Sponsored by
Hi {{first_name}} ,
Have you been in this situation?
A supplier looks commercially attractive, technically capable and operationally convenient. Then, late in the process, Legal asks about end use, country exposure, ownership, subcontractors, export classification or data access. Suddenly procurement is no longer discussing cost and delivery. It is explaining why the risk was not visible earlier.
This week’s CPO Path is about that moment and the skill procurement leaders need when compliance, security and sourcing decisions meet under time pressure.
Enjoy reading!
PS:
Live session: Procurement AI Agent Prototype
The first live prototype session will take place on Wednesday, July 8, 2026.
Based on the first survey responses, the session will focus on what readers clearly asked to see: a practical procurement AI agent setup, realistic use cases, and a controlled view of what such an agent can already support today.
Date: Wednesday, July 8, 2026
Time: 9:00 AM PT / 18:00 CEST
Application closes: Monday, July 6, 2026, at 9:00 AM PT / 18:00 CEST
The registration link will be shared only with submitted applications. If you applied already, the webinar registration link will be send before the event.
Regulation, Security, Compliance: The CPO’s 48-Hour Risk Test | CPO Path #13, CW 25 2026
Executive premise
Regulation, security and compliance are no longer late-stage checks. They increasingly shape whether a supplier can be nominated, whether goods can move, whether a customer commitment can be protected, and whether a sourcing decision will still look acceptable when Legal, Security, Finance or the board reviews it.
The CPO’s role is not to replace Legal or Compliance. The CPO’s role is to make supplier risk visible early enough to influence the decision.
Why this matters
In many organisations, compliance arrives after procurement has already built momentum. The RFQ is done. The preferred supplier is selected. The project team is aligned. The commercial case looks attractive. Then a restricted-party concern, export-control question, contractor issue, cyber-risk finding or customer evidence request changes the room.
That sequence is risky because the organisation has already invested politically in a decision.
Official control systems are becoming more operationally relevant for procurement. OFAC administers sanctions programs and provides sanctions lists, sanctions search, general licences, civil penalties and reporting resources. ([OFAC], n.d.) BIS provides export-control guidance on the EAR, classification, country guidance, end-use and end-user controls, licensing, screening and export compliance programs. ([BIS], n.d.) BAFA describes export control as a foreign- and security-policy instrument and refers to dual-use regulation, embargoes, licensing, end-use certificates and internal compliance programmes. ([BAFA], n.d.)
For procurement leaders, the implication is practical. The function must no longer ask only: “Can this supplier deliver at the right cost and quality?”
It must also ask: “Can this supplier support the business without creating a legal, security, continuity or market-access issue that another function will later have to explain?”
The real dynamic
The old supplier-risk model often worked like a gate. Screen the supplier, collect documents, involve Legal when needed, then proceed.
That model is increasingly too slow.
Reuters reported that Siemens equipment reached a sanctioned Russian explosives manufacturer through a Russian middleman sourcing technology from Chinese wholesalers and resellers, based on customs data and state procurement records reviewed by Reuters. ([Reuters], 2025) That case is instructive because the procurement risk did not sit only in the brand name or the product. It sat in intermediaries, end use, product codes and routing.
Reuters also reported that Brazilian officials found Chinese workers at a BYD construction site in Brazil in “slavery-like conditions,” with authorities citing excessive hours, degrading accommodation and passport withholding. ([Reuters], 2024) That case is different in content, but similar in structure. The relevant procurement risk was not only the contracted party. It was the execution chain.
Critical-materials risk shows a third pattern. Reuters reported in June 2026 that some critical minerals from China had become “nearly unobtainable” for U.S. companies because of export controls and licensing delays. ([Reuters], 2026) This is not a classic supplier-performance problem. It is a lead-time and access problem created by state control.
A more mature procurement view therefore treats regulation and security as sourcing conditions, not as paperwork.
That does not mean every supplier needs a heavy review. It means the CPO needs a fast triage system.
The most useful skill here is the 48-hour Go / Contain / Exit test.
