Who Approved That Order? Decision Rights for AI in Supply Chain Planning 

Who Approved That Order? Decision Rights for AI in Supply Chain Planning 

Supply Chain Analytics Pulse

Who Approved That Order? Decision Rights for AI in Supply Chain Planning 

October 2026 | Supply Chain Analytics Pulse

In early 2021, Zillow told the pricing experts who checked its home-buying algorithm to stop questioning it. Within months, the company was buying homes far faster than it could sell them. In the third quarter of 2021 alone, Zillow Offers bought 9,680 homes and sold 3,032. By the end of the year it had written down $407.9 million in inventory, shut the business down, and cut about a quarter of its workforce. 

The algorithm got the blame. The researchers who later studied the case pointed somewhere else: the company had removed the human guardrails around a model it was still learning to trust. Zillow Offers was, at its core, an inventory business, and the checkpoint between an AI estimate and a purchase had been taken out. 

Supply chains are now handing similar decisions to AI. Gartner expects spending on supply chain management software with agentic AI capabilities to grow from under $2 billion in 2025 to $53 billion by 2030. Two thirds of supply chain digital investment already goes to AI, yet 55% of chief supply chain officers say they are unclear on the return. And ISG’s latest research finds that more than half of enterprises still keep a human in the loop, rising to more than two thirds for consequential decisions. 

That brings us back to one of the themes from Pulse’s September live session with AI expert Michael Alf: Accountability when AI gets a decision wrong. 

This edition takes that theme into daily operations. It maps where AI decision authority sits in supply chain planning today, where accountability breaks first in data, inventory, and planner overrides, what bounded autonomy looks like at companies that set it up well, and how to assign decision rights that let AI move fast without leaving the outcome unowned. 

01 From Recommending to Deciding: Where AI Authority Sits in 2026

From Copilot to Agent

For the last few years, AI in supply chain planning mostly talked. It answered questions, explained a forecast, summarized an exception. In 2026 it increasingly acts. 

ISG describes the shift plainly. Planning AI that started out explaining forecasts can now identify issues, reason about causes, propose actions, and act on its own within guardrails. 

Autonomy is a decision someone has to make

ISG’s own conclusion is that pure autonomy is a practical impossibility today. Enterprises have to define when an agent may recommend, when it may act, when a human must approve, and how exceptions get escalated. Its research expects only 13% of agentic processes to be fully autonomous through the end of 2027. 

So, the most important design work in AI-driven planning sits outside the model. It is a set of decision rights: who, or what, is allowed to commit the company to an outcome, up to which limit, and who answers for that outcome afterward. 

The ROI gap is partly an ownership gap 

Gartner’s August survey found that 67% of supply chain digital investment now goes to AI, while 55% of chief supply chain officers are unclear on what it returns. Gartner links much of that to change management: AI use cases are multiplying faster than organizations can adapt how they work around them. 

Unclear decision rights are one of the quieter reasons. When nobody owns an AI decision, nobody measures whether it was a good one. Value leaks away through overrides nobody tracks and automated actions nobody reviews until the quarter closes. 

What regulation requires, and when 

In the EU, the Digital Omnibus on AI entered into force on 27 July 2026. It moved the deadline for stand-alone high-risk AI systems under Annex III of the AI Act to 2 December 2027, and for AI embedded in regulated products to 2 August 2028. The Article 50 transparency obligations were left unchanged and have applied since August 2026. 

Typical demand forecasting and replenishment tools are not among the uses the Act lists as high-risk. For those, the legal floor is low, and the governance burden sits almost entirely with the company. 

02 Where Accountability Breaks First: Data, Inventory & the Override

When an AI-driven decision goes wrong, the failure rarely starts inside the model. It tends to start in one of three places: the data the model consumes, the moment a recommendation turns into a commitment of stock or cash, and the override, where a human steps in or quietly steps away. 

The decision nobody knows they are making

Target Canada was not an AI failure. It ran on automated forecasting and replenishment, which is exactly why it is worth rereading now. 

