Prepare for the Supply Chains Act reporting cycle: Top 10 compliance tips

JENNIFER KING: Everyone who's joining, I'll start by introducing myself. And then hopefully, more people will join before we introduce our speaker today, Stephen Pike. My name is Jennifer King. I'm a partner at Gowling WLG and I'm Co-Lead of the National Administrative Law Practice Group at Gowling. I'm a litigator and regulatory lawyer, and a big portion of my practice is in the area of environmental law. I work across the country and in Nunavut. I previously was Co-Lead of the ESG advisory services practice group, of which Stephen Pike currently co-leads.

And just to say a bit about our group. We have lawyers, partners in all of the different areas that touch on ESG, including in advertising, environmental litigation, and in governance from right across the country. We're also tied into our global firm that has expertise in this area.

Stephen Pike, who's the speaker today, is-- I'm proud to introduce Stephen. We've worked for many years on ESG issues. He's a partner in the Toronto office at Gowling WLG and co-leader currently of the firm's ESG advisory services practice. Stephen is a senior legal advisor to Canadian, American, and global companies and businesses, and regularly advises on corporate governance, ESG operation, and risk management issues.

Stephen is co-editor of ESG in the boardroom, a guidebook for directors that's published by the American Bar Association. And Stephen appeared as a witness before the Standing Senate Committee on human rights to give evidence regarding Bill S 211, which is now the fighting against forced labor and child labor in Supply Chains Act. Stephen, before I start peppering you with questions about compliance issues related to this act, can you tell us a little bit more about your experience, in particular with the act, since it came into force a few years ago.

STEPHEN PIKE: Well, thank you very much, Jen. It's a pleasure to be here. And thank you very much for agreeing to pepper me with probing questions about the Supply Chains Act. Yes, I've been involved with the act since-- actually, probably before it was passed by the Senate. And then the House of Commons came into force in January 1, 2024.

It's an act that's very short. It was a private member's bill, but it's a very short act. And unlike much of the legislation that we see these days, it is very compact and does not have a lot of detail or granular information in it to allow companies to easily comply with the requirements under the act. So I've worked with part of a legal advisory group working with Public Safety Canada to last year work on new guidance that was published that helped a lot of companies have a clear picture of what's required of them. And again, we saw new guidance published by Public Safety Canada in December that provides additional guidance.

In December, I was called to give evidence to the Standing Committee on international trade as they were studying Canadian businesses, supply chains, and forced labor, and importing of goods. And that's a brief precis of the work that I've done with respect to the Supply Chains Act, including advising many companies over the past few years on compliance issues.

JENNIFER KING: Stephen, I'm assuming that a lot of the people who have joined our webinar today are already familiar with the act, because I think this is a focused on compliance. But perhaps, can you give just a short intro into the act before we dig into compliance.

STEPHEN PIKE: Sure. Well, on January 1, 2026, Public Safety Canada opened its portal for the filing of reports under the fighting against forced labor and child labor in Supply Chains Act. By the way, I'm going to call it the Supply Chains Act. Our audience today, I know, has a wide variety of experience filing reports under the Supply Chains Act. Some are working on their second report, some on their third, and some are just starting out and working on their first one. So over the next 30 minutes or so, we'll be addressing issues that span the experience curve.

So as the third reporting cycle is now underway, let me-- we'll offer a handful of key compliance tips. But let me give you a brief overview as Jen had requested. It's essential to remember that the mandatory disclosure in the report is retrospective and historical. What did the reporting entity do in its most recently completed financial year? Any aspirational statements or forward-looking information requires very careful scrutiny.

The essential content of the report is disclosure of the steps that the entity had taken during its previous financial year to prevent and reduce the risk that forced labor or child labor is used at any step in the production of goods in Canada or elsewhere or used in the production of goods that the reporting entity imported into Canada. The completed report must be approved by the reporting entities governing body, which for most of you, if not all of you, is the board of directors.