When a risk trigger appears, procurement should be able to answer five questions within two working days:
Question | Decision use |
|---|---|
What triggered the concern? | Screening hit, media report, authority inquiry, bank alert, customer request, audit finding, cyber incident |
What is affected? | Supplier, contract, shipment, payment, plant, project, customer, data access |
What type of risk is plausible? | Sanctions, export control, forced labour, cyber/data, end use, country exposure |
What must be stopped immediately? | Payment, shipment, access, PO release, contract signature, supplier nomination |
Is this a Go, Contain or Exit case? | Continue with evidence, limit exposure, or stop and resource |
The difference between weak and strong procurement leadership is not whether someone notices a risk. Most organisations notice eventually.
The difference is whether the CPO can structure the issue before the organisation loses time, trust or optionality.
What strong leaders do differently
They embed Legal, Export Control and Security before supplier nomination in high-risk categories, not after the preferred supplier has already been selected.
They classify supplier risk by consequence, not only by spend. A small supplier with remote access, controlled technology, subcontractor dependency or single-source status can carry more enterprise risk than a large but replaceable supplier.
They maintain a living regulatory watchlist. OFAC, BIS, BAFA, EU requirements, customer evidence requests, bank requirements and critical-material controls should not sit in separate inboxes. They should be mapped to suppliers, categories, plants and contracts.
They use a simple decision vocabulary: Go, Contain, Exit.
Go means continue, but with evidence, clauses, audit rights or monitoring.
Contain means limit exposure: pause shipment, block prepayment, restrict access, hold new volume, request documentation or activate a second source.
Exit means stop award, block the vendor, suspend the contract, resource or escalate to management.
They also prepare the board view in procurement language that travels upward: exposed spend, critical suppliers without substitution, screening coverage, alert-to-decision time, contract control clauses and open major findings.
Deloitte’s 2025 CPO survey states that the top three effective risk-mitigation strategies among surveyed CPOs were active alternative sources, better supply-chain visibility and more intensive supplier information sharing. ([Deloitte], 2025) Those are not only resilience measures. They are the operating basis for regulatory and security readiness.
Intelligence from the full research pack
A useful CPO-level reading is that supplier risk is now shifting from supplier identity to supplier execution network.
In practice, the relevant question is not only “Who is our supplier?” It is also:
Who owns the supplier?
Who routes the goods?
Which intermediaries are involved?
Where is the product installed?
Who has end-use control?
Which subcontractors or workers actually execute the work?
Which government licence, customs step or documentation requirement can delay the flow?
Which system, data or plant access does the supplier receive?
This is where procurement’s leadership role changes.
The future risk is often not visible in the vendor master. It sits in the chain around the supplier: resellers, agents, subcontractors, country routing, end users, worksite conditions, software access, payment flows and government-controlled lead time.
That is why a good procurement response cannot be limited to onboarding forms. It needs three operating objects:
First, a supplier risk screen that checks ownership, intermediaries, country exposure, product sensitivity, end use, labour risk, cyber/data access, evidence quality and substitutability before nomination.
Second, a regulatory watchlist that links OFAC, BIS, BAFA, EU, customer and bank requirements to concrete suppliers, categories, plants and projects.
Third, a board dashboard that shows exposure, control maturity and decision speed: risk-exposed spend, screening coverage, alert-to-decision time, substitution readiness, contract-clause coverage and open audit findings.
That is the difference between a compliance process and a procurement leadership system.
A compliance process asks whether the supplier passed the required check.
A procurement leadership system asks whether the business can still act if the supplier becomes restricted, compromised, delayed, non-compliant or commercially unusable.
CPO Path Diagnostic
Question | Fully true | Partly true | Not true |
We identify high-risk suppliers before nomination, not only during onboarding. | ☐ | ☐ | ☐ |
Procurement knows which suppliers create sanctions, export-control, labour, cyber or data-access exposure. | ☐ | ☐ | ☐ |
We can move from a risk trigger to Go / Contain / Exit within 48 hours. | ☐ | ☐ | ☐ |
Our critical contracts include the clauses needed to enforce documentation, audit, subcontractor and compliance obligations. | ☐ | ☐ | ☐ |
We can show the board our supplier-risk exposure, control maturity and substitution readiness in one view. | ☐ | ☐ | ☐ |
Full research pack
We prepared a more detailed working pack behind this edition, including:
a tiered due-diligence model
a 48-hour triage checklist
a supplier risk screen
a regulatory watchlist template
escalation logic
model clauses
board KPIs
a 15-minute board deck structure
a 100-day implementation plan
a non-binding outlook for 2026–2029
The full pack is more operational and built for implementation work. Email me to get the full pack here:
One-line verdict
Procurement earns strategic trust when it turns unclear supplier risk into a structured executive decision before the business becomes exposed.
