Who actually has to map their supply chain under Bill S-211?

It is never importers alone. The Act reaches any entity producing, selling, distributing, or importing goods over the set thresholds — retailers, distributors, manufacturers, resource companies, and government institutions all fall inside it, not just the importer on the customs form. And the reach goes further than the thresholds in practice: when a reporting customer maps its own chain past tier one, your company lands on that map too, along with your suppliers, whether or not you file your own report.

How far past tier one does the mapping actually have to go?

Far enough to reach where the risk actually lives. Forced and child labour risk does not sit in your direct suppliers; it sits upstream, in entities most companies have never listed. "Tier one and done" is not a mapping — it is the part of the chain that was easy to see.

When should mapping start if the report is due May 31?

Sixty to ninety days before the deadline, at minimum, for the outreach and evidence-gathering alone — and that assumes the map itself already exists. The report covers a full year of work; you cannot write a year in six weeks. The teams that hold up treat the reporting year as self-documenting, dating every supplier examination and remediation step as it happens rather than reconstructing it in spring.

What happens if the mapping is incomplete when the report is signed?

The signature is what carries the exposure, not the prose. A Bill S-211 violation can mean a fine of up to $250,000, and directors and officers are personally liable — individually, not just the corporation. An incomplete map does not make the report safer to sign; it makes the gap in it someone else’s question to ask, in public, after the fact.

Checklist · Compliance Foundations

Bill S-211 Supply-Chain Mapping Checklist (2026)

Q: Does a CTPAT, PIP, or AEO assessment count as my Bill S-211 mapping?

S-211 is Canadian statute and adopts no program by reference, so nothing counts automatically. But the evidence those assessments produce — the mapped chain, the examined suppliers, the dated trail — is the same evidence the S-211 report has to describe. Map and examine your chain once, to that standard, and it feeds every filing at once instead of getting rebuilt from scratch every spring.

By Mandy-Lynn Aitken, 30 years on both sides of the supply-chain auditPublished September 27, 2026

Print this. Work down it in order. Every item traces back to what Bill S-211 actually asks of your report — not what a consultant assumes it asks.

The market this reaches is never “importers” alone. Bill S-211 applies to any entity producing, selling, distributing, or importing goods over the thresholds: retailers, distributors, manufacturers, resource companies, and government institutions all sit inside it.

The report is one page. The mapping underneath it is the part nobody has the people for.

1. Map the structure

List your own business structure and every supply chain that feeds it — not the tidy tier-one list in your ERP, but the chain as it actually runs.
Name every upstream entity you can identify past tier one. Do not assume a tier-two or tier-three entity is “covered” because a tier-one supplier exists between you and it.
Flag every unmapped corner explicitly, rather than leaving it blank. An unmapped corner marked as a known gap is defensible. A blank section is not.
Have each supplier name their own sub-suppliers, carriers, and transit points — this discovery step routinely surfaces parties no one in the building knew existed.

2. Find where the risk hides

Weigh risk by region: forced and child labour risk concentrates unevenly, and the Act asks whether you looked honestly at where it actually lives, not where it is convenient to look.
Weigh risk by sector and by recruitment practice, not only by geography.
Treat a self-reported questionnaire as a starting point, not an examination. A questionnaire nobody verified is not evidence of due diligence — it is evidence someone asked a question once.
Look for coached or rehearsed answers. Standard checklist-style forms miss what forced-labour risk is actually made of: a live conversation that reads how a supplier answers, not only what they answer, surfaces the gap between the written procedure and the lived reality.

3. Gather what the report must evidence

The annual report covers four pillars — your structure, the risk you examined, the measures you put in force, and the training behind them. Each is a public claim, so each needs a record behind it:

A documented chain map, dated, with upstream entities named rather than assumed.
A risk assessment per part of the chain, with region and sector risk weighed and evidence behind each conclusion.
Due diligence measures in force — supplier requirements communicated and tracked, not just written into a policy nobody enforces.
Remediation steps for every gap found, documented with a named owner and a deadline.
Training records a reader can point to — not a slide deck someone remembers presenting.

The standard that separates a defensible report from a decorative one: could you draft this year's report from records, not recollection?

4. Confirm who signs, and when it is due

The report is due May 31 each year. The next annual filing lands May 31, 2027.
Begin evidence-gathering and supplier outreach 60–90 days before the deadline, so the proof exists before the report is drafted rather than scrambled for afterward.
The report is approved and signed by your governing body, and it is public — permanent, and searchable against your own prior filings.
Under the Act (ss. 19–20), a failure can carry a fine of up to $250,000, and a director or officer who directed or authorised it is personally a party to the offence — not only the corporation.
Brief every signatory on the actual evidence before they sign. No claim in the report should be one they could not personally defend if asked.

5. Use what you already have

Bill S-211 is its own filing — no CTPAT, PIP or AEO certificate substitutes for it. But the evidence a CTPAT, PIP, or AEO assessment produces — the mapped chain, the examined suppliers, the dated trail — is the same evidence the S-211 report has to describe. Run those programs and S-211 as one cohesive assessment and the mapping work feeds every filing at once. Run them as separate silos and you go back to the same suppliers, separately, for each one.

Guide

Download: this checklist, print-ready

The same checklist above, formatted to one printable page you can hand to whoever owns the mapping.

The report comes due every May 31 with your leadership's name on it

Run your 8 highest-risk suppliers through the full assessment, by request, no credit card, and see what Bill S-211 asks of you, carried for you.

Request a demo See the Bill S-211 program page

The programs this maps to: Bill S-211 · What must the report contain · CTPAT vs PIP vs AEO