Rushing toward its 2013 launch, the company had merchandisers enter data for roughly 75,000 products into SAP on a rigid schedule. An internal investigation later found dimensions entered in inches instead of centimetres, dimensions in the wrong order, the wrong currency, and missing fields. The team estimated the data was accurate about 30% of the time, compared with 98% to 99% in Target’s U.S. systems. At that point the system had no way to flag entry errors. 

75k

products for data entry

30%

data accuracy

The replenishment logic depended on exact product and shelf dimensions. With bad data, it could not work out when a shelf needed restocking. Shoppers found empty shelves while distribution centres overflowed, and the company switched auto-replenishment off at its first stores so staff could restock by hand. 

Target Canada filed for creditor protection in January 2015 and closed all 133 stores by April. 

Nobody at Target Canada decided that the replenishment system should run on data that was right a third of the time. Nobody was assigned to stop it either. The fix, when it finally arrived in 2014, was a verification step that blocked bad data before it entered the system. That is a decision right in its own form: who may write data that an automated decision will consume, and what gets checked before it does. 

🔎​ Just exploring? Get FREE insights like this in your inbox twice a month.

Subscribe to Supply Chain Analytics Pulse for bi-weekly announcements of the latest supply chain research, trends, and best practices.

When a recommendation becomes a commitment

Zillow’s original process had three checkpoints. The algorithm estimated a home’s value, pricing experts vetted and adjusted the bid, and renovation teams subtracted expected repair costs. 

Project Ketchup, launched in early 2021 to speed up purchasing, collapsed that chain. Zillow began using its Zestimate directly as the cash offer for qualifying homes, stopped pricing experts from modifying the algorithm’s estimates, and sometimes raised bids by thousands of dollars above the algorithmic price to win more sellers. Purchaces jumped from 3,805 homes in the second quarter of 2021 to 9,680 in the third, more than the previous five quarters combined. 

3805

purchaces increas in 2nd quarter

9680

purchaces in 3rd quarter

The researchers who studied the case argue that Zillow grew volume without treating its human experts as guardrails for a price model that was still maturing. Their closing question could headline this whole edition: “When AI-based business models fail, who is accountable?” 

The same pattern exists in supply chain every day, in purchase orders, stock transfers, and allocation decisions. The risk grows with three things: how much value one decision commits, how hard it is to reverse, and how many of them run before anyone looks. 

The human in the loop is also a risk point

Keeping a person in the loop is not automatically safe. A study of more than 60,000 forecasts from four supply chain companies found that planner adjustments improved accuracy on average in three of them. Small adjustments, though, often made it worse, and upward adjustments were more often wrong, a sign of systematic optimism.

Target Canada had an override problem too. Analysts judged on in-stock rates switched off automatic replenishment alerts for some products, so the system stopped reporting them as out of stock. On paper, the numbers looked good. On the shelves, they did not.

A human in the loop only works when the loop is visible. Every override needs an owner, a reason, and a record, or the AI ends up blamed for decisions it never made.

03 Bounded Autonomy in Practice: Who Is Getting It Right

WalmartAuthority

Real authority, inside a fence

In 2021, Walmart Canada began letting an AI negotiation tool from Pactum negotiate directly with suppliers on Walmart’s behalf. 

The scope was deliberately narrow. The pilot covered tail-end suppliers of goods not for resale, such as fleet services, shopping carts, and store equipment, and only suppliers that were already pre-approved. 

The fence was built by people. Budget owners defined the negotiation scenarios. Buyers chose which suppliers to include. The legal team checked that the chatbot’s script and the resulting contracts met Walmart’s contracting standards. The team behind it stressed that automated procurement only works when the buyer has precisely defined what it is willing to concede, and what it wants in return. 

Walmart set a 20% agreement rate as the bar for a positive return. The pilot reached agreements with 64% of suppliers, with an average turnaround of 11 days, average savings of 1.5%, and longer payment terms. 

