A company must periodically assess its own operations, its subsidiaries and, where related to its chain of activities, its business partners, at least every five years and after a significant change, and update its policy and measures in light of the result.
The requirement, in our words
Companies must review at intervals what they, their subsidiaries and, for their chain of activities, their business partners are doing, to check implementation and monitor the adequacy and effectiveness of identifying, preventing, mitigating, ending and minimising adverse impacts. Assessments use qualitative and quantitative indicators where appropriate and are carried out promptly after any significant change, at least once every five years, and whenever there is good reason to think measures are no longer adequate or new risks have arisen; the policy, the impacts identified and the measures are then updated, with due regard to stakeholder information.
Why it matters
Monitoring is the feedback loop. The five-year maximum is a ceiling, not a schedule: a significant change triggers an earlier assessment, and so does a reasonable belief the measures no longer work or that new risks have arisen. The output is not a report for its own sake; it updates the policy, the impact list and the measures.
What changed
The old Article 15 required monitoring but did not set the five-year maximum or the trigger in the same terms. The replacement adds both and ties the update to the assessment.
What to do
- Write an effectiveness assessment with indicators, results and dated triggers.
- Keep a change log that shows each reassessment after a significant change.
- Update the policy and the action plans from the assessment, not separately.
Evidence to have ready
| Category | Artefact |
|---|---|
| Monitoring and review | Effectiveness assessment report with indicators, results and dated triggers |
| Monitoring and review | Change log showing reassessments after significant changes |
| Monitoring and review | Updated due diligence policy and impact register following each assessment |
Common failures
- Five-year interval treated as the only trigger despite significant changes
- Assessment completed but policy and measures never updated
Dates
Transposition by 26 July 2028; application from 26 July 2029. The first assessment is due within five years of the start of application, or earlier on a trigger.
The question to test
Is the five-year clock diarised, and does a significant change trigger an earlier review?
Cross-references
A4-11 Actual impact last resort · A4-14 Due diligence statement and ESAP
Source
Article 4(11), replacing Article 15 of Directive (EU) 2024/1760; OJ L 2026/470, 26 February 2026; https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026L0470. Our statement of the duty, read from the Official Journal text and the held control record, not the instrument verbatim.
Not legal advice; does not certify. A reading of the duty and the evidence commonly sampled, not a substitute for the Official Journal text, the national transposing measure or your auditor's judgement.