Compliance Without Competitive Advantage Is a Wasted Obligation

Depends on sector, size, legal form, products, and operating countries, determined via the obligations register, since the combination of applicable rules is genuinely unique to each company rather than something that can be answered with a general industry rule of thumb. Mapping it properly requires checking each of these factors individually rather than assuming a peer company's obligations match your own.

Map applicable EU and national legislation per country of operation, then attach owners, controls, and evidence per obligation, so the register becomes a working governance tool rather than a static list compiled once and never revisited. An obligation without a named owner and defined evidence requirement tends to be the one that quietly falls out of compliance first.

Run an ongoing scanner over trusted regulatory sources that flags changes and who they affect, rather than relying on someone in the organisation to notice relevant updates as they happen to come across them. Sustainability legislation is changing quickly enough right now that a register built once and left static will be measurably out of date within a year without this kind of ongoing tracking.

Compare policy against practice via interviews and documentation sampling, then decide explicitly which side should change, since either the policy is unrealistic and needs updating or the practice needs to be brought in line with what's already been committed to publicly. Leaving the gap unaddressed is the riskiest option of all, since it becomes visible to exactly the wrong audience at exactly the wrong moment.

Gather the underlying documents and assess whether they actually support the stated policy, rather than assuming that a policy document alone constitutes sufficient evidence of compliance. Auditors specifically look for evidence that a policy is actually being followed in practice, not just that it exists on paper somewhere in the organisation.

A structure that lets an external auditor trace the path from reporting rule to source document to evidence, built in from the start rather than assembled hastily once an audit has already been scheduled. Building this traceability retroactively under time pressure is both more expensive and more likely to reveal gaps that would have been easy to fix earlier but are now urgent problems.

Through a control matrix with an owner, control, frequency, and record for every obligation, giving the board something concrete to point to when asked whether the organisation genuinely understands and manages its sustainability risk exposure. A general assurance from management that things are handled is considerably weaker evidence than a documented control matrix a director could actually walk through.

Define per obligation what 'met' looks like, who checks it, how often, and where that's recorded, applying the same discipline to sustainability reporting that financial reporting has used for decades. Without this level of specificity, 'we have controls' tends to mean something different to every person in the organisation who's asked about it.

Track the EU legislative database, the sustainability standard-setter, relevant national legislators, and sector regulators on an ongoing basis, rather than a one-off review conducted whenever a major new regulation happens to make headlines. A horizon scan that only activates in response to news coverage will consistently miss the quieter regulatory changes that often matter just as much operationally.

A structurally underestimated layer, every operating country adds its own additional rules, usually not available in English, which means multinational companies frequently underestimate their true compliance burden by focusing primarily on EU-level requirements. The national layer often contains obligations that are just as material as the EU-level ones, simply harder to discover.

Name an owner per obligation in the control matrix, obligations without a named owner are the ones that slip, typically not because anyone is being negligent but because an unowned obligation has no one whose job it is to notice when something changes. Explicit ownership converts a general organisational responsibility into a specific person's accountable task.

Applicability depends on size and sector thresholds, determined as part of the obligations register mapping, since the directive's requirements scale with company size and don't apply uniformly across all businesses regardless of scale. Checking applicability early avoids either wasted compliance effort for a company that isn't actually covered, or a nasty surprise for one that assumed it wasn't.

Depends on your product category, assessed during obligations mapping alongside other applicable EU regulations, since the regulation applies to specific commodity categories rather than to companies in general. Product-level assessment is necessary because a company can have some product lines covered by the regulation and others entirely unaffected.

Requirements and timing depend on your packaging categories and volumes, mapped alongside your other obligations, since the regulation's specific requirements and phase-in dates vary by the type and quantity of packaging a company places on the market. A generic answer isn't useful here; it genuinely requires mapping against your specific packaging portfolio.

Connect the remediation roadmap and control matrix to your existing risk structure rather than building a parallel compliance programme that duplicates governance the organisation already has in place elsewhere. A standalone ESG compliance track tends to compete for the same limited management attention as everything else and loses that competition once the initial regulatory pressure that created it fades from focus.