The AI had genuine authority to commit Walmart to terms. What made that safe was that every commitment it could make had been approved by a person in advance. The AI chose among options. People decided what the options were. 

Air CanadaAccountability

The company owns what it’s AI says

In February 2024, a Canadian tribunal ruled on a case that started with a chatbot. Air Canada’s website chatbot told a customer he could apply for a bereavement fare after travelling, which contradicted the airline’s actual policy. 

Air Canada argued, in effect, that the chatbot was responsible for its own actions. The tribunal called that a remarkable submission and held that the airline is responsible for all the information on its website, whether it comes from a static page or a chatbot. 

The ruling came from a small-claims tribunal, so its legal weight is limited. The principle behind it is harder to argue with. An AI system acting for a company speaks as the company. In supply chain, that covers an agent confirming a delivery date, accepting a supplier’s terms, or promising stock that is not really there. 

A three-tier model for decision rights 

Putting ISG’s four questions together with the lessons above gives a practical way to sort AI decisions. 

Tier 1: AI acts alone, within limits: Frequent, low-value, easily reversed decisions. Think routine replenishment of stable SKUs within a quantity band, bookings on contracted lanes, or stock rebalancing below a set value. Every action is logged with the data behind it. 

Tier 2: AI recommends, a named person approves: Anything above a threshold, new SKUs, promotional periods, and any decision that touches a customer commitment or a supplier contract. 

Tier 3: A person decides, AI supports: Allocation during shortages, supplier exits, network changes, and anything that is expensive or slow to undo. 

Log-hub’s Supply Chain Agent is designed around a similar division of labour. Users describe a supply chain problem and the outcome they want in plain language. The Agent selects the relevant analytical module, runs the calculation, and returns the results to the user’s workspace, while the planner keeps control over strategy, judgment, and the decision itself. 

04 Organizational Readiness Check

Before approving the next AI feature or agent, it is worth an honest look at whether the organization knows who is allowed to decide what. The first dimension matters most. Without a decision inventory, every other control is guesswork. 

DimensionEarly Stage / Starting pointDeveloping / In progressAdvanced / Governed
Decision Inventory and TieringNo list of which decisions AI makes or influences. Autonomy levels follow vendor defaults.Main AI use cases are listed, but authority levels are informal and differ from team to team.Every AI-influenced decision is mapped to a tier, with a value threshold, a reversibility rating, and a named owner.
Data Ownership for AI InputsNo one owns the master data fields that models consume. Errors surface when outcomes go wrong.Key data domains such as items, suppliers, and lead times have owners and periodic clean-ups.Every critical input field has an owner, validation at entry, and monitoring that flags bad data before it reaches an automated decision.
Override and Exception LoggingOverrides happen in spreadsheets or email, with no record.Overrides are recorded in the planning system but rarely reviewed.Every override carries a reason code, override accuracy is reviewed monthly, and switching automation off requires a logged reason.
Accountability and EscalationWhen an AI-driven decision goes wrong, responsibility is unclear between the team, IT, and the vendor.Escalation paths exist for major incidents, but not for routine AI errors.Each decision class has a named owner, defined escalation thresholds, and post-incident reviews that examine decision rights as well as the model.
Incentives and MeasurementTeams are measured on metrics that automation settings can hide, such as in-stock rates that improve when alerts are switched off.AI outcomes such as accuracy and service level are tracked, but separately from human decisions.AI decisions, human overrides, and business outcomes are measured together, so nobody can look good by quietly bypassing the system.
Workforce AI and Regulatory ScopeNo overview of AI tools that allocate tasks to workers or evaluate their performance.Such tools are known, but not assessed against the EU AI Act.Workforce AI is assessed against the Act's employment category, with a preparation plan for the December 2027 deadline.

05 Key Implementation Steps: Choose Your Perspective 

Click on the perspective you want to analyze – executives or analysts.

