NAVEXGlobal：2026年十大风险与合规趋势报告-英文版

NVEXNavigatorSeries

Top10Trendsin

RiskandCompliance

2026

Contents

BYCARRIEPENMAN

3Executivesummary

5HowAIwillimpactComplianceteams’workandstaffingBYMATTKELLY

8Supplychainintegrityin2026:whatdoesthismean?

BYPIERREBERLIOZ

12CompliancetrendsforEurope–whatdoyouneedtowatch?

BYYUVALGRAUER

16Thefutureofcomplianceandethics:trendsforthefieldinto2026BYJOEMURPHY

19Laborrulesarechanging–stayingaheadwithpolicy,trainingandmoreforahealthiercultureandfewerincidents

BYCINDYRAZANDEDMILLS

24What’soldisnewagain–2026presentsnewandenduringchallengesinriskassessment

BYKYLEMARTIN

27SignalsshowheightenedstressonworkplaceculturesBYSARAHJOLOVEDAY

31TheexpandingroleoftheboardofdirectorsincomplianceBYREBECCAWALKER

35Fundamentalsthatwon’tchangeamid2026’sregulatoryheadwindsBYSIDNEYBASHAGOANDDANIELKAHN

39Lookingback,movingforward:a15-yearjourneyinwhistleblowing

andincidentmanagementbenchmarking–what’snext?

2NAVEXTop10TrendsinRiskandCompliance2026

3NAVEXTop10TrendsinRiskandCompliance2026

NVEX

Executivesummary

Whatarethetopriskand

compliancetrendsfor2026?

Echoingyearspast,expertscontributingtothisTop10

TrendsinRisk&Compliancepublicationdescribedfamiliarforcesthatcontinuetoimpactourprofessions.Technology–namely,artificialintelligence–isreshapingtheway

organizationstacklemisconduct.Supplychainethicsand

integritywillmattermorethanever.Risk-basedstrategic

thinkingisadifficultchallenge,andsignalsofgreaterstressaregrowingintheworkforce.

Manyofthesefamiliarthemescomewithcorresponding

guidancefromourexperts,learnedfromyearsofexperienceinthefield.ThewayAIisempoweringcomplianceis

becomingclearer.Regulatoryrequirementsandpublic

expectationsforethicalandresilientsupplychainsare

becomingmoreconsistent.Thepathforwardinrisk-basedstrategymayberesolving,andactiontoaddressrecent

culturalsignalsmaybeclearer.

The2026Top10TrendsinRisk&Complianceservesasanindicatorforthewayforwardinthemonthstocome.Ourexpertshaveoutlinednotonlychallengesforcompliance,butwaystoaddressthem.

Wehopereadersfollowingtheseessaysfindwaysto

improvetheircomplianceprograms–tocreatemore

businessvalue,improveculturesofethics,positivelyimpacttheirorganizations’globalreach–andmuchmore.

Belowisasummaryofsomeofourpredictionsandconsiderationsfor2026.

AIwillplayanimportantroleforcomplianceprograms,andteamswillevolveinresponse

Artificialintelligenceisbecomingdeeplyintegratedintocomplianceprograms,and2026willseemoreclarityinquestionsaboutwhatthefuturewilllooklike.

Whiletheparticularsdifferforvariousorganizations,akeyquestionasthistechnologymaturesisaroundtheexpectedroleofcompliancestaffgoingforward.Forexample,

integratingAImightmeanthatorganizationswillreorient

theircomplianceteamstofocuslessonrespondingto

inquiriesaboutpoliciesandmoreonconsideringpolicy

soundnesstosupportaself-service,AI-poweredmodelforinquiries.Bothprocessesarecriticalandonlyoneelementofcompliancework,butthismayrepresentthekindof

clarificationwe’llseein2026asAIbecomesmoreandmoreintegratedincomplianceprograms.

ItisexcitingtoseeexamplesinpracticeforhowthesetoolswillenableCompliancetomakeagreaterimpactontheir

organizations.Thenatureoftheworkmaychange,butthegoalsofempoweringindividualsandethicalcultureswill

remainthesame.

