Conflict Minerals: Who Must Carry Out Supply Chain Due Diligence Under EU Regulation 2017/821

Most manufacturers meet the conflict minerals rules the same way: an email arrives from a Western customer asking them to complete a questionnaire on the origin of the tin in their solder or the tungsten in their cutting tools. The questionnaire has a deadline, and the answer “we don’t know” is, in practice, a lost contract.

Behind that email sits Regulation (EU) 2017/821 — the EU’s supply chain due diligence law for minerals. This article answers the three questions that actually matter: are you in scope, what exactly is required, and what to do when you are not in scope but your customers keep asking.

What conflict minerals are

Conflict minerals (3TG) are tin, tantalum, tungsten and gold when they originate in conflict-affected or high-risk areas. The term does not describe a chemical property — it describes a risk: the profit from mining these four metals is concentrated enough to finance armed groups and opaque enough to disappear after the third resale.

The Regulation therefore does not ban imports. It requires you to know where the metal came from and to be able to prove it. The logic is the same as traceability in any regulated supply chain: the problem is not the product itself, but the inability to trace its path backwards.

Who is in scope

The obligation falls on the “Union importer” — the party declaring the minerals or metals for release for free circulation in the EU. If you buy from a trader who has already imported the goods, you are not an importer under the Regulation. If you import directly from a third country, you are.

The second filter is volume. The Regulation applies only above the annual quantities in Annex I, calculated per tariff code.

The figures were chosen to capture the overwhelming majority of EU import volume while sparing small importers the administrative burden. The practical result is that genuinely obliged companies are few — smelters, metal traders and a handful of processors. For everyone else the Regulation arrives by a different route.

The five steps of due diligence

The Regulation does not invent its own methodology — it makes the OECD Due Diligence Guidance for responsible supply chains of minerals from conflict-affected and high-risk areas binding. The framework has five steps, and it is the same framework behind every customer questionnaire you will receive.

1. Establish a management system. A supply chain policy communicated publicly and to suppliers; clear internal responsibility; a traceability system that retains documented information; and a grievance mechanism.
2. Identify and assess risk. Trace the chain back to the smelter or refiner. In practice this means collecting the names and identifiers of smelters — not the names of the traders you bought through.
3. Design a response strategy. Where risk is identified, report to senior management and adopt a measurable plan: disengage, mitigate, or continue temporarily under monitoring with defined deadlines.
4. Commission an independent third-party audit. The auditor verifies conformity with Articles 4 to 7. The audit is mandatory for importers in scope and is the point at which declarations become evidence.
5. Report publicly. Publish information on your due diligence policies and practices annually, and make audit reports available to the competent authority.

If the sequence looks familiar, that is because it is a classic management cycle — policy, risk assessment, controls, verification, reporting. A company running an ISO 9001 system already has four of the five elements; only the mineral-specific content is missing.

The independent audit: what is actually checked

The independent audit under Article 6 is not a certification. You do not receive a certificate to hang on the wall — you receive an audit report that the competent authority can request. The auditor works to the scope set by the Regulation and checks three things:

• Whether your system meets the requirements of Articles 4, 5 and 7 — documents, responsibilities, traceability, disclosure.
• Whether it works in practice — whether there are records showing risk was assessed, not merely described in a procedure.
• Whether the smelter and refiner data underpinning your origin claims is credible.

The usual stumbling block is the same one that shows up in supplier audits: an elegant policy and zero records. A policy takes a day to write. Traceability takes months, because it depends on your suppliers being willing to answer.

Enforcement in Bulgaria

The national competent authority under Regulation (EU) 2017/821 in Bulgaria is the Ministry of Economy and Industry, designated by Council of Ministers Decision No. 63 of 2019. The inspection procedure is set out in Ordinance No. RD-04-3 of 26 April 2021, published in State Gazette No. 38 of 11 May 2021.

Checks are ex-post: the authority does not authorise imports in advance, but verifies afterwards whether an obliged importer has met its duties. Where non-compliance is found, a notice of remedial action is issued. Member States report the results to the European Commission annually by 30 June.

Not an importer, but the customer is asking. Now what?

This is the real scenario for nine out of ten manufacturers. You sit downstream — you make a component, a sub-assembly or a finished product — and your customer is the obliged party. They cannot prove origin without asking you.

One distinction matters here: you have no legal obligation, but you do have a contractual one. And the contractual one is harder, because it has no thresholds and no competent authority to appeal to. It has only a customer looking for a second supplier.

The practical advice: never answer a questionnaire from memory. A declaration without a basis is more dangerous than an honest “we are building the system and will have an answer by the end of the quarter”. The first absorbs someone else’s liability; the second is a project.

How it fits with the other EU supply chain rules

The key distinction: the Conflict Minerals Regulation was not amended by the Omnibus package. The 2026 simplification narrowed CSRD and CSDDD, not the 3TG regime. It is, however, in its own review process — in June 2026 the Commission launched a tender supporting that review, so changes to scope and thresholds are possible. If you sit close to the thresholds, follow it.

Where to start this week

• Pull your import data for the last 12 months by tariff code. Five minutes with your finance team settles the question of whether you are obliged at all.
• List the suppliers whose materials contain 3TG. There are usually between five and fifteen — not the two hundred most companies fear.
• Send one letter requesting smelter information. The replies will show you exactly where the real problem sits.
• Publish a responsible sourcing policy on your website. It is the cheapest step with the highest visibility to customers.
• Build the requirement into supplier contracts instead of chasing it again every year.

Conclusion

Conflict minerals are a rare case where the legal duty touches few companies and the commercial duty touches almost all. If you are an importer above the thresholds, you have a clear list of requirements, a competent authority and a mandatory audit. If you are not, you have customers who will ask — and for whom “we don’t know” is an answer with consequences.

Either way the solution is the same: traceability that works without campaigns. If you already run a management system, the upgrade takes weeks rather than months. If you don’t, this is a good reason to start — see our Regulation (EU) 2017/821 service or read how supplier audits work.