I. Introduction
European Union (EU) sustainability law increasingly governs global value chains by requiring companies to know, document, and justify the conditions under which products enter the union market. Companies are no longer asked merely to publish high-level commitments. They must build systems that identify suppliers, trace products, assess risk, exercise leverage, store evidence, and explain decisions to regulators, customers, and, in some cases, courts.Footnote 1 The Corporate Sustainability Due Diligence Directive (CSDDD) gives this shift a general corporate form.Footnote 2 The EU Deforestation Regulation (EUDR) gives it a more concrete market-access form: covered products may not be placed on the Union market unless operators can support a due diligence statement with traceability and risk-assessment evidence.Footnote 3 The EU Forced Labour Regulation (FLR) adds a complementary prohibition-based form by making supply chain and production information relevant to investigations and decisions concerning whether products made with forced labour may be placed or made available on, or exported from, the Union market.Footnote 4
China’s State Council Order No. 834, the Provisions on the Security of Industrial and Supply Chains, enters this landscape with a different vocabulary. It frames industrial and supply chains through security, resilience, controllability, risk monitoring, emergency response and countermeasures.Footnote 5 Its most relevant provisions do not simply prohibit foreign compliance systems. Article 13 addresses certain investigations and information-collection activities in China. Article 15 permits security investigations where foreign organisations or individuals interrupt normal transactions, adopt discriminatory measures, or otherwise cause or threaten substantial harm to the security of China’s industrial and supply chains. Article 16 requires domestic organisations and individuals to comply with measures adopted under the security-investigation provisions and, where they fail to do so, allows further restrictions, including restrictions concerning data and personal information.Footnote 6
The resulting problem is often described as one of regulatory conflict: Brussels asks firms to collect evidence and discipline suppliers, while Beijing may treat some of those acts as security-sensitive. That description is useful, but it does not go far enough. The deeper issue is legal reclassification. A supplier questionnaire, audit visit, satellite-linked plot record, termination clause, platform-generated risk score, or cross-border data transfer may move from one legal category to another as it crosses legal orders. In the EU setting, it may be compliance evidence. In the Chinese security setting, it may become information gathering, discriminatory disruption, data export or conduct relevant to supply chain security.
This article argues that compliance infrastructure has become a distinct object of legal analysis in contemporary supply chain law. By compliance infrastructure, I mean the organisational, contractual, digital and evidentiary systems through which obligations governing value chains become operational. These systems include supplier codes, contractual audit clauses, traceability files, certification schemes, due diligence platforms, escalation procedures, remediation plans, reporting templates and data-transfer channels. The central claim is that this infrastructure is no longer merely the background machinery of legal implementation. Under conditions of economic security, data sovereignty and sustainability regulation, compliance infrastructure can itself become a security object.
The argument is doctrinal and conceptual. It reads EU sustainability instruments and Order No. 834 as legal architectures for producing, moving, and controlling supply chain information. It does not claim that EU-style sustainability compliance is automatically unlawful in China, nor does it suggest that companies should retreat from human rights or environmental due diligence. The narrower claim is that compliance systems have become legally unstable because the features that give them operational strength also make them security-sensitive: visibility, traceability, standardisation, leverage and circulation.
The article therefore intervenes in a debate usually framed through extraterritoriality, private governance or business and human rights. These frames remain indispensable, but they do not fully capture the infrastructural form of contemporary supply chain regulation. EU law often governs foreign production through market access, private contracts and documentation rather than through direct commands to foreign suppliers.Footnote 7 The result is a form of regulatory projection that depends less on territorial jurisdiction in the classical sense than on the capacity to make non-EU production legible to EU-facing firms, platforms and authorities.Footnote 8 Once that legibility is produced through data-intensive systems, the same infrastructure becomes susceptible to a different legal description: not only as transparency, but as exposure; not only as accountability, but as extraction; not only as due diligence, but as a possible security event.
The article proceeds as follows. Part II situates the argument in the literatures on global value chains, mandatory due diligence, Chinese sustainable supply chain governance, private ordering, digital compliance and economic security. Part III explains how EU sustainability law operates as evidentiary infrastructure, focusing on the CSDDD, the EUDR, and the FLR. Part IV analyses Order No. 834 as a supply chain security filter rather than as a simple prohibition. Part V explains the selection and operation of three sites of legal reclassification. Part VI locates the article’s contribution within existing infrastructural scholarship and draws implications for risk regulation, transnational private law, and compliance design. Part VII concludes.