Organizationswithethicalsupplychainswillwinin2026

Ethicsandresilienceinthesupplychainhaslongbeenacriticalvaluefororganizationsandconsumers.The

importanceisonlyintensifyinginrespecttoregulation,includingtheEuropeanUnion’sDigitalOperational

ResilienceAct(DORA).

4NAVEXTop10TrendsinRiskandCompliance2026

In2026,ourexpertssuggestorganizationswithethicalandresilientsupplychainswillhaveanadvantage.Suchflows

ofserviceandsuppliesaresubjecttochangeatamoment’snotice,ofcourse,butthefundamentalconsiderations

appeartobesolidifyingfor2026.Regulatorycompliance,ethicalconsiderationsandresilientsupplychains–thesefundamentalsaremoresolidthaneverin2026.Thisis

particularlyimportantasconsumersincreasinglyexpecttheselevelsofsupplychainduediligenceregardlessofregulatoryrequirements.

Sophisticationofriskmanagementandassessmentwillimprove

NAVEXresearchandpartnershipwiththeindustryhavelongsignaledthatthe“languageofrisk”maynotalwayssharethesamesyntaxasthelanguageofcompliance.Yet2026may

beatimewhenthatdisconnectcoalescesintoalanguagethatresonatesacrossfunctionalareas,enablinggreaterimpactwithboardsofdirectorsandothers.

Thelanguageof“risk”isdifficulttoquantifyandarticulateacrossfunctionalareas,butperhapslesssoleading

into2026.Complianceisoftenseenasarisk-mitigating

elementoftheorganization,butwherethereisrisk,there

isalsobusinessopportunity.Toolsandpracticesenabling

conversationsaboutCompliance’svaluetotheorganizationaregrowinginimportance–thosewhocapitalizeonthosetoolsandstrategiesarelikelytoexcelin2026.

Worrisomesignalsendureintheworkplace

Higherlevelsofreportingaboutanyissueintheworkplaceshouldrepresenta“goodthing,”showingthatemployees

trusttheinternalreportingsystemandfeelwillingto

raiseconcernsofmisconduct.Thesereportsalsoprovideinsightsintothe“mood”ofworkplaces,andshouldbeusedtoinformleadershiponculturaltrends.

Namely,WorkplaceCivility,therecommendednomenclature

forreportsoftenregardingemployeerelationsormisconductthatNAVEXusesinourbenchmarking,deservesattentionin

2026.Thisreportingcategory(orinourparlance,“RiskType”)ofteninvitesnuancedassessmentasasignalofculturalhealthandhascontinuedtogrowasashareoftotalreporting.We’veobservedanotableincreaseinEurope,perhapsrelatedto

theevolutionofthepublicconsciousnessinwhatconstitutesmisconductinlightofmaturingregulatoryprotectionsfor

whistleblowersintheregion.

Unfortunately,thisisnottheonlycategoryinwhichwe’veseenanincrease.ImminentThreattoaPerson,AnimalsorPropertyhasincreasedinthetotalglobalshareaswell.

Theseshiftsdon’tnecessarilyreflectmorereportingineachcategory,butmayinviteconsiderationoftheissuesmost

importanttoreportersandwheretheyaremostwillingtospeakout.

Theseobservationsmightsuggestthat2026presentsa

timewhenworkersandotherreportersarebothbetter

educatedaboutculturaldynamicsandreportingresources,butalso,onedge.AsWorkplaceCivilityreportshavebeen

prominentinrecentyears,thisisnotnecessarilysomethingnew.However,asourexpertsdiscuss,will2026beour

opportunitytoactandachievetheproductiveandethicalworkplacedynamicsthatallowworkerstoflourish?

Whatdoes2026holdforRiskandCompliance?

Theessaysinthisreportrepresentarangeofexpert

perspectivesrelevanttoCompliance,HumanResources,Legal,Procurementandmanyotherrelatedprofessions.

