I. Introduction
Within the field of business and human rights, there is a growing reliance on artificial intelligence (AI) to conduct human rights due diligence. Human rights due diligence is the process by which a company identifies, prevents, mitigates and accounts for potential adverse human rights impacts within its operations and supply chains. Introduced in the 2011 United Nations Guiding Principles (UNGPs) as part of the corporate responsibility to respect human rights, human rights due diligence is now the cornerstone of the international legal framework on business and human rights.Footnote 1 Over the past fifteen years, this legal norm has been incorporated into domestic regulations, ranging from disclosure laws to mandatory due diligence legislation. However, while the UNGPs define the general parameters of human rights due diligence, governments have failed to provide sufficient guidance on how to operationalize the process and are inadequately monitoring and enforcing compliance with the laws.Footnote 2 We are thus seeing ‘cosmetic compliance’ among companies, including a box-ticking approach that focuses on process rather than outcomes, shallow due diligence that does not go beyond the first tier of suppliers and the absence of meaningful engagement with stakeholders.Footnote 3
As companies and states struggle to comply with and enforce these laws, respectively, they are increasingly turning to digital technologies such as AI to conduct due diligence on complex global supply chains. A noteworthy example is the use of AI-enabled tools to implement recent forced labour import bans. Since 2020, the United States-Mexico-Canada Agreement commits the three state parties to prohibit the importation of goods produced in whole or in part by forced labour. In addition, in 2021, the United States passed the Uyghur Forced Labor Prevention Act (UFLPA), which aims to ensure that no product made wholly or in part in China’s Xinjiang Uyghur Autonomous Region is imported into the country. To facilitate compliance with these laws, companies and government officials are relying on technology firms to map complex multi-tiered supply chains and screen for forced labour indicators in public sources, commercially available trade data and corporate data.
Yet the use of AI to facilitate compliance with the UFLPA and other supply chain regulations has not been critically examined regarding its implications for corporate accountability. This article examines the promise and perils of AI as a technology of governance for interpreting the norm of human rights due diligence and implementing supply chain legislation. By enabling supply chain visibility and risk assessment, AI is significantly enhancing companies’ ability to conduct human rights due diligence in compliance with recent laws. Yet I argue that the use of AI in this context is also disrupting traditional conceptions of corporate accountability by delegating interpretive judgments to technology firms and their proprietary models, privatizing human rights and deemphasizing stakeholder engagement.
While scholars have analysed how AI impacts human rights and law more generally, there is scant attention to how AI is shaping corporate accountability in practice. This article examines the methodologies behind these tools, the role of technology firms in their design and application and the unintended consequences of relying on those firms to interpret the legal norm of human rights due diligence.
As part of a socio-legal empirical methodology, I conducted twelve semi-structured interviews with representatives of technology firms, consultants and human rights advocates. Interviewees were selected based on their professional involvement in developing, advising on or assessing technologies used to implement global supply chain regulations and human rights due diligence. The interviews were conducted in person or virtually in 2025 and were recorded and transcribed with the informed consent of the participants.Footnote 4 I analysed the interview transcripts with a focus on the design and use of AI tools for human rights due diligence, including their data sources and analytical methods, approaches to supply chain mapping and risk assessment, stakeholder engagement and implications for corporate accountability. In addition, I conducted participant observation at two conferences featuring presentations and demonstrations by policymakers, practitioners and technology firm representatives. These observations provided contextual background and informed the subsequent interviews.
I also analysed reports, product materials and other publicly available resources issued by technology service providers in this field. These firms offer a range of digital tools that perform various functions in support of companies’ compliance with supply chain regulations, including mapping supply chains and identifying and assessing human rights risks. I focus primarily on two case studies that illustrate distinct approaches to supply chain risk assessment. Sayari is a risk intelligence and supply chain mapping platform that uses AI and graph analytics to analyse public and commercial data, map corporate and trade relationships and identify risk exposure, while Assent is a compliance management platform that assesses human rights risks using supplier surveys, AI-powered screening of external digital sources such as watchlists and adverse media, and review by subject matter experts. I also draw on examples from two other firms, Altana AI and Kharon, as additional points of comparison. The cases are not intended to be representative of all technology service providers but to show how different digital tools and methods shape the interpretation and implementation of human rights due diligence.
The remainder of this article proceeds as follows. Section II reviews the landscape of supply chain regulations, including disclosure laws, mandatory human rights due diligence legislation and forced labour import bans. Section III discusses the barriers to implementing human rights due diligence, including conceptual challenges and practical difficulties. Section IV analyses how companies and states are using AI to attempt to address these challenges. It focuses on the critical role of AI for increasing supply chain visibility, assessing human rights risks and monitoring corporate compliance. Section V evaluates the risks of AI-driven corporate accountability, including data gaps and credibility concerns, the privatization of human rights and the marginalization of rightsholders. The concluding Section VI discusses how AI can be used to promote corporate accountability in ways that strengthen, rather than undermine, meaningful human rights due diligence.
II. The landscape of supply chain governance
Human rights due diligence lies at the core of modern conceptions of corporate accountability. It has evolved from an ambiguous and broadly defined concept referenced in soft law instruments to a legal norm that has become a central focus of supply chain regulations.Footnote 5 In 2011, the UN Human Rights Council unanimously endorsed the UNGPs, which established the international legal framework for human rights due diligence.Footnote 6 While the UNGPs assign states the primary duty to protect against corporate human rights abuses, they also urge companies to identify, prevent, mitigate and account for adverse human rights impacts on an ongoing basis. Unlike conventional due diligence, which focuses on risks to the business, human rights due diligence focuses on risks to people and extends to impacts linked to a company through its business relationships, including entities in its value chain.
