If a lender or a regulator asked tomorrow, could you prove it?
Forced-labour, cyber-resilience and sanctions duties — they bind several tiers below you, on deadlines already set. There’s a difference between asserting your chain is clean and being able to evidence it.
Settled as the Compliance Evidence PackMost obligations are met by assertion until the day they’re tested. An Evidence Pack draws the boundary between what your records actually prove and what you’d have to reconstruct under a probe — before the lender, the offtaker or the regulator draws it for you.
What you can evidence — and what you’d have to reconstruct.
Typical reader: a compliance & assurance lead.
The clocks are already running.
The EU’s Forced Labour Regulation (Regulation (EU) 2024/3015) entered into force on 13 December 2024 and applies from 14 December 2027, barring forced-labour solar polysilicon from the EU market — while the US has barred such imports since the UFLPA presumption took effect in June 2022. And the UK’s Cyber Security and Resilience Bill, introduced to Parliament on 12 November 2025, widens cyber duties on essential energy services and their suppliers. The deadlines are set — the question is whether you can evidence the chain before they’re tested. See what changed →