Report must include an attestation that's signed by a member of the governing body to the effect that the report was formally approved by the board of directors. When I say formally approved, I'm referring to a resolution passed by the board of directors approving the report. Then the report has to be filed using the Public Safety Canada portal. And as part of the filing process, the reporting entity also completes Public Safety Canada's mandatory detailed online questionnaire. Finally, the report has to be posted on the website of the reporting entity.

JENNIFER KING: So under this act, is there anything besides this report that's required to be done by the reporting entity?

STEPHEN PIKE: That's a great question, Jen, to start with. Well, if you deconstruct the act, you'll find there's actually five critical deliverables under the Supply Chain Act. Deliverable one, prepare a report that addresses each mandatory requirement of the Supply Chains Act. Deliverable two, upload the report in PDF format on the Public Safety Canada portal on or before May 31 in each year.

The third deliverable, complete the mandatory Public Safety Canada online questionnaire. This is essentially a multiple-choice exercise that permits the reporting entity to tick the box of the answers that are applicable, and also there are opportunities to provide additional information in the questionnaire.

So we have the report, and we have the questionnaire. They both must be accurate. And that's absolutely the starting point. But as well, the data and information that's in the report and the data and information that's in the questionnaire have to be consistent. For example, if in the report, if you provide the disclosure that the reporting entity provides training to all of its employees on forced labor and child labor, in the questionnaire, it should reflect the same fact and shouldn't see something that says, no, we do not provide training on forced labor and child labor to our employees. So it's as simple as that. But that consistency is key.

The fourth deliverable is the posting of the report on the reporting entity's website, and we'll talk about that in a minute. And then the fifth critical deliverable is applicable only to reporting entities that are incorporated under the Canada Business Corporations Act or any other federal act of parliament. These corporations must not only file the report with Public Safety Canada and not only post the report on their website, but they must also provide the report to each shareholder along with reporting entity's annual financial statements. So the answer, Jen, only five critical deliverables.

JENNIFER KING: Are those all due by May? By the May deadline?

STEPHEN PIKE: Yes. The report has to be filed on or before May 31. And the way that it's filed requires the reporting entity to complete the questionnaire. So that's going to be done before May 31. And the approval of the report by the board of directors has to precede the filing of the report. So it all has to line up carefully.

JENNIFER KING: OK. Can you explain what is required for the questionnaire and any tips that you might suggest regarding compliance with the questionnaire requirement.

STEPHEN PIKE: Sure. And there have been some changes in how the questionnaire is going to be dealt with. But essentially, the way it works is you can go online on Public Safety Canada's website and find the list of the questions that will appear in the questionnaire. And you can use those questions and the variety of answers that it allows when you're filing your report. But also puts you in a position when you sign on to file your report and you're completing the questionnaire, you should know in advance-- that's my tip-- know in advance what your answers are going to be to the questionnaire.

So let's start with how many questionnaires need to be filed. So one questionnaire is to be filed by the reporting entity that has submitted the PDF report. If a joint report, including multiple reporting entities, is filed, only one reporting entity is required to complete the questionnaire. That will be the reporting entity that filed the report. So for example, in a situation where a parent company and a number of controls subsidiaries have combined together to create a joint report, in many cases, it will be the parent company that's going to file the report, and it will be the company answering the questions in the questionnaire.

The questionnaire requires that the reporting entity that's filing the report provide contact information, have to provide the name, title, and email address of the person authorized to fill out the questionnaire on behalf of the reporting entity. The questionnaire, unlike the report, doesn't require an attestation or a signature, nor does it require board approval. Flip side of that is that the report doesn't require the reporting entity to provide contact details for someone in case Public Safety Canada needs to get in touch with them.

Something that is very critical, in my view, is that when you're completing the questionnaire at the end, before you exit the Public Safety Canada portal, I highly recommend that you either print a copy of the questionnaire with the reporting entity's answer to the questionnaire, or download it or save it. It's critical, in my view, to have an audit trail memorializing the answers that the reporting entity provided to Public Safety Canada. And because after you exit the Public Safety Canada portal, you will not be able to retrieve a copy of your questionnaire.