Over the past fifteen years, states have adopted laws that draw from the UNGPs and transform the voluntary norm of human rights due diligence into a legislative mandate. The first wave consisted of disclosure laws addressing conflict minerals and modern slavery.Footnote 7 These laws require companies to report on their efforts to address human rights violations in their supply chains, but require little concrete action and impose few penalties for non-compliance.Footnote 8 A second model comprises mandatory human rights due diligence laws, which require companies to identify and address human rights risks in their operations and supply chains and, in some cases, impose legal liability for failure to comply.Footnote 9
In 2024, the European Union (EU) adopted the Corporate Sustainability Due Diligence Directive, which requires large EU companies and certain non-EU companies doing significant business in the EU to assess their actual and potential adverse human rights and environmental impacts and take action to prevent, mitigate and address identified harms. As of August 2026, however, the Directive had been amended through Omnibus I, narrowing its corporate scope and allowing companies to prioritize the assessment of impacts involving direct business partners when impacts in several areas are equally likely or equally severe.Footnote 10 While existing mandatory due diligence laws feature limited oversight and enforcement mechanisms, they nevertheless represent a significant development in the legalization of human rights due diligence.Footnote 11
In addition to disclosure regimes and mandatory human rights due diligence laws, a third category of regulation consists of forced labour import bans. These laws prohibit the importation or sale of goods made wholly or in part using forced labour and thereby encourage companies to undertake due diligence throughout their supply chains. In the United States, Section 307 of the US Tariff Act of 1930 prohibits the importation of goods made with forced labour, with enforcement having increased considerably since 2016 (following the closing of the consumptive demand loophole).Footnote 12 In 2021, the United States passed the UFLPA, which prohibits the importation of products made wholly or in part in China’s Xinjiang Uyghur Autonomous Region. The UFLPA establishes a rebuttable presumption that any goods mined, produced or manufactured wholly or in part in the Xinjiang region are made with forced labour. Thus, it places the onus on companies to provide ‘clear and convincing evidence’ to US Customs and Border Protection (CBP) to demonstrate that such goods were not made with forced labour.
Canada and Mexico have also adopted forced labour import bans to comply with their commitments under the 2020 United States-Mexico-Canada Agreement. As of August 2026, Canada was considering Bill C-35, which would strengthen its forced labour import regime by authorizing the government to list goods reasonably suspected of being produced with forced labour and requiring importers of listed goods, upon request, to provide prescribed information to the Canada Border Services Agency. The European Union has similarly adopted the Forced Labour Regulation, which prohibits products made with forced labour from being sold in or exported from the EU. The European Commission has since issued guidelines on the implementation of the regulation, which is set to apply from 14 December 2027.Footnote 13 While customs and import bans are becoming a prominent regulatory mechanism aimed at promoting corporate accountability, there is still limited evidence on the potential unintended effects on workers and the extent to which these laws will prevent forced labour on the ground.Footnote 14
III. The challenges of conducting human rights due diligence
Despite the proliferation of supply chain regulations, human rights due diligence remains difficult to implement. According to Corporate Human Rights Benchmark’s 2020 analysis of disclosures from 229 global companies, human rights due diligence is a key challenge for companies. It ‘remains an area of poor performance across all sectors’ and the lowest area of improvement in the four years since the launch of the annual benchmarking report. Almost half of the companies assessed (46.2 per cent) failed to score any points under the benchmark’s human rights due diligence indicators.Footnote 15 Corporate Human Rights Benchmark’s 2023 analysis of the largest companies found that while there had been some progress in this area, more than half of companies (55 per cent) still failed to include rightsholders in their human rights due diligence processes, thereby undermining their credibility.Footnote 16
Uneven performance could also be explained by two other critical factors: (i) the absence of guidance on what constitutes adequate human rights due diligence and a lack of tools to achieve this standard; and (ii) the difficulty and cost of mapping complex global supply chains, comprehensively assessing human rights risks and managing ‘nth-tier’ suppliers (those beyond a company’s first-tier suppliers).
Ambiguity in the interpretation of human rights due diligence leaves companies with broad discretion on how to operationalize this critical legal norm.Footnote 17 Existing laws have failed to provide adequate clarity concerning the obligations inherent in human rights due diligence. There is a proliferation of guidance, or the lack thereof in some jurisdictions, that can be disparate or contradictory.Footnote 18 In the face of gaps in how to interpret this norm and thereby implement supply chain legislation, companies are increasingly turning to ‘regulatory intermediaries’ to provide critical commentary and tools on how to identify and assess risks in global supply chains.Footnote 19 Regulatory intermediaries perform important functions in the implementation of rules by ‘interpreting and elaborating them for specific circumstances [and] “translating” them into practical forms useful to targets.’Footnote 20 As companies have demanded tools to assist them in complying with the laws, technology vendors have stepped in to perform this interpretive role.Footnote 21
Companies also face the practical difficulty and cost of mapping complex and rapidly changing supply chains and conducting human rights risk assessment beyond the first tier of suppliers. Global supply chains frequently involve multiple layers of suppliers that may be challenging to trace.Footnote 22 Comprehensive monitoring can be challenging since companies often rely on first-tier suppliers to identify and audit those in the second tier, who in turn identify and audit the next tier and so on. But suppliers may be unable or unwilling to disclose the relevant information.Footnote 23 According to a 2024 survey by McKinsey and Company, only 30 per cent of global companies had visibility beyond their first-tier suppliers.Footnote 24 The volatility of supply chains also complicates companies’ efforts to maintain an updated list of suppliers and sub-tier suppliers. Companies are therefore turning to AI to identify sub-tier suppliers and assess human rights risks across dynamic and complex supply chains.
IV. The critical role of AI in regulating global supply chains
Companies are increasingly turning to technology firms to help them interpret the legal norm of human rights due diligence and implement supply chain legislation. While a variety of technologies are being used in this context, AI is arguably the most critical as it enables companies to manage multi-tiered supply chains and mine large datasets for risk intelligence. Here, I will focus on AI’s benefits—increasing supply chain visibility, assessing human rights risks and monitoring corporate compliance—while Section V will cover potential risks. Although AI tools also support other steps of human rights due diligence (e.g., grievance mechanisms that rely on AI-powered chatbots to provide easily accessible information to human rights victims), those applications are less frequent and fall outside the scope of this study.
A. Increasing supply chain visibility
AI can enable the mapping and tracing of suppliers beyond the first tier and down the supply chain, thereby enhancing supply chain visibility. By applying complex algorithms and synthesizing massive amounts of data from various sources, AI tools can improve the transparency of supply chains and facilitate the traceability of products. Thus, they can make human rights due diligence more efficient and scalable.