Itisthrillingtoconsider:by2027,ourindustrymayrestataplaceofgreatermaturityandimpactinlinewiththetrendsdescribedinthispublication.Thepathforwardseems

clearer.Yetchallengesremain,andthisguidance,alongwithotherpublicationsweprovidefreelytothepublic,isdesignedtohelpreaderstonavigatethem.

NVEX

5NAVEXTop10TrendsinRiskandCompliance2026

HowAIwillimpactComplianceteams’workandstaffing

ByMattKelly

Artificialintelligencewasthedominanttechnologystory

of2025,andwillremainsoin2026.Forbetterorworse–or,morelikely,forbothbetterandworseatthesametime–AIisnowseepingintoeverycornerofcorporateoperations.

Compliancefunctionsarenoexceptiontothattrend.Chiefcomplianceofficerswillneedtospend2026findingtherightwaystointegrateAIintotheirprogramandconsideringwhatanAI-enhancedprogramwillmeanfortheirteam.

Braceyourselves.Thefinalresultmightlookquitedifferentfromwhatyouimaginenow.

Wecanbreakdownthechallengeaheadintoseveraldiscretetasks:

•AssessingthepotentialofAItodocompliancework

•UnderstandinghowAIwilltransformthecomplianceprocessesyoualreadyrun

•IdentifyingthenewriskandtechnologyquestionsthatAIinacomplianceprogramisgoingtoraise

Chiefcomplianceofficerswill

needtospend2026findingthe

rightwaystointegrateAIinto

theirprogramandconsidering

whatanAI-enhancedprogramwillmeanfortheirteam.

Let’stakeeachchallengeinturn.

UnderstandingAI’scompliancecapabilities

Yes,AIcandoawiderangeofcompliancework,anddoit

quitewell–butdoingcomplianceworkisnotnecessarilythesameasexecutingcomplianceprocesses.

Largelanguagemodels(LLMs)fromOpenAI,Microsoft,

GoogleandAnthropic–oftencalled“frontiermodels”–powernearlyeveryAIsystemcomplianceofficersencounter.

Thesemodelsexcelattaskssuchasmatchingormapping

data,extractinginformation,andrankingelementsbasedonriskorurgency.Theyaregreatatlanguagetranslationand

patternanalysis.Theycansummarizelongdocumentsandsuggestnextstepsinacourseofaction.

Thosetasksareallworkthatcomplianceteamsmustget

done;ifAIcanhelptodothatworkfaster,that’sgreat.Ontheotherhand,ifyouaskcomplianceofficerswhattheydoeveryday,they’llrattleoffalistofprocesses:

•“Ireviewwhistleblowerreportstoidentifyseriousissuesthatneedimmediateattention.”

•“Iassessconflictofinterestsubmissionsfrom

employees,andconsiderwhetherweneedmoredetailbeforecomingupwithamediationplan.”

•“Iassessemployeetrainingneedsbasedonrisks

wehave,andconfirmthatthetrainingmaterialsweprovidereflectthoseissuesandworkwell.”

Everycomplianceprocessconsistsofmultiplesmaller

steps,andmanyofthosestepsaretheworkthatAIcan

dowell.AI,however,stillstrugglestostringallthatwork

togetherintooneself-containedprocessthatitcanexecuteaswellasaperson.

6NAVEXTop10TrendsinRiskandCompliance2026

Soyes,AIcancategorizeconflictofinterest(COI)

submissionsbyissue,region,andsoforth;butitstruggles

tounderstandwhatadditionaldetailmighthelptodeterminethetrueriskinaCOlsubmission.ltcantakeawrittenpolicyandcookupatrainingvideo;butitcan’teasilyponder

internalhotlineandtrainingdatatodeviseanewpolicythatbetteraddressesemployeebehavior.

Fornow,AIisstillverymuchatoolcomplianceteamscan

usetoachieveyourprogramobjectives.Itcan’tachieveyourprogramobjectivesonitsown–thatstillrequirespeople.