II. From compliance duties to compliance infrastructure
The first strand of relevant literature concerns the legalisation of global value chains. Legal scholarship has shown that value chains are not simply economic facts waiting to be regulated. They are made legally visible through concepts such as lead firm, business relationship, chain of activities, market placement, contractual control and adequate governance. EU law is particularly important because it constructs global value chains differently across company law, consumer law, trade law and market regulation. Recent scholarship describes global value chains as regulatory proxies through which the EU transnationalises internal-market objectives beyond its territory.Footnote 9 Chinese legal scholarship has similarly examined how European and US supply chain legislation can produce extraterritorial effects through the control exercised by lead firms across global value chains.Footnote 10
The second strand concerns mandatory human rights and environmental due diligence. Scholarship has traced the move from transparency and voluntary codes towards mandatory, risk-based due diligence in global value chains.Footnote 11 Chinese legal scholarship has likewise examined the transition from voluntary soft-law expectations to mandatory human rights due diligence, while questioning how far due diligence obligations should extend along supply chains and how their scope should reflect different relationships between firms and adverse impacts.Footnote 12 Chinese management scholarship adds a complementary operational perspective through sustainable supply chain management research on the coordination of environmental and social responsibilities across supplier networks.Footnote 13 The CSDDD has been analysed as a shift from disclosure towards the mandatory prevention of adverse impacts and as a hybrid instrument drawing on soft-law guidance, French vigilance law, German supply chain law, and EU sustainability policy,Footnote 14 while Chinese trade law scholarship has examined the Directive’s regulatory pathway and the lessons it may offer for China.Footnote 15 Other work asks whether mandatory human rights due diligence can prevent abuses, create accountability and avoid becoming a process-centred exercise that benefits corporate risk management more than rightsholders.Footnote 16
The transparency literature shows why this distinction matters. Disclosure and reporting regimes can improve visibility while still failing to change underlying conduct, especially when information is too aggregated, too technical, or too weakly connected to enforcement.Footnote 17 Studies of conflict-minerals reporting, modern slavery disclosure, and human rights reporting have repeatedly shown that information duties can produce elaborate documentary compliance without necessarily improving conditions for workers, communities or affected ecosystems.Footnote 18 Mandatory due diligence was partly a response to that limitation. Yet due diligence can reproduce the same weakness if the law rewards the existence of process more than the effectiveness of prevention, remedy and participation.Footnote 19 The infrastructure of compliance is therefore not normatively neutral: it may enable accountability, but it may also organise a legally defensible form of distance.
Recent risk regulation scholarship makes this point especially clear. Griffin and Fornasari argue that EU law increasingly uses corporate risk management obligations in both sustainability due diligence and digital platform regulation, entrusting large firms with the management of risks to public values.Footnote 20 Partiti shows that human rights due diligence interacts with voluntary standards, certification, risk assessment, monitoring and remediation systems rather than replacing them.Footnote 21 Villiers similarly emphasises the complexity created by the interaction between corporate reporting, due diligence, accountability, group structures, and supply chains.Footnote 22 These studies help explain why compliance infrastructure is not incidental to risk regulation. It is the institutional form that risk regulation takes inside the firm and across the chain.
The third strand concerns contract and private ordering. Supply chain obligations often become effective through private law before they are tested through public enforcement. Sustainability clauses, supplier codes, audit rights, cooperation duties, termination rights, and model contract clauses translate public regulatory pressure into buyer-supplier relationships.Footnote 23 Contract scholarship has shown that these instruments may be understood as proactive contracting, international sales obligations, CSR clauses or transnational private governance.Footnote 24 Private auditors, certifiers, and safety experts can also become legally significant intermediaries, including through tort liability where their assurance work fails.Footnote 25
The fourth strand concerns digitalisation and data. Due diligence is increasingly mediated by platforms, databases, satellite imagery, predictive tools, algorithmic risk scoring and remote stakeholder engagement.Footnote 26 Digital platforms may act as second-order lead firms because they structure how supply chain information is gathered, classified, and circulated.Footnote 27 More broadly, scholarship on algorithmic regulation and platform governance shows that risk classification can shift power towards technical intermediaries and corporate systems.Footnote 28 This matters because digital compliance systems intensify the very qualities that make supply chain governance attractive to regulators: visibility, standardisation, scale and repeatability.
The fifth strand concerns economic security, sovereignty and weaponised interdependence. International economic law scholarship has increasingly shown that supply access, data infrastructures, financial networks and chokepoints can become instruments of geopolitical power.Footnote 29 A related strand of Chinese international-law scholarship has examined sustainable supply chain compliance through WTO constraints, traceability and transparency requirements, risk allocation and the risk that compliance rules may be repurposed as instruments of economic sanctions.Footnote 30 EU market regulation itself often operates through territorial extension: it does not directly command all foreign producers, but it makes access to the EU market depend on conditions satisfied outside the EU.Footnote 31 China-focused data law scholarship likewise shows that cross-border data flows are increasingly governed through the categories of national security, data as a strategic resource, and security-assessment mechanisms.Footnote 32
The research gap lies at the intersection of these literatures. Taken together, these literatures explain the legalisation of global value chains, the rise of mandatory due diligence, the contractualisation and digitalisation of compliance and the turn to economic security. What remains less directly theorised is the legal status of the operational infrastructure itself: how audits, contractual leverage, traceability systems, digital platforms and evidentiary flows can acquire a different legal character when sustainability compliance is performed across security-conscious legal orders.