Supply chain mapping is a foundational step in human rights due diligence. It involves identifying direct and indirect suppliers across multiple tiers of the supply chain and tracing the relationships and interdependencies among them. As part of this process, companies identify adverse human rights impacts associated with their operations, products and services and collect information about geographic regions and industries with heightened human rights risks (e.g., forced labour in China’s Xinjiang region and child labour and forced labour in the cobalt mining industry in the Democratic Republic of the Congo). Thus, supply chain mapping feeds into the risk assessment process and enables companies to prioritize actions based on the severity of identified human rights risks.
One of the most prominent technology providers that offer supply chain-mapping tools is Sayari, which was founded in 2015 and is headquartered in Washington, DC. Like other firms that operate in this space (including Altana AI, Provenance, FRDM and Sourcemap), Sayari specializes in facilitating corporate compliance with human rights due diligence laws, particularly the UFLPA. Sayari’s risk intelligence platform processes data from billions of public and commercial records. It then uses graph analytics technology to produce a visualization of supply chains as networks, where it flags human rights risks. AI technology is used to parse, standardize and resolve messy unstructured data and screen for direct and upstream supplier risk. I will focus on Sayari’s supply chain mapping technology in this section and then discuss its risk assessment tools in Section IV.B.
Sayari applies its algorithms to official public records, commercially available import-export trade data from over 70 countries and corporate data. Its technology connects data on three billion relationships, including trade, ownership and control, which are extracted from 7.1 billion records from 245 jurisdictions around the world.Footnote 25 To account for the volatility of supply chains (such as tactical name changes and the closing of subsidiaries), Sayari refreshes its data and brings in new data every two to four weeks.Footnote 26 It also preserves time-stamped historical snapshots of corporate records at regular intervals, allowing users to identify what changed and when and to trace the evolution of corporate ownership over time.Footnote 27
Figure 1 is a supply chain network visualization produced by Sayari, based on official Chinese corporate records.Footnote 28 It demonstrates indirect corporate links between Contemporary Amperex Technology (CATL, located at the top right of the visualization), which is the world’s largest electric vehicle battery producer, and the Xinjiang-based company Xinjiang Zhicun Lithium (located further down the map).
Supply chain network map produced by Sayari.
Figure 1. Long description
A network diagram with yellow and blue nodes connected by labeled arrows.
At the top left is a blue person icon labeled Guan Chaoyu. He is linked as Legal Representative of Gwin Semiconductor (Xiamen) Co., Ltd. and as a 67% Shareholder of, Director of, and Manager of Ningbo Meishan Bonded Port Area Yitian Investment Co., Ltd.
At the top right, Contemporary Amperex Technology Company (CATL) is a 100% Shareholder of Ningbo Meishan Bonded Port Area Wending Investment Co., Ltd.
In the upper-middle section, Ningbo Meishan Bonded Port Area Chendao Investment Partnership (Limited Partnership) receives investment from three sources: Guan Chaoyu (99% Shareholder), Yitian Investment (1% Shareholder), and Wending Investment (34% Shareholder, noted as a former relationship).
Moving down the central axis, Chendao Investment is a 61.22% Shareholder of Zhicun Lithium Group Co., Ltd., which in turn is a 100% Shareholder of Xinjiang Zhicun Lithium Industry Co., Ltd.
At the bottom, Xinjiang Zhicun Lithium Industry Co., Ltd. acts as a 100% Shareholder for seven subsidiaries arranged in a horizontal row: Xinjiang Zhicun Smart Energy Co., Ltd., Hetian Zhicun New Materials Co., Ltd., Bazhou Xiyu Loulan New Energy Materials Co., Ltd., Xinjiang Qiangdian Energy Investment Co., Ltd., Pishan County Karakoram Mining Co., Ltd., Luopu Zhicun New Energy Materials Co., Ltd., and Xinjiang Zhicun Supply Chain Management Co., Ltd.
Three pink text boxes provide context: one notes that Meishan Yitian and Meishan Aspiration were registered one day apart; another states Chendao Investment took its stake in Zhicun Lithium in May 2023 after CATL’s divestment; the third notes Xinjiang Zhicun Lithium was registered in July 2022.
These shareholding relationships provide evidence that CATL sources raw materials from entities that use forced labour. This finding led the US House Select Committee on the Chinese Communist Party to recommend that the company be added to the UFLPA Entity List.Footnote 29 Companies on this list are subject to a rebuttable presumption that their goods were made with forced labour and are therefore prohibited from importation into the United States.
In order to identify connections between different suppliers and parts, Sayari uses AI to examine international trade data that is categorized by standardized product codes, which are referred to as harmonized system (HS) codes. This analysis helps map out which suppliers likely provide components or subcomponents for a specific product, even several tiers deep into the supply chain. It then builds a ‘product blueprint’, which is a visual supply chain map that shows how a specific product is made, including the components, subcomponents and the suppliers involved at each step of its global supply chain. The following is Sayari’s description of its AI-powered product blueprint methodology:
Sayari Map allows supply chain and procurement teams to upload up to 25,000 suppliers at a time, screen these suppliers for more than 100+ risk factors, then automate filterable mapping to better understand sub-tier suppliers and all of their relationships. The product maps the upstream supply chains of the uploaded suppliers that match against Sayari’s database at a product level, leveraging Sayari’s AI-enabled product blueprints … To generate the Product Blueprints, Sayari’s Data Engineering team has built a recommendation engine that analyzes the entire breadth of Sayari’s global shipment data across 70+ jurisdictions to identify and assign weights to input-output HS Code pairs. Sayari Map then leverages large language model technology to validate that these pairs have a component-subcomponent relationship, and builds a linked property graph based on the validated and QA’ed pairs [passed through a quality assurance process], creating a library of Product Blueprints for every HS Code available in its database.Footnote 30
In summary, Sayari’s AI-enabled tool organizes unstructured raw data by standardizing names, reconciling diverse entities, resolving duplicate records, matching suppliers across languages and data formats and building a unified and structured supply chain map across data sources. Sayari maintains data provenance, meaning that it links each data point and relationship in its platform to the underlying primary source document, which can help users provide evidence to authorities investigating the origin of a product—for example, when CBP officials review detained shipments for UFLPA compliance.Footnote 31
B. Assessing human rights risks
Risk identification and assessment is another important step in human rights due diligence that is being automated using AI. This step is grounded in Principle 18 of the UNGPs, which states that businesses should ‘identify and assess any actual or potential adverse human rights impacts’.Footnote 32 After a company has mapped its operations and supply chain, it needs to identify existing adverse human rights impacts (e.g., documented cases of child labour at a supplier site) and potential risks of future adverse human rights impacts (e.g., sourcing from a region with known forced labour practices). Risks should be assessed based on their impact on people, rather than on their financial impact to the company.