Analyst View

Build the Decision Register

✔For each AI-influenced decision, capture its current tier, value at risk, reversibility, frequency, data inputs, and owner. 

✔ Start with the ten decisions that commit the most inventory or cash each week, since that is where a wrong call costs the most. 

✔ Propose tier thresholds from your own data, for example the order value above which a planner’s review has historically changed the outcome. 

Audit the Data the AI Actually Consumes

✔ List the input fields behind your highest-value AI decision: lead times, pack sizes, dimensions, units of measure, supplier IDs.
✔ Check each field for an owner, a last-updated date, and validation at entry. Unit and dimension errors like Target Canada’s are the classic failure pattern.
✔ Add simple alerts for values that break physical or business logic, such as a case pack that does not match the order quantity, before they reach an automated decision. 

Turn Overrides Into Evidence

✔ Log every override with a reason code and the value before and after the change. 

✔ Review each month which overrides improved outcomes. Research on supply chain forecasts found that small adjustments often hurt accuracy and upward adjustments were more likely to be wrong, so start by checking those. 

✔ Track how often automation is switched off, by whom, and for what reason. 

Test the Escalation Path Before You Need It

✔ Define what counts as an AI exception for each decision class: a value spike, a new SKU, a supplier outside the approved list, or data that fails validation. 

✔ Run a tabletop test. Feed a deliberately wrong input into a test scenario and trace who gets alerted, and how quickly. 

✔ Ask vendors to show how their agents behave when they meet bad data. ISG lists this among the questions buyers should put to providers. 

Executive View

Commission a Decision Inventory Before the Next AI Purchase

✔ List every decision AI currently makes, recommends, or shapes, from replenishment and allocation to carrier booking and supplier scoring. Include tools that individual teams bought on their own. 

✔ For each decision, record how much value it commits, how hard it is to reverse, and how often it runs. ISG recommends this per-decision view over generic measures such as planning speed. 

✔ Make vendor autonomy settings an explicit choice. If a tool can act on its own, someone inside the company should have approved that setting. 

Put a Named Owner on Every Decision Class

✔ Give each decision class one owner who answers for its outcomes, whether the AI or a person made the final call. 

✔ Teams without a dedicated AI function do not need to build one before starting. The owner of the business process owns the AI decisions inside it, with IT and the vendor in a supporting role. 

✔ Keep the Air Canada ruling in mind. Externally, the company owns whatever its AI commits to, so internal ownership should be just as clear.

Fix Incentives Before Adding Autonomy

✔ Check whether any team metric can be improved by switching automation off or overriding it quietly, as happened with in-stock reporting at Target Canada. 

✔ Measure AI decisions and human overrides against the same business outcomes. 

✔ Be wary of growth targets that push teams to remove checkpoints. That pressure is the core lesson of Zillow’s Project.

Use the EU AI Act Window Deliberately

✔ Ask for an overview of AI tools that allocate tasks to warehouse or transport staff, or rate their performance. 

✔ Have those tools assessed against the Act’s employment category, with legal support, well before 2 December 2027. 

✔ Use the documentation built for workforce AI as a template for governing other AI decisions, even where the law does not yet require it. 

06 Conclusion

Every case in this edition has the same shape. Zillow’s losses grew after it removed the checkpoint between its algorithm and its purchases. Target Canada’s replenishment system followed its data, and nobody owned the data. Each time, the larger problem was a decision nobody had clearly been given the right, or the duty, to make.

What held up was bounded authority, decided in advance. Walmart let AI commit it to supplier terms because people had already defined every term it could offer. With ISG expecting only a small share of agentic processes to run fully autonomously through 2027, most AI decisions will be shared between people and systems for years. That shared zone is where accountability goes missing unless someone designs it.

When the AI gets a decision wrong, the person on the hook should be whoever owned that decision class before the AI touched it, backed by a record of what the AI did, which data it used, and who reviewed it. Organizations that can produce that record within a day are ready for more autonomy. The rest will find out the expensive way.

🔎​ Just exploring? Get FREE insights like this in your inbox twice a month.

