{"id":1749,"date":"2026-10-31T11:15:10","date_gmt":"2026-10-31T10:15:10","guid":{"rendered":"https:\/\/advokatskafirmasajic.com\/blog\/?p=1749"},"modified":"2026-11-11T11:15:58","modified_gmt":"2026-11-11T10:15:58","slug":"legal-allocation-of-risk-after-esg-cbam-and-supply-chain-due-diligence","status":"publish","type":"post","link":"https:\/\/advokatskafirmasajic.com\/blog\/legal-allocation-of-risk-after-esg-cbam-and-supply-chain-due-diligence\/","title":{"rendered":"Legal allocation of risk after -ESG, CBAM, and supply chain due diligence"},"content":{"rendered":"\n

Introduction: From Logistics to Regulatory Infrastructure<\/strong><\/p>\n\n\n\n

Global supply chains have long been designed primarily according to three criteria: cost, quality, and lead time. Legal contracts followed this exact logic. Their core function was to determine who bears the risk of delays, damaged goods, price fluctuations, currency volatility, and failure to meet technical specifications. However, modern European regulation is changing the very nature of the supply chain. A supplier is no longer merely a source of goods or components, but also a source of regulatory data. Meanwhile, a buyer or importer is no longer just a purchasing entity, but often a holder of statutory obligations to understand how, where, and under what social and environmental conditions those goods are produced.<\/p>\n\n\n\n

ESG standards, the EU Carbon Border Adjustment Mechanism (CBAM), the Corporate Sustainability Due Diligence Directive (CSDDD), sustainability reporting rules, and prohibitions on products made with forced labour collectively form a new regulatory architecture. Its core feature is that corporate liability extends beyond a company's physical boundaries and immediate employees to its business partners and various levels of its chain of activities. At the same time, these regulations typically place legal responsibility on the large buyer, importer, or the entity placing the product on the market, even though the relevant facts lie with manufacturers, subcontractors, mines, carriers, or energy providers in another jurisdiction.<\/p>\n\n\n\n

Due to this information asymmetry, the contract becomes the central instrument for managing regulatory risk. It is no longer just a record of a commercial agreement, but an operating system that dictates who collects data, who verifies emissions, who bears the cost of decarbonization, who remedies human rights violations, and who pays when inaccurate information leads to market exclusion, regulatory fines, or product recalls. The new supply chain architecture is therefore, in equal measure, a new architecture of contractual risk allocation.<\/p>\n\n\n\n

CBAM: Carbon as an Element of Price and Contractual Liability<\/h1>\n\n\n\n

CBAM is the clearest example of transforming environmental data into direct financial and customs risk. The definitive regime applies from January 1, 2026, to covered goods, including specific products made of cement, iron and steel, aluminium, fertilizers, electricity, and hydrogen. Following the 2025 amendments, the single mass threshold is set at 50 metric tons, with special rules governing electricity and hydrogen. Covered importers must hold the status of authorized CBAM declarant, report embedded emissions and submit the corresponding number of CBAM certificates. For imports executed during 2026, the first declaration and submission of certificates are due by September 30, 2027. The price of certificates is linked to the price of emission allowances under the EU ETS, while the actual carbon price paid in the country of origin may, under prescribed conditions, be taken into account.<\/p>\n\n\n\n

This system changes price negotiations. A traditional clause establishing a fixed agreed price does not automatically answer who bears the CBAM cost. That cost depends on the emission intensity of production, the quality of measurement, fluctuations in the EU ETS allowance price, the availability of verified data, and the possibility of deducting a carbon price paid in a third country. If a manufacturer fails to provide credible data, the importer may be forced to rely on less favourable default values. The consequence is not merely a higher certificate cost, but also potential penalties, detention of goods, or supply chain disruptions.<\/p>\n\n\n\n

Therefore, the contract must separate at least four categories of risk. The first is data accuracy risk: the supplier must guarantee the completeness, consistency, and traceability of embedded emissions data. The second is methodological risk: the parties must establish which methodology, facility boundaries, emission factors, and verification standards apply. The third is price risk: it must be determined whether the CBAM cost is embedded in the price, passed on to the buyer, or shared according to a predefined formula. The fourth is regulatory risk change, as the scope of products, calculation methods, and financial burdens may shift over multi-year contracts.<\/p>\n\n\n\n

