The Corporate Sustainability Due Diligence Directive (CSDDD) requires large EU and non-EU companies to identify, prevent, and address environmental and human rights harms across their value chains. Adopted in June 2024 and significantly amended by the Omnibus I Directive, in force since March 2026, the CSDDD creates binding due diligence obligations that go beyond reporting into action.
This guide covers CSDDD requirements after the latest threshold changes: who must comply, the six-step due diligence process, supply chain obligations, how the directive compares to the EUDR and CSRD, and practical steps for building an environmental due diligence program.
Last updated: September 26, 2026
What Is the CSDDD?
The CSDDD (also written as CS3D) is an EU directive that obligates companies to conduct human rights and environmental due diligence across their operations and supply chains. Unlike the CSRD, which requires companies to report on sustainability, the CSDDD requires companies to act by identifying and mitigating adverse impacts.
The directive aligns with the OECD Guidelines for Multinational Enterprises and follows a six-step due diligence framework. It was proposed by the European Commission in February 2022, adopted as Directive (EU) 2024/1760 in June 2024, and substantially amended by the Omnibus I Directive (EU) 2026/470 in February 2026. The Omnibus narrowed the scope, deleted the climate transition plan requirement, and removed the EU-wide civil liability rule, so liability now runs through national law with a right to full compensation.
CSDDD Status in 2026
As of September 2026, the CSDDD is in force but applies to no company yet. The original directive has been in force since July 25, 2024, and the Omnibus I amendments (Directive (EU) 2026/470) since March 18, 2026. Here is where the directive stands after Omnibus I:
- Scope: EU companies with more than 5,000 employees on average and more than EUR 1.5 billion in net worldwide turnover, and non-EU companies with more than EUR 1.5 billion of net turnover in the EU. The directive does not state how many companies this covers.
- Transposition: Member States must adopt national laws by July 26, 2028.
- Application: one date, July 26, 2029, for all in-scope companies. The first annual statements cover financial years starting on or after January 1, 2030.
- Guidelines: the Commission must adopt general due diligence guidelines by July 26, 2027. It consulted the public from June 12 to August 14, 2026 and plans to adopt them in early 2027.
- Deleted: the climate transition plan duty and the EU-wide civil liability rule.
Companies that expect to be in scope can use the transposition window to start supply chain mapping and risk scoping before national laws take effect.
Who Must Comply with the CSDDD?
The Omnibus I Directive raised the CSDDD thresholds substantially. The original directive phased in from 2027 for the largest companies and would have reached companies with more than 1,000 employees and EUR 450 million in turnover by 2029. Omnibus I replaced that with a single, higher bar and one application date. A company is in scope once it meets the thresholds in two consecutive financial years.
| Company Type | Employee Threshold | Turnover Threshold | Compliance Date |
|---|---|---|---|
| EU companies | More than 5,000 (average) | More than EUR 1.5 billion worldwide net turnover (company, or group on a consolidated basis) | July 26, 2029 |
| Non-EU companies | No employee threshold | More than EUR 1.5 billion of net turnover generated in the EU | July 26, 2029 |
| Franchise/licensing (EU or non-EU) | No employee threshold | More than EUR 75 million of EU royalties AND more than EUR 275 million of net turnover (worldwide for EU companies, in the EU for non-EU companies) | July 26, 2029 |
| Parent companies | A holding-company ultimate parent may be exempted if an EU subsidiary is designated to carry out the obligations | ||
Companies below these thresholds are not directly in scope. Smaller suppliers can still receive information requests from in-scope customers. The Omnibus limits those requests: a company may ask business partners with fewer than 5,000 employees for information only when it cannot reasonably be obtained another way.
CSDDD Timeline: From Proposal to Omnibus
The CSDDD’s dates have moved twice since adoption. The Stop-the-Clock Directive (EU) 2025/794 delayed transposition by one year and moved the first phase to July 2028. The Omnibus I Directive then replaced the phases with a single compliance date.
| Milestone | Original (2024) | After Stop-the-Clock (2025) | After Omnibus I (2026) |
|---|---|---|---|
| General guidelines | January 26, 2027 | January 26, 2027 | July 26, 2027 |
| Member State transposition | July 26, 2026 | July 26, 2027 | July 26, 2028 |
| Phase 1 (more than 5,000 employees / EUR 1.5B) | July 26, 2027 | July 26, 2028 | July 26, 2029 (single date, all in-scope companies) |
| Phase 2 (more than 3,000 employees / EUR 900M) | July 26, 2028 | July 26, 2028 | Deleted |
| Phase 3 (more than 1,000 employees / EUR 450M) | July 26, 2029 | July 26, 2029 | Deleted |
The Omnibus eliminated the lower thresholds entirely. Companies with 1,000-4,999 employees or under EUR 1.5 billion turnover are no longer in scope at any phase. The Commission must report by July 26, 2031 on whether companies with more than 1,000 employees and EUR 450 million in turnover should be brought back into scope.
What Does the CSDDD Require?
The Six-Step Due Diligence Process
The core CSDDD requirements center on the OECD’s six-step due diligence framework. Companies must apply these steps across their own operations, their subsidiaries, and the business partners in their “chain of activities,” starting with the areas where harm is most likely and most severe.
| Step | Requirement | Practical Example |
|---|---|---|
| 1. