ESG risk reaches as far as the chain of activities does, so tier 1 is a visibility boundary rather than a legal one. Enacted EU due diligence law covers direct and indirect business partners alike. Depth of enquiry past tier 1 follows severity and likelihood, established by a scoping exercise, not contractual distance.
Tier is a procurement convention, not a statutory unit. Enacted EU due diligence law works through definitions rather than through a tier count. It defines a chain of activities and a class of business partners, then splits that class in two. A direct business partner holds a commercial agreement with the company. An indirect business partner holds none, yet performs business operations related to the company’s products or services. Both sit inside the duty. Member State measures apply from 26 July 2029.
Where visibility breaks
Purchase orders stop at tier 1. Past that point there is often no contract, no audit right and no name. OECD guidance meets the gap by directing enterprises to obtain information about business relationships beyond contractual ones, including sub-suppliers beyond tier 1, and to assess the risk profile of more remote tiers through mid-stream actors and control points. Where no contract exists, it suggests requesting disclosure of sub-suppliers, sub-contractors or country of origin, or using an existing traceability or chain of custody scheme.
| Tier | Typical visibility | Usable evidence type |
|---|---|---|
| Tier 1 | Named and contracted | Contract clauses, questionnaire responses, audit reports, primary data |
| Tier 2 | Named only if tier 1 discloses | Sub-supplier lists, flow-down clauses, declarations |
| Tier 3 and beyond | Usually anonymous | Country of origin, chain of custody schemes, sector risk profiles |
| Raw material origin | Visible only where a regulation compels it | Plot geolocation, traceability records |
The cascade clause, and what triggers depth
Obligations cross the contract boundary through a cascade:
1. The company seeks contractual assurances from a direct business partner covering compliance with its code of conduct. 2. The same clause obliges that partner to establish corresponding contractual assurances from its own partners, to the extent their activities form part of the chain of activities. 3. Where those measures have not sufficed, contractual assurances may be sought from an indirect business partner directly.
Depth is risk-triggered. Identification opens with a scoping exercise across general areas, and in-depth assessment follows only where impacts are most likely and most severe. Where several areas rank equally, direct business partners may be prioritised.
Two instruments reach further on their own terms. The EU Deforestation Regulation requires the geolocation of every plot of land on which the relevant commodity was produced. In India, value chain ESG disclosure is scoped by contribution rather than by tier, covering partners individually comprising 2% or more of purchases and sales, and it is voluntary for the top 250 listed entities from FY 2025-26.
Sources: CSDDD consolidated text, OECD Due Diligence Guidance, EUDR consolidated text, SEBI circular, 28 March 2025
Assembling that evidence chain is preparation, not verification: independent third parties verify, and neither that verification nor a contractual clause discharges liability. ESG advisory services structure supplier evidence and ready the data file, and the ESG guide sets out how scoping decides where enquiry goes deeper.