A large customer sends you a new supplier code of conduct and a questionnaire on human rights and environmental risks in your supply chain. Your company is far below the size of firms that EU due diligence law covers directly. But your customer is covered, and it passes the duty down its chain.
- CSDDD: the EU directive on corporate sustainability due diligence for human rights and the environment, Directive (EU) 2024/1760.
- Who it covers after the Omnibus: EU companies with over 5,000 staff and €1.5 billion turnover, and non-EU firms with that turnover in the EU.
- When: member states must transpose it by 26 July 2028, and companies apply it from 26 July 2029.
- Smaller companies: not covered directly, but their large customers will ask them for data and contract terms.
What is the CSDDD?
The Corporate Sustainability Due Diligence Directive (CSDDD) introduces a duty of due diligence for certain groups of companies. Its aim is to prevent and address the harm that business does to human rights and the environment. It applies to activities in the EU and beyond its borders.
The EU adopted the directive in 2024 as Directive (EU) 2024/1760. In 2026, the Omnibus I package, Directive (EU) 2026/470, narrowed its scope and moved its dates. It came into force on 18 March 2026.
What does the directive change?
The directive brings these main changes:
- a duty of due diligence on human rights and the environment for certain companies;
- more accountability of companies for the harm their business causes;
- better access to remedies for people affected by that harm;
- due diligence that covers the company's own operations, its subsidiaries and its chain of activities;
- rules on liability for breaches of the due diligence duty, set out in national law.
Who does the directive cover?
The directive covers companies from the EU and from outside the EU that reach a set turnover in the EU. This puts all companies on the EU market on equal terms and stops firms from avoiding the rules by moving production abroad.
After the Omnibus I package, the directive covers:
- EU companies with more than 5,000 employees and more than €1.5 billion in net worldwide turnover;
- EU parent companies of groups that reach these thresholds together;
- non-EU companies with more than €1.5 billion in net turnover in the EU, and the parent companies of such groups.
Special rules also apply to franchise and licensing groups. The Commission must review the thresholds by 26 July 2031.
Small and medium-sized companies are not covered directly. But the directive will still affect them, because large customers must check their supply chains.
When will the rules apply?
The Omnibus I package moved the dates:
- 26 July 2028: the deadline for member states to transpose the directive into national law;
- 26 July 2029: companies in scope must apply it.
Until national laws exist, the level of penalties, the supervisory authorities and the conditions of civil liability remain open in each country.
What duties will companies have?
Companies in scope must:
- build due diligence into their policies and risk management;
- identify and prioritise actual and potential adverse impacts;
- prevent potential adverse impacts and reduce those they cannot prevent;
- bring actual adverse impacts to an end;
- set up a complaints procedure for people with justified concerns about harm to human rights or the environment;
- monitor how well their due diligence works and report on it.
The original directive also required companies to adopt a climate transition plan. The Omnibus I package removed this duty. Large companies may still have to report a transition plan under the CSRD and ESRS E1.
How do you identify and assess impacts?
To find where harm is most likely, companies should map their own operations and those of their subsidiaries. Where relevant, they also map their business partners in the chain of activities. Then they assess the areas with the highest risk in depth.
How do you respond to impacts?
The directive sets out a sequence of responses:
- Prevent potential impacts. Take suitable measures. Where prevention is not possible, reduce the harm that you identified or should have identified.
- Take suitable measures. Without undue delay, prepare and carry out a prevention action plan. Get contract assurances from business partners that they will follow your code of conduct and the action plan, with ways to check this. Make the necessary investments and changes.
- Use measures of last resort. Do not start new relationships, or extend existing ones, with partners where the harm arose. If the harm is severe, consider a stronger action plan with a temporary suspension of the relationship, or even its end.
- Bring actual impacts to an end. Take suitable measures to stop the harm that you identified or should have identified.
What does the CSDDD mean for suppliers?
Most companies will meet the CSDDD not as a law, but as a customer request. Large buyers will add due diligence clauses to contracts, send questionnaires and ask for evidence. This includes data on emissions, energy and materials, and policies on human rights.
Suppliers that already have a corporate carbon footprint and clear environmental data answer such requests faster and keep their place in the supply chain.