Union [3]. Phased application begins on July 26, 2027 for the largest companies.

Germany's Lieferkettensorgfaltspflichtengesetz (LkSG, the Act on Corporate Due Diligence Obligations in Supply Chains) applies to companies with at least 1,000 employees in Germany as of January 1, 2024; the threshold was 3,000 employees in 2023. The Federal Office for Economic Affairs and Export Control (BAFA) administers the act. In 2024, BAFA conducted 851 ex officio audits including 638 risk-based controls and 39 occasion-related audits. BAFA initiated administrative fine proceedings in 18 cases. Maximum penalties are EUR 8 million for intentional or negligent violations of due diligence obligations, with separate fines up to EUR 50,000 for failure to take required action [4].

Norway's Transparency Act (Åpenhetsloven), in force since 2022, requires in-scope enterprises to conduct due diligence across their own operations and supply chains under the OECD Guidelines methodology, publish an annual due diligence report by June 30, and respond to public information requests within three weeks. The Norwegian Consumer Authority is the enforcement body; penalties run up to 4% of annual turnover or NOK 25 million, whichever is higher [5].

The Uyghur Forced Labor Prevention Act, in force in the United States since June 2022, establishes a rebuttable presumption that goods produced in whole or in part in Xinjiang or by entities on the UFLPA Entity List are made with forced labor and prohibited from importation under 19 U.S.C. § 1307. U.S. Customs and Border Protection detained an average of 428 shipments per month in 2024 with USD 1.34 billion in merchandise detained; approximately 48% of detained shipments were ultimately denied. The CBP Electronics Center of Excellence and Expertise recorded the highest sector volume; the automotive and aerospace sector recorded the steepest growth, with a roughly 1,000 percent surge in November 2024 detentions [6].

The substantive obligation across instruments converges. The differences sit in scope, in disclosure requirements, in enforcement mechanism, and in penalty exposure. The compliance question is not which instrument applies. It is what the architecture of the company's actual diligence is, and whether that architecture can survive simultaneous evaluation under all the applicable instruments at once.

II. THE ALLOCATION PROBLEM: PROCUREMENT, SUSTAINABILITY, LEGAL, OPERATIONS

The corporate-responsibility frameworks describe the diligence as a single integrated obligation belonging to the enterprise. The internal organization of every multinational distributes that obligation across four functions whose incentives and reporting lines diverge.

Procurement owns the buying decision, the supplier relationship, the unit-cost target, and the lead time. Procurement's performance is measured against price, quality, and delivery. The function carries the operational view of the supply base, including the supplier behaviors that are not visible from the disclosure framework. Procurement decisions, made at the level of category strategy, supplier selection, and purchase order, are where the diligence becomes operational or does not.

Sustainability or environmental, social, and governance owns the policy framework, the public disclosure, the supplier code of conduct, and the audit program. Sustainability's performance is measured against framework adoption, disclosure quality, and stakeholder ratings. The function carries the framework view of the supply chain, including the published commitments against which the company will be judged. Sustainability typically does not own the supplier decision and does not control procurement's incentive structure.

Legal owns the contractual instruments, the regulatory interpretation, the litigation exposure, and the response to enforcement inquiry. Legal's performance is measured against risk reduction, defensibility, and absence of escalated proceedings. The function carries the documentary view of the supply chain, including the warranties and representations the company has obtained from suppliers and the indemnification it has secured. Legal typically does not own the operational decision and does not have direct visibility into supplier site practices.

Operations owns the production schedule, the inventory model, the supplier qualification for technical performance, and the engineering specifications. Operations' performance is measured against throughput, quality, and cost. The function carries the production view of the supply chain. Operations decisions, including which supplier to qualify for a new program and how to respond to a supplier capacity constraint under deadline, are where time pressure intersects with the diligence the company has committed to.