FittingAIintoyourcomplianceprogram

Evenwhenusedsimplyasatool,AIunquestionablycanhelpchiefcomplianceofficerstoimproveyourprogramoverall.Therealquestionfor2026ishowtointegrateAIintoyour

complianceprogram.

First,considertheobjectivesyouandseniormanagementwanttoachieve.Alcanhelpwithallsortsofprocess

improvements,butmakingthoseimprovementsdoesneedcarefulplanning.

Forexample,youcoulduseAItobuildapolicychatbotthat

answersemployees’questionsaboutcompliancepolicies.

Lotsofcompaniesarealreadyexperimentingwiththisexactidea.Earlyevidencesuggestsemployeesdoengagewith

policychatbotsoften,whichisgood.

AIsystemswilltransformyourcomplianceprogram,leavingitabletodomorethings

moreefficiently.Thatdoesn’t

automaticallymeanAIwillmakeyourprogrammoreefficientorlesscomplicated–theworkofcomplianceteamswilladjusttosupportthesenewcapabilities.

Atthesametime,however,youmayneedtowritelonger

policies,andupdatethemmoreoften,toassurethepolicychatbotgivescurrentandcorrectanswers.Youmightalsohavemorepolicyescalationstoevaluatesinceemployeesareaskingthebotmorequestions(sometimes,lotsmore).

Inotherwords,policychatbotscanhelpyoubuildamore

engagingcomplianceprogram,butthateffortmight

rearrangetheworkyourcomplianceteamdoes–eliminatingsomeworkhere,creatingnewworkthere.Someofthat

work,AIwillhandle;otherwork,humanemployeeswillstillneedtomanage.

That’sthesortofanalysischiefcomplianceofficerswill

needtoperformin2026andbeyond:“Ifweintroduce

artificialintelligenceintothiscomplianceprocess,howwillitchangethatprocess?Andwhatwillthatchangemeanformyownteamsupportingthatprocess,andwhatwillitmeanforothersengagingwiththatprocess?”

Thelistofpotentialscenarioshereislong.AIsystemswilltransformyourcomplianceprogram,leavingitabletodomorethingsmoreefficiently.Thatdoesn’tautomaticallymeanAIwillmakeyourprogrammoreefficientorless

complicated–theworkofcomplianceteamswilladjusttosupportthesenewcapabilities.

TheotherchallengesAIintroduces

Complianceofficersalsoneedtothinkaboutthelarger

strategicquestionsofhowto“fit”AIintoyourcomplianceprogramandyourorganization’sITenvironment.

Forexample,mostLLMscannowdomostcomplianceworkquitewell–butnosingleLLMdoesallcompliancework

consistentlywell.So,wouldyouwanttouseoneLLMthatisgoodatallyourcompliancetasks,butnotnecessarilygreatattheoneortwocompliancetasksthatmattermosttoyou?OrwouldyouwanttousemultipleLLMs,eachonefocused

onyourmostcommonorpressingneeds?

UsingonlyoneLLMwouldsavemoneyandreducesecurityandoperationalrisks,butmaysacrificeperformance.UsingmultipleLLMsmaybringbetterperformance,butmay

introducemoresecurityandoperationalrisk.Sohowwouldyou,yourCISO,yourITmanager,andyourCFOdecidewhichchoiceisbest?

ThequestionsaboutusingAIstrategicallyinyourcomplianceprogramaremany.They’llneedtobeansweredtoo.

7NAVEXTop10TrendsinRiskandCompliance2026

Compliance’sroleforbroaderAIimplementation

ComplianceofficerswillalsoplayacrucialrolehelpingtherestoftheenterpriseastheyintegrateAIintotheiroperations,too.

First,businessunitswillneedhelpidentifyingand

assessingthecompliancerisksthatmightarisefrom

weavingAIintotheirprocesses.Thenthey’llneedhelp

developingandimplementingnewcontrolstomakesuretheirAI-enhancedbusinessprocessesavoidprivacy,

securityandcompliancerisks.

Whatdoesthatmeaninpractice?

Considerafewsteps.