Subscribe to Supply Chain Analytics Pulse for bi-weekly announcements of the latest supply chain research, trends, and best practices.

In case you missed it – Previous Pulse Editions

Most Supply Chains Still Go Dark Below Tier 1

Most Supply Chains Still Go Dark Below Tier 1

Supply Chain Analytics Pulse

Most Supply Chains Still Go Dark Below Tier 1

August 2026 | Supply Chain Analytics Pulse

A decade-old 6% statistic still gets recycled as current research. The real numbers are different, and the gap between what executives believe and what they can actually verify is the more useful numbers for a board conversation.

The claim that only 6% of companies have full end-to-end supply chain visibility traces back to the GEODIS Supply Chain Worldwide Survey, a poll of 623 companies conducted in 2017. Nearly a decade later, that same 6% figure is still being presented as fresh 2026 data across dozens of procurement and logistics roundups.

More recent, purpose-built surveys put genuine end-to-end visibility somewhere between 13% et 18%. QIMA’s 2026 Global Sourcing Survey found 18% of companies report full end-to-end visibility, an improvement on prior years, though the same survey found average supplier-network mapping sits at only 60%, meaning a large share of companies that have mapped their network still don’t have verified visibility into it. Achilles’ Global Supplier Risk and Sustainability Survey found only 6% of organizations have full visibility specifically into Tier 2 and Tier 3 suppliers, and EcoVadis’s Sustainable Procurement Barometer found only 12% can monitor more than half of their Tier 2 base at all.

The pattern holds regardless of who ran the survey or how “full visibility” was defined: visibility is high at Tier 1 and collapses sharply beyond it. McKinsey’s 2025 supply chain risk research found 95% of leaders report visibility into Tier 1 risk, while only 42% of the same group report visibility into Tier 2 or beyond. Executive confidence in overall visibility runs as high as 93% in some surveys, even as the same executives name Tier 2 and Tier 3 suppliers as their single biggest blind spot. That confidence-capability gap, not any single percentage, is the more useful number for a board conversation: dashboards built on Tier 1 completeness are routinely mistaken for full-chain visibility.

01 Why Technology Alone Hasn’t Closed the Gap

Five structural forces explain why more AI and more dashboards haven’t moved the needle much on their own.

Buyers hold contracts, and audit rights, with their Tier 1 suppliers. Almost none of that formal standing extends to Tier 2 or Tier 3. A visibility platform has nothing to connect to below the purchase order boundary, because the purchase order boundary is exactly where the enrolled, contracted relationship ends.

Tier 1 suppliers frequently treat their own upstream relationships as proprietary information and decline to disclose them, and in plenty of cases only have partial visibility into their own exposure further upstream anyway. Meanwhile a meaningful share of sub-tier suppliers, more than a third by some counts, have no plans to adopt any AI or digital reporting tools at all, leaving buyer-side systems with nothing compatible to connect to on the supplier’s side even where the will to share data exists.

🔎​ Just exploring? Get FREE insights like this in your inbox twice a month.

Subscribe to Supply Chain Analytics Pulse for bi-weekly announcements of the latest supply chain research, trends, and best practices.

Roughly half of organizations attempting to unify visibility platforms across a fragmented IT landscape cite integration complexity and data quality as the primary blockers, and a majority say legacy systems continue to blunt the return on newer AI and visibility tools. Where sub-tier data does exist, it tends to be self-reported at onboarding and rarely refreshed, meaning the further a supplier sits from the direct contract, the older and less trustworthy its data typically is.

High executive confidence coexists with low actual capability because most organizations’ sense of “visibility” is really a sense of Tier 1 completeness. Nobody sets out to conflate the two; it happens because Tier 1 is where the contracts, the data feeds, and the dashboards all live.

And increasingly, it is a regulatory problem. The EU’s Corporate Sustainability Due Diligence Directive, the US Uyghur Forced Labor Prevention Act, and Scope 3 emissions disclosure rules now legally require sub-tier evidence, not just Tier 1 attestations.