The OECD six-step due diligence process is observable as a single integrated process inside the framework. Inside the company, each of the six steps falls across the four functions. Embedding responsible business conduct into management systems is a sustainability and legal effort that becomes operative only when procurement and operations apply it to actual decisions. Identifying and assessing adverse impacts is a sustainability function whose outputs depend on procurement and operations sharing the supplier and operational data. Ceasing, preventing, or mitigating adverse impacts is an operational decision constrained by procurement's category strategy and legal's contractual framework. Tracking implementation requires data flow across all four functions. Communicating how impacts are addressed is a sustainability and legal function whose accuracy depends on procurement and operations sharing what the diligence actually produced. Providing for or cooperating in remediation is a cross-functional decision that requires senior alignment.

The allocation question is whether the four functions hold the six steps as a single integrated obligation or as four overlapping partial obligations. Where the allocation is partial, the diligence becomes the sum of what each function chooses to contribute under its own incentive structure. Where the allocation is integrated, the diligence becomes a process the enterprise can defend as a single coordinated activity.

III. THE SIX-STEP ARCHITECTURE, APPLIED

The OECD Due Diligence Guidance for Responsible Business Conduct describes the six steps in operational terms. Applied to a supply chain at the level of decision rights rather than at the level of policy text, the steps have an architectural anatomy.

Step 1, embedding responsible business conduct into policies and management systems, becomes operative when board-level governance instruments are in place; when a senior executive owns the diligence at the enterprise level; when policy documents are translated into procurement category strategies, supplier qualification criteria, contractual standard terms, and operational decision rules; and when the policy is treated as binding on the operational decision, not as aspirational commentary [2].

Step 2, identifying and assessing actual and potential adverse impacts, requires a mapping of the supply chain across tiers, a risk assessment that incorporates sector, geography, and product-specific risk, and a prioritization that focuses diligence resources on the highest-risk supplier-product-geography combinations. The mapping is operational only if it reaches beyond Tier 1 to the tiers where the most acute risks typically sit, including raw-material extraction in the case of minerals and metals, fiber production in the case of textiles, and component manufacturing in the case of electronics [2, 7].

Step 3, ceasing, preventing, or mitigating adverse impacts, is the operational test. Decisions in this step include disengagement from a supplier, capacity-building programs with a supplier, joint remediation with affected stakeholders, and re-engineering of the procurement specification to remove the risk. The substantive test is whether the company has the operational latitude to make these decisions when the procurement category strategy, the production schedule, and the customer commitment are running in the opposite direction.

Step 4, tracking implementation and results, requires the company to define what success looks like for each diligence activity and to measure progress against that definition. The data systems required include supplier-level performance data, incident and complaint data, audit findings, and remediation status. Where data systems are fragmented across procurement, sustainability, legal, and operations, the tracking step is a reconciliation problem before it is a performance-management problem.

Step 5, communicating how impacts are addressed, is the disclosure step. The instruments include statutory transparency reports under the Norwegian Transparency Act and the German LkSG, the annual statement under the UK Modern Slavery Act, and the disclosures under the EU Corporate Sustainability Reporting Directive and the Corporate Sustainability Due Diligence Directive. The communication step is operational only if its content reflects what steps 1 through 4 produced, not what the disclosure framework requires irrespective of the underlying activity.

Step 6, providing for or cooperating in remediation when the enterprise has caused or contributed to an adverse impact, is the test that distinguishes an integrated diligence program from a ceremonial one. Remediation includes grievance mechanisms, compensation, restoration of affected rights-holders to the position they would have been in absent the harm, and reform of the practice that caused the harm. The instruments under which remediation is now legally required include the CSDDD, the LkSG, the OECD National Contact Point system, and the Norwegian Transparency Act [3, 4, 5, 8].

IV. THE AI SHIFT: WHAT TOOLS ADD, AND WHAT THEY CANNOT REPLACE

Supply chain mapping and screening are domains where machine learning and large-scale data extraction have produced operational improvements. Automated supplier discovery against sanctions lists, entity lists, and adverse media data sources is now operationally faster than manual screening. Automated mapping of multi-tier supply relationships through trade, import, and corporate-registry data has reached a point where mapping of supplier networks beyond Tier 1 is possible at scale. Automated monitoring of supplier sites through geospatial data, port data, and labor-condition reporting has expanded what diligence teams can see between formal audit cycles.

