Who decides what it means?

The translation — from published text to something a category manager can act on in a sourcing decision — is the real work of procurement compliance. It is done by named people. And it has to be redone every time the text, the scope or the timeline changes.

That would be a manageable design question if the rules held still. They don’t. Not everything below applies to every function, but something below applies to all of them, and this is twelve months.

None of this is an argument about whether the direction of travel is right. It is an observation about operating models. If procurement compliance work is organised as a queue of deadlines, a year like this one does not shorten the queue — it re-sorts it. And each re-sort raises the same question about who decides.

This is not an abstraction for the people in the room. Asked to name their biggest risk-management challenges at EBG | Xperience 2025, the Gothenburg group put geopolitical and regulatory uncertainty second at 57% — behind only visibility beyond Tier 1. Another 32% named balancing cost against compliance.

Where the work splits

Procurement compliance splits into three parts, and they behave differently

Defining and scoping

Someone decides what a rule means here — which entities, which categories, which tiers, which materials. Whether that decision exists as a method somebody owns, or as a call made once that nobody has revisited, is exactly what the table’s first question asks. The two look identical from the outside until the rule changes; then one gets updated and the other gets re-made from scratch.

Implementing

Clauses drafted, questionnaires sent, supplier data collected, systems configured. This part is visible and usually has a budget line, which tends to mean it also has an owner — although that owner is not always the same person who made the scoping call.

Verifying

Here there is data, and it is not comfortable.

CPO Outlook 2025 survey (59%) · EBG | Xperience 2025 post-report, risk questions asked in Gothenburg, 28 participants (71%, 0%). In that same Gothenburg group, 68% described their overall risk management as proactive and structured.

That gap between framework and reach does not prove that contractual requirements go unverified — the surveys measure supply chain visibility, not verification practice. But it does make the table’s third question a fair one to put to a room of peers.

Post-Omnibus, that question has a new edge. The final CSDDD text limits what companies can demand from business partners with fewer than 5,000 employees, unless the information cannot reasonably be obtained by other means. How much of your supply base that covers depends entirely on your supply base — but wherever it applies, the work moves from “we have the right to ask” to “we have to design a way to know.” That is a procurement design problem before it is a legal one.

One more finding from our own data

In a mapping exercise at CPO Outlook 2025, hosted by Essity, Solar and Equinor, participants plotted sustainability initiatives against business impact and clarity of ownership. The regulation-driven ones — supplier due diligence, human rights and labour conditions — concentrated where ownership is clear and impact understood. Circular sourcing appeared repeatedly in high impact with unclear owner, and Scope 3 split across both. The conclusion in the report was blunt: regulation creates structure; ambition alone doesn’t.

It is worth holding next to a year in which several of those regulations moved. The lab does not settle what that means. It puts the question to ten people who are living it.

Why the room matters

A behavioural point, worth stating carefully rather than confidently

“Compliance” is not a fixed property of the regulation. What counts as enough is settled between people inside a company — in meetings, in precedent, in what got accepted last time — and different functions can each hold a definition of procurement compliance that works perfectly well inside their own remit. Procurement, sustainability, legal and regulatory affairs are not in disagreement most of the time. They are mostly just not in the same conversation, because the normal working week rarely puts them there.

If that description is right, then the differences are not visible from inside any one function. They become visible when the same question is put to all four at once. That is not a rhetorical point. It is a room-booking decision, and it is one of the reasons a peer lab with ten people from different companies can surface something an internal workshop does not.

Three things worth doing on a Monday

Whether or not you come

1. Take one regulation you live with and write down, on one line each, who defines its scope for your business, who implements it, and who verifies it. If any of the three is a name you had to guess at, that is the finding.
2. Check whether your foundation is regulation-shaped or data-shaped. If supplier, contract and material data exist as one set that each new rule can be layered onto, the next change is an update. If they exist as separate projects named after regulations, the next change is a new project — and on the evidence of the past twelve months, there will be a next change.
3. Pick one requirement you have put into a contract and ask what you would produce if a customer asked you to prove it holds. Not whether the clause exists. What evidence you would send, and who would assemble it.

Day two, we come back to it

On the morning of 15 October we open by recapping several of the labs on stage — a conversation with the moderators, not a presentation, covering where the rooms converged and where they genuinely split. What the room worked on is shared. What was said in confidence stays in the room.

CPO Outlook 2026 is EBG | Network’s 23rd summit, 14–15 October at Hotel Birger Jarl in Stockholm. The through-line this year is the double shift procurement is being asked to make: run the function as it is today, and rebuild it for an AI-shaped future, with the same team, in the same week. Two days of peer labs and roundtables — each running twice, with fresh groups — keynotes from operating leaders, and the Nordic CPO of the Year award.