Supply Chain Due Diligence Sounds Like a Department We Don't Have — What Does an SME Actually Do?

The short answer

You don't need a due-diligence department; you need a due-diligence file. Regulation (EU) 2023/1542 mandates a supply-chain due-diligence programme for four materials — cobalt, lithium, nickel, and natural graphite — aligned with OECD guidance and covering human rights and environmental risks. For a pack assembler or mid-size manufacturer, the practical work is obtaining, assessing, and retaining supplier documentation, then referencing it in the passport. Structured paperwork, not investigative journalism.

The chain, and where you sit in it

The provenance that needs proving runs mine → smelter → cathode → cell. Unless you're vertically integrated, you sit at the end, and your window into the chain is your cell supplier. That's by design: due-diligence obligations cascade — your supplier leans on their cathode supplier, who leans on the smelter. Your obligations concentrate at the interfaces you control:

1. Ask — require due-diligence documentation for the four materials from every cell supplier, contractually.
2. Assess — check the reports actually cover the OECD risk categories and the materials in your cells, rather than filing them unread.
3. Retain and reference — the passport carries due-diligence report references; your file is what stands behind them when a regulator or customer asks.

Why buyers will check before regulators do

Automotive OEM procurement teams already request documented chain of custody for battery-grade minerals in RFP responses — this shifted from nice-to-have to non-negotiable well before the passport deadline. Suppliers who have mapped their upstream chains command a premium; suppliers who can't answer get filtered out at qualification. In practice, your due-diligence file gets exercised by customers months or years before market surveillance ever looks at it — which also means it earns revenue, not just compliance.

The SME-scale programme, concretely

• A policy (pages, not binders) stating your commitment and the OECD framework you follow.
• A supplier questionnaire covering the four materials, origins, and their due-diligence reporting.
• Contract clauses making that documentation a delivery obligation, refreshed on a defined cycle.
• A risk log — which suppliers answered, what gaps remain, what you decided and why. The decision trail is the part auditors actually read.
• Passport hooks — report references entered per product so the published record and the file agree.

The red flag worth acting on

A supplier that cannot produce any due-diligence documentation for cobalt or graphite in 2026 is not a paperwork laggard — provenance either flows down the chain or it doesn't exist. That's a sourcing risk to price in now, while switching costs are a choice rather than an emergency.

What this means for your team

Assign the file to one named owner, send the questionnaire this month, and let the responses build the risk log. Done this way, due diligence is a few focused weeks and a maintenance rhythm — a fraction of the effort its reputation suggests.