A well-crafted CBAM clause does not simply conclude with a statement that the supplier will “comply with all applicable laws.” It must regulate deadlines and formats for data submission, the buyer's audit rights, recordkeeping, cooperation with accredited verifiers, notifications regarding changes in production processes, and indemnification for additional costs caused by inaccurate or delayed data. At the same time, the buyer should not shift risks beyond the supplier's control\u2014such as market price fluctuations of CBAM certificates\u2014onto the supplier, unless that risk is explicitly factored into the price.<\/p>\n\n\n\n

Sustainability Due Diligence: From Promises to Verifiable Procedures<\/strong><\/p>\n\n\n\n

CSDDD introduces a different, yet complementary model. Following the 2026 amendments, the directive is targeted at very large companies: EU companies with more than 5,000 employees and a net worldwide turnover exceeding EUR 1.5 billion, as well as non-EU companies generating more than EUR 1.5 billion in turnover within the Union. Member States are required to transpose the directive by July 26, 2028, with measures applying from July 26, 2029. Although the thresholds are high, the contractual impact of the directive is far broader. A large company covered by these rules relies on information and actions from thousands of suppliers who are not themselves direct addressees of the directive.<\/p>\n\n\n\n

The essence of due diligence is not a guarantee that an adverse event will never occur, but a risk-based, verifiable process: integrating due diligence into policies and risk management, identifying and assessing adverse human rights and environmental impacts, preventing or mitigating them, remediating actual impacts, communicating with stakeholders, establishing grievance mechanisms, monitoring, and documenting. Contractual assurances from business partners are important, but they do not constitute a safe harbour. The directive explicitly links them to appropriate verification measures, and the use of contractual clauses or independent verification does not, in itself, exclude corporate liability.<\/p>\n\n\n\n

This alters the function of the traditional supplier code of conduct. Previously, a code was often an annex to a contract accepted without actual negotiation or a clear implementation system. In the new regulatory environment, a clause under which a supplier guarantees that its entire supply chain is completely free of human rights violations can be both unrealistic and legally counterproductive. It encourages formal signing rather than actual disclosure of issues. A more effective model requires an obligation to map high-risk areas, provide access to relevant data, ensure prompt incident reporting, establish corrective action plans with measurable timelines, and allow progress verification.<\/p>\n\n\n\n

The principle of proportionality is particularly critical. When contractual assurances are requested from small and medium-sized enterprises (SMEs), the terms must be fair, reasonable, and non-discriminatory, and the cost of independent verification is, as a rule, borne by the large company requesting it. Through this, the European legislator sends a clear signal: due diligence cannot be reduced to unilaterally shifting the entire regulatory burden onto the weaker partner. The lead company must use its leverage, but also offer training, technical support, financing, or a realistic transition period when such measures are necessary to prevent harm.<\/p>\n\n\n\n

ESG Data and the New Economy of Evidence<\/strong><\/p>\n\n\n\n

In parallel with due diligence, sustainability reporting rules are transforming value chain data into information that must be sufficiently reliable for boards, investors, auditors, and regulatory authorities. Even following the 2026 simplifications to the CSRD framework, the core logic remains unchanged: the reporting entity must explain its material impacts, risks, and opportunities, which requires data from its business partners. Scope 3 emissions, raw material provenance, energy consumption, workplace injuries, workforce demographics, and human rights incidents are now becoming part of contractual data exchange rather than mere voluntary corporate communications.<\/p>\n\n\n\n

The greatest legal risk often lies not in intentional misreporting, but in system mismatches. A supplier may rely on a different reporting period, a distinct facility boundary, an incomplete list of subcontractors, or an emission factor that the buyer cannot incorporate into its methodology. Consequently, the contract must establish data ownership, permitted scope of use, format, update frequency, and the level of assurance required. Trade secret protection must also be explicitly addressed: the buyer requires sufficient information to demonstrate compliance, but the supplier should not be compelled to disclose proprietary formulas, profit margins, client lists, or technical knowledge beyond what is strictly necessary.<\/p>\n\n\n\n

