Compliance teams count regulations and run a project with a specific budget per regulation. We’re starting to see leading teams do things differently, combining budgets across regulations and leveraging geospatial AI as a foundational data layer.

Last updated 14 September 2026.

Compliance teams we talk to often put the number of supply-chain regulations they face at six or seven. A European automotive supplier we spoke with recently listed six: the packaging regulation (PPWR), the Battery Regulation, the EU Forced Labour Regulation, the CSDDD, Germany's LkSG and France's duty-of-vigilance law. It then added the US UFLPA and the BIS affiliates rule, because its customers had asked for them.

Our count is higher. Since June we have been running every framework we could find through a catalogue that pulls out each disclosure point verbatim, compares it with every other framework's version of the same point, and keeps the strictest. More than 70 frameworks are in it, 11 of them binding law, carrying more than 800 disclosure points between them. Four of those instruments have changed since March: the directive amending the CSRD and the CSDDD entered force on 18 March, the revised ESRS were adopted on 3 July, PPWR applied from 12 August, and the Forced Labour Regulation guidelines reached the Official Journal on 3 September.

We’ve learned that the foundational dataset under these regulations is a record of where things are made. When we merged those 800 disclosure points the facts that recurred described: which plot or facility, what happened on that land since a cutoff date, what sits next to it, and what public record attaches to it. Over the past month of calls with the automotive supplier, its compliance platform, and the lawyers working on these same regulations, those places were what most of the regulations on the table required. The rest of this piece proves that case and delineates where the record stops.

The overlap in regulation requirements are place based

For each disclosure point, the catalogue retains the version with the strictest requirement—any looser versions are automatically satisfied by it. Across 800 points, that leaves a much shorter list. About 35 of those facts can be generated from a supplier name and a location alone: who the entity is and what it produces, the supply shed or catchment it draws on, the infrastructure around it, the legality and human-rights record attached to it, and the natural hazards it faces.

We measured how far those 35 reach in June 2026. Against the first 52 points in the catalogue, they fully satisfy 9 (17%), pre-fill 20 (38%) and materially contribute to 28 (54%). Measured against the location and physical-asset items inside each framework, they cover between 50% (UK Modern Slavery Act) and 92% (GRI) of those items across six frameworks, with the EUDR due diligence statement at 73% and the Forced Labour Regulation at 75%. These are our own figures on our own denominators.

What a supplier name and location can establish

  • The site and its land-use history. Applies to EUDR, ESRS E4, the GHG Protocol, and CSDDD.
  • Nearby environmental risks, including protected areas and water-stressed basins. Applies to ESRS E3/E4, SFDR, and TNFD.
  • Associated hazards and public records, such as sanctions or court actions. Applies to ESRS E1, forced-labour rules, UFLPA, and CBAM.
  • Geographic and product-level forced-labour risk. Applies to ESRS 2, GRI 409-1, and the UK Modern Slavery Act.

A principles-based duty has no single strictest data point to keep. Thus, the only information name and location does not cover is packaging, substances and battery rules which are mostly document work, and the CSDDD's policy and remediation duties concern the company's own conduct.

Building on one foundational dataset reduces compliance workload

The standard advice counts six EU regulations and recommends aligning the data collection for each. The software market is organised the same way: Verdantix benchmarked 16 supply-chain sustainability vendors this year, and the products are sold as modules per regulation, each opening with a supplier questionnaire.

The automotive team asked for something else: one evidence pack per supplier that every regulation could read and every business unit could open. Of its six regulations, only the packaging and battery rules require a filing. The other four are diligence duties, where the deliverable is whatever you can show an authority when it asks. Its compliance platform, which had planned a module per regulation, told us that building all of them would be very difficult.

The requirement list is in constant flux. Germany has removed the LkSG reporting obligation while keeping its due-diligence duties until the CSDDD is transposed. The CSDDD now applies only to companies with more than 5,000 employees and EUR 1.5 billion in turnover, from 26 July 2029. The UFLPA Entity List grew by 43 companies to 187 on 3 August, a 30% increase in one day. A project per regulation has to be re-scoped each time one of these moves.

The regulators are writing location into the text

The revised ESRS, mandatory for financial years from 2027, cut mandatory datapoints by over 60% and kept the spatial ones. E4-5 says "primary data on the state of nature metrics collected at location-level or through remote sensing is the best means to help determine impacts on biodiversity and ecosystems." E1-2 requires a company to take into account "the locations of its assets and business dependencies in its value-chain." ESRS 1 allows geographies to be analysed at the level of "country, region, county, water basin, ecosystem, or site." The word hectare appears nowhere in the 186-page annex; where the 2023 text asked for areas, the adopted text asks for a list of sensitive areas by name and type. A site list with coordinates answers those clauses directly.

The amended CSDDD tells companies to scope their risk "relying solely on information that is reasonably available", to ask business partners with fewer than 5,000 employees for information "only where the information cannot reasonably be obtained by other means", and names "digital solutions" and "independent reports" among the resources they may use instead. The CSRD caps what a reporter may demand from a supplier with 1,000 employees or fewer. The law now expects you to know things about a supplier before you ask, and limits what you may ask, so the evidence pack has to start from what can be known without the supplier.

The Forced Labour Regulation guidelines, ahead of the ban applying on 14 December 2027, list "satellite imagery and geolocation of facilities" among the evidence an authority may weigh, alongside "supply chain maps covering tiers and sub-tiers", and state that an inability to provide traceability information for a product that may have been mixed with a high-risk one "may weigh negatively in the overall assessment of evidence." Under that regime a located, traced supplier base is the operator's defence.

Outside the EU the dependency is older. The UFLPA presumes that goods touching a listed entity or the Xinjiang region are made with forced labour, and the importer rebuts it with provenance evidence. CBAM's default values for imported emissions carry a mark-up over the country average of 10% this year, rising to 30% from 2028, and the alternative is verified data from the actual installation. The UK's planned GB regime applies a legality test to forest-risk commodities for businesses with turnover over GBP 1 million, and the EUDR applies in Northern Ireland in phases from 30 December 2026, the day it applies to large and medium operators in the EU. EUDR is just one instance of this pattern, and the automotive supplier had put it at the bottom of its list.

What to do with this

Take the list of regulations you have been handed and write down, for each one, what it asks you to know about a supplier. Then mark how many of those would be answered by the same location record. In our catalogue it answers about half of the location-keyed points and a small share of the product-keyed ones. The remainder is your own disclosure work, and location data cannot replace it.

Build the supplier evidence pack from that record first and lay each regulation's remaining asks on top. Where a supplier will not answer a questionnaire, the amended CSDDD now says to try other means first, and the Forced Labour guidelines say that having no traceability at all counts against you.

Epoch generates that record from a supplier name and a location: detected plots and facilities, the supply shed around them, land-use change since the cutoff, protected-area and water-stress proximity, and the legality and forced-labour screens attached to the place, with the clause each item answers.

If you'd like to learn more about how we generate the first-mile record that sits under these regulations, or put the product to work in your supply chain, reach out to us here.

Or, subscribe to our newsletter to get the latest on supply chain risk management, EUDR, deforestation, water stress, and the latest trends in geospatial AI.