DevelopanAIgovernancemodel.Thatis,astructured

approachforseniorexecutives(ideally,ateamincluding

headsofLegal,ITSecurity,HR,Finance,andofcourse

Compliance)toreviewandapproveAIimplementationacrosstheenterprise,sothoseuse-casesproperlyhandlethe

company’scomplianceobligations.Goodnews:accordingtothe

NAVEX2025StateofRisk&ComplianceReport

,two-

thirdsofcomplianceofficersareeither“very”or“somewhat”involvedindecidinghowAIisusedwithinyourorganization.

UseframeworkstoguideyourAIimplementation.

Frameworkscanhelpyouidentifynewregulatoryrisks,

gapsinyourexistingcontrols,andnewcontrolsthatmightplugthoseholes.Twoleadingframeworkstodayarethe

ISO42001standardforAImanagementsystems,popularinEurope;andtheNISTAIRiskManagementFrameworkintheUnitedStates.Australia,Singapore,andothercountriesarerapidlydevelopingtheirownregulatoryframeworkstoo,sokeepyoureyesopenglobally.

Preparetohelp.AsyourorganizationrollsoutnewpoliciesorcontrolsforAI,you’llneednewtrainingandcommunication

materialstohelpemployeesunderstandAIrisksandbehavior.You’llneedpolicymanagementcapabilitiestoidentifynewAIregulationsastheyarrivetoseewhetheryourpoliciesneed

updating.You’llneedtesting,auditinganddataanalyticscapabilitiesgearedforAIrisks,too.

2026prediction

Concernsaboutan“AIbubble”willbecomemorepointed

–primarilyfortheLLMsspendingbillionsondatacenter

infrastructure,butevenforotherAIbusinessestoo.

ExecutiveswillwanttoseeclearandspecificROIfor

proposedAIinvestments,soteamleaderstryingto

integrateAIintotheiroperationswillneedgoodanswersforproductivitygains,riskmanagementrequirementsanddatamanagementchallenges.

Abouttheauthor

MattKelly

MattKellyiseditorandCEOofRadicalCompliance,ablogandnewsletterthatfollowscorporategovernance,risk,

andcomplianceissuesatlargeorganizations.Hespeaks

andwritesoncompliance,governance,andrisktopics

frequently.Followhimon

LinkedIn

or

getintouchwithhim

viaemail

.

8NAVEXTop10TrendsinRiskandCompliance2026

NVEX

Supplychainintegrityin2026:

whatdoesthismean?

ByPierreBerlioz

“Resilience”isclearlythekeywordfor2026–themantra

thatmustguideeverycompanytofacetheongoing

turbulence,which,regrettably,wefearwillextendbeyondDecember31,2026.

“Resilience”ratherthan“sustainability,”because

sustainabilityhasbeenexperiencinganunprecedentedbacklashsinceitsemergence,unfortunatelyassociatedwiththeideaofabureaucraticburden.Thisperceptionisfuelledbyregulationswhoseextremesophisticationandunreasonablehastehaveunderminedtheirfoundations.

“Resilience”ratherthan“competitiveness,”because

competitivenesshasbeenweaponizedtoconcealattemptstomaintainoutdatedmodelsthroughderegulation.

Ultimately,thisapproachwillonlyweakentheglobal

economiesandtheirplayersagainstcompetitorswho

understandthepoweroflawtoimposenewperspectives.

Resilienceforsustainabilityandcompetitiveness,instead,

becausesustainabilityandcompetitivenessaretruly

effects,notcauses.Acompanycanonlybesustainableandcompetitive–onedoesn’thappenwithouttheother–ifit

restsonaresilientfoundation,enablingittodevelopdespitegeopolitical,economicorregulatoryhazardsandobstacles.

Fromthisperspective,thesupplychainisasignificant

stake.Itcanbeapillarofstrengthorthecompany’sAchilles’heel,dependingonthecompany’sabilitytoensureits

integrity.Integrity,inthiscontext,meansensuringeverylinkinthechainissufficientlyrobust.Thefragilityofanysingle

linkcanindeedcompromisetheproperfunctioningofthe

entirechainand,consequently,thelong-termviabilityofthecompanywhoseactivityreliesonit.

