Guide · Compliance Foundations

What Must a Bill S-211 Report Contain?

By Mandy-Lynn Aitken, 30 years on both sides of the supply-chain auditUpdated July 13, 2026

Short answer: your Bill S-211 annual report must cover the structure of your business and its supply chains, the forced and child labour risk you examined, the due diligence measures you put in force, and the training behind them. It is due May 31 each year, approved and signed by your governing body, and it is public.

That is the whole ask in two sentences, and it sounds manageable until you sit down to write one.

The report is one page. The proof is the year behind it.

This guide walks through what the report has to contain, when it is due, and what the signature at the bottom actually puts on the line: a fine of up to $250,000, with directors and officers personally liable.

What must a Bill S-211 report contain under section 11(3)?

Section 11(3) of the Fighting Against Forced and Child Labour in Supply Chains Act sets out the required contents of the annual report. In plain English, the report covers what you did this year: the structure, the risk, the measures, the training.

Each of those pillars is a claim you are making in public:

• The structure. Your business and its supply chains, described honestly. Not the tidy tier-one list in your ERP: the chain as it actually runs, including the upstream entities you have never listed.
• The risk. Where forced and child labour risk actually concentrates in your chain, weighed by region, by sector, by recruitment practice. The Act asks whether you looked, honestly, where the risk lives.
• The measures. Your policies, your supplier requirements, your remediation steps. The report describes your measures, and a reader is entitled to ask whether they exist anywhere but the report.
• The training. Records a reader can point to, not a slide deck someone remembers presenting.

Here is the standard that separates a defensible report from a decorative one: could you draft this year's report from records, not recollection? A report built from dated records, where every claim traces to evidence, survives a challenge. A report reconstructed each spring from memory and goodwill does not. The thresholds, definitions, and mandatory disclosures under the Act were clarified for 2026, so the report you filed last cycle is not automatically the template for the next one.

The gap between defensible and decorative is now measurable. The S-211 Report Card graded 92 real filed reports line by line against the Act, and the national median came out at 50.5 out of 100. Nearly half graded D or F.

When is the Bill S-211 report due?

The Bill S-211 annual report is due May 31 each year. The next annual filing lands May 31, 2027, and the year of evidence behind it is accumulating, or failing to accumulate, right now.

That timing is the trap built into the Act. May 31 feels far away in July, and then the spring arrives and someone is asked to reconstruct twelve months of supplier examinations, risk decisions, and training records in six weeks. The report covers a year. You cannot write a year in a month.

A practical rhythm that holds: begin your evidence and supplier outreach 60 to 90 days before the deadline, so the proof is in hand before the report is finalized rather than scrambled for afterward. Better still, treat the reporting year as self-documenting: every supplier examination dated when it happens, every remediation step logged with an owner, every training session recorded when it runs. When the filing comes due, the report is an act of assembly, not archaeology.

One more thing the calendar does quietly: it raises the bar every year. The first report was the easy one. Each year after it, the bar is your own previous filing. If year one said “we are building our mapping,” year two has to show the map. A regulator, a customer, or a journalist can lay your filings side by side, and the gap between what you promised and what you did is right there in your own words.

What is the $250,000 penalty, and who is personally liable?

A Bill S-211 violation can mean a fine of up to $250,000. Directors and officers are personally liable: this is not a line item the corporation absorbs, it is exposure with individual names on it.

That is why the signature matters more than the prose. The report is approved and signed by your governing body, and it is public. Permanent. So the real question underneath every section of the report is this one: would you sign your name, in public, to a claim about suppliers you have never actually examined?

Be clear about who the villain is here, because it is not the person holding the pen. Nobody signing these reports is careless. The mapping underneath the report is the part nobody has the people for. Forced labour risk does not live in your direct suppliers; it lives upstream, in entities two tiers down that no one in your building has ever listed, and the Act asks a leadership team with day jobs to vouch for all of it. The exposure is not a character flaw. It is a staffing reality.

But the liability does not care about staffing realities. One supplier nobody examined. One region everyone knows and no one mapped. One journalist, customer, or regulator who reads your public report and asks the question your records cannot answer. That is the distance between a signature that holds and a signature that costs up to $250,000.