Compliance infrastructure offers an analytical category for examining this problem. Global value chain law makes production legible; mandatory due diligence requires firms to act on that legibility; contracts, platforms and data systems operationalise those duties; and economic security law changes the legal significance of visibility itself. The concept thus captures the point at which EU sustainability risk regulation and Chinese supply chain security law meet. The question is therefore not only whether EU sustainability duties are legitimate or enforceable, but also whether the infrastructures through which those duties are performed remain legally stable across security-conscious legal orders.
III. EU sustainability law as evidentiary infrastructure
EU sustainability law is commonly described in terms of duties: to identify adverse impacts, prevent or mitigate them, bring them to an end, report on them or refrain from placing non-compliant products on the market. But these duties depend on a prior condition. They require companies to create evidence capable of linking dispersed production sites to legally relevant risks. The CSDDD and EUDR illustrate the core model, while the Forced Labour Regulation extends the same evidentiary logic into public investigation and product exclusion.
The CSDDD gives this evidentiary logic a general corporate form. Directive (EU) 2024/1760 requires in-scope companies to integrate due diligence into policies and risk management systems, identify and assess actual or potential adverse human rights and environmental impacts, prevent or mitigate potential impacts, bring actual impacts to an end or minimise their extent, establish notification and complaints mechanisms, monitor effectiveness and communicate publicly.Footnote 33 Although subsequent amendments have altered its scope and timetable, the Directive’s basic technique remains infrastructural. It turns sustainability into a recurring corporate system for knowledge production, risk assessment, decision-making and review.Footnote 34
The CSDDD also relies on supply chain relationships rather than solely on corporate boundaries. It expects companies to work through subsidiaries and business partners, including by seeking contractual assurances, supporting small and medium-sized enterprises where relevant, adopting prevention action plans, suspending relationships in certain circumstances, and monitoring the effectiveness of measures.Footnote 35 Recent risk regulation scholarship on the CSDDD’s resilience effects is useful here because it shows how the Directive can push companies to assess vulnerabilities and redesign supplier-management practices.Footnote 36 The point is not simply that firms must comply with a new public law rule. They must produce a governance apparatus capable of translating legal risk into operational action.
This apparatus is likely to be most visible in procurement and supplier management. Buyers will need to decide what information is required at onboarding, how often supplier risk should be reassessed, what evidence is sufficient for lower-tier suppliers, which risks justify a corrective-action plan, when responsible disengagement is permissible, and how decisions should be documented. Each of these questions has a legal dimension, but each also has an infrastructural dimension. A firm can prove that it acted reasonably only if it has records showing what it knew, how it assessed risks, when it escalated concerns, and how it responded. Corporate risk management therefore becomes a form of legal memory.Footnote 37
The EUDR is even more directly evidentiary. It prohibits relevant commodities and products from being placed or made available on the Union market or exported from the Union unless they are deforestation-free, produced in accordance with the relevant legislation of the country of production, and covered by a due diligence statement.Footnote 38 Operators must collect information, documents and data showing, among other things, product descriptions, quantities, countries of production, geolocation of plots of land, and supplier information. They must assess risk and, unless the risk is no or negligible, adopt risk mitigation procedures before market placement.Footnote 39
Under the EUDR, lawful market access is impossible without traceability infrastructure. A product is not merely a product; it is an evidentiary bundle. Its legal status depends on the ability to link commodity, plot, producer, supplier, date, jurisdiction, deforestation status and due diligence statement. This is why the EUDR has generated intense debates about smallholders, national producer databases, interoperability, platform capacity and the distribution of compliance costs across value chains.Footnote 40 Compliance is therefore not an event at the border. It is a chain of information practices that begins upstream and travels through private and public systems.Footnote 41
The EUDR also shows why sustainability law can become highly granular. Unlike general corporate reporting, it requires product-specific evidence of legality and deforestation-free status. That granularity can improve enforcement, but it also expands the category of information that becomes relevant to market access. Plot coordinates, production dates, supplier identities and origin documentation may be routine for one regulatory purpose and sensitive for another. The regulation therefore turns environmental legality into a data architecture. That architecture is most demanding precisely where supply chains are fragmented, informal, politically sensitive or technologically uneven.Footnote 42
The FLR applies the same evidentiary logic through a different legal technique. From 14 December 2027, it will prohibit economic operators from placing products made with forced labour on the Union market, making them available there, or exporting them from the Union. Unlike the CSDDD’s general corporate due diligence model, the Regulation operates through risk-based public investigation and product-specific enforcement. Competent authorities may request information concerning products, producers, suppliers and relevant due diligence measures. If a violation is established, the competent authority must adopt a decision prohibiting the products and ordering their withdrawal and disposal. Supply chain information thus becomes relevant not only to corporate compliance but also to case selection, investigation and market exclusion.Footnote 43
Although the Regulation is country-neutral, its investigative architecture may have particular significance for EU–China value chains. Where suspected forced labour imposed by state authorities is at issue, information about upstream suppliers, production locations and relevant due diligence measures may become important to preliminary assessment, investigation and eventual market exclusion.Footnote 44 The Regulation therefore complements the CSDDD’s relational model and the EUDR’s traceability model through public investigation, while relying on much of the same compliance infrastructure.
