Supply Chain, Sanctions & Third-Party Risk
You can outsource the service. You cannot outsource the accountability.
Who you depend on, and what they expose you to.
Why it's on the leadership agenda
Most regulatory frameworks now reach into the supply chain. NIS2 and DORA treat supplier security as the regulated entity's problem. Sustainability and forced labour rules do the same for how goods are made.
The EU now requires every member state to treat sanctions breaches as criminal offences. Directive (EU) 2024/1226 sets company fines of up to 5% of worldwide turnover, and liability can follow from the conduct of people in leading positions.
A single supplier failure can halt operations, trigger a reportable incident and damage relationships with customers. Leadership needs to know where those single points of failure are.
What the module covers
Mapping critical suppliers and concentration risk, including cloud and ICT providers
Supplier security obligations under NIS2 and DORA, and what contracts must contain
Sanctions exposure: screening, ownership and control, and red flags in trade flows
Forced labour and human rights risk in product supply chains
Continuity planning for supplier failure, with a board-level scenario
Oversight: what third-party risk reporting the board should receive, and how often
What your leadership team will be able to answer
Which suppliers could stop our critical services, and how quickly could we recover?
Do our contracts give us the audit, exit and incident rights the regulations expect?
How do we know we are not dealing, directly or indirectly, with a sanctioned party?
Could any product we sell be linked to forced labour, and could we prove otherwise?
Who owns third-party risk, and what did the board last see about it?
The regulatory frame
Harmonised criminal offences for sanctions breaches. Company fines of 1 to 5% of worldwide turnover, or EUR 8m to EUR 40m.
Transposition deadline 20 May 2025
Products made with forced labour can be banned from the EU market, withdrawn and disposed of.
Applies from 14 Dec 2027
Supply chain security and ICT third-party risk are part of the regulated entity's own obligations.
In force
Dates reflect the position as of September 2026. Every engagement begins with a current regulatory review.
What you leave with
A map of critical suppliers and concentration risks, ranked by impact
A contract gap check against NIS2 and DORA expectations
A view of sanctions and forced labour exposure across your supply chain
A tested plan for the failure of a critical supplier
A third-party risk report format for regular board review