Companies and suppliers are using AI-based technological solutions to harness predictive intelligence and automate risk assessment. AI tools facilitate the collection, mining and analysis of large quantities of data—including social media posts, news articles, academic studies and non-governmental organization (NGO) reports—on different suppliers and sites in a company’s supply chain. By screening public data sources in multiple languages, these tools can forecast potential human rights risks and identify high-risk regions or sectors. For instance, algorithms can ‘detect specific patterns in complaints of social media users directed against a particular business or industrial site or identify negative assessments in news items potentially unavailable to human analysts due to the sheer size of the data collected and linguistic barriers’.Footnote 33 AI can thus address the limits of in-person social audits, which have been widely critiqued for failing to detect human rights abuses due to their superficial coverage based on snapshot inspections, a check-box approach to compliance and a tendency to legitimize business interests rather than meaningfully engage with workers.Footnote 34 As a result, AI fills an important gap in facilitating risk identification and assessment in dynamic and complex supply chains.
AI-powered risk assessment on sectoral, geographic and product risk factors, along with human rights indicators (e.g., forced labour), is then leveraged to produce risk scores for suppliers and their factories. Risk rating systems categorize risks at different levels (e.g., low, medium or high risk), which enables companies to prioritize high-risk sectors and regions in such areas as forced labour. Risks are flagged for companies on an AI-enabled platform, which corporate clients can customize based on their risk appetite and compliance obligations.
Below, I include a detailed analysis of two technology firms that carry out AI-based risk assessment: one (Sayari) that also conducts supply chain mapping as described above and a second (Assent) that focuses on supply chain compliance and risk management. Their distinct approaches reflect the different business models and strategic orientations of each firm. Sayari is primarily a risk intelligence platform that uses AI technology to aggregate and analyse public records, trade data and corporate networks to surface hidden risk exposure. Assent is a compliance management platform that specializes in direct supplier engagement and supply chain data collection.
Sayari automatically screens suppliers and flags risks based on over 100 proprietary risk factors. Under each factor, users (whether companies or CBP officials) can view the associated source document, underlying indicators and number of related alerts. Users can also filter risk flags by severity to prioritize specific investigations. These risks include what Sayari describes as ‘surface risk’—for example, an entity appears on the UFLPA Entity List, operates in or sources from Xinjiang, or has been identified in adverse media or NGO reporting—as well as ‘hidden risk’, which represents potential and emerging risks that arise from company relationships, beneficial ownership structures, sub-tier supplier networks and trading activity.Footnote 35 Sayari’s dashboard continuously monitors suppliers and provides notifications to companies about changes in their supply chain’s risk exposure.
Under Sayari’s platform, risks are categorized by severity into critical, high and elevated risks.Footnote 36 For instance, critical risks of forced labour include the entity appearing in the Sheffield Hallam University forced labour reports (a series of influential reports and evidence-based studies on Uyghur forced labour and its ties to global supply chains), the UFLPA entity list maintained by the US government, or an entity subject to a Withhold Release Order (WRO) issued by CBP (an enforcement tool to detain shipments at US ports of entry when government officials have reasonable but not conclusive evidence that the goods were produced using forced labour). High risks of forced labour include direct trade history with, ownership by or ownership of entities on the aforementioned lists (Sheffield Hallam reports, UFLPA entity list, or WRO list), an entity with a Chinese prison labour keyword, a Xinjiang-registered entity, or an entity with a Xinjiang keyword. Elevated risks include a supplier network with entities on the lists or mentions of forced labour in adverse media (i.e., when an entity is publicly mentioned in official government websites or mass media outlets for involvement in forced labour).
Another technology company that offers supply chain risk assessment is Assent. Founded in 2010 and headquartered in Ottawa with multiple global offices, Assent specializes in supply chain compliance and sustainability data management. According to its website, Assent’s supplier intelligence network is ‘the world’s largest database of supplier contacts and compliance records’.Footnote 37 Assent facilitates corporate human rights due diligence by focusing on the risk assessment process. Its sustainability platform offers risk screening of suppliers based on both direct and indirect supplier engagement. As part of direct engagement, Assent uses its sustainability platform to distribute surveys and industry-wide questionnaires (e.g., the Slavery and Trafficking Risk Template, the Conflict Minerals Reporting Template and the Extended Minerals Reporting Template) to identified (mostly first-tier) suppliers of each purchased part for a given product. The firm then screens supplier responses to flag human rights risks and validate supplier submissions.Footnote 38 AI is used for document data parsing, the automation of evidence review, data matching and bill of materials data validation.Footnote 39 Assent also uses AI to quality-check supplier responses and flag gaps or inconsistencies. In order to mitigate risk, Assent issues corrective action notices to suppliers whose responses do not meet compliance requirements and provides training and support to those suppliers on regulatory compliance.
In addition to direct supplier engagement, Assent uses AI-powered supplier screening to engage in what it calls ‘indirect supplier engagement’, which aims to provide continuous visibility into hidden risks that surveys would miss. Indirect engagement entails analysing information on suppliers that appears in public sources, watchlists and adverse media. As part of supplier screening, Assent monitors over two million digital sources, including news media, radio, television, social networks, NGO reports, subscription services, sanction lists and government registries, from 182 countries and 18 languages.Footnote 40 It also uses negative sentiment analysis to identify high risks that appear in sources. Sentiment analysis is a machine‑learning technique that classifies text as positive, neutral or negative.