Sustainability data is therefore acquiring a status similar to a product's technical specifications. Inaccurate data can trigger a misstated report, a higher CBAM assessment, regulatory proceedings, or loss of financing. Contractual representations regarding data should be linked to correction obligations, audit rights, document retention periods, and carefully calibrated liability. Automatic unlimited indemnification for every error may be inequitable, but limitations of liability should not shield fraud, wilful concealment, repeated refusal to cooperate, or non-compliance leading to a ban on placing products on the market.<\/p>\n\n\n\n

The Contract as a System of Allocation and Joint Risk Management<\/strong><\/p>\n\n\n\n

A new generation of contracts must bridge regulatory compliance with commercial reality. The first step is to precisely define the scope. Phrases such as “ESG requirements,” “applicable regulations,” or “sustainable product” are overly broad unless it is clear whether they encompass only binding law, the buyer's contractual policies, industry standards, or future amendments. Dynamic references to all future buyer policies create unlimited risk for the supplier; a completely static annex, on the other hand, quickly becomes obsolete. A reasonable solution is a change management procedure: notification, impact assessment, a transition period, and price renegotiation when a new obligation substantially increases costs.<\/p>\n\n\n\n

The second step is the allocation of control. Risk should primarily be borne by the party best positioned to prevent the event or produce evidence. The manufacturer controls the production process, energy inputs, and facility data; the importer controls customs declarations, certificate surrenders, and regulatory communications; the lead company controls the design of the due diligence program and decisions regarding the continuation of the business relationship. The contract should align with this map of control rather than simply offloading all risk onto the supplier with less bargaining power.<\/p>\n\n\n\n

The third step is establishing an escalation mechanism. A breach should not automatically lead to contract termination. For most deficiencies, a structured sequence is more appropriate: notification, severity assessment, temporary protective measures, a corrective action plan, performance verification, and only then suspension or termination. Immediate termination remains justified in cases of fraud, concealment, forced labour, grave imminent danger, or refusal to cooperate. An irresponsible withdrawal by the buyer can worsen the position of workers and the local community; thus, the contract must facilitate responsible disengagement rather than hasty legal distancing.<\/p>\n\n\n\n

The fourth step is the careful drafting of liability provisions. An indemnification clause should distinguish direct regulatory costs, remediation costs, product recalls, loss of certifications, and indirect reputational damage. Necessary components include a reasonable limitation of liability, specific sub-limits, and carve-outs for intent, fraud, gross negligence, and non-waivable statutory violations. Equally important are the duty to mitigate damages, control of defence in legal proceedings, and the prohibition of double recovery. Insurance can cover a portion of the risk, but it frequently excludes fines, known circumstances, and purely regulatory costs, meaning a policy cannot substitute for a well-designed contractual framework.<\/p>\n\n\n\n

Finally, a global contract must address conflicts of law. Demands for data disclosure or audits may conflict with rules on personal data protection, trade secrets, competition law, export controls, or local labour law. An information access clause should therefore incorporate a necessity test, purpose limitations, security safeguards, controlled auditor access, and anonymization procedures. An audit right lacking these protections can create a new legal risk while attempting to mitigate an old one.<\/p>\n\n\n\n

Bosnia and Herzegovina (BIH): Indirect Application and Negotiating Opportunities<\/strong><\/p>\n\n\n\n

Companies from Bosnia and Herzegovina will often not be direct addressees of the CSDDD or CSRD, but they will feel the impact of these rules through contracts with buyers, banks, and investors from the European Union. For exporters of steel, aluminium, cement, electricity, and other covered products, CBAM already holds immediate commercial significance. A BIH manufacturer that cannot verify its actual emissions becomes a more expensive and riskier supplier, even when the price and quality of its products are competitive.<\/p>\n\n\n\n

