Regulation (EU) 2024/3015 prohibited products made with forced labour from the EU market. What it lacked was the digital backbone to make that prohibition enforceable across all 27 member states. A new regulation builds it.
The EU Forced Labour Regulation, Regulation (EU) 2024/3015, which prohibits placing on the Union market any product made with forced labour, entered into force in December 2024. While the prohibition is sweeping in scope and has some clear political ambitions, it has suffered from operational weaknesses from its inception. Namely, it did not address how, across 27 member states with separate customs services and market surveillance authorities, would the system actually identify violations, coordinate investigations, and issue withdrawal orders consistently?
Regulation 2026/903 answers that question, specifying the creation and functioning of a dedicated forced labour module within the Information and Communication System for Market Surveillance, the established EU platform through which market surveillance and customs authorities already coordinate product safety enforcement. The new module, the ICSMS forced labour module, will serve as the single channel through which all formal communications under the Forced Labour Regulation are transmitted and recorded.
As the regulation explains, when a submission arrives through the Single Information Submission Point alleging forced labour in a particular territory, the Commission routes it to the relevant lead competent authority. From that point, every step of the investigation, including requests for information, involvement of additional authorities, assessment conclusions, decisions finding a violation, withdrawal and disposal orders, penalty notifications, and subsequent judicial appeal outcomes, is communicated through the ICSMS module in a standardised format. Customs authorities access the same module for the subset of functions relevant to border controls.
This new standarized format is important, as forced labour investigations will frequently involve supply chains spanning multiple member states. A violation identified through imported goods entering via Rotterdam may involve a company with EU operations in three other countries. Without a common communication standard, coordination defaults to bilateral email chains and informal contacts, which is exactly the fragmentation that allowed systematic non-compliance to persist under earlier product safety regimes. The ICSMS module imposes a structure that makes cross-border cases manageable.
The data governance provisions reflect the sensitivity of the information involved, as investigation files will contain personal data identifying ICSMS users; and allegations may involve confidential business information. The regulation designates the Commission and national competent authorities as joint controllers for personal data in the module, a configuration the European Data Protection Supervisor reviewed in March 2026. Retention periods are set to align with the length of possible review and appeal procedures.
The first forced labour investigations under Regulation 2024/3015 are expected to begin once the Commission designates priority sectors and geographic regions for risk-based assessment. The ICSMS module is the infrastructure those investigations will run through. Its entry into force on the twentieth day after publication marks the moment when the Forced Labour Regulation’s enforcement framework moves from a legislative text to an operational system.
