Home › Blog › Supply chains

How to Write a Supplier Code of Conduct: The 10 Sections, and How to Make It Stick

A supplier code of conduct sets out the minimum standards you expect from the businesses you buy from: how they treat workers, how they handle bribes and fraud, what they do to the environment and how they look after data. For a UK business it does real legal work. It is one of the procedures a court looks at under the Bribery Act 2010 and the failure to prevent fraud offence, and it is the first thing most readers check in a Modern Slavery Act statement. This page gives a ten-section structure you can adapt, the wording choices that matter, and the steps that turn a published document into something suppliers actually follow.

Why a supplier code matters in UK law

No UK statute says "you must have a supplier code of conduct". Three laws make one close to essential for any business of size:

• Bribery Act 2010, section 7. A commercial organisation is guilty if a person associated with it, which can include a supplier or agent acting on its behalf, pays a bribe to win or keep business for it. The only defence is having adequate procedures to prevent bribery, and due diligence and communication with business partners are two of the six principles in the Ministry of Justice guidance. Our Bribery Act compliance page covers the defence in full.
• Failure to prevent fraud. In force since 1 September 2025 under the Economic Crime and Corporate Transparency Act 2023, it applies to large organisations meeting two of three tests: more than 250 employees, more than £36 million turnover, more than £18 million in total assets. It is built on the same model, with a reasonable procedures defence. See failure to prevent fraud.
• Modern Slavery Act 2015, section 54. Organisations with £36 million or more in turnover must publish an annual slavery and human trafficking statement. A supplier code is the standard evidence of the "policies" part of that statement; our guide on how to write a modern slavery statement explains how to report on it.

Customers ask for one too. Public sector buyers, large retailers and B Corp assessments all expect to see written supplier standards, so a small business with no legal duty often writes one to win contracts.

The ten sections

1. Scope and who it applies to

Say which suppliers are covered (usually all of them, with the depth of checks scaled to risk), whether it applies to their own suppliers, and that it sits alongside, not instead of, the law and your contract terms. State that where local law and the code differ, the higher standard applies.

2. Legal compliance

A short clause requiring suppliers to comply with all applicable laws, including competition, sanctions and export control, tax and employment law. Keep it brief; the value of the code is in the sections that go further than the law.

3. Labour and human rights

The longest section for most businesses. Rather than inventing your own wording, base it on a recognised standard. The ETI Base Code, built on International Labour Organization conventions, has nine clauses that many UK retailers already use:

1. Employment is freely chosen
2. Freedom of association and the right to collective bargaining are respected
3. Working conditions are safe and hygienic
4. Child labour shall not be used
5. Living wages are paid
6. Working hours are not excessive
7. No discrimination is practised
8. Regular employment is provided
9. No harsh or inhumane treatment is allowed

Two points worth spelling out explicitly, because they are the most common forced labour indicators: workers must not pay recruitment fees, and employers must not hold their passports or identity documents.

4. Health and safety

Require a safe workplace, risk assessment, training, protective equipment at no cost to workers, fire safety and, where relevant, safe accommodation. For suppliers that work on your own sites, link to your site rules.

5. Bribery, fraud and conflicts of interest

Prohibit bribes, facilitation payments and kickbacks in any form; set a limit on gifts and hospitality to your staff, matching your own gifts and hospitality policy; require suppliers to declare any conflict of interest, such as a family link to someone in your buying team; and prohibit fraud, false invoicing and misrepresentation.

6. Environment

Ask for compliance with environmental permits, responsible handling of waste and hazardous substances and, for larger suppliers, reporting of energy use and emissions. If you have a net zero target, this is where Scope 3 data requests belong. Avoid asking for claims you cannot check; unsupported green claims in your own marketing are now a regulatory risk, as explained in greenwashing rules in the UK.

7. Data and confidentiality

Require suppliers handling personal data to comply with UK GDPR, keep your information confidential, report security incidents promptly and follow your security requirements. Suppliers processing personal data on your behalf also need a written processing agreement under Article 28 UK GDPR; the code should point to it, not replace it.

8. Subcontracting and sub-tier suppliers

Most serious labour abuses happen below the first tier. Require suppliers to tell you before subcontracting work, to pass the code's standards down their own supply chain and to disclose production sites on request.

9. Monitoring and audit rights

State that you may ask for self-assessment questionnaires, documents and audits, announced or unannounced, including worker interviews held in private. Say who pays for a follow-up audit when the first one finds problems.

10. Raising concerns and remedies

Give suppliers and their workers a way to report breaches confidentially, including anonymously, without retaliation. Then say what happens when a breach is found: a corrective action plan with deadlines first, and termination only for a refusal to fix serious breaches. Cutting a supplier off straight away can leave workers worse off, so most codes put remediation first.

Making it contractual

A code published on your website but missing from your contracts is mostly a communications document. To give it force:

• reference the code in your standard terms and in every new supplier contract, with a clause that a material breach is a breach of contract
• include audit rights and an obligation to remedy within a set period
• ask suppliers to sign an acknowledgement at onboarding and again when the code changes
• apply it through your purchasing practices; impossible lead times or price cuts can push suppliers into the excessive hours and unpaid overtime the code prohibits

Rolling it out

1. Map and rank your suppliers. Sort by spend and by risk: sector, country, use of agency labour, and whether they act for you with officials.
2. Draft and consult. Run the draft past procurement, legal and two or three key suppliers. Plain English matters; translate it for suppliers whose staff do not read English.
3. Get board approval. Top-level commitment is one of the six principles under both the bribery and fraud guidance, and a board minute is useful evidence.
4. Train buyers. The people negotiating with suppliers need to know what the code says and what to do if they spot a problem.
5. Check proportionately. Questionnaires for low-risk suppliers, documents and site visits for high-risk ones.
6. Review yearly. Record what you found and fixed; that record is what your modern slavery statement and any court will look for.

A supplier code is the outward-facing half of your ethics framework. Your own staff follow your internal code, covered in how to write a code of conduct, and the two should use the same standards so a supplier is never held to a rule your own team ignores. For more on responsible business, see the e-Business Ethics homepage.