Understanding Supply Chain Due Diligence for DPPs

Este artículo aún no está disponible en su idioma, por lo que se muestra en inglés.

What is Supply Chain Due Diligence?

Supply chain due diligence is the process by which businesses identify, prevent, mitigate, and account for adverse impacts in their supply chains. These impacts may be environmental (such as deforestation, pollution, or excessive carbon emissions) or social (such as forced labour, child labour, or unsafe working conditions). Due diligence requires businesses to look beyond their own operations and take responsibility for the practices of their suppliers, sub-suppliers, and other value chain partners.

In the context of Digital Product Passports, supply chain due diligence takes on a specific practical dimension. The data that populates a DPP does not originate solely from the manufacturer, it comes from across the supply chain. The recycled content percentage requires data from material suppliers. The carbon footprint requires emissions data from every tier of the supply chain. The substances of concern disclosure requires chemical composition data from component suppliers. Without robust due diligence processes, this data cannot be collected, verified, or trusted.

The ESPR does not operate in isolation. It sits within a broader EU regulatory landscape that includes the Corporate Sustainability Due Diligence Directive (CSDDD), the Deforestation Regulation, and the Conflict Minerals Regulation. Together, these instruments create a comprehensive framework that requires businesses to understand and take responsibility for their supply chains.

How Due Diligence Connects to DPP Data Requirements

The connection between supply chain due diligence and DPP data requirements is direct and practical. Consider the types of information that a Digital Product Passport must contain:

• Material composition: Requires data from raw material suppliers and component manufacturers about the specific materials used in each component.
• Recycled content: Requires verified data from material suppliers about the proportion of recycled versus virgin materials.
• Substances of concern: Requires chemical composition data from every supplier whose materials end up in the final product.
• Carbon footprint: Requires scope 3 emissions data from across the supply chain, including raw material extraction, processing, and transport.
• Country of origin: Requires traceability data that identifies where raw materials were sourced and where manufacturing took place.
• Compliance declarations: Requires evidence that the product and its components meet all applicable regulatory requirements.

Each of these data points depends on information flowing from suppliers to the manufacturer. Due diligence is the process that ensures this information is collected systematically, verified for accuracy, and updated as supply chains change. Without it, DPP data is unreliable and potentially non-compliant.

The EU Regulatory Framework for Due Diligence

Several EU regulations create due diligence obligations that intersect with DPP requirements:

ESPR (Regulation 2024/1781): The ESPR itself requires that product information in DPPs be accurate and verifiable. Manufacturers are responsible for the accuracy of the data in their products' passports, which implicitly requires due diligence on supplier-provided data. The regulation text establishes the framework for these requirements.

Corporate Sustainability Due Diligence Directive (CSDDD): This directive requires large companies to identify, prevent, and mitigate adverse human rights and environmental impacts throughout their value chains. While broader in scope than DPPs, the CSDDD's due diligence processes generate data that is directly relevant to DPP population.

Deforestation Regulation: Requires businesses placing certain commodities on the EU market to demonstrate that their supply chains are deforestation-free. The traceability systems required by this regulation overlap with those needed for DPP compliance.

REACH Regulation: Requires the registration, evaluation, and authorisation of chemicals used in products. REACH compliance data about substances of concern feeds directly into DPP requirements.

Building a Due Diligence Process for DPP Compliance

An effective supply chain due diligence process for DPP compliance involves several stages:

Mapping: The first step is to map your supply chain comprehensively. This means identifying not just your direct (tier 1) suppliers but also their suppliers (tier 2) and beyond. For DPP purposes, you need to trace the supply chain far enough to collect all required data points. For material traceability, this often means reaching back to the raw material level.

Risk Assessment: Not all suppliers and supply chain tiers carry equal risk. Risk assessment involves evaluating each supplier and material source against criteria such as geographic risk (some regions have higher risks of environmental or social violations), commodity risk (some materials are more likely to be associated with adverse impacts), and supplier risk (based on past performance and audit results).

Data Collection: Once the supply chain is mapped and risks assessed, systematic data collection processes must be established. This involves defining what data each supplier must provide, in what format, and with what frequency. For DPP purposes, the data requirements are defined by the applicable delegated acts.

Verification: Supplier-provided data must be verified. Verification methods range from documentary checks (reviewing certificates, test reports, and audit results) to physical verification (on-site audits, sampling, and testing). The level of verification should be proportionate to the risk level identified in the assessment stage.