By combining its supplier screening methodology with direct surveys, Assent produces what it calls a ‘360-degree’ view of a company’s sustainability performance across its supply chain.Footnote 41 Its platform combines data from direct surveys and indirect screening across public sources to produce risk scores for each supplier’s environmental, social and governance (ESG) performance. These risk scores, which appear in corporate clients’ online ESG risk dashboards, help companies identify high-risk suppliers across different ESG risk areas. Figure 2 provides a snapshot of a sample ESG risk dashboard, with numerical risk scores classified under low, medium and high risk under different issue areas.Footnote 42
ESG risk dashboard produced by Assent.
Figure 2. Long description
The dashboard is divided into two main sections.
Top Section: Performance Summary.
Four donut charts display risk scores.
1. Overall: 71 (medium risk, yellow).
2. Environment: 50 (high risk, red).
3. Social: 62 (medium risk, yellow).
4. Governance: 86 (low risk, green).
A legend defines risk levels: Low (86-100) in green, Medium (62-85) in yellow, and High (0-61) in red.
Bottom Section: Detailed Table.
The table is organized by Topic, Risk Score, Responses by Risk Level (stacked bar charts), and Suppliers by Response Status (stacked bar charts).
Environment Category:
- Climate Impact: Score 55 (medium).
- Resource Use: Score 22 (high).
- Biodiversity: Score 19 (high).
- Product Stewardship: Score 11 (high).
Social Category:
- Human Trafficking and Slavery: Score 44 (high).
- Human Rights: Score 77 (medium).
- Labor Rights: Score 22 (high).
- Diversity and Inclusion: Score 21 (high).
Governance Category:
- Data Protection: Score 71 (medium).
- Organizational Commitment: Score 61 (high).
- Resilience: Score 66 (medium).
The ‘Suppliers by Response Status’ column uses a blue-scale legend: Completed (dark blue), In Progress (medium blue), and Not Responded (light blue).
While Assent produces scores on suppliers’ ESG risks (with human rights categorized under ‘social’ risks), it does not disclose the scoring scale, weighting system or risk typology, all of which it considers proprietary information. I will elaborate on the lack of transparency behind AI tools in Section V.
The two case studies of Sayari and Assent illustrate how technology firms with different business models use AI to assess human rights risks in supply chains. Sayari is primarily a risk intelligence platform that uses AI technology to aggregate and analyse public records, trade data and corporate networks to surface hidden risk exposure. Sayari does not help companies respond to flagged risks but just identifies them; thus, it is not a remediation tool. Since it focuses on network mapping and the flagging of risk without directly engaging with suppliers, one limitation is that its technology can lead to false positives. For instance, the platform will flag risk based on ‘possibly the same as’ matches. These matches occur when two or more records with different spellings likely refer to the same entity. Thus, if one record is flagged with a risk factor, then the others in the same group are flagged even though the linkage is not verified. Sayari’s platform will also flag risk based on remote ownership ties (e.g., a supplier has a minority shareholder who is also a part-owner of a Xinjiang-based entity that uses forced labour).Footnote 43 Since the platform assumes the accuracy of official records and relies on algorithmic inferences that may be incorrect or exaggerated, its human rights risk assessment process is based on probabilistic models, network logic and automated rules without relying on contextual analysis by human experts.
Assent is a compliance management platform that specializes in direct supplier engagement. Its core data comes from questionnaires and supplier declarations, although it also uses AI-driven supplier screening of media sources and watchlists as part of its indirect supplier engagement. Because Assent provides limited visibility into the sub-tiers of corporate supply chains, it can only collect data to the extent that suppliers are willing or able to disclose it. As a sustainability expert at the company explained:
Assent is focusing on the things around due diligence like risk identification of tier 1 suppliers … The expectation is to start where it’s most relevant, where you have the established business relationships, which is tier 1. We do ask high level [questions, such as], ‘What’s your level of engagement with the additional tiers?’ We do want to build a network to bring those suppliers in and have them reach out … But it’s very long-term and it’s a journey, it’s a progression. But definitely focusing on initial tier 1s.Footnote 44
As a result, the platform may be less able to identify hidden risks deeper in the supply chain.
At the same time, Assent’s supplier screening process takes a more balanced approach that incorporates human judgment rather than primarily relying on automated analysis. A representative from Assent noted that ‘it always has to be human-vetted and include human input … You can’t solely rely on AI, but you need to have that dual effort of manual and automated or AI tools’.Footnote 45 Assent’s risk assessment platform therefore integrates digital sources with analysis by human rights and subject matter experts, who provide context to the data.Footnote 46 Its customer success representatives also assist suppliers in responding to questionnaires and offer guidance on how to interpret standards, improve ESG scores and enhance regulatory compliance. In this way, the firm combines automated data analysis with expertise from an in-house team of regulatory specialists.
C. Monitoring corporate compliance
The use of AI is not limited to business. Governments are beginning to use AI tools to monitor corporate compliance with supply chain regulations and investigate potential violations. In the case of the UFLPA, CBP has contracted with several AI firms (e.g., Sayari and Altana AI) to identify companies which may be in violation of import regulations.Footnote 47 CBP officials use AI to help screen cargo at ports of entry and efficiently flag high-risk shipments. According to Altana AI, thousands of CBP users have access to its platform, which enables them to:
perform network analysis of the global supply chain; integrate additional data sources and analytics to efficiently and effectively screen the value chains of goods entering the United States for forced labour; coordinate strategic analysis and tactical efforts to comply with the UFLPA; compile evidence to support enforcement actions; and better collaborate with the private sector to ensure that compliant supply chains aren’t disrupted.Footnote 48
As it monitors compliance with its forced labour import ban and the UFLPA, the US government has access to the same platforms that are available to business clients. As a senior analyst at Sayari explained, ‘It is the same tool. There’s not a government version of Sayari … A government user is able to see what a user on the commercial side would see, and vice versa … You run the same search, and you get the same results on both sides’.Footnote 49
In other jurisdictions, public authorities face the challenge of reviewing a vast number of due diligence reports and modern slavery disclosures. AI tools based on natural language processing could help analyse these reports and ensure efficient compliance with legislation.Footnote 50 The ability of data analysis tools to supervise large-scale compliance with supply chain laws depends on the format of disclosures. Machine readability enables AI to extract raw data, efficiently assess statements across indicators and thereby enhance comparability between companies and across sectors. Thus, the Walk Free Foundation has called on the UK and Australian governments to require that companies publish modern slavery statements in a standardized, machine-readable format.Footnote 51
NGOs and academic experts are also experimenting with the use of AI to assess regulatory compliance. For instance, Project AI against Modern Slavery (AIMS) was developed by social scientist Adrian Bora in partnership with the Future Society and the Walk Free Foundation.Footnote 52 Project AIMS leverages machine learning and other AI techniques to analyse corporate reports submitted under the UK and Australian modern slavery laws. Its objective is to empower the public and investors with information about corporate practice, while also providing legislators with valuable insights on corporate compliance and potential reforms to existing laws.Footnote 53 In contrast to private sector-led initiatives, Project AIMS is based on open-source data and thus available to the public to use, reproduce, or further develop the analysis.