Hi {{first_name}}, Which path are you on?
I read every single message, and past posts already shaped this space. Reach out to me and tell me what you’re up to and the path you’ve chosen and please share your thoughts about our journey on you preferred platform. CPO Path is free, help me keep it that way.
OR
Talk soon,
Pascal
Did this resonate with you?
MY OFFER
ProcWee™ and CPO Path are built from my work in procurement practice, not from theory alone. I work as an interim procurement manager and advisor, and I use these newsletters to share the patterns, risks, and leadership questions that show up in real organizations.
If you are facing a critical procurement project, a difficult internal situation, or a career-relevant leadership question, there are two ways to engage.
Free Webinar: Procurement AI Agent Prototype
Format: 45 minutes
Date: July 8, 2026
Time: 9:00 AM PT / 18:00 CEST
Type: private, invite only
Fee: $0
Structure:
Procurement AI Agent prototype demonstration
use cases selected based on survey answers
practical examples around spend and supplier diagnostics, contract clause analysis, supplier risk monitoring, negotiation preparation, and procurement reporting support
final minutes: Q&A
1-On-1 initial consultation
Format: 45 minutes
Fee: $121
Best fit for:
S2C / P2P process issues
plant engineering, nearshoring
process automation and AI use cases
supplier strategy and negotiation situations
personal positioning as a procurement leader
Slot reservation includes mandatory qualification questions. If your answers indicate that I am not the right person to help, the slot will not be finally confirmed and no payment link will be sent.
The initial consultation is designed to clarify the situation, identify the real constraint, and assess whether I can help meaningfully. If there is a fit, we can discuss a follow-up program or project-based support after the call.
Quick wins to implement today:
Your Admin Savior
Catch is an AI agent focused solely on administrative tasks. We don’t write code, create images, or analyze data. Our single mission is to build the most advanced agent you can trust to delegate your daily workload, expertly handling scheduling, reminders, email, and travel logistics.
Genuinely proactive, Catch operates with the initiative of a human employee. It is available wherever you already are, working seamlessly over the phone, WhatsApp, and iMessage to keep your day moving forward. Because true delegation requires absolute peace of mind, Catch is built on highly secured infrastructure and is fully SOC 2 compliant, ensuring your data is always protected.
Test Catch today to see how it handles the friction in your workflow.
SOURCES
BAFA. (n.d.). Export Control. Retrieved from https://www.bafa.de/EN/Foreign_Trade/Export_Control/export_control_node.html
BIS. (n.d.). Bureau of Industry and Security Homepage. Retrieved from https://www.bis.gov/
Deloitte. (2025, August 19). Procurement at the Tipping Point: Deloitte’s 2025 Chief Procurement Officer Survey Reveals the Pressure and Promise of Technology Disruption. Retrieved from https://www.deloitte.com/us/en/about/press-room/2025-chief-procurement-officer-survey.html
OECD. (2026). Responsible Business Conduct. Retrieved from https://www.oecd.org/en/topics/responsible-business-conduct.html
OFAC. (n.d.). Office of Foreign Assets Control. Retrieved from https://ofac.treasury.gov/
Reuters. (2024, December 23). Chinese workers found in “slavery-like conditions” at BYD construction site in Brazil. Retrieved from https://www.reuters.com/business/autos-transportation/workers-found-slavery-like-conditions-byd-construction-site-brazil-2024-12-23/
Reuters. (2025, August 7). Despite Western sanctions, Russian bomb factory bought Siemens tech via middleman. Retrieved from https://www.reuters.com/business/aerospace-defense/despite-western-sanctions-russian-bomb-factory-bought-siemens-tech-via-middleman-2025-08-07/
Reuters. (2026, March 20). How to manage risk in a global economy where trade is a weapon. Retrieved from https://www.reuters.com/sustainability/boards-policy-regulation/how-manage-risk-global-economy-where-trade-is-weapon--ecmii-2026-03-20/
Reuters. (2026, June 10). US business group says some critical minerals are “nearly unobtainable” from China. Retrieved from https://www.reuters.com/world/china/us-business-group-says-some-critical-minerals-are-nearly-unobtainable-china-2026-06-10/
Thank you for reading,
Pascal Hecker | Editor-In-Chief, CPO Path.