Taken together, these instruments have two consequences. First, they change the role of the firm. The firm becomes a private evidentiary intermediary between EU public law and foreign production sites. It must translate EU legal duties, product prohibitions and investigative requests into supplier instructions, contractual warranties, audit protocols, data templates and records relevant to investigation or remediation. Second, they change the role of suppliers. Suppliers are not only producers of goods. They become producers of legally usable information. They must generate, retain and sometimes transmit evidence demanded by downstream buyers or competent authorities because market access, due diligence and product exclusion increasingly depend on that evidence.
Across this framework, three control points recur. The first is evidence production: the creation of records, certifications, maps, audits, complaints data and risk assessments. The second is supplier leverage: the contractual and commercial power through which firms seek cooperation or remediation, suspend or terminate relationships, or adjust sourcing in response to market-access and product-exclusion risks. The third is circulation: the movement of evidence through corporate groups, platforms, auditors, regulators, importers, customers and public reporting systems. These control points give EU sustainability governance operational force. They also create points of vulnerability when another legal order classifies the same practices as matters of security.
IV. Order No. 834 as a supply chain security filter
Order No. 834 should not be read as a mirror image of EU sustainability law. It does not create a general corporate due diligence regime for human rights or the environment. Instead, it creates a supply chain security framework. Its stated purposes include preventing and responding to industrial and supply chain security risks, ensuring the stable and smooth operation of key industrial and supply chains, and supporting high-quality development.Footnote 45 The regime is organised around key sectors, core technologies, risk monitoring, emergency response, information systems, data, investigations and countermeasures.Footnote 46
For the purposes of this article, the most important feature of Order No. 834 is that it treats supply chains as security infrastructures. The supply chain is not merely a market arrangement. It is a system whose interruption, manipulation or loss of controllability may become a security concern. That framing matters because it creates a legal lens through which foreign compliance conduct may be evaluated. A foreign buyer’s decision to require additional information, change sourcing terms, suspend a supplier, terminate a relationship or transmit data abroad may not remain within the vocabulary of private contract or sustainability compliance. It may be assessed against the state’s interest in industrial and supply chain security.
Article 13 is the first relevant filter because EU sustainability compliance often begins with information collection. Supplier questionnaires, audits, document requests, facility inspections, geolocation data and risk-screening exercises are standard compliance tools. Article 13 addresses investigations and information collection concerning industrial and supply chains within China when such activities violate Chinese law or relevant state provisions.Footnote 47 The provision does not prohibit all information gathering. Its significance is conditional: it signals that supply chain information collection becomes legally sensitive when it touches Chinese industrial and supply chain interests.
This point matters because Article 13 is not a general prohibition on due diligence, supplier audits or information requests. It is better read as a legality filter. The question is no longer only what evidence EU law requires, but whether the methods used to generate that evidence in China comply with Chinese laws, administrative regulations, departmental rules and relevant state provisions. The result is conditional visibility: information gathering may remain possible, but broad, routine or open-ended collection of compliance information becomes harder to treat as legally unproblematic.
Article 15 is the second relevant filter because EU sustainability compliance often depends on leverage. If a supplier refuses to provide evidence or take remedial action, or is classified as high-risk, the buyer may reduce orders, suspend the relationship, terminate a contract or exclude the supplier from an EU-facing supply chain. Article 15 allows security investigations when foreign organisations or individuals interrupt normal transactions, adopt discriminatory measures, or otherwise cause or threaten substantial harm to China’s industrial and supply chain security.Footnote 48 The legal risk is not that every buyer decision is unlawful. The risk is that certain buyer decisions can be reclassified as discriminatory or disruptive when they operate at scale, affect strategic sectors, or appear linked to foreign regulatory pressure.
Article 15 also contains meaningful thresholds. It would be too strong to say that every supplier decision taken for EU compliance purposes becomes discriminatory disruption. Ordinary sustainability compliance should not be equated automatically with conduct threatening China’s industrial and supply chain security. But it would be equally weak to treat Article 15 as irrelevant. Where exclusion, suspension, order reduction, or sourcing redesign affects strategic sectors, appears linked to foreign regulatory pressure, or operates through standardised risk classifications, the same decision may become open to a different legal description.
