Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
For a long time, compliance was treated as an internal function. Policies were written, controls were implemented, and responsibility sat neatly within the boundaries of a single organisation.
In 2026, that model no longer holds.
Across a growing number of EU regulations, compliance is extending beyond individual companies and into the supply chains they depend on. This shift is not always explicit, but it is already reshaping how businesses operate, especially for growing companies.
A structural shift in how supply chain compliance works
Recent regulatory developments point in the same direction. Whether the focus is environmental impact, cybersecurity, or financial crime, the mechanism is increasingly similar.
Under the EU’s deforestation rules, companies placing products on the market must demonstrate that goods are sourced responsibly. That requirement cannot be fulfilled without detailed input from suppliers. Under the NIS2 Directive (EU) 2022/2555, organisations are expected to manage cybersecurity risks, including those that originate from vendors and service providers. Sanctions frameworks require businesses to understand who they are transacting with, not just internally, but across their partner network.
In each case, responsibility may sit with one company, but execution depends on many.
This is the essence of supply chain compliance for growing companies. Even when they are not the primary target of regulation, they are part of the system that makes compliance possible.
How this shows up in practice
For many SMEs, the impact is already visible, even if it is not framed as regulation.
Requests for information are becoming more frequent and more structured. Companies are being asked to provide details on sourcing, ownership, operations, or risk exposure. These requests often come from clients, partners, or intermediaries rather than regulators themselves.
What has changed is not only the volume of these requests, but the expectation behind them. It is no longer enough to respond informally or on a best-effort basis. There is an increasing expectation that information is accurate, consistent, and available when needed.
This creates a new type of operational pressure. The challenge is not interpreting legal texts, but being able to respond in a way that is reliable and repeatable.
The hidden problem: Fragmentation
Most SMEs already handle some form of due diligence, whether through onboarding checks, questionnaires, or internal reviews. The difficulty is that these activities are rarely connected.
Information is often spread across spreadsheets, emails, and documents. Processes vary depending on who is handling the request. Over time, this leads to fragmentation, where the same data is collected multiple times in slightly different ways, and no single source of truth exists.
This approach can work when requests are occasional. It becomes much harder to manage as expectations increase and timelines shorten.
In this context, the real risk is not non-compliance in a strict legal sense. It is inconsistency. When information cannot be easily retrieved or verified, it becomes difficult to demonstrate that appropriate checks have been carried out.
From one-off effort to ongoing process
Another important change is the move away from one-off checks. Compliance is increasingly treated as an ongoing process rather than a point-in-time activity.
A supplier is not simply reviewed once. Their status may need to be monitored, updated, and reassessed over time. Documentation is expected to be maintained, not just created. The same applies to areas such as sanctions exposure, ESG indicators, or cybersecurity risks.
For growing companies, this does not necessarily mean doing more work. It means organising existing activities in a way that allows them to be repeated and maintained without starting from scratch each time.
This is where many businesses begin to feel the strain. Without a clear structure, even simple processes can become time-consuming.
What a practical approach looks like
Supply chain compliance for growing companies does not require complex systems or large teams. It requires clarity in how information is handled.
At a basic level, businesses need to know who they are working with, be able to collect relevant information in a structured way, and respond to requests without rebuilding the process each time. Just as importantly, they need to retain a record of what has been done, so that it can be demonstrated if required.
This can be applied proportionately. Not every relationship carries the same level of risk, and not every request requires the same depth of response. The key is consistency, not complexity.
Where SMEs feel the impact
In most cases, the challenge is not awareness. SMEs understand that expectations are changing.
The difficulty lies in execution. Information is not centralised, processes are not standardised, and documentation is not always accessible when needed. These gaps often remain invisible until they are tested, for example during a procurement process or an audit.
At that point, the ability to respond quickly and clearly becomes a competitive factor.
Conclusion
Supply chain compliance for growing companies is not a future concern. It is already taking shape in how companies request, share, and verify information.
The shift is not about complexity, but about structure. Moving from informal, one-off responses to simple, repeatable processes.
For growing companies, that shift is what makes compliance manageable.
Frequently asked questions
EU rules such as the deforestation regulation, the NIS2 Directive and sanctions frameworks place responsibility on one company but depend on information from its suppliers, so the requests arrive from clients and partners rather than regulators.
Fragmentation. Due diligence information sits in spreadsheets, emails and documents, processes vary by person, and the same data is collected several times with no single source of truth.
No. Compliance is increasingly treated as an ongoing process: a supplier's status may need to be monitored, updated and reassessed over time, and documentation has to be maintained, not just created.
Know who you work with, collect the relevant information once in a structured way, answer every request from that record, and keep evidence of what has been done, applied proportionately to the risk of each relationship.
THIRD-PARTY RISK SCREENING
QuickScreen360: screen suppliers and partners for compliance risks. Send due diligence requests, assign training and monitor results in one platform.