Three EU rules now rank evidence gathered independently above supplier questionnaires, and two producer countries have restricted access to precise location data. We think the questionnaire has become the fallback step, and the screen should come first.

Last updated 23 October 2026.

This autumn, two compliance platforms and an assurance body asked us the same question: what portion of our suppliers do we actually need to chase? We see the same pattern in our own programmes. In our experience, about one supplier in five sends a plot file when asked. Even buyers with substantial purchasing power often receive no response.

We think supplier due diligence is moving toward screening each site using public records and observable evidence, then requesting only the documents required by applicable law from flagged suppliers. This is our read of the shifting industry standard and the three EU rules outlined below, which now position questionnaires as a fallback. The EUDR sets a minimum penalty of 4% of EU turnover from 30 December 2026, while the Forced Labour Regulation allows products to be withdrawn from the EU market from 14 December 2027.

1. The response rate is your coverage ceiling

A questionnaire programme covers the suppliers who answer, and a silent supplier is an unknown. Fewer than 12% of palm companies disclose plantation coordinates, and the one-in-five file rate is what we see across commodities when buyers do ask. Questionnaire responses that do come are from parties with an incentive to shape them and assurance bodies say their auditors are brought in only after a risk has been identified elsewhere.

The count matters more than the rate. In our internal count for one six-regulation scope, the baseline for a site came to about 40 questions. They cover where it is, which laws apply there, whether it carries legality or forced-labour flags, the governance and conflict context, and whether the land was converted. At 500 sites that is around 20,000 facts a questionnaire has to request, chase, and trust.

The same 40 facts can be produced for every site from two kinds of evidence that need no request. One is what the ground shows—land conversion since the cut-off date, protected-area overlap, and the facility's footprint. The other is what the public record shows including, the law that applies at that address, cited to the statute, with legality and forced-labour screening, and adverse media and governance indicators. Neither depends on the supplier replying.

2. Three EU rules now put the questionnaire after the screen

The Commission's Forced Labour Regulation guidelines, published in June, exclude social audits where workers are "under threat or under constant surveillance" or where "access to production facilities is limited." Where state-imposed forced labour may be involved, in-depth assessments "must involve independent desktop research, reports from international organisations, expert risk analysis and credible civil society data." They list "satellite imagery and geolocation of facilities" as evidence, and say an inability to provide traceability "may weigh negatively."

The amended CSDDD tells companies to scope out information that is "reasonably available". Business partners with fewer than 5,000 employees may be asked "only where the information cannot reasonably be obtained by other means." Article 8(3) names independent reports and digital solutions as acceptable means. The duty takes effect in July 2029, so this is a model rather than a live obligation. Even so, the logic is clear: the screening record shows that other means were tried first.

The CSRD value-chain cap, in force since March 2026, goes further for small partners. A reporting company may not require a partner with 1,000 employees or fewer to provide information beyond the voluntary SME standard, and the partner has a statutory right to refuse.

EUDR is the one place the task survives in full. The Commission's FAQ says "there is no exception for the traceability requirement via geolocation," and the statement still needs plot coordinates. The same FAQ accepts "remotely sensed information (air photos, satellite images)" to verify declared plots. The screen tells you which fifth of your suppliers to send the request to, and which plots are the problem when the answer comes back.

3. Producer countries are putting precise location data behind approval

Indonesia's geospatial agency issued Regulation No. 1 of 2026, in force since 3 June. It limits ordinary cross-border sharing of coordinates to four decimal places. The six-decimal points and polygons EUDR asks for now need the agency's approval when the sharing is tied to an international business transaction, with a ten-working-day verification. Since September the Ministry of Forestry's own map has carried a view-only notice. Mongabay reported on 6 October that unauthorised downloads can be prosecuted with "up to 9 years in prison and/or a fine of up to Rp 3 billion."

Both are approval regimes. The palm oil association GAPKI's own reading is that "national systems must be capable of consistently generating, maintaining, and exchanging such data." The route for a six-decimal polygon out of Indonesia is becoming a national system with an application and a ten-day wait. Any process that assumed a supplier could email a polygon now has a wait built in. China set the pattern earlier this year. Since 31 March, State Council Decree 834 puts supply-chain "information collection" inside China under legal review. We wrote last month about which step of a diligence programme each of China's rules reaches. The one step none of them reaches is assessing the supplier from outside China.

What the sequence looks like

Run it in this order.

  1. Locate the sites from the supplier names you already hold, and the sourcing area each site draws from.
  2. Screen every site for the 40-odd facts, from what the ground shows and what the public record shows, and label each fact as direct evidence, proxy evidence, or unavailable.
  3. For each site, list the laws that apply and the specific document each law requires of that supplier.
  4. Send the request only to the sites the screen flagged, and only for those documents.
  5. Keep the screening log. Under the CSDDD it is the record that other means were tried first. Under the Forced Labour Regulation it is the desk research the guidance asks for.

Two limits. On a deforestation frontier, timber in parts of West or Central Africa for instance, the screen can flag hundreds or thousands of plots at one supplier. At that point you ask for plot data. And the data that lives inside the supplier, bills of materials, test reports, payroll, recruitment fees, stays the questionnaire's job. The screen decides who gets asked and for what.

That is the change we think is under way. The questionnaire's response rate is a coverage ceiling, and the rules are now written so that the screen, and the record of it, comes first. At least one law firm's published roadmap for the Forced Labour Regulation already runs in this order: screen and prioritise, then map suppliers, then build the files. At Epoch it is the order our product runs in.

If you'd like to learn more about how we assess a supplier from a name and an address without asking it for anything, or put the product to work in your supply chain, reach out to us here.

Or, subscribe to our newsletter to get the latest on supply chain risk management, EUDR, deforestation, water stress, and the latest trends in geospatial AI.