02 Three Methods Actually Closing the Sub-Tier Gap

None of these approaches are new in concept, but each has moved from pilot to production use over the past two to three years in ways that don’t show up in a typical visibility software comparison article.

Trade-data network inference

Rather than waiting for a Tier 1 supplier to voluntarily disclose its own upstream relationships, this approach reconstructs the supplier network directly from customs and bill-of-lading records, information that governments already require at the border regardless of whether any individual company wants to share it. Platforms built on this model, S&P Global’s Panjiva being the largest, now index billions of shipment records and millions of companies across roughly twenty countries, and use network analysis to surface buyer-supplier relationships that would otherwise stay invisible. The method has a real limit worth naming: it shows trade flows and corporate relationships, not labor conditions or compliance status. It is a mapping layer, useful for finding out who is actually connected to whom, not a verification layer that confirms a supplier is behaving responsibly.

Forensic and isotopic origin verification

This addresses a different failure mode: paper trails that are technically complete but unreliable, whether through honest error, transshipment, blending, or deliberate falsification. The method analyzes naturally occurring chemical and isotopic variations in a raw material itself, shaped by the soil, water, and climate where it grew or was mined, and compares that chemical fingerprint against a reference database of known origins. Because the test examines the physical material rather than accompanying documents, it produces evidence that doesn’t depend on a supplier’s paperwork being honest. US Customs and Border Protection has explicitly recognized isotopic testing as admissible evidence for forced-labor compliance and began expanding its own in-house testing capability for exactly this reason.

Blockchain-based material passports

This method tackles the standardization and incentive problems directly, giving multiple parties in a value chain — miner, refiner, component maker, assembler — a shared, tamper-evident ledger to record material provenance, emissions, and recycled content as materials change hands. Rather than asking each sub-tier supplier to disclose data into a buyer’s proprietary system with no benefit to the supplier, a shared passport standard gives every participant in the consortium the same verified record, which is part of why these programs have found more sub-tier cooperation than bilateral disclosure requests typically do. The EU’s Digital Product Passport framework, starting with batteries, is effectively forcing this approach into a common data schema across the industry rather than leaving it to each company to build its own.

03 Case Studies

Two proof points and one cautionary tale — chosen because they span three different sub-tier verification methods and three different outcomes.

AutomotiveBlockchain Material Passport

Tracing Critical Minerals From Rock to Car

Volvo Cars and UK-based traceability provider Circulor began working together in 2018 on a problem that sits at the center of the visibility gap: cobalt, nickel, lithium, and graphite pass through mining, refining, and component manufacturing steps that are almost never contractually connected to the automaker buying the finished battery. Six years later, in 2024, Volvo’s EX90 became the first commercially available vehicle to ship with a working digital battery passport, built on Circulor’s platform, tracing critical raw materials from extraction through to the finished battery pack.

The passport records three things that matter to a regulator and a customer differently: the origin and production journey of each critical raw material, the embedded carbon footprint of the full battery pack, and the percentage of recycled content used. The mechanism that made supplier participation possible was not a mandate from Volvo alone — it was membership in the Global Battery Alliance, a multi-party consortium that gave sub-tier suppliers a shared, reusable record instead of a one-off disclosure requirement unique to a single customer.

Under the EU Battery Regulation, digital battery passports become mandatory for EV and large industrial batteries from February 18, 2027, and due diligence obligations covering cobalt, lithium, nickel, and natural graphite apply from August 18, 2027.

6 yrs

from first pilot (2018) to commercial rollout (2024)

145+

suppliers connected across the battery value chain

Feb / Aug ’27

EU passport & due diligence deadlines

ApparelForensic Origin Verification

When the Paper Trail and the Physical Material Disagree

Cone Denim, the denim manufacturer owned by Elevate Textiles, is one of the most established named users of Oritain’s forensic cotton verification, using the science to certify to its own retail customers that specific denim rolls were made from cotton grown in the countries claimed, and not from regions flagged under forced-labor rules. The value to Cone Denim’s customers is that the result is independent of any document Cone Denim itself could produce.