Article 16 is the third relevant filter because EU compliance is also a data flow problem. The provision should not, however, be misread as an ordinary or baseline prohibition on cross-border data transfers. Evidence does not remain where it is produced. It moves between suppliers, buyers, auditors, digital platforms, parent companies, EU importers and regulators. Article 16 comes into play after measures have been taken under the security investigation provisions and requires domestic organisations and individuals to comply with those measures. If they fail to do so, authorities may order correction and impose further restrictions, including restrictions concerning the cross-border receipt or provision of data and personal information.Footnote 49 Article 16 is therefore better understood as an escalation tool: once a supply chain security dispute has been activated, evidence circulation itself may become part of the countermeasure architecture.
This distinction matters for legal design. Describing Order No. 834 as a general data transfer ban would be inaccurate, but treating data circulation as legally neutral would be equally misleading. EU sustainability compliance depends on the repeated movement of information from suppliers to buyers, subsidiaries to parent companies, traceability platforms to auditors, and internal systems to market-access declarations, assurance files and public reports. A compliance model built on continuous evidentiary movement becomes fragile when that movement may be conditioned, restricted, or reclassified through supply chain security escalation.
Order No. 834 does not itself establish a general regime for outbound data transfers. Its data-related provisions are more specific: they link information sharing in key industrial and supply chains to data security, require enterprises and research institutions to ensure the security and controllability of core technologies, related information systems, and data, and allow further restrictions on the cross-border receipt or provision of data and personal information only after measures have been adopted under the supply chain security investigation provisions.Footnote 50 It should therefore be read in conjunction with, rather than as a substitute for, China’s wider data governance framework. Separate legal instruments, including the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law, regulate network security, important data, personal information processing, and the provision of data or personal information outside China.Footnote 51 Security assessment measures and the 2024 Provisions on Promoting and Regulating Cross-Border Data Flows create a layered system in which outbound data transfers may be permitted, restricted or conditioned depending on data category, transfer volume, sensitivity and the applicable institutional pathway.Footnote 52 Order No. 834 adds a supply chain security layer to this framework: it does not replace the general data transfer rules, but it creates circumstances in which supply chain evidence circulation may be evaluated through industrial and supply chain security.
Order No. 834 also belongs to a broader family of economic-security instruments. Article 1 expressly grounds the Order in the National Security Law, the Foreign Relations Law, the Anti-Foreign Sanctions Law and the Foreign Trade Law, while adjacent regimes such as export control law regulate strategic goods, technologies, services and related technical data.Footnote 53 Together, these instruments contribute to a legal environment in which foreign measures, strategic goods, data, sanctions and industrial capacity may be evaluated through the lenses of sovereignty and security. This does not mean that every sustainability compliance act will be treated as hostile. It does mean that the legality of compliance cannot be assessed by reading EU instruments alone. A multinational compliance system may be designed in Brussels, but it is implemented through local contracts, local employees, local suppliers, local data and local authorities.
Order No. 834 therefore operates less as a simple prohibition than as a legal filter. It makes compliance infrastructure conditional. The same audit, questionnaire, data request, contract clause, or termination decision may pass through the filter without difficulty, require redesign, require localisation, or trigger legal concern depending on sector, actor, data, effect, and political context. This is why legal reclassification matters. The issue is not whether EU law and Chinese law always collide. It is that the legal meaning of compliance infrastructure can change when the infrastructure that enables sustainability compliance is evaluated as an object of supply chain security.
V. Three sites of legal reclassification
Building on the legal filters identified above, the following analysis focuses on three connected sites within compliance infrastructure: evidence production, supplier leverage and evidence circulation. Together, these sites trace how compliance evidence is created, used to exercise leverage and circulated through corporate and regulatory networks, while revealing the principal points of interaction with Articles 13, 15 and 16 of Order No. 834.
The first site is evidence production. EU sustainability law requires companies to produce evidence about harms, risks, origins, suppliers, plots, workers, commodities and remediation. Evidence production is normally treated as benign because it is associated with accountability. But evidence is also information about industrial organisation. In China-related supply chains, a request for supplier identity, production capacity, facility location, sourcing relationships, upstream inputs, subcontracting arrangements, or geolocation may reveal commercially and strategically sensitive information.
The problem is not that evidence production is illegitimate. The problem is that evidence production has two legal lives. In the EU legal order, it is a condition of compliance and market access. Within China’s supply chain security framework, it may become an information collection practice whose legality depends on domestic law, sectoral sensitivity and the identity of the requesting actor. A single spreadsheet may therefore function both as due diligence evidence and as security-sensitive supply chain intelligence. This dual character is especially likely where evidence is collected through standardised global platforms, where foreign buyers request data directly from Chinese suppliers, or where auditors and certifiers gather information across many firms in the same sector.