Practical Challenges in Supply Chain Data Collection

Collecting the data needed for DPPs from across the supply chain presents several practical challenges that businesses must address:

Supplier Reluctance: Some suppliers view detailed data requests as intrusive or commercially sensitive. Material compositions, supplier relationships, and cost structures may be considered trade secrets. Overcoming this reluctance requires clear communication about regulatory requirements, contractual obligations, and the mutual benefits of transparency.

Data Quality: Even willing suppliers may provide data of inconsistent quality. Different suppliers may use different measurement methods, reporting formats, or levels of precision. Standardising data collection through structured templates and clear specifications is essential.

Multi-tier Visibility: Many businesses have limited visibility beyond their direct suppliers. Reaching tier 2, tier 3, and deeper suppliers requires either direct engagement (which is resource-intensive) or reliance on tier 1 suppliers to collect and relay data from their own suppliers (which introduces reliability risks).

Dynamic Supply Chains: Supply chains are not static. Suppliers change, material sources shift, and manufacturing processes evolve. Due diligence is not a one-time exercise but an ongoing process that must keep pace with supply chain changes. DPP data must reflect the current state of the supply chain for each product.

Small Supplier Capacity: Small and medium-sized enterprises in the supply chain may lack the resources, expertise, or systems to provide the detailed data required for DPP compliance. Supporting these suppliers through training, tools, and reasonable timelines is both practical necessity and ethical obligation.

Technology Solutions for Supply Chain Due Diligence

Technology plays an increasingly important role in making supply chain due diligence scalable and efficient:

Digital Product Passport Platforms: Platforms like MyProductPassport provide structured frameworks for collecting, storing, and managing the supply chain data needed for DPPs. By defining the required data fields and formats, these platforms standardise the collection process and reduce the burden on both manufacturers and suppliers. Learn how to get started with our guide on creating your first Digital Product Passport.

Supply Chain Traceability Systems: Blockchain-based and conventional traceability systems track materials and components as they move through the supply chain, creating an auditable chain of custody. These systems provide the provenance data needed for DPP material traceability fields.

Supplier Management Platforms: Dedicated supplier management tools automate the process of distributing data requests, collecting responses, tracking compliance, and flagging gaps. Integration with DPP platforms can streamline the flow of data from supplier to passport.

Automated Verification: Emerging technologies such as AI-powered document analysis, satellite monitoring for deforestation risk, and IoT-enabled material tracking can supplement manual verification processes, improving both coverage and efficiency.

Contractual Frameworks for Supplier Data

Securing reliable data from suppliers typically requires formal contractual arrangements. Key elements of supplier contracts for DPP due diligence include:

• Data provision obligations: Clear specification of what data the supplier must provide, in what format, and by what deadlines.
• Accuracy warranties: Contractual assurances that the data provided is accurate, complete, and based on appropriate measurement or calculation methodologies.
• Update obligations: Requirements for suppliers to notify the manufacturer of any changes that would affect the accuracy of previously provided data.
• Audit rights: The right for the manufacturer (or a third party) to verify supplier-provided data through on-site audits or document reviews.
• Cascading obligations: Requirements for suppliers to impose equivalent data obligations on their own suppliers, ensuring data flows from deeper supply chain tiers.
• Confidentiality protections: Appropriate safeguards for commercially sensitive supplier data, ensuring that DPP transparency requirements do not compromise legitimate trade secrets.

Building a Resilient Due Diligence Programme

Supply chain due diligence for DPPs is not a one-off project but an ongoing operational capability. Building a resilient programme requires investment in people, processes, and technology.

Start by designating clear responsibility for supply chain data within your organisation. Whether this sits within procurement, sustainability, quality, or a dedicated DPP team, someone must own the process end to end. Then establish the data collection processes and supplier engagement strategies described above, beginning with your highest-risk and highest-volume supply chains.

Integrate due diligence data flows with your Digital Product Passport system from the outset. Treating supply chain data collection and DPP population as separate processes creates duplication, inconsistency, and inefficiency. When data flows directly from supplier due diligence into passport records, both processes benefit.

Finally, plan for continuous improvement. Regulatory requirements will evolve, supply chains will change, and technology capabilities will advance. A due diligence programme that is designed for adaptability will serve your business far better than one that is built to meet today's minimum requirements and nothing more.