After the questionnaire is completed, Public Safety Canada will send a confirmation via email to the email address that have been provided as part of the contact information. The change this year is that Public Safety Canada is going to send out bespoke links to each reporting entity that's previously submitted a report, and that will allow reporting entities to work on the questionnaire in various iterations. In other words, they don't have to complete it all in one sitting and they can share-- they'll be able to share the link to different computers. In other words, others in the business can be involved in completing the questionnaire.

However, if you're not receiving one of those links because you haven't filed a report before, you're able to continue to access the standard supply chains questionnaire on the Public Safety Canada web page. So as in prior years, you had to complete the questionnaire in one sitting and just on one computer. Now, it seems that Public Safety Canada is making a little bit more convenient for businesses.

JENNIFER KING: Stephen, you previewed earlier that we were going to talk more about the requirement to post the report. And I understand that it is still a requirement that a company has to post the report. Can you tell us a bit more about that requirement?

STEPHEN PIKE: Sure. So it is still a requirement that the reporting entities responsible to post the report in a prominent place on the reporting entity's website. Prominent place means a place on the website where it's easily accessible to interested parties and stakeholders, and sometimes easily accessible in the eye of the beholder.

We see lots of websites where companies are posting various other reports. And in many circumstances, that's the appropriate place to post it. In others, we see at the bottom of the landing page, lots of different links. And sometimes, that's the right place. So it's really up to the business to rationally decide where it would be easily accessible.

The questionnaire, by the way, and the reporting entity's answer do not have to be posted on the reporting entity's website. A question that comes up is Public Safety Canada publishes an online catalog of all the reports filed under the act, and that includes reports for prior years. So it's essentially a historical deposit or repository of whatever reports have been filed.

Companies that have filed in previous years are not required under the act to post prior year reports. Public Safety Canada recommends that companies post prior year reports, but the legal requirement is to maintain the most recent report in a prominent place on their website. So you do not have to have a historical iterations of your various reports.

One thing I'll say is-- I mentioned the Public Safety Canada website and the catalog. They're only published in the catalog if they pass a initial quality assurance check by Public Safety Canada. So for example, a report, according to Public Safety Canada report, won't be published if it doesn't contain information relevant to the Supply Chains Act or the reporting requirements. So that's a big issue for companies that are not focused on getting the report in line with what's required under the act.

JENNIFER KING: I understand that you get a lot of questions about the signature to the attestation. Can you shed some light on this issue?

STEPHEN PIKE: Sure. In the first two years of the Supply Chains Act reporting, there seemed to have been a lack of clarity as to the signature requirement. Who's supposed to provide it? How would it be provided? And Public Safety Canada's tried to provide the necessary clarity.

One, a blank signature block is not acceptable. A wet signature, like that signing with the pen, is acceptable. A typed signature is now acceptable, and a digital signature, such as DocuSign, is acceptable. And for those who are using DocuSign or similar platforms, I recommend that reporting entities save the DocuSign certificate of completion, which will show an evidence who signed the Supply Chains Act report.

And again, just to take a step back, the signatory must be a member of the governing body of the reporting entity. So if you have a board of directors because your corporation, then that body, the board of directors, a member of the board of directors has to sign the report and approve it, as well as after having the board formally approve it by resolution.

JENNIFER KING: And so today, we've been talking about some of these requirements. But I think it's important to note that this is really not a tick-the-box exercise. Can you tell us a little bit about the enforcement provisions under the act. What happens if you don't report or if you're not accurate?

STEPHEN PIKE: Well, the Supply Chains Act has a full array of enforcement provisions, including fines up to $250,000 and potential personal liability for directors and officers. For example, knowingly providing a report that contains a false or misleading statement is an offense under the Supply Chains Act. Failing to file an annual report under the act, when so required under the act, is also an offense under the act. That being said, Public Safety Canada has not publicized publicized its enforcement program, but has indicated that it's working to increase awareness of the reporting requirements, enhance analysis to promote compliance, and improve the quality of reporting information.