Acompanycanonlybe

sustainableandcompetitive–

onedoesn’thappenwithoutthe

other–ifitrestsonaresilient

foundation,enablingittodevelopdespitegeopolitical,economicorregulatoryhazardsandobstacles.

Thedifficultyliesinidentifyingthesefragilities.Inthis

regard,linescanbeconsiderablyblurredbyissuing

directivesthataresometimescontradictoryandadoptedwithinshortintervals.Inthiscontextofpermanentshifts–inthisuncertainlandscapethatwill,atbest,onlypartiallyclearupduring2026–companiescanlegitimatelyfeellost.

Theycanalsoseethisasanopportunityforagenuine,

strategicgroundworkeffort,movingpasttheminor

vicissitudesoftheliteraltextoftheregulationsandthe

confusiontheycreate.Instead,theycanfocusonthespiritoftheregulations,whichpossessesagenuinerationality:thecompanymustknowandunderstanditssupplychaintobothcontrolit,andthusensureitsintegrity.

9NAVEXTop10TrendsinRiskandCompliance2026

Knowingyoursupplychain

Thebankingsector,aswellascertainserviceproviders(e.g.,accountingorlegalprofessionals),haveanobligationto

KnowYourCustomer(KYC),notablytoavoidbeingunwittingaccomplicesinillicitoperations.Knowingyourcustomer

requirestracingthechainoffinancialflowstoidentifytheultimatebeneficialownerofthetransaction.

Increasingly,duetotheriskstheyface,companies

haveasimilarobligationtoknowtheirsuppliersand

subcontractors,notonlyTier1butalsothosebelow,rightuptotheinitialsourceofsupply.

Thisobligationisoneofthesignificantissuesassociated

withadoptingtheCorporateSustainabilityDueDiligence

Directive(CSDDD)anddeterminingitsfinalcontentfollowingthe2024reformofitsinitialtextinthe“omnibus”draft

directive.

However,othertextsimposeasimilarobligationandarescheduledtocomeintoeffectprogressivelystartingin

2026.Thisisparticularlythecasewithregulationsaimedatcombatingdeforestationandforcedlabor.

Thefirstrequiresthatpalmoil,soy,wood,cocoa,coffee,

cattleandrubber,aswellasproductsderivedfromthese

commodities,entering,circulatingwithin,orbeingexportedfromtheEuropeanmarket,mustbe“deforestation-free”

andhavecompletetraceabilityensured.Consequently,thismeansthedifferentlinksinthesupplychainmustbeknown,andeachlinkmustpossessthisinformation.

ThesecondregulationprohibitstheplacingontheEuropeanmarket,circulationwithinit,andexportfromitofproductsresultingfromforcedlabor.Thistextindicatesthatit“doesnotcreateadditionalduediligenceobligationsforeconomicoperatorsotherthanthosealreadyprovidedforbyUnionornationallaw.”Inotherwords,theissueofforcedlaborisa

subjectthatcompaniessubjecttoduediligenceobligationsundertheirnationalorEuropeanlawmustintegrateinto

theirimplementation.TheregulationisthusintendedtofitwithintheframeworkestablishedbytheCSDDDandbeappliedinaccordancewithitsprovisions.

Theregulationappliestoallcompanies,regardlessoftheirlegalnature,formorsize.However,notallcompaniesare

legallyobligatedtoundergoduediligence.Therefore,whiletheregulationdoesnotformallycreateanyobligationfor

companiestoexerciseduediligenceregardingforcedlabor,itindirectlycreatessuchanobligation,nonetheless.

ThisisalsothecasewiththeCSDDD.Article8ofthe

directiverequiressubjectcompaniestocarryoutmappingoftheirownactivities,thoseoftheirsubsidiaries,and,whenlinkedtotheirchainsofactivities(valuechain),thoseoftheirbusinesspartners.Althoughthetextdoesnotexplicitly

stateit,thisimpliesthecompanymustknowitssuppliersandsubcontractorsatvarioustiers.

