The EU Deforestation Regulation (2023/1115) is in full enforcement, and it's already reshaping global supply chains. If you deal in cattle, cocoa, coffee, oil palm, rubber, soya, or wood, you need a Due Diligence Statement for every shipment — backed by geolocation coordinates down to the plot level. No exceptions, no phase-ins for small operators.
Most companies underestimate how hard the geolocation requirement is. Your supplier in Côte d'Ivoire needs to provide plot-level GPS coordinates that match satellite imagery. If they can't, your shipment doesn't clear customs.
If you've got 1,000+ employees in Germany, the LkSG already applies to you — and BAFA isn't messing around. Fines can hit €8 million or 2% of annual turnover, and the seven due diligence obligations (§4–§10) cover everything from risk analysis to complaints procedures to annual BAFA reporting.
Here's the thing: LkSG compliance isn't a one-time project. It's an annual cycle of risk analysis, preventive measures, documentation, and reporting. LkSG compliance software won't replace the human rights expertise you need, but it'll stop you from drowning in paperwork while BAFA asks for your records.
If you think the CSRD is just an expanded version of the old NFRD, you're in for a shock. The Corporate Sustainability Reporting Directive (2022/2464) doesn't just expand the scope from 11,000 companies to 50,000 — it fundamentally changes what reporting means. 1,100+ datapoints. Double materiality. Limited assurance. iXBRL tagging. And for the first time, your sustainability data needs to stand up to external scrutiny.
The European Sustainability Reporting Standards (ESRS) are the rulebook, and they cover environmental, social, and governance topics in granular detail. If you already report under GRI or SASB, there's overlap — but the bar is significantly higher.
The US Toxic Substances Control Act (TSCA) imposes some of the most stringent chemical reporting obligations in the world. Companies importing, manufacturing, or processing chemical substances in the United States must navigate inventory listings, Significant New Use Rules (SNURs), Section 5 premanufacture notifications, and the rapidly evolving PFAS reporting framework under TSCA 8(a)(7). Without the right infrastructure, compliance becomes a drain on regulatory teams — and a serious liability risk.
If you run a website or app in the EU, UK, or Canada, an accessibility statement isn't optional — it's the law. Even where it isn't legally required, publishing one is the single cheapest way to reduce your ADA litigation risk and signal to users that you take inclusion seriously.
An accessibility statement is a public declaration of your conformance level, what you've done to meet it, and how users can contact you if they encounter barriers. This guide covers what to include, which jurisdictions require one, and how to keep it from going stale (which is where most organisations fall down).
In most businesses, compliance and sustainability report to different executives, use different software, collect different data, and attend different conferences. Compliance owns the legal obligation — the product safety certificates, the chemical declarations, the import filings. Sustainability owns the voluntary narrative — the carbon footprint, the ESG report, the supplier diversity metrics.
That separation is ending. Regulations across every major market are requiring the same data that both functions need — and building separate systems to satisfy the same regulatory demand is no longer tenable.
In Europe, the CSRD requires audited sustainability disclosures against over 1,100 data points. In the United States, California's SB 253 and SB 261 require climate emissions and risk disclosure from companies doing business in the state. The SEC's climate disclosure rule — currently stayed but directionally clear — will require public companies to report Scope 1, 2, and in many cases Scope 3 emissions. Australia's mandatory climate reporting framework, phased in from 2024 onward, requires financial-disclosure-grade climate data from large entities. China's dual-carbon policy (碳达峰, 碳中和 — "carbon peak, carbon neutrality") is driving mandatory environmental disclosure through the China Securities Regulatory Commission and the Ministry of Ecology and Environment.
The global direction is unambiguous: sustainability reporting is becoming compliance.
If you sell products in California, you are legally required to provide "clear and reasonable" warnings when your product exposes consumers to any chemical listed under California Proposition 65. With over 900 listed substances and frequent updates, tracking your obligations manually is impractical at scale. Prop 65 compliance software automates the screening, declaration, and warning-label workflow so you can ship to California with confidence.
If you run a website, app, or digital service, you're probably already required to comply with WCAG — even though it isn't a law itself. The Web Content Accessibility Guidelines (WCAG) are the global standard for digital accessibility, and they've been incorporated into legal frameworks across the EU, UK, US, Canada, and Australia. You don't have a choice about whether to follow them; you only have a choice about whether you comply proactively or reactively after a complaint.
Developed by the W3C's Web Accessibility Initiative, WCAG covers visual, auditory, physical, speech, cognitive, language, learning, and neurological disabilities. It's the closest thing to a universal accessibility rulebook the world has.
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive horizontal regulation of artificial intelligence — and its compliance deadlines are no longer theoretical. The bans on unacceptable-risk AI systems hit in February 2025, and the big one (high-risk AI obligations) arrives in August 2026.
Here's what most people miss: the AI Act doesn't regulate AI technology — it regulates what you do with it. The same AI model can be treated four different ways depending on how it's deployed. That distinction is the whole game.
The ICO's June 2026 guidance on IoT products explicitly states that manufacturers must conduct DPIAs before processing personal data from connected devices, and that consent must be obtained for any tracking technologies used. With penalties under PECR now aligned to UK GDPR levels — up to £17.5 million or 4% of global turnover — the cost of manual compliance management is no longer just administrative.
Compliance teams managing GDPR manually spend roughly 60% of their time on record-keeping alone — ROPA maintenance, DPIA documentation, consent logs, breach reports. That is time most product companies don't have.
GDPR compliance software automates these workflows. On the Sustalium platform, we built the GDPR module specifically for product companies — not tech firms — because the data flows are different when you're managing IoT data, supplier records, and customer shipments rather than SaaS user accounts.