In the first two years of reporting under the Supply Chains Act, no orders were made under the act against any entities, nor were any charges laid under the act. So with respect to this third year of reporting, I think we wait and see what happens right now. It's not clear how the act will be enforced.

JENNIFER KING: I understand that one of the most challenging aspects of the disclosure required by Public Safety Canada in the report is this question as to how the reporting entity assesses its effectiveness and ensuring that forced labor and child labor are not being used in its business and supply chains. Can you talk a bit about this challenge and how you recommend that some of the entities answer this question?

STEPHEN PIKE: Sure. It's this question is different from all the other questions in terms of being subjective and also not being historical. It's a challenging question for many reporting entities. So there, as you had said, they're required to report on how they ensure the forced labor and child labor are not being used in their business and supply chains. But this is how question, not a results-oriented question or narrative about what the reporting entity found in its assessment. It doesn't seek a qualitative assessment by the reporting entity. Rather, Public Safety Canada wants reporting entities to describe the policies and processes they've implemented to measure their success in preventing and reducing risks of forced labor and child labor in their activities and supply chains.

Public Safety Canada, though, has also indicated that a reporting entity could respond, indicating that they have taken no actions to assess their effectiveness and in preventing or reducing risk of forced labor, child labor, and business and supply chains. It's really challenging for that information to be put out into the public sphere.

I've read a lot of reports where we've seen reporting entities indicate that they have taken no actions, or they provide what they believe is to be an accurate answer, but it may not be a how answer. It maybe the results answer.

And I think that I remind boards of directors to carefully consider their answer to this question when they're approving the report and ensure that they've provided the answer that the act requires, which I would say generally, almost invariably, we get good answers. We see good answers. But where I've seen for some reports, some government reports, for example, where they have not taken any steps to assess the effectiveness of the steps they're taking, I think that can be a real challenge.

JENNIFER KING: Well. We're mid starting to be late February now. So we're right into this third reporting cycle. You prepared a short article with top 10 compliance tips as businesses prepare for this next reporting cycle. We're going to put a link to that article in the chat. Thank you very much.

In the few minutes that we have left, Stephen, can you just highlight what your top tips are for the attendees.

STEPHEN PIKE: Yeah. I would say-- and this is maybe seen. I'll give you two answers to that. So one is looking at terminology, we see that the act is very clear in terms of talking about forced labor and child labor. And what's really interesting and should be carefully reviewed are, for example, the policies, codes of conduct, supplier codes of conduct, and various processes and procedures that our internal documents or external documents that reporting entity has put into place.

The question is, are they talking about forced labor and child labor? Are they talking about modern slavery? Are they talking about human trafficking? You want to have that alignment of policies with what the act is requiring. And if the policies are different and using different terminology, you'd want to address that in the report to ensure that it's seamless in terms of the use of terminology.

The other thing I'll just mention in passing is the UK government and the Australian government and the Canadian government got together in 2025 and put together a template, multi-jurisdictional report, that allowed companies, reporting entities that are filing under the UK Modern Slavery Act, 2015 or the Australian Modern Slavery Act and the Supply Chains Act, and perhaps even the California Transparency in Supply Chains Act, that they don't all cover the same ground. So for example, the California Transparency in Supply Chains Act only covers human trafficking and slavery. Does it cover child labor? Not clearly.

So you need to ensure, for those filing multi-jurisdictional reports, that they carefully assess in each jurisdiction what is required to be included in the report.

JENNIFER KING: Good point. All right. Well, Stephen, you have more tips in the article that everyone has access to, and I commend everyone to Stephen's book that he contributed to the ESG in the boardroom. If we didn't have the snowstorm in Toronto, I have a copy in my office that I can show you. But if you want to have access to that book or need any information about how to get it, please contact the organizers and we'll make sure that we connect you to that.

Stephen, thank you so much. I think we've covered a lot of ground in a short period of time, so hopefully, this is all helpful to all of the participants in the webinar as you look forward to this reporting cycle. Thank you very much, Stephen.

STEPHEN PIKE: It's absolutely a pleasure. And thank you, Jen, for your probing questions. And thanks everyone.