V. The risks of AI-driven corporate accountability
By enabling companies to map the nth tier of suppliers and automate human rights risk assessments, AI offers distinct benefits in optimizing the human rights due diligence process and facilitating supply chain compliance. Yet AI-based tools also suffer from serious constraints including data gaps, credibility concerns and a lack of transparency. AI-driven corporate accountability threatens to privatize the human rights due diligence process and marginalize rightsholders by delegating interpretive judgment to technology firms and their proprietary models.
A. Data gaps and credibility concerns
Although some AI firms claim that they provide ‘a single source of truth’,Footnote 54 in reality, they are limited by two key obstacles—gaps in data and concerns over the credibility of data. First, there are notable data gaps where information may be missing, out-of-date, or buried in unstructured formats. With data coming from government sources, commercial databases and other publicly available sources, certain types of human rights violations and portions of the supply chain may not be represented in the datasets that are relied upon by AI tools. Sayari, for example, uses public records to detect Uyghur forced labour risk but is unable to identify other labour rights violations that are not documented in these records. According to a senior analyst at the firm, ‘wage deductions and debt bondage aren’t visible in public records in the same way, without talking to people and looking at labour contracts and all that [work] you can do if you’re an investigative reporter or an NGO. But someone like us isn’t going to obviously see that at scale’.Footnote 55 In addition, risk screening tools such as those used by Assent often focus on first-tier suppliers and cannot detect risks in the informal sectors that comprise the subsequent tiers of suppliers.Footnote 56
With respect to compliance with forced labour import bans, some countries (such as Canada, China and those in the European Union) do not disclose firm-level import and export data, while others (such as the United States) only disclose customs manifest data for shipping but not air or freight. At a hearing on ‘Modernizing Customs Policies to Protect American Workers and Secure Supply Chains’, the commercial vendor Import Genius provided the following written testimony to the US Trade Subcommittee of the House Committee on Ways and Means:
Air and truck cargo currently represents 46.5 percent of U.S. import value, surpassing the nearly 43 percent arriving by maritime transport. By failing to publish air and land data, we are missing half the picture, including many high-value products … The current blind spot for air imports prevents American companies from seeing connections that are necessary to make the most informed decisions.Footnote 57
Since comprehensive customs data is not disclosed, banned goods made with forced labour may be entering the United States by air or truck, or being transshipped to the US market through other countries. The limited access to customs data in certain countries prevents civil society actors, journalists, trade unions and other relevant stakeholders from conducting investigations on products made with forced labour and filing petitions with customs officials.Footnote 58
Another data gap, which is especially significant with respect to UFLPA compliance, stems from shifting supply chains. Data may not reflect the current reality in areas such as conflict-affected zones or in politically sensitive regions where governments deliberately obscure supply chains or redistribute labour—for instance, through the transfer of Uyghurs engaged in forced labour from Xinjiang to other provinces of China. Under the UFLPA, there is a legal presumption that goods produced wholly or in part in the Xinjiang region involve forced labour and are therefore inadmissible into the United States. Therefore, existing AI models are premised on the identification of goods with suppliers in Xinjiang. However, they do not account for the Chinese government’s transfer of Uyghur workers outside of the region, which was estimated by some sources to be as many as 3.2 million transfers in 2021.Footnote 59 These forced labour transfers cannot be captured using corporate ownership data alone. According to a senior analyst at Sayari, ‘the transfers themselves aren’t something that we would see in corporate records.’Footnote 60 Therefore, firms need to rely upon qualitative analysis of Chinese sources, reports by civil society groups and lists published by NGOs.Footnote 61
In addition, products made with Uyghur forced labour may be transshipped through intermediaries in other countries (e.g., Indonesia, Vietnam and Malaysia), which are listed as the source in customs forms.Footnote 62 Since AI systems rely on official customs data or shipping manifests (which reflect the declared exporter, not the actual origin), the original country of origin (China) may be concealed. This leads to an unintended consequence of the UFLPA—forced labour is being relocated to regions within China and funneled through third-country intermediaries, making it difficult for AI tools to trace and thus concealing important human rights risks.
Beyond missing data, there are also credibility concerns associated with the data that AI tools rely on to map supply chains and conduct risk assessments. The reliability of AI-powered human rights due diligence depends on the trustworthiness of the data, and there is a risk of manipulation if records are falsified. In the case of data used to identify goods made by Uyghur labour, companies may be changing their names in official records to avoid detection. In addition, the Chinese government may be deleting sensitive data to prevent scrutiny of forced labour practices.Footnote 63 As the chief executive officer of Altana AI observed, ‘There are definitely more and more attempts to obfuscate and avoid enforcement. AI is not a silver bullet; it’s not an all-seeing eye … There’s nothing in our technology that can identify the actual movement of Uyghur people. Unfortunately, I think this is going to be a cat-and-mouse game for a long time’.Footnote 64
To address the limitations of AI-enabled tools, particularly in identifying Uyghur labour, some firms—as well as the US government—also draw on qualitative research conducted by human analysts using Chinese-language sources.Footnote 65 For example, Kharon offers a forced labour dataset developed through a review of primary sources, including local government notices, securities disclosures, Chinese media, corporate announcements and WeChat posts, by Chinese-speaking analysts.Footnote 66 CBP has contracted with Kharon to use its risk analytics platform to support the agency’s enforcement of the UFLPA and other customs and trade laws.Footnote 67 A number of firms, including Altana AI, TrusTrace and Sourcemap, also integrate Kharon’s forced labour data and risk detection tools into their AI-enabled supply chain mapping platforms. According to Kharon’s Global Director of Strategy:
AI is an accelerator in our research process. Our subject matter experts use it to generate leads and query data across hundreds of sources, finding patterns in a volume of material no team could read. Not every discovery is a risk-relevant finding. A determination has to be made: does the data indicate a connection to forced labor practices, directly or through a related party? Sometimes AI makes that determination. Sometimes an analyst does. And sometimes it’s a combination of the two. But in every case an analyst validates the data before we publish it.Footnote 68
Kharon’s approach highlights the importance of supplementing AI-enabled analysis with human expertise.