The way out is not a perfect chain. No supply chain will ever be at 100%. But you will prove your due diligence at 100%, and that proof is precisely what the signature is supposed to stand on.

Who has to file a Bill S-211 report?

The Act sets entity thresholds that determine who must file, and those thresholds, definitions, and mandatory disclosures were clarified for 2026.

Two practical tests matter more than the statutory text for most readers of this page.

First: if your customers are asking you for your report, or asking you to feed theirs, the threshold debate is already academic for you. Reporting companies have to describe their chains, which means they have to examine the entities in them. That examination lands on your desk as questionnaires, attestation requests, and assessment invitations whether or not you file your own report.

Second: the mapping pulls in companies the thresholds never named. When a reporting customer maps its chain past tier one, your company lands on that map, along with your suppliers, and theirs. The Act's reach in practice is the reach of every chain that touches you. Plenty of companies below any threshold are living under Bill S-211 anyway, one customer request at a time.

If that is you, the work is the same either way: know your own chain, examine your own suppliers, and hold evidence you can hand over without a scramble. The companies that treat a customer's S-211 request as a fire drill do it again every spring. The ones that hold a living map answer in a day.

Does C-TPAT, PIP, or AEO work count toward Bill S-211?

Yes. Any of C-TPAT, PIP, or AEO satisfies Bill S-211 due diligence. If your chain is already assessed to those standards, the report stands on work you have already done.

This is the single biggest piece of leverage in the whole reporting cycle, and most teams do not use it. The trusted-trader programs and the forced-labour reporting regime are asking the same underlying question in different words: do you actually know, and can you actually prove, who is in your chain and how they operate? A supply chain examined to C-TPAT, PIP, or AEO standards has already produced the mapping, the supplier examinations, and the dated evidence trail the annual report needs to cite, line by line.

The reverse is also true, and it is the expensive version: teams that run S-211 as its own isolated project rebuild the map each spring, re-chase supplier attestations that other programs already collected, and re-answer what last year already answered. The Act comes due every year. Duplicated effort compounds every year too.

This is exactly the leverage XFACTOR VERIFIED builds on: one live, scenario-based assessment of each supplier, mapped to C-TPAT, Bill S-211, PIP, AEO, ESG, and the Nestlé food program at once. Your suppliers are actually examined, the gaps become findings with an owner, a deadline, and a signature on the fix, and the same dated evidence trail carries every program you hold. To be equally clear about what that is not: XFACTOR is not a certification body and does not file your report for you. It builds the mapping, the evidence, and the due diligence underneath your signature, so it holds.

How do you build a report that survives a challenge?

Start from the standard a challenger will apply: every claim traceable to evidence, every measure in force rather than on paper. Then work backwards through four disciplines.

Map past tier one. A documented chain map with the upstream entities named, not assumed, and the unmapped corners flagged as risk. The mapping is the foundation everything else stands on, because the risk that hurts you hides in sub-suppliers you never see. Have each supplier name their own sub-suppliers, carriers, and transit points: that discovery step routinely surfaces parties no one knew existed.

Examine, do not survey. A risk assessment per part of the chain, with region and sector risk weighed and evidence behind each conclusion. A questionnaire nobody verified is not an examination. Standard self-reported forms miss the thing forced-labour risk is made of: coercion is coached, and rehearsed answers pass checklists. A live assessment that reads how a supplier answers, not just what they answer, surfaces the gap between the written procedure and the lived reality.

Fix what you find, on the record. Due diligence measures in force, supplier requirements communicated and tracked, remediation steps documented with named owners and deadlines. A gap you found and fixed, with a signature on the fix, is evidence of diligence. A gap you found and filed away is evidence for the other side.

Brief the people who sign. Governance sign-off with full visibility, the signatories briefed on the evidence, and no claim in the report they could not personally defend. Your people are the asset here, not the liability: a leadership team that has actually seen the evidence signs with confidence instead of hope.

Do those four things across the year and the May 31 filing becomes what it was always supposed to be: a summary of work that exists.

The programs this maps to: Bill S-211 · C-TPAT