Drawn from five years of testing roughly 1,000 garments annually across 40 brands, the data found that while 94% of UK companies and 87% of US companies surveyed said they trace their cotton supply chains, 90% of the brands actually tested in 2025 returned at least one result consistent with prohibited cotton exposure, up sharply from 64% the year before. Oritain’s own leadership has described this as a widening “verification gap” between documentation and reality.

The broader lesson for any Tier 2/3 raw-material category, not just cotton, is that self-reported traceability and verified traceability are two different claims, and only one of them holds up when a regulator asks for evidence rather than a supplier’s word.

96%+

of global cotton production covered by Oritain’s reference database

90%

of brands tested in 2025 returned a prohibited-origin result, up from 64%

94%/87%

of UK / US companies believe their cotton supply chain is traced

SolarUFLPA Enforcement Exposure

What the Blind Spot Costs When Customs Finds It First

Not every case is a success story, and that is the point of including one that isn’t. VSUN, a solar module brand acquired by Japanese manufacturer Toyo in September 2025, had modules detained by US Customs and Border Protection in early 2026 under the Uyghur Forced Labor Prevention Act. Industry analysts tied the detentions to solar cells most likely produced at VSUN’s Ethiopia facility, coinciding with a broader spike in CBP detentions of Ethiopian-origin solar cells and components in January and February 2026. Analyst estimates put the potential earnings impact at up to $30 million.

A company can have a fully compliant-looking Tier 1 relationship, while the actual forced-labor exposure sits two or three tiers upstream. Under UFLPA’s rebuttable presumption, the burden of proof sits with the importer, not the government, and CBP has been explicit that supplier self-declarations alone are increasingly insufficient.

$30M

analysts’ estimated earnings impact of the VSUN detentions

1,580%

increase in automotive/aerospace UFLPA detentions, 2023–2024

47%

of all UFLPA-detained shipments (Jun ’22–Dec ’24) ultimately denied entry

04 Organizational Readiness Check

Before committing further budget to visibility tools, it’s worth assessing where the organization actually sits across four dimensions, not just how much has already been spent.

DimensionEarly StageDevelopingAdvanced
Contractual Reach Beyond Tier 1Contracts and audit rights exist only with Tier 1 suppliers; sub-tier suppliers are unknown or informally identified at bestFlow-down disclosure clauses exist for a subset of critical categories; Tier 2 identified for high-risk commodities onlyStandard contracts include sub-tier disclosure and audit-cooperation clauses across all sourcing categories, not just flagged ones
Data StandardizationSupplier data collected via spreadsheets and email; no shared format across partnersTier 1 data integrated via EDI or supplier portals; sub-tier data, where it exists, arrives in inconsistent formatsShared data standards (Digital Product Passport schema, industry consortium formats) move data between buyer, supplier, and verification providers without manual translation
Verification MethodVisibility relies entirely on supplier self-attestation and periodic paper auditsTier 1 audited directly; sub-tier claims spot-checked occasionally, usually reactive to a specific regulatory requestIndependent verification, forensic testing, blockchain-recorded provenance, trade-data cross-checks, runs continuously as part of ongoing monitoring, not only after a shipment is detained
Regulatory IntegrationCompliance handled reactively, one regulation at a time, usually after a detention, audit finding, or customer requestA dedicated function tracks one or two major regulations (commonly UFLPA alone); data isn't shared across other requirementsA single due diligence data model feeds CSDDD, UFLPA, Scope 3 disclosure, and Digital Product Passport requirements at once, avoiding duplicated collection for each one

05 Key Implementation Steps: Choose Your Perspective

Click on the perspective you want to analyze – executives or analysts.

Executive View

Decide which categories actually need Tier 2+ visibility, and which don't.

