Environmental regulations are quickly becoming another challenge for an industry already battered by rising costs and unrelenting trade disruption. For the companies that are positioning for the future, these incoming policies could give them an advantage and help them strengthen operations. But not all are capable of doing so.
To take the temperature of where the industry stands as it relates to sourcing, diversification and regulations, QIMA recently survey 1,000 businesses. It’s not surprise that more than 90% of U.S.- and China-based supply networks were heavily affected by tariffs last year. But issues around product provenance, environmental performance and supply chain due diligence requirements are also a factor. Half of businesses surveyed expect compliance requirements to disrupt their operations, and that number rises to 62% for companies in the EU. Yet preparedness remains uneven. One in three companies report they’re still unsure which ESG rules apply to them.
That uncertainty is magnified by the need for visibility beyond their immediate vendors. Today, QIMA’s findings state the average business can map 60% of their supplier network, and only 18% have mapped it end-to-end. This gap shows up in performance across the business. Companies with fully mapped supply chains report significantly easier quality control, compliance, on-time shipping and cost management. And unsurprisingly, this means they’re more positive about their outlook going forward.
QIMA says regulations are having a broader impact as well. Among companies that fall within the scope of ESG legislation, 60% are more likely to consider environmental, social and governance factors across their sourcing strategies. Those that do are creating a further competitive advantage.
QIMA is designed to help companies make smarter, holistic business decisions in a landscape that’s volatile and likely to stay that way.
“We stopped treating disruption as something to recover from,” said Gabriel Amouyal, audit services director at QIMA. “It’s a permanent feature of the operating environment now, and our job is to make sure clients aren’t scrambling every time it hits.”
And when it comes to ESG regulations, QIMA is trying to help companies embrace “compliance as a roadmap for responsible sourcing, not just a box checking exercise.”
Here Amouyal discusses where companies remain unprepared, why traditional audits are no longer sufficient on their own and how sourcing shifts, AI and continuous supply chain monitoring are changing the approach to risk and compliance.
HGI: How would you characterize clients’ awareness of the environmental and trade policies that will require them to prove product contents and provenance?
Gabriel Amouyal: Awareness has grown significantly over the past two years, but it remains uneven, and awareness is not the same as readiness.
Large multinationals exposed to CBAM, CSRD, EUDR, or UFLPA have generally mobilized, with cross-functional teams in place and supplier data foundations under reconstruction. Mid-market brands and much of the upstream supply base are in a very different position, often underestimating what proving provenance requires: visibility down to raw material origin, mapping beyond tier one, and documentation robust enough to withstand customs scrutiny or public investigation.
Across our client base, this is a capability gap more than an intent gap. Companies know what’s coming; few have industrialized the traceability and verification infrastructure to comply at scale.
A subtler risk is that compliance-readiness is increasingly being confused with risk-readiness. Passing an audit does not prevent a shipment from being detained or a brand from being called out publicly. The bar has moved from declaration to evidence, and the companies that internalize that shift early will have a real commercial advantage.
HGI: With new regulations, audit fatigue is becoming a bigger challenge. How can the industry reduce duplicate audits while maintaining trust and credibility?
GA: Audit fatigue is real, but it’s more a symptom of a fragmented assurance ecosystem than of over-regulation itself. A single supplier can be audited ten or twelve times a year against largely overlapping standards — SMETA, SLCP, Higg, BSCI, brand protocols — with little incremental insight after the first few.
The bigger issue is that audits were never designed to carry the weight now placed on them. An audit is a point-in-time snapshot, often announced, of a facility that operates every day of the year. It is a useful tool, but only one tool. A credible assurance model must combine several sources of evidence: risk-based audits, worker voice technologies, traceability and transaction data, laboratory testing, and continuous digital monitoring.
Three shifts would meaningfully reduce the audit burden without weakening credibility. The first is mutual recognition between schemes. The second is a genuine move toward risk-based auditing, concentrating scrutiny where geography, sector, and past performance warrant it. The third, and most under-invested, is a rebalancing from audit toward remediation and continuous improvement: spot checks between audit cycles, worker voice channels, supplier training, and long-term support on the sustainability journey. Assurance should be a process, not an event.
Trust is not undermined by fewer audits. It’s undermined by audits that sit in isolation, disconnected from each other, and from the remediation work that should surround them.
HGI: How is QIMA future-proofing operations from further disruption?
GA: We are investing along three lines.
The first is geographic. As sourcing shifts out of China and into Vietnam, India, Bangladesh, Mexico, Egypt, and Tunisia, our auditor and laboratory network is expanding in step. Audit volume backs it up: year to date up 50% in Vietnam, 46% in Tunisia, 38% in Bangladesh, 35% in Egypt, 23% in Mexico, and 15% in India.
The second is digital. We are embedding AI into our audit and inspection workflows, and scaling the traceability and supplier data platforms that give clients continuous visibility across their supply chain rather than episodic snapshots.
The third is a deliberate broadening of what we offer. EUDR’s application date for large and medium operators now lands December 30, 2026, and UFLPA enforcement keeps tightening. CSDDD has been delayed and softened under the EU’s Omnibus reforms, with application now pushed to 2029, but that doesn’t remove the underlying pressure. Even a softened regime still requires the same evidentiary infrastructure: risk identification, supplier mapping, mitigation, verification, remediation, and reporting. We are extending our capabilities across that full cycle, from upstream risk screening, through on-the-ground audits and laboratory testing, to corrective action, training, and disclosure-ready reporting. The ambition is to accompany clients across the full arc of due diligence, not to be a provider they call at isolated points.