Another limitation of relying exclusively on automated analysis is that poorly calibrated keyword searches and interpretations embedded in algorithms may lead to the under-detection of human rights abuses or the overstatement of risks based on unverified claims. Many firms use sentiment analysis to categorize news and social media, but negative-sounding news does not necessarily indicate misconduct. For instance, when AI engines scan news articles or social media posts for signs of human rights risks such as labour unrest, the data may reflect allegations that have not been independently verified. Other human rights risks, such as sexual harassment, forced labour and child labour, may also be underreported due to their sensitive nature. In addition, sentiment analysis across geographic regions and languages does not pick up on divergent cultural and political interpretations.
These methods may also introduce geographic bias. Because many AI models rely heavily on publicly available sources such as social media and news reports, they may identify higher rates of reported violations in more open democratic societies, where abuses are more likely to be documented. By contrast, abuses in jurisdictions with limited press freedom, weak civil society, or low levels of digital media may go underreported and thus not appear in the data. If reporting is scarce in less open countries, a model may infer a low level of risk even where serious abuses are occurring. In other words, an absence of reported human rights abuses does not necessarily indicate a lower level of human rights risk.
Given these data gaps and credibility concerns, AI tools may produce false negatives by failing to identify unreported risks or false positives by flagging unsupported risks as high based on unreliable inputs. Because these tools can measure only what appears in available public records, they may overemphasize certain risks while downplaying or overlooking others. Take, for example, Sayari’s ‘possibly the same as’ mechanism. As discussed in Section IV.B, Sayari links records that likely refer to the same entity even when the connection has not been verified. If one of those records concerns an entity on the UFLPA Entity List, the possible match may also be classified as a critical forced labour risk. While the classification does not itself establish that forced labour was used, it may lead a company or government user to investigate the supplier and request additional documentation. Yet Sayari’s public materials do not identify any process through which the supplier can directly challenge or correct the match.
Some technology firms have tried to address these problems by adding verification and human review to their risk assessment processes. As discussed above, Assent uses subject matter experts to review risk information, while Kharon relies on Chinese-speaking analysts to provide context, translate sources and conduct quality assurance. While these steps may reduce the risk of false positives and false negatives, they cannot overcome gaps or inaccuracies in the underlying data.
B. Privatizing human rights and marginalizing rightsholders
The use of AI in human rights due diligence represents a privatization of human rights and supply chain governance that disrupts traditional conceptions of corporate accountability and deemphasizes stakeholder engagement. Although companies remain legally responsible for human rights due diligence, key interpretive judgments are increasingly delegated to technology firms and embedded in their proprietary models. This creates an accountability gap: profit-driven firms influence what counts as a risk, how severity is assessed and what constitutes adequate due diligence without being legally accountable for those judgments. This gap between delegated judgment and retained legal responsibility is especially troubling given that supply chain regulations are intended to enhance corporate accountability to the public and hold companies responsible for human rights violations in which they are complicit, whether wittingly or unwittingly.
The delegation of interpretive judgment to private actors is not unique to AI. Scholars have long criticized social auditing and the private compliance industry for relying on checklists, failing to detect abuses and prioritizing business interests over workers.Footnote 69 Yet AI intensifies these concerns in important ways. While an auditor’s checklist and written findings can be reviewed by humans, AI tools generate risk scores and classifications through probabilistic models and automated rules that are difficult to understand or contest. The methodologies behind these tools are often proprietary, including the data sources, weighting systems and risk typologies used to identify and rank risks. AI also allows technology firms to apply the same risk criteria across thousands of suppliers and corporate relationships on an ongoing basis, which far exceeds the scale of traditional social auditing.
More broadly, this delegation of interpretive judgment reflects a technocratic model of governance. Technologies such as AI are not neutral instruments that can be applied mechanically. They are normative tools that embed certain values and shape behaviour. They can also reify power inequalities and concentrate interpretive authority in the technology firms and technical experts that design and operate these systems.Footnote 70 According to anthropological scholarship on the role of technologies of governance, these tools imbue a technocratic rationality into decision-making that masks underlying power relations as well as the methodologies behind the technologies.Footnote 71
The use of AI in human rights due diligence threatens to privatize public governance functions and reinforce existing power imbalances between companies and rightsholders. Algorithms codify complex norms into risk‐scoring frameworks, which determine what qualifies as a human rights violation and how serious the risk is. According to a consultant who worked with clients on their human rights due diligence processes: ‘[Companies] have their law firms that help them set up the systems, but then it’s engineers who program things. There’s always a translation between the human rights language and the human rights logic into code and into numbers’.Footnote 72 The engineers and technical experts who design algorithms and apply these technologies are serving as de facto interpreters of human rights, frequently with little or no opportunity for input from rightsholders themselves. Yet the companies that rely on these tools remain legally responsible for the resulting decisions. This approach can distance the due diligence process from the people it is meant to protect. As a business and human rights consultant remarked, ‘these kinds of tools can end up treating people as data points rather than as autonomous individuals with dignity’.Footnote 73
The algorithms and methodologies underlying AI-enabled risk assessments are generally proprietary, as firms do not disclose details to the public or even to companies themselves.Footnote 74 This includes the datasets used to train their models, their criteria for what counts as a rights violation, the factors used to determine severity levels and the weighting of different inputs. This lack of transparency limits opportunities for stakeholder engagement in the due diligence process. Stakeholders are not consulted about how risks are identified and evaluated, and rightsholders are often overlooked.
