The rules shaping supply chains and the AI inside them
Traceability, due diligence, carbon and customs rules decide which data a supply chain must produce — and that is where AI tools are being deployed. Each entry gives its dates and links to the source we checked them against.
Sources last checked on 30 Oct 2026. Dates move: always confirm with the official text before acting. This page is information, not legal advice.
Risk-based rules for AI systems placed on the EU market. The 2026 Digital Omnibus postponed the high-risk obligations.
What it requires: Banned practices since 2025; transparency duties for some AI systems; risk management, documentation and human oversight for high-risk systems.
Where AI comes in: AI used to recruit, allocate tasks to, or monitor and evaluate warehouse and transport workers falls in the employment category of high-risk systems.
Prohibited AI practices banned
Obligations for general-purpose AI models apply
Most transparency obligations apply
Stand-alone high-risk systems (Annex III, incl. employment) — postponed from Aug 2026
High-risk AI embedded in products under EU safety law (Annex I) — postponed from Aug 2027
Cattle, cocoa, coffee, oil palm, rubber, soya and wood products can only be sold in the EU if they did not come from recently deforested land. Postponed twice.
What it requires: Geolocation of the plots of land where the commodity was produced, and a due diligence statement before placing goods on the market.
Where AI comes in: Satellite-image analysis and traceability platforms are used to check plot geolocation against deforestation data at scale.
Applies to large and medium-sized operators and traders
A carbon price on imports of cement, iron and steel, aluminium, fertilisers, hydrogen and electricity. The definitive regime started on 1 January 2026.
What it requires: Importers above 50 tonnes a year must be authorised CBAM declarants, report the emissions embedded in their imports, and buy and surrender CBAM certificates.
Where AI comes in: Collecting verified emissions data from non-EU suppliers is the hard part; supplier-data and carbon-accounting tools automate the collection and checks.
Directive (EU) 2026/470 narrowed sustainability reporting (CSRD) and supply chain due diligence (CSDDD) to the largest companies.
What it requires: CSRD: companies with more than 1,000 employees and €450m turnover. CSDDD: more than 5,000 employees and €1.5bn turnover must identify and address human-rights and environmental risks in their chains of activities.
Where AI comes in: Supplier risk-screening tools that combine news, sanctions and audit data are the main AI use case for CSDDD-style due diligence.
Omnibus I directive enters into force
Deadline for Member States to transpose the CSRD changes
Bans products made with forced labour from the EU market, whether imported, made in the EU or exported. Commission guidelines were published in June 2026.
What it requires: No grandfathering: goods already in warehouses or distribution channels are covered from the application date. Authorities can order withdrawal and disposal.
Where AI comes in: Multi-tier supplier mapping is the prerequisite; AI tools are used to map sub-tier suppliers and flag forced-labour risk indicators.
Commission publishes application guidelines
Prohibition applies to all products on the EU market
EV, light-means-of-transport and industrial batteries above 2 kWh need a digital battery passport, reachable by QR code.
What it requires: Passport data on composition, carbon footprint and responsible sourcing; due diligence on cobalt, lithium, nickel and natural graphite, postponed by two years.
Where AI comes in: Digital product passports depend on reliable upstream data capture — a growing use case for traceability and data-validation tools.
Battery passport mandatory
Raw-material due diligence obligations apply (postponed from Aug 2025)
Low-value e-commerce parcels no longer enter the EU duty-free. A flat €3 duty per item type applies as a transitional measure.
What it requires: Item-level customs declarations for every B2C consignment of €150 or less, including those using IOSS.
Where AI comes in: Item-level declarations at parcel volumes make automated tariff classification (HS codes) a necessity for marketplaces and carriers.
Low-value shipments no longer enter the US duty-free. CBP made the suspension indefinite in June 2026; Congress has also repealed the statutory exemption.
What it requires: A formal or informal customs entry for every shipment, whatever its value.
Where AI comes in: As with the EU reform, parcel-level entries drive demand for automated classification and landed-cost tools.
De minimis treatment suspended for all countries
CBP interim final rules make the suspension indefinite
Goods made wholly or partly in Xinjiang, or by entities on the UFLPA Entity List, are presumed made with forced labour and can be detained at the border.
What it requires: Importers must prove, with supply chain tracing documentation, that detained goods are not linked to forced labour.
Where AI comes in: Detentions hinge on sub-tier visibility: entity-resolution tools screen supplier networks against the Entity List.