CSDDD Explained: Scope, Deadlines and Duties After the Omnibus

The Corporate Sustainability Due Diligence Directive (CSDDD), Directive (EU) 2024/1760, obliges very large companies to identify, prevent and remedy human rights and environmental harm in their own operations, their subsidiaries and their chain of activities. Directive (EU) 2026/470, in force since 18 March 2026, rewrote central parts of it: the scope, the timeline, the penalties and the way due diligence is carried out.

Many summaries still describe the 2024 version with staggered thresholds from 1,000 employees, mandatory climate transition plans and fines of 5 percent of turnover. None of that is current law. This guide describes the rules as they stand.

Who is in scope

The CSDDD applies to a small group of very large companies. Both criteria must be met.

For groups, the ultimate parent company can fulfil the obligations for its subsidiaries. Companies below the thresholds have no direct duties, but they feel the directive through their customers. More on that below.

Timeline: 2028 and 2029 are the dates that count

The phased start that used to begin in 2027 is gone. There is one application date for everyone in scope.

What due diligence requires

The core process follows the OECD Due Diligence Guidance for Responsible Business Conduct and has 6 elements:

1. Integrate due diligence into policies and risk management systems.
2. Identify and assess actual and potential adverse impacts.
3. Prevent, mitigate, end and minimise those impacts.
4. Set up a notification mechanism and a complaints procedure.
5. Monitor the effectiveness of the measures.
6. Communicate publicly about due diligence.

Risk-based scoping instead of mapping everything

Companies start with a scoping exercise based on reasonably available information. It identifies the general areas where adverse impacts are most likely and most severe. An in-depth assessment is only required in those areas. This replaces the idea that every tier of every supply chain must be mapped to the same depth.

Limits on information requests

Information may be requested from business partners only where it is necessary. For partners with fewer than 5,000 employees the bar is higher: a request is allowed only if the information cannot reasonably be obtained by other means. This sits alongside the EU value chain cap in sustainability reporting, which limits what large customers may demand from smaller suppliers for their reports.

Monitoring every 5 years

Companies assess the adequacy and effectiveness of their measures at least every 5 years, and earlier when a significant change occurs or there are reasonable grounds to believe new risks have arisen. The 2024 text required an annual assessment.

Stakeholder engagement and business relationships

Engagement focuses on workers, trade unions, workers' representatives and the people and communities directly affected. It is required when impacts are assessed, when action plans are drawn up and when remediation is designed. Ending a business relationship remains a last resort.

Penalties and civil liability

National supervisory authorities enforce the rules. Fines are set by the member states, and the directive caps the maximum at 3 percent of net worldwide turnover. The 2024 text had demanded a maximum of at least 5 percent.

The harmonised EU civil liability regime in Article 29 was removed. Whether a company is liable for damage caused by a breach is now a question of national law. Where liability exists, injured parties keep the right to full compensation, without overcompensation. For companies with operations in several member states this means that liability exposure depends on where a claim is brought.

What changed compared with the 2024 text

What suppliers below the threshold should expect

Around the companies in scope sit many suppliers that are not. If you are one of them, 3 things follow. Your large customers will ask fewer blanket questions and more targeted ones, tied to risk areas they have identified. Contract clauses on human rights and environmental standards stay, because they are the customer's main preventive tool. And a customer who finds a problem at your site is expected to work on a fix with you before walking away.

My view: the practical answer for a supplier is not a CSDDD project. It is a small, consistent data set that answers the recurring questions once, covering energy, emissions, workforce, health and safety and a code of conduct. The voluntary SME standard is built for that purpose, and I describe how to use it in VSME reporting for SMEs. For the operational side of supplier work, see supply chain compliance in 7 steps.

CSDDD and the German Supply Chain Act (LkSG)

Germany's Lieferkettensorgfaltspflichtengesetz has applied since 2023 and covers companies with at least 1,000 employees in Germany. It is enforced by BAFA and stays in force until the CSDDD is transposed. The German government has announced that the transposition act will replace it.

Companies between 1,000 and 5,000 employees in Germany are covered by the LkSG today and will be outside the CSDDD. How the German legislator handles this group in the transposition act is the open question to watch.

How to prepare

1. Check scope at group level against both criteria, including non-EU entities with EU turnover.
2. Run the scoping exercise now. It needs no legal deadline and shows where the in-depth work will be.
3. Build on what exists. LkSG risk analyses, complaints channels and supplier codes carry over.
4. Review questionnaires. Blanket requests to small partners will be hard to justify.
5. Connect the work with other regimes that touch the same suppliers, such as the EU Deforestation Regulation.
6. Follow the Commission guidelines due by 26 July 2027 and the national transposition.

The legal text of the original directive is available on EUR-Lex.

FAQ