The exclusion of rightsholders affects both the information used to assess risk and their ability to challenge risk classifications. As discussed in Section V.A, a Sayari representative acknowledged that wage deductions and debt bondage may not appear in public records and cannot be identified without speaking to workers or reviewing labour contracts. While Assent invites suppliers to respond to questionnaires and corrective action notices, workers and affected communities do not appear to have a similar opportunity to provide information or respond to a risk determination. The public materials I reviewed did not identify any way for rightsholders to review or challenge those determinations.
Some companies may defer too readily to these tools without fully understanding the methods behind them. According to recent guidance on the use of digital tools for due diligence by Germany’s Federal Ministry for Economic Cooperation and Development:
Companies rely too heavily on the information provided [by digital tools] without taking their own measures to analyze and identify risks. This can lead to risks being insufficiently recognized and make effective risk management more difficult … [C]ompanies should therefore ensure that they do not blindly rely on the data and evaluations provided, but instead … first check on their own responsibility whether and which tools are suitable for implementing the law.Footnote 75
An interview with a business and human rights advisor further supports this observation. She described clients that placed too much trust in automated processes and failed to critically review the tools: ‘When I talk to clients that already have a digital solution in place, they haven’t asked these questions. So I have had situations where I sit with clients and I tell them, “You go to your customer and ask them [what the methodology is] …” [But] they haven’t asked these questions.’Footnote 76 As a result, corporations may be unable to provide clear explanations for how a specific risk score was calculated or why a supplier was assigned a certain risk level.
The concentration of interpretive authority in technology firms and the lack of transparency surrounding AI tools are particularly troubling when the same firms provide services to both regulated companies and government agencies. As discussed in Section IV.C, firms including Sayari and Altana AI offer risk intelligence tools to companies while also contracting with CBP to support UFLPA enforcement. In the case of Sayari, commercial users and CBP officials access the same platform and receive the same search results. These arrangements represent public-private ‘algorithmic assemblages’ in which the same private firms and their proprietary tools shape both corporate compliance and government enforcement.Footnote 77
This dual role creates a potential conflict of interest and raises concerns about the independence of regulatory oversight. When companies and regulators rely on the same proprietary data, algorithms and risk classifications, regulators may be unable to independently verify the reliability of the underlying data sources or the assumptions used to classify risks. As a result, technology firms are not simply providing technical support. They are shaping how human rights risks are defined and prioritized without being publicly accountable for those judgments.
VI. Conclusion
AI is playing a critical role in enhancing human rights due diligence by increasing supply chain visibility, facilitating human rights risk assessment and enabling states to monitor corporate compliance with supply chain regulations. However, there are risks associated with AI-driven corporate accountability, including data gaps and credibility concerns, the privatization of human rights and the marginalization of rightsholders. Algorithmic human rights due diligence creates an accountability gap. Rightsholders may have no way to access or contest the evidence behind risk determinations, while companies may not understand decisions shaped by proprietary AI systems. Interpretive judgment is delegated to technology firms, but legal responsibility remains with the companies that rely on them. The lack of transparency behind decision-making threatens to transform human rights due diligence from an instrument of corporate accountability into a tool of corporate legitimacy.Footnote 78
Therefore, technology must not be treated as a stand-alone solution but rather as a complementary tool towards achieving meaningful human rights due diligence. According to a report by the United Nations Office of the High Commissioner for Human Rights, the use of digital technologies in human rights due diligence needs to be more rights-compatible, based on meaningful stakeholder engagement.Footnote 79 This requires ‘the right blend of technical and human rights subject matter expertise’ and a synthesis of ‘technological solutions with more traditional, human-centred methods of engagement’.Footnote 80
Rather than outsourcing interpretive judgment to technology firms and depending entirely on automated risk analysis, companies should maintain oversight of their due diligence processes. Under the UNGPs, companies remain responsible for identifying and assessing adverse human rights impacts and cannot delegate that responsibility to technology vendors. Companies should therefore conduct due diligence on the tools they use to carry out human rights due diligence. In order to do so, they need to carefully assess the origin and quality of the data, the methodology used to identify and assess risks and the limitations of the tools, including gaps in data coverage and the risk of false positives or false negatives that may require further investigation. In addition, companies should not just accept a vendor’s results but should ensure that there are human rights experts who are reviewing risk classifications and providing contextual analysis. The use of a technology provider should support, rather than replace, a company’s own judgment about human rights risk.
Given that the UNGPs call on states to protect against corporate human rights abuses and to provide effective guidance to companies on how to respect human rights, states also have an important role to play. This is especially true when governments themselves use AI tools to enforce supply chain laws. In those cases, government agencies should independently assess the due diligence tools they purchase, and procurement contracts should require vendors to provide agencies with sufficient information to conduct that review. Government agencies should review the evidence behind a vendor’s risk classification and make their own assessment before taking enforcement action. Since government agencies such as CBP may rely on the same platforms used by the companies they regulate, procurement contracts should require vendors to disclose the services they provide to those companies and include procedures for identifying and addressing potential conflicts of interest. The need for transparency is not limited to government procurement. Regulators should require a basic level of disclosure whenever companies rely on AI tools to comply with supply chain laws. At a minimum, such disclosures should identify the data sources used, how risks are assessed and ranked, when human review is used and the limitations of the tools.
Suppliers and rightsholders should also have access to enough information to understand and challenge risk classifications that affect them. The UNGPs stress the importance of effective grievance mechanisms and access to remedy for affected stakeholders. There should therefore be a process through which affected suppliers, workers and communities are informed of the basis for a classification and can provide additional information to challenge classifications that do not reflect conditions on the ground.
As AI facilitates the mapping of supply chains beyond the first tier and assessment of human rights risks, companies should ensure that these tools supplement, rather than replace, meaningful engagement with workers and other affected stakeholders. Ultimately, companies must remain accountable for how they interpret and implement human rights due diligence and for the human rights impacts of their business activities.
Acknowledgements
Many thanks to Kathleen Claussen, John Foote, Joanna Langille, Ryan Liss, Valerie Oosterveld, Michael Santoro, and participants in Georgetown Universit’s International Law and Foreign Relations Colloquium and Western University Faculty of Law’s International Law Colloquium for extremely helpful comments. I am also grateful to Mackenzie Birbrager and Yasmin Rajwani for excellent research assistance.
Competing interests
The author declares none.
Open access
