Supply chain due diligence compliance stopped being a paperwork exercise in 2026. Two EU regimes that procurement teams once treated as future problems are now operational realities, and both reward the same thing: continuous, evidence-based monitoring of supplier risk rather than an annual questionnaire.
Here is the direct answer to what changed. Regulators have moved from guidance to enforcement, and from “collect a form once a year” to “prove you are watching the right suppliers all the time.” If your due diligence program still runs on static spreadsheets and a yearly survey, it no longer satisfies the standard regulators are now applying.
The grace period is over for third-party risk
The Digital Operational Resilience Act (DORA) entered into application on January 17, 2025, and 2026 is the year it has teeth. National competent authorities have ended the informal tolerance that defined 2025 and are conducting active supervisory reviews, cross-checking the mandatory Register of Information and issuing the first compulsion payments.
The financial stakes are concrete. General non-compliance can draw fines of up to 2% of global annual turnover or EUR 10 million, whichever is higher. Designated critical ICT third-party providers face up to EUR 5 million plus 1% of average daily worldwide turnover for every day they stay non-compliant, for up to six months. Notably, the European supervisors have flagged that Articles 28 to 30, covering ICT third-party risk management, carry the highest rate of compliance gaps. The weakest part of most programs is exactly the part regulators are examining first.
CSDDD got narrower, not softer
The other shift came from the Corporate Sustainability Due Diligence Directive. In December 2025 the European Parliament approved the Omnibus I package, and the amending directive entered into force on March 18, 2026. It narrowed scope and pushed the application deadline to July 26, 2029, with national transposition due by July 26, 2028.
A later deadline is easy to misread as a reprieve. It is not. The Omnibus did not remove the obligation to run a documented, risk-based due diligence program; it raised the bar on what counts as adequate. Sending the same questionnaire to every tier-1 supplier is no longer defensible. The new watchword is “less, but more accurate, and verifiable.” Companies still need to prioritize suppliers by actual risk, collect evidence, and run trigger-based reassessments whenever new risk emerges, not just on a fixed cadence.
The common thread across both regimes is unmistakable: regulators now expect procurement to demonstrate that it is monitoring the right suppliers continuously and can prove it with evidence.
What good looks like
Compliance and continuity have converged. The same supplier that creates regulatory exposure when it is poorly monitored is the supplier that takes your production line down when it fails quietly. Both problems are solved by the same capability: live, prioritized, explainable risk monitoring instead of point-in-time snapshots.
That means three things in practice. First, risk-based prioritization, so scarce diligence effort lands on the suppliers that actually matter rather than spreading evenly across a thousand vendors. Second, continuous monitoring that updates when a supplier’s financial health deteriorates, not when the next annual survey comes due. Third, an evidence trail that shows a regulator what you knew, when you knew it, and what you did about it.
This is the gap Chain Verity was built to close. Chain Verity tracks 200-plus financial signals per supplier across tiers 1, 2, and 3, quantifies exposure in dollars rather than traffic-light colors, and produces explainable risk scores that double as the audit trail regulators are asking for. Procurement teams preparing for the 2026 enforcement reality can request early access here.
Frequently Asked Questions
Q: What do new supply chain regulations require procurement teams to do in 2026?
A: They require risk-based, continuous due diligence rather than annual questionnaires. Under DORA, financial entities must actively manage and document ICT third-party risk, and under the post-Omnibus CSDDD, in-scope companies must prioritize suppliers by real risk and keep verifiable evidence of oversight. The expectation is proof of ongoing monitoring, not a once-a-year form.
Q: Did the CSDDD Omnibus eliminate supply chain due diligence obligations?
A: No. The Omnibus I directive narrowed the scope and moved the compliance deadline to July 26, 2029, but it kept the core obligation to run a documented, risk-based due diligence program. It actually made the risk-based standard stricter, so uniform tier-1 questionnaires no longer satisfy it.
Q: Is DORA being actively enforced in 2026?
A: Yes. DORA applied from January 17, 2025, and in 2026 the supervisory tolerance period ended. National competent authorities are running active reviews, cross-checking the Register of Information, and the first formal fines are expected in the second half of 2026.
Q: What are the penalties for non-compliance?
A: Under DORA, organizations can face fines of up to 2% of global annual turnover or EUR 10 million, whichever is higher. Critical ICT third-party providers face up to EUR 5 million plus 1% of average daily worldwide turnover for each day of continued non-compliance, for up to six months.