Preparation, therefore, should not begin with filling out a buyer\u2019s questionnaire, but rather with an internal map of data and responsibilities. It is necessary to determine who measures energy consumption and emissions, who controls calculation factors, where supporting documentation is stored, how subcontractors are vetted, and who signs off on statements provided to the buyer. Legal counsel must link production, finance, procurement, human resources, and IT. Without this internal framework, a company risks accepting broad ESG clauses that cannot be operationally fulfilled.<\/p>\n\n\n\n

At the same time, the new regime presents a negotiating opportunity. A supplier equipped with credible emissions data, raw material traceability, regulated labour relations, and a documented incident response strategy can negotiate longer-term contracts, preferred supplier status, cost-sharing for verification, or co-financing for energy efficiency improvements. Compliance then ceases to be merely an expense and becomes a market asset. For companies in Bosnia and Herzegovina, geographic proximity to the EU, an industrial heritage, and renewable energy potential can serve as a competitive advantage, provided they are translated into verifiable data and contractual rights.<\/p>\n\n\n\n

Conclusion<\/strong><\/p>\n\n\n\n

The new architecture of global supply chains does not abolish traditional risks; rather, it overlays them with an additional layer of climate, social, and data liability. CBAM transforms emissions into a border financial cost. CSDDD transforms supplier relationships into a subject of continuous due diligence. ESG reporting transforms value chain information into evidence that must withstand rigorous audit. Rules on forced labour and other market access conditions demonstrate that the consequence of non-compliance is no longer limited to contractual damages but extends to product bans and market exclusion.<\/p>\n\n\n\n

The response cannot be an infinite expansion of supplier guarantees. A contract that shifts all liability onto the weakest link may appear protective, but it often yields poor-quality data, concealment of issues, and supply chain instability. A more sustainable model allocates risk based on control, knowledge, and benefit: the supplier is accountable for its processes and data accuracy; the buyer for its regulatory decisions and systems within its control; and both parties for cooperation, corrective measures, and adaptation to change.<\/p>\n\n\n\n

In this sense, the modern supply agreement is becoming an instrument of corporate governance. Its quality will be measured not merely by how effectively it enables litigation following a breach, but by how well it prevents breaches, produces reliable evidence, and preserves the business relationship under regulatory pressure. Companies that understand this will not only mitigate legal risk, but they will also build supply chains that are more transparent, resilient, and competitive in an economy where market access increasingly depends on verifiable origin, emissions, and production practices.<\/p>\n\n\n\n

Sources and Regulatory Notes<\/strong><\/p>\n\n\n\n

[1]<\/strong> Regulation (EU) 2023\/956 establishing a carbon border adjustment mechanism (CBAM), consolidated version of 20 October 2025; European Commission, CBAM definitive regime, and CBAM communication and news.<\/p>\n\n\n\n

[2]<\/strong> Directive (EU) 2024\/1760 on corporate sustainability due diligence, consolidated version of 18 March 2026, as amended by Directives (EU) 2025\/794 and (EU) 2026\/470.<\/p>\n\n\n\n

[3]<\/strong> Directive (EU) 2024\/1760, in particular provisions on contractual assurances, compliance verification, and civil liability.<\/p>\n\n\n\n

[4]<\/strong> Directive (EU) 2022\/2464 as regards corporate sustainability reporting, consolidated version of 18 March 2026.<\/p>\n\n\n\n

[5]<\/strong> Regulation (EU) 2024\/3015 on prohibiting products made with forced labour on the Union market.<\/p>\n\n\n\n

Author teksta: Aleksandar Sajic<\/p>\n","protected":false},"excerpt":{"rendered":"

Introduction: From Logistics to Regulatory Infrastructure Global supply chains have long been designed primarily according to three criteria: cost, quality, and lead time. Legal…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91,82],"tags":[],"class_list":["post-1749","post","type-post","status-publish","format-standard","hentry","category-articles","category-newsletter-en"],"_links":{"self":[{"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/posts\/1749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/comments?post=1749"}],"version-history":[{"count":1,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/posts\/1749\/revisions"}],"predecessor-version":[{"id":1750,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/posts\/1749\/revisions\/1750"}],"wp:attachment":[{"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/media?parent=1749"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/categories?post=1749"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/advokatskafirmasajic.com\/blog\/wp-json\/wp\/v2\/tags?post=1749"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}