What these tools change is the speed and breadth of step 2 (identification and assessment) and step 4 (tracking). What they do not change is the substantive judgment at steps 1, 3, 5, and 6. The decision to embed a particular responsible business conduct standard into procurement category strategy is a corporate decision. The decision to disengage from a supplier, to invest in capacity-building, or to re-engineer a specification is an operational and commercial decision with consequences for customers, suppliers, and affected rights-holders. The decision about what to communicate publicly under the disclosure regimes is a regulatory and reputational decision. The decision about what remediation is owed to affected stakeholders is a corporate, legal, and ethical decision.

The risk of AI-enabled supply chain tools is that the tooling produces an artifact, a multi-tier map, a risk score, a flagged shipment, that has the appearance of diligence and is treated as the diligence. The OECD framework requires the substantive activity. The tools can support steps 2 and 4. They cannot perform steps 1, 3, 5, or 6 on the enterprise's behalf. Where the tools are used as the diligence rather than as inputs to the diligence, the same architectural failure pattern observed in quality systems applies: the artifact remains intact while the operational decision behind it is not made.

V.  LEADERSHIP ACCOUNTABILITY ACROSS JURISDICTIONS

The enforcement record across the six instruments documents a consistent pattern. BAFA's 2024 report describes most German LkSG-covered companies as taking due diligence seriously, with administrative fine proceedings initiated in only 18 cases against 851 audits [4]. CBP's UFLPA enforcement record shows growing detentions volume, growing denial rates, and growing sectoral coverage, with electronics, automotive, and aerospace as 2024 focal sectors [6]. The Norwegian Consumer Authority's enforcement record under the Transparency Act has so far emphasized compliance support over fines, with information requests and corrective orders as the primary instruments. The CSDDD's enforcement framework, with administrative penalties up to 5% of net worldwide turnover for the most serious infringements, has not yet been operationalized at member-state level given the 2027 application date [3].

The accountability inquiry that follows is sharper than the enforcement record suggests. The Justice Department's September 2024 update to the Evaluation of Corporate Compliance Programs, while not specific to supply chain due diligence, has established the operational standard that prosecutors now apply to compliance programs across domains: a program is judged on whether it operates against the risk it is designed to address, whether it has the data and resources required, and whether it evolves based on lessons learned [11]. The same standard, applied to supply chain HRDD, asks whether the diligence operates against the human rights and environmental risk it is designed to address.

For boards, the implication is the same allocation question. A supply chain due diligence report that documents policy coverage, supplier code-of-conduct adoption, audit completion rates, and the number of corrective actions opened is the documented program. A report that documents the operational metrics, the share of procurement category strategy decisions that were taken with diligence input, the share of supplier disengagement decisions taken on human rights grounds, the share of remediation cases resolved with affected stakeholder participation, and the cycle time from incident identification to substantive corrective action, is the operational program. The boards that receive only the first report cannot meet the inquiry the six jurisdictional regimes now describe.

VII. CONCLUSION

A decade after the UN Guiding Principles established the corporate responsibility to respect, six jurisdictions now operate mandatory human rights due diligence regimes in parallel. The OECD six-step process describes a substantive diligence obligation that does not change across the instruments. What changes is which company is in scope, when, and what penalties attach to failure to perform the diligence.

The institutional question that distinguishes credible diligence from ceremonial diligence is allocation. Procurement, sustainability, legal, and operations each hold parts of the six steps. Where the four functions hold the six steps as a single integrated obligation, the diligence becomes a process the enterprise can defend. Where the allocation is partial, the diligence becomes the sum of what each function chooses to contribute under its own incentive structure, and the gap between the disclosure framework and the operational decision is what enforcement, litigation, and reputational scrutiny will reach.

The leadership inquiry is not whether the company has a supply chain policy. It is whether the allocation of the six steps across the four functions is documented at the level of decision rights, whether the operational decisions made under time and cost pressure converge with the diligence the company has publicly committed to, and whether the absence of that convergence is visible to leadership before it is visible to a regulator, a customer, or a litigant.