✔ Rank sourcing categories by regulatory exposure (CSDDD, UFLPA, EU Battery Regulation, Scope 3), single-source concentration, and reputational risk. Not every commodity needs isotopic testing or a blockchain passport; reserve the highest-cost verification methods for the categories where a stockout, detention, or disclosure failure would actually be damaging.

Put the contractual mechanism in place before the technology.

✔ Amend Tier 1 contracts to require sub-tier disclosure and audit cooperation as a condition of doing business, not a voluntary request. Without that contractual leverage, a visibility platform has nothing to connect to below the purchase-order boundary, regardless of how capable the software is.

Fund independent verification alongside self-reported data, not instead of it.

✔ Self-attestation and paper audits remain necessary, but Oritain’s 2026 research shows a widening gap between what brands believe about their sourcing and what independent testing confirms. Build verification cost into the sourcing budget for high-risk commodities from the outset.

Sequence the roadmap to regulatory deadlines, not a generic visibility ambition.

✔ CSDDD, UFLPA, the EU Battery Regulation’s due diligence obligations (August 2027) and Digital Battery Passport requirement (February 2027), and Scope 3 disclosure rules each carry concrete dates. A roadmap built around named deadlines produces compliance evidence on the schedule regulators actually enforce.

Pilot in the category with the clearest existing exposure.

✔ Choose one commodity or supplier tier where regulatory or reputational risk is already visible, and prove the model there first. Volvo and Circulor took six years to move from pilot to a commercially available battery passport; set board expectations for sub-tier visibility programs in years, not quarters.

Analyst View

Treat trade-data inference as a way to fill gaps, not replace supplier disclosure.

✔ Bill-of-lading and customs data can reconstruct a supplier network even when a Tier 1 supplier declines to disclose its own upstream relationships. Cross-reference inferred networks against supplier-declared data to flag discrepancies; a mismatch is itself a risk signal worth investigating.

Build a tiered verification hierarchy instead of a single audit standard.

✔ Reserve forensic and isotopic testing for the highest-risk raw materials (cotton, critical minerals, timber), documentation review for moderate-risk categories, and standard audits for the rest. Applying the most expensive verification method uniformly isn’t affordable; applying the cheapest method uniformly is how a verification gap opens.

Track the age of every sub-tier data point, not just whether it exists.

✔ Sub-tier intelligence gathered at onboarding tends to go stale quickly, and industry research consistently points to onboarding data running well over a year old by the time it’s used in a live decision. Set a re-verification threshold by data type and risk category.

Score suppliers on disclosure willingness as its own risk category.

✔ A Tier 1 supplier that declines to share upstream relationship data is not a neutral data gap — it should carry its own risk weighting, separate from whatever compliance score the supplier otherwise holds. This reframes a “no data available” result into an actionable signal.

Design any traceability platform choice for interoperability, not lock-in.

✔ Battery passports, forensic testing providers, and trade-data platforms increasingly need to exchange data with each other, with customs authorities, and with the buyer’s own ERP. A single-vendor platform that can’t export to a common standard will need replacing the moment the next regulation lands.

06 Conclusion

The visibility gap below Tier 1 has stopped being a technology-availability problem, if it ever really was one. Every method described in this edition — trade-data inference, forensic verification, blockchain material passports — already exists and is already running in production at real companies today. What’s different about the organizations actually closing the gap is that they paired the technology with a contractual mechanism to reach past Tier 1, a verification method that doesn’t depend on a supplier’s paperwork being honest, and a roadmap sequenced to the regulatory dates that are now forcing the issue whether a company is ready or not.

The organizations that move first on sub-tier visibility now, ahead of the 2027 EU deadlines and the next round of UFLPA enforcement, will be making a deliberate choice. The ones that wait will likely be making the same choice for them.

In case you missed it – Previous Pulse Editions

Recieve the Literature by e-mail!

Recieve the Literature by e-mail!

Share with us your e-mail address in order to receive the resource.

You have Successfully Subscribed!