The dual character of evidence also affects whose knowledge is recognised. EU sustainability compliance often privileges documentary proof, platform fields, certificates, satellite data and audit files. These forms can be useful, but they may crowd out worker testimony, community knowledge and local context. Scholarship on data and detection in international law has shown that technical systems redistribute what can be sensed and acted upon.Footnote 54 In supply chain compliance, this redistribution is legal as well as epistemic. The infrastructure determines not only what a company can know, but also what it can prove.
The second site is supplier leverage. EU sustainability instruments often assume that lead firms can and should use leverage to prevent, mitigate or bring adverse impacts to an end. Contractual assurances, corrective action plans, suspension and termination are treated as tools of responsible business conduct. But leverage can also be experienced as coercion or discrimination when it is applied unevenly, follows foreign regulatory classifications, or excludes firms from market access because they cannot or will not generate the requested evidence.
This is where EU sustainability compliance may acquire security significance under Order No. 834. A European buyer may believe that it is suspending a supplier because required documentation is missing or risk mitigation is inadequate. A Chinese authority may ask whether the suspension interrupts normal transactions, imposes discriminatory measures or threatens industrial and supply chain security. The legal meaning of the buyer’s act therefore depends on the frame. Sustainability law may classify the act as risk management. Supply chain security law may classify it as disruption.
The third site is evidence circulation. Compliance evidence gains value by moving. It travels from supplier to buyer, buyer to importer, importer to regulator, subsidiary to parent company, auditor to client, platform to dashboard and internal report to public-facing disclosure. This circulation is legally central to EU sustainability governance because regulators, customers and investors cannot evaluate compliance without usable evidence. But circulation also creates data-governance exposure. The more integrated and platform-based the compliance system, the more likely it is that data will cross borders, be aggregated, be reused for multiple regulatory purposes, or become accessible to foreign entities.
Evidence circulation therefore creates a double dependency. EU law depends on circulation because sustainability compliance must be demonstrable. Chinese security and data law may condition circulation because data, personal information and supply chain information are not legally neutral. This is not only a privacy issue. Some supply chain data may not be personal data at all, yet may still be sensitive because they reveal production networks, strategic capacity, bottlenecks or dependencies. The infrastructure of compliance may therefore become a map of industrial vulnerability.Footnote 55
This point is easiest to see in relation to digital platforms. A platform may begin as a vendor tool for supplier onboarding or deforestation traceability. Over time, it may accumulate data on suppliers and production sites, together with certificates, remediation histories, delivery patterns and risk scores from multiple buyers. It may also standardise what counts as a risk and how suppliers are ranked. Scholarship on platform law shows that private infrastructures can become governance sites in their own right because they make decisions, structure participation and create internal procedures that resemble adjudication.Footnote 56 In supply chain compliance, this means that a platform may become both an accountability tool and a strategic information node. Table 1 summarises how these three sites of legal reclassification operate across EU sustainability law and China’s supply chain security framework.
Three sites of legal reclassification of compliance infrastructure.
Table 1. Long description
A table comparing legal reclassification of compliance infrastructure across EU sustainability law and China’s supply chain security framework. The table has four rows and four columns. Column headers are Compliance function, EU sustainability meaning, Possible security reclassification, and Practical risk. Row 1: Compliance function: Evidence, EU sustainability meaning: production, Possible security reclassification: Proof of due diligence, origin, legality or risk mitigation, Practical risk: Information collection affecting industrial and supply chain security. Row 2: Compliance function: Limits on audits, EU sustainability meaning: questionnaires, geolocation or supplier mapping, Possible security reclassification: (empty), Practical risk: (empty). Row 3: Compliance function: Supplier leverage, EU sustainability meaning: Prevention, mitigation, remediation or responsible disengagement, Possible security reclassification: Discriminatory measure, transaction interruption or supply chain disruption, Practical risk: Scrutiny of suspension, termination, exclusion or sourcing redesign. Row 4: Compliance function: Evidence, EU sustainability meaning: circulation, Possible security reclassification: Demonstratability to regulators, buyers, platforms and markets, Practical risk: Sensitive data flow or externalisation of supply chain intelligence. Row 5: Compliance function: Data transfer, EU sustainability meaning: restrictions, localisation, access controls or platform redesign, Possible security reclassification: (empty), Practical risk: (empty).
This reclassification analysis also clarifies why a purely conflict-of-laws framing is too narrow. The issue is not only whether two legal norms are inconsistent. Often, the norms are formally compatible at a high level: companies should respect sustainability duties and comply with domestic security and data law. The difficulty arises in the infrastructure between them. A company may be able to state both obligations, but may not be able to perform both through the same operational system. The conflict is infrastructural before it is doctrinal.
