Supply-Chain Due Diligence

Governed by the integration rule document. Core scope: CSDDD, EUDR and the Forced Labour Regulation. The architectural objective is governed evidence discovery and targeted collection while preserving each regime's distinct scope and legal tests.

2026-W38 authority register

ID	Finding	Authority / disposition
SC-01	Directive (EU) 2026/470 amends CSDDD. EU-company scope uses more than 5,000 employees and more than EUR 1.5bn worldwide net turnover; relevant third-country scope uses more than EUR 1.5bn Union turnover.	LEGAL_ACT; verified in the amending Directive. Applicability still requires entity, period and national-transposition resolution.
SC-02	CSDDD Article 8 requires necessary, targeted, reasonable and proportionate partner information requests. For partners with fewer than 5,000 employees, information may be requested only where it cannot reasonably be obtained by other means. Independent reports, digital solutions, industry/multi-stakeholder initiatives and notification/complaints mechanisms are expressly recognised sources.	LEGAL_ACT; REQUEST_RIGHTS_DELTA, WORKFLOW_CHANGE, EVIDENCE_CHANGE.
SC-03	Commission CSDDD guidance remains future implementation material; Directive 2026/470 requires guidelines including digital tools, data sources, stakeholder engagement and information sharing.	AWAIT_GUIDANCE; do not hard-code future guidance preferences.
SC-04	EUDR operational and scope developments remain core watch items, including product-scope and information-system changes.	LEGAL_ACT/technical implementation family; exact current act/schema versions require separate inspection before adapter changes.
SC-05	Forced Labour Regulation applies from 14 December 2027 and is a product prohibition/investigation regime, not a general CSDDD-style annual reporting framework.	LEGAL_ACT; retain investigation/product evidence architecture without inventing periodic reports.

Architecture Integration decision

CSDDD aligns strongly with existing EPU Supplier Contributions

Canonical review of EPU Supplier Contribution Architecture shows that ZAYAZ already implements the central acquisition principle CSDDD now reinforces:

Resolve → anticipate → acquire the delta → validate → reuse.

The existing contract already resolves current EPU data, supplier-maintained product records, connected ERP/PLM/PIM/API sources, prior evidence, interoperable sources and derivable values before asking for unresolved data. It also records requirement/acquisition objective, evidence types, permissions, provenance and contributor authority.

Therefore CSDDD does not justify another supplier questionnaire or evidence subsystem.

The missing bounded capability is a regulatory request-entitlement decision before the existing contribution object is created. It should answer:

Given this regime, purpose, partner, risk/evidence gap, partner-size evidence, sources already checked and requested datum, is ZAYAZ entitled to ask this question now?

Required decision inputs:

• regulatory instrument/provision/profile;
• purpose and due-diligence stage;
• risk or adverse-impact context;
• requested datum/evidence;
• evidence sources already resolved/checked;
• why alternatives are insufficient;
• partner employee-count evidence and reference period;
• request necessity, targeting, reasonableness and proportionality;
• confidentiality/rights constraints;
• decision, reason and policy version.

The contribution request then carries the entitlement receipt as provenance.

Disposition: PROPOSED_DELTA; unregistered candidate: regulatory request-entitlement gate is the strongest next Hecate candidate after duplicate/spec review.

Policy should remain configurable

Future Commission guidance may refine risk factors, evidence sufficiency, stakeholder engagement, contractual measures and digital-tool use. Those belong in versioned policy profiles over the stable workflow, not hard-coded control flow.

Stable architecture:

scope → prioritisation → evidence resolution → evidence sufficiency → unresolved gap → entitlement decision → targeted contribution → assessment → prevention/mitigation/remediation → monitoring

Disposition: stable workflow PROPOSED_DELTA only where not already canonical; guidance-sensitive parameters AWAIT_GUIDANCE.

EUDR and Forced Labour remain specific consumers of shared evidence

EUDR must preserve commodity/product/CN scope, parcel/geolocation, legality, operator role, due-diligence statement and schema/API versions. A general supplier assessment cannot substitute for missing parcel-specific evidence.

Forced Labour can reuse evidence and traceability infrastructure but must preserve product/lot, investigation, finding, decision, response and remediation history. No generic annual Forced Labour report should be invented.

Acceptance criteria

Scenario	Expected behavior
Partner has 3,000 employees	Evaluate CSDDD below-5,000 safeguard and CSRD protected-undertaking rule independently; do not use one small_supplier flag.
Partner has 4,999 vs 5,000 employees	Apply the verified special CSDDD partner safeguard boundary correctly while preserving general necessity/proportionality rules.
Reliable evidence already resolves the risk	Do not issue a duplicate supplier contribution without a documented new evidence gap.
External source exists but rights prohibit the intended use	Do not treat it as usable evidence merely because it is technically accessible.
EUDR parcel evidence is missing but a corporate supplier assessment exists	Keep parcel diligence incomplete.
Future Commission guidance changes preferred risk factors	Update the policy profile without rewriting the core contribution architecture.
Forced Labour guidance appears	Do not convert guidance into an invented periodic reporting duty.

Cross-regime collisions

X-01 — CSRD/CSDDD. Separate legal entitlements over the same contribution substrate.