Thecurrentdiscussionsontheomnibusdraftdirective

demonstratethis.Astheobjectiveofthistextistosimplifythemechanism,theproposalsaimtoclarifyspecific

provisionsoftheCSDDD,particularlyArticles8through11.

Specifically,thetextadoptedbytheCounciloftheEuropeanUnionfortriloguenegotiationsincludesaprovisioninArticle8statingthatthecompanymustmapitschainofactivities

toidentifyitsindirectbusinesspartners.

Admittedly,thismappingmustbecarriedoutusing

reasonablyaccessibleinformation.Thedirectiveonly

establishesbest-effortobligations,butitclearlystatesanobligationtoknowyoursupplychain.

Giventhatacompanycanonlyknowthischainbytracingitupward,thisobligationwillindirectlyfalloneverycompanymemberofasupplychain.Eachcompanymustbeableto

communicatetoitshigher-upsinthechain–particularlytheonedirectlyaboveit–whichlinksaresituatedbelowit.

Theadjustmentofthresholdscurrentlybeingdiscussed

bytheEuropeanlegislatorwillnotalterthisfundamental

principle:allcompaniesmustbeawareoftheirsupplychain.

Controllingyoursupplychain

Whyisitnecessarytoknowyoursupplychain?Itisnota

bureaucraticrequirement.Itisanindispensableprecautionthatallowsfordiscerningstrengthsandweaknesses,thusenablingthenecessarymeasurestobetakentocontrolit.Thisensuresitismanagedasefficientlyaspossiblewhile

preventingtherisksitmaygenerate.

Thishighlystrategicknowledgeconstitutesatradesecretformanycompanies,protectedassuchbytheEuropean

DirectiveofJune8,2016,andtheimplementinglawsofthememberstates.Thecompanyisthereforenotrequiredtomakeitpublic;onlytheresultsofriskanalysesperformedbasedonthisdatamaybepublished.ThispointisaffirmedbytheCSRD(CorporateSustainabilityReportingDirective)andisexpectedtobeevenclearerintherevisedversionoftheomnibusdirective.

10NAVEXTop10TrendsinRiskandCompliance2026

However,thisprotectionisconditionalontheexistence

ofmeasuresintendedtomaintainthesecrecyofthis

information.Thecompany’sinformationsystemmust

thereforeensurethataccesstothisdataislimitedtothosewhoneedtoknowandthattheseindividualsaresubjecttoconfidentialityobligations.

Similarly,whenacompanycommunicatesthisinformationtootherlinksinthesupplychain,eitherinexecutionofa

legalobligationortocomplywithcontractualobligations,itisimperativethatitexpresslystateitsconfidentialnatureandimposeitspreservationthroughadaptedclauses.

Thisnecessarycontroloverthesupplychain,whichpertainstothecompany’sstrategy,isnotexplicitlymandatedbythetexts.TheCSDDD,theregulationsondeforestationorforcedlabor,orsimilartextsonlyrequireriskprevention.Control

ofthevaluechainisameansofthisprevention,thecontentandmethodsofwhicharelefttothecompany’sdiscretion.

Nevertheless,theregulationprovidescompanieswithlegalavenuestoensurethiscontrol.ThisisnotablythecasewiththeCSDDD,specificallyArticles10and11,whichmention

obtainingcontractualguaranteesaspossiblemeasures.

Thecontractisindeedtheprincipalinstrumentfor

managingthesupplychain,asthechainitselfconsistsof

aseriesofagreementsbetweenmultiplecompaniesthat

linkthemwithinthesameproductiveand/orcommercial

process.Controlofthechainthusnecessarilyinvolves

insertingclausesintothesevariouscontracts,eitherto

prohibitcertainactivitiesorbehaviors,ortoimposecertainpracticesorthecommunicationofinformation.These

clausescanalsohelpensureacertainhomogeneitywithinthecha