Nor should the analysis be reduced to corporate burden. The reclassification of compliance infrastructure can affect rightsholders, workers, smallholders and suppliers. If buyers respond to legal uncertainty by exiting suppliers rather than investing in lawful evidence systems, vulnerable actors may lose market access. If buyers respond by reducing transparency, sustainability harms may become less visible. If states respond by restricting information flows too broadly, accountability may weaken. The challenge is therefore not to protect firms from compliance. It is to design compliance systems that are legally defensible, rights-sensitive and security-aware.
This is why responsible disengagement must be handled carefully. EU due diligence discourse increasingly recognises that disengagement may sometimes be necessary, but that it should usually follow engagement, prevention, mitigation, remediation and attention to adverse consequences. In a security-sensitive environment, the same sequence matters for an additional reason. A documented, proportionate and remediation-oriented process is less likely to be characterised as arbitrary exclusion or discriminatory disruption than a sudden termination based on opaque risk scores. Procedure cannot remove all geopolitical risk, but it can change the legal character of a decision.Footnote 57
VI. Implications for risk regulation and private law
The first implication is conceptual. Existing work on infrastructure as regulation, legal pluralism and supply chain infrastructures shows the value of “thinking infrastructurally”: treating infrastructure as a form of ordering rather than as neutral technical support.Footnote 58 Risk regulation scholarship should therefore treat compliance infrastructure as an object of regulation in its own right. Traditional accounts focus on the regulator, the regulated firm and the risk to be managed. Supply chain sustainability law adds another layer: the infrastructure through which risk is identified, classified and acted upon. When that infrastructure becomes security-sensitive, the scope of regulation expands. Law regulates not only deforestation, forced labour, labour rights, corporate governance or market access, but also systems that make those risks visible.
The second implication concerns transnational private law. Contracts are now central sites of legal translation. A supplier clause drafted to satisfy EU due diligence requirements may have effects under Chinese supply chain security law. Lawyers therefore cannot treat sustainability clauses as self-contained boilerplate. They must ask what information the clause requires, who receives it, where it is stored, how it may be reused, what happens if the supplier refuses to provide the requested information, and whether suspension or termination could be characterised as discriminatory or disruptive. Contract design must move from one-sided evidence extraction towards documented cooperation, proportionate information requirements, remediation, staged escalation and lawful data handling.Footnote 59
The third implication concerns digital compliance platforms. Platforms can make compliance scalable, but they can also centralise sensitive supply chain information, standardise risk classifications and create opaque decision pathways. From the perspective of EU sustainability law, platform-mediated due diligence may distance companies from affected stakeholders and convert human rights or environmental questions into corporate risk scores.Footnote 60 Research on data sharing in United Kingdom modern slavery and human trafficking initiatives illustrates the broader data governance risk: systems intended to improve transparency and coordination can expose vulnerable people to further harm where sharing procedures are opaque and accountability for downstream uses is limited.Footnote 61 A related but distinct concern arises under Chinese security law, where the aggregation of supply chain information may increase its visibility, portability and strategic value. Platform governance should therefore be treated as part of legal compliance design rather than merely as the procurement of a software service.
The fourth implication concerns corporate governance. Board and senior management oversight of sustainability compliance should include a map of the compliance infrastructure’s security risks and data flows. This does not mean subordinating human rights and environmental duties to security concerns; it means recognising that poorly designed infrastructure may fail under both sustainability and security law. A system that cannot lawfully collect or transfer evidence may not satisfy EU expectations. A system that collects excessive or poorly controlled information may create exposure under Chinese security and data law. Governance should therefore ask not only whether the firm is compliant, but also whether the infrastructure through which it complies is legally robust.
The fifth implication concerns regulators. EU lawmakers and enforcement authorities should be attentive to the foreign legal environments in which EU compliance systems operate. If market access rules require data that cannot lawfully be collected or transferred in certain jurisdictions without safeguards, companies may respond by de-risking, disengaging, or relying on formalistic documentation. Guidance should therefore address proportionate evidence requirements, lawful pathways for data collection and transfer, recognised alternative forms of evidence, supplier cooperation and responsible disengagement. Chinese authorities, for their part, should clarify how Order No. 834 applies to ordinary sustainability audits, traceability systems, and contractual remediation mechanisms so that security review does not unnecessarily chill legitimate accountability.
The sixth implication concerns enforcement style. The concept of “really responsive regulation” requires regulators to attend not only to the operating frameworks of regulated firms but also to the broader institutional environment of the regulatory regime.Footnote 62 Supply chain sustainability enforcement should therefore examine not only whether a firm possesses documents, but also whether its compliance infrastructure is capable of producing reliable and rights-sensitive knowledge through proportionate methods. Conversely, new governance scholarship warns that principles-based compliance can degenerate into internal procedures that are impressive on paper but weak in practice.Footnote 63 The relevant regulatory question is therefore not only whether a company has a policy, a platform, or a supplier code, but whether those instruments connect to genuine prevention, remediation, and lawful information governance.
