Epoch's Jinal Surti joined Linklaters' James Marlow on the firm's due diligence podcast. Here is what the conversation means for anyone whose company buys through a supply chain.
Last updated 30 October 2026.
Our co-founder and CEO Jinal Surti joined James Marlow, Managing Associate in Linklaters' sustainability team, for an episode of the firm's due diligence podcast. The episode, “Sustainability Due Diligence & Supply Chain Risk Management: How Technological Solutions Can Help”, is released on 4 November. The starting point was simple. Older regulations, such as the UK Modern Slavery Act, asked companies to describe how they address risks in their supply chains. The new ones, the EU's Corporate Sustainability Due Diligence Directive and Forced Labour Regulation, ask them to prove that they found and dealt with those risks. In James's words, "the bar moves to companies needing to demonstrate that risks were actively identified, investigated and addressed, with evidence, not just description."
We think that shift changes the question a regulator asks. It used to be "what did you collect?". It is becoming "what did you check, and what did you do about it?". That is our read of the dry runs the EU authorities ran last year, and our conclusion from this conversation. Three things from the episode follow from it.
A reporting rule asks what your policies are and what you know, once a year. A diligence rule asks what you found, how you checked it, and what you did about it, for each site or shipment. A supplier's answer stops being the final deliverable and becomes just one input you have to test.
1. Most companies cannot yet answer the first question: where does this come from?
Jinal's example was a car maker tracing natural rubber. It reaches its supplier's address and stops there. The rules want the processing site and the plots the rubber grew on. Many companies hold only an office address for a supplier, and some have no address at all.
A supplier you have found may also not be allowed to answer. Data rules in several producer countries, China and Indonesia among them, now restrict what a supplier can send abroad. Even a willing supplier may be unable to share a map of its plots.
2. Regulators will check what you left out
This was Jinal's central point. "What enforcement agencies are going to do is look at what you did not submit. Are you relying blindly on what the suppliers are giving you, or are you doing an independent assessment of what is actually out there?" In short: "you can't just repeat what your supplier is telling you. You have to do your own diligence."
The EU authorities have already said this in practice. In last year's EUDR dry runs, operators were told they cannot hide behind a general due diligence system. The authorities' report put it plainly: "simply collecting data and documents is not enough". We covered the lessons from those exercises in March.
3. Investigate first, then ask only where it matters
Questionnaires, Jinal argued, "were never designed to support these types of regulations". Few suppliers answer, the answers stop at the first tier, and they are hard to check. Epoch's approach runs the other way. Find the sites, even without a usable address. Check each one against what the ground shows and what the public record shows, without asking the supplier. Keep the result in a form that can be reused for the next regulation.
The payoff is focus. In one of our analyses Jinal cited, the worst 5% of roughly 2,600 palm oil mills in Indonesia drove 73% of the deforestation. In another, only 4.5% of 3,700 cocoa supply sheds in Côte d'Ivoire were fully clean, but the typical one carried just 0.3%. Knowing which few to look at is what lets a company ask a handful of suppliers specific questions about specific places, instead of sending everyone the same form.
What stays with the company?
Independent evidence does not replace supplier declarations, audits, or certificates. It tests them. Where the two agree, confidence goes up. Where they disagree, that is where to look next. Any tool used in that process has to show its working, because a legal team will be asked to defend it, and the decisions have to sit with people in the company, not with the tool.
James's takeaway was that technology "is increasingly becoming part of the expected infrastructure rather than a snazzy compliance add-on". Its role is to strengthen a process in which companies still have to show the judgement calls they made. Jinal's closing line is the one we would emphasise. "Technology can now give companies enormous access to data and evidence, but the diligence, acting on what that evidence shows, is still on the company to do."
Listen to the full episode, "From Reporting to Diligence: How emerging regulations are changing the requirements for corporates", on Linklaters Sustainable Futures.
If you'd like to learn more about how we assess a supplier from a name and an address without asking it for anything, or put the product to work in your supply chain, reach out to us here.
Or, subscribe to our newsletter to get the latest on supply chain risk management, EUDR, deforestation, water stress, and the latest trends in geospatial AI.