X-02 — reusable evidence/EUDR. Reuse only where subject, parcel/product, period, legality, authority and rights match.

X-07 — evidence rights. Canonical Pergamum Pulse rights vocabulary already provides permission states including permitted, permitted-with-conditions, restricted, prohibited and unresolved. Regulatory evidence reuse must compose with that gate.

X-10 — future CSDDD ESAP statements. Share transmission infrastructure where possible but keep legal/reporting profiles distinct from CSRD/ESEF.

Canonical specs reviewed / requiring follow-up

Reviewed:

• EPU Supplier Contribution Architecture;
• Pergamum Pulse rights vocabulary;
• Pergamum Pulse lifecycle foundations.

Follow-up before unregistered candidate: regulatory request-entitlement gate readiness:

• FOGE/requirement-driven question generation;
• canonical applicability/policy resolver;
• RIF risk object and evidence-gap contracts;
• existing Hecate/Jira work that may already cover supplier entitlement;
• exact EUDR API/schema and product-scope artefacts.

Weekly cohort history

Cohort	Intelligence retained	Integration decision
2026-W36	CSDDD risk-led collection and partner safeguard	Candidate evidence-gap request contract.
2026-W37	Configurable policy pending guidance	WATCH/AWAIT_GUIDANCE; no invented implementation delta.
2026-W38	Verified Directive 2026/470 request safeguards; EUDR/Forced Labour in core	Integrated 2026-09-15: existing EPU Supplier Contributions already implements resolution-first acquisition. Propose only the missing legal request-entitlement gate and regime-specific evidence profiles.

What changed in ZAYAZ? The supplier architecture recommendation was narrowed from a new subsystem to a bounded legal-entitlement extension of the existing EPU Supplier Contribution Architecture. That is a genuine architectural delta; no supplier request or production policy was activated.

2026-W39 Architecture Integration

Direct legal verification

Directive (EU) 2026/470 and the consolidated CSDDD now provide direct source confirmation of the request controls that underpinned unregistered candidate: regulatory request-entitlement gate:

• companies perform scoping using reasonably available information;
• partner information requests must be necessary;
• for business partners with fewer than 5,000 employees, information may be requested only where it cannot reasonably be obtained by other means;
• where several partners can provide the information, companies should reasonably prioritise the partner where the adverse impact is most likely;
• independent reports, digital solutions, industry/multi-stakeholder initiatives and notification/complaints information are recognised resources.

Separately, the CSRD protected-undertaking rule applies to sustainability-reporting requests and expressly does not displace requests required for other Union obligations such as due diligence.

Architecture decision — unregistered candidate: regulatory request-entitlement gate advances

This makes the proposed Regulatory Request Entitlement Gate for EPU Supplier Contributions sufficiently determined for a Hecate Need draft.

It should not generate questions itself. It should gate the existing requirement-driven EPU contribution flow.

Minimum contract:

request objective / governed requirement
        ↓
resolved reusable evidence
        ↓
unresolved evidence gap
        ↓
regime + provision + purpose
        ↓
counterparty size evidence
        ↓
alternative-source evaluation
        ↓
necessity / targeting / proportionality policy
        ↓
REQUEST_ALLOWED | REQUEST_CONDITIONALLY_ALLOWED | REQUEST_DENIED | UNRESOLVED
        ↓
entitlement receipt
        ↓
existing EPU Supplier Contribution

Proposed Hecate Need acceptance criteria

1. CSRD and CSDDD policies are separate and independently versioned.
2. Unknown employee count or unresolved purpose fails closed to UNRESOLVED, not implied permission.
3. A CSRD self-declaration retains source, date and manifest-error review state.
4. CSDDD decisions for partners with fewer than 5,000 employees preserve evidence of alternative sources considered.
5. Existing reusable evidence suppresses duplicate requests unless a new governed gap exists.
6. Request entitlement does not imply evidence sufficiency, verification or disclosure authority.
7. Every generated contribution preserves the entitlement receipt and exact policy version.
8. Historical entitlement decisions replay against the rule version applicable at decision time.

Other regimes

EUDR and Forced Labour remain regime-specific consumers of the shared evidence substrate. No W39 source requires a new generic subsystem.

W39 history

What changed in ZAYAZ? unregistered candidate: regulatory request-entitlement gate moved from architectural candidate to ready for Need drafting. No request was issued and no production entitlement policy was activated.

W39 source/evidence register

All entries below were retrieved/rechecked 2026-09-22.

Finding	Authoritative source	Locator
CSDDD request safeguards	EUR-Lex — Directive (EU) 2026/470	CSDDD Article 8(2a)–(3), as amended: necessity; alternative-means safeguard for partners with fewer than 5,000 employees; prioritised requesting; independent reports/digital solutions/initiatives/complaints resources.
CSDDD consolidated baseline	EUR-Lex — Directive (EU) 2024/1760	Corporate Sustainability Due Diligence Directive baseline instrument, read together with Directive (EU) 2026/470.
Commission implementation context	European Commission — Corporate sustainability due diligence	Current Commission implementation/guidance overview.
CSRD protected-undertaking interaction	EUR-Lex — Directive (EU) 2026/470	Accounting Directive Article 19a(3) amendment; reporting-purpose value-chain cap does not eliminate separately applicable Union-law obligations.