The seventh implication concerns the normative evaluation of due diligence. Compliance infrastructure is necessary if sustainability obligations are to be more than symbolic, but it also redistributes power. It can shift costs upstream, privilege firms with data capacity, exclude small suppliers, empower auditors and platforms, and turn affected stakeholders into data points. The security turn adds another dimension: compliance infrastructure can redistribute strategic visibility among states, firms and platforms. Legal design must therefore evaluate infrastructure by asking what it reveals, whom it empowers, whom it burdens, and how it can be contested.
This emphasis on contestability makes participation more than a decorative feature of compliance design. It is a safeguard against both box-ticking and security overreach. If affected stakeholders, suppliers and local experts can contest risk classifications, explain missing data, propose alternative evidence and challenge disengagement decisions, the infrastructure is less likely to become a closed system of extraction and exclusion. Company law scholarship has long argued that global supply chains expose the limits of corporate law structures built around separate legal personality, shareholder value and group fragmentation.Footnote 64 Participation cannot solve those structural limits by itself, but it can make the evidentiary system less one-sided. It also helps distinguish legitimate accountability from opaque control.Footnote 65
Taken together, these implications point towards a practical design principle: bounded interoperability. Supply chain compliance systems should be interoperable enough to satisfy EU evidence requirements, but bounded enough to respect applicable security, data governance and proportionality requirements in the jurisdictions where evidence is produced. Bounded interoperability would favour data minimisation, purpose limitation, local verification where appropriate, controlled access, audit trails, supplier participation, tiered disclosure and documented assessments of proportionality. It would also distinguish between evidence that must move across borders and evidence that can be verified locally without full extraction.Footnote 66
Bounded interoperability is not a complete solution to geopolitical conflict or to the tension between sustainability and security. Its value instead lies in locating the compliance problem at the infrastructural level. The task is not simply to determine whether firms have duties, but to design compliance infrastructures through which those duties can be performed without turning accountability into uncontrolled information extraction or creating avoidable conflict with security law.
VII. Conclusion
Contemporary supply chain regulation increasingly operates through compliance infrastructure. Legal disputes therefore concern not only the content of duties, but also the systems through which those duties are performed. Although the CSDDD, EUDR and FLR use different legal techniques, each depends on infrastructure that makes global production visible, evidentiary, and governable. China’s Order No. 834 shows that the same infrastructure may be read through security, resilience, and controllability.
The article’s core claim is one of legal reclassification: compliance infrastructure can become a security object. Evidence production, supplier leverage and evidence circulation are three connected sites at which practices necessary for sustainability governance may also attract security scrutiny. This does not make EU sustainability compliance impossible, nor does it mean that supplier audits, traceability systems, contractual remediation or data transfers are automatically unlawful. It means that their legal character can change when they operate in a supply chain security environment.
Order No. 834 sharpens this point because its most relevant provisions operate through filters and escalation rather than simple prohibition. Article 13 functions as a legality filter for certain investigations and information collection concerning industrial and supply chains in China. Article 15 creates a pathway for investigating conduct by foreign organisations or individuals where it interrupts normal transactions, involves discriminatory measures, or causes or threatens substantial harm to industrial and supply chain security. Article 16 does not impose a baseline data transfer ban, but permits further restrictions concerning data and personal information where domestic actors fail to comply with measures adopted under the investigation provisions. The legal problem is therefore not automatic doctrinal conflict, but infrastructural instability: formally compatible obligations may not always be operationally compatible within the same system.
For risk regulation and transnational private law, the broader lesson is that compliance infrastructure should be treated as an object of regulation and a form of ordering in its own right. This perspective directs attention to the organisational, contractual and digital systems through which sustainability duties become operational. Those systems determine what counts as evidence, whose knowledge becomes legible, how leverage is exercised, where information moves and whether affected actors can contest the resulting classifications. Governing sustainability risk therefore also requires attention to the architecture, participation and accountability of the systems through which compliance is performed.
For regulators and firms, this suggests a practical orientation rather than a retreat from sustainability compliance. Compliance systems should be designed for bounded interoperability: they should be sufficiently interoperable to meet EU evidence requirements, but their operation should be bounded through data minimisation, purpose limitation, controlled access, local verification where appropriate, supplier participation, tiered disclosure and documented assessments of proportionality. Such design will not eliminate geopolitical friction. It can, however, reduce the risk that sustainability compliance will be reclassified as opaque information gathering, discriminatory disruption or uncontrolled externalisation of supply chain intelligence.
Acknowledgements
The author gratefully acknowledges the institutional support of the Faculty of Law, University of Helsinki and the valuable comments of the anonymous reviewers.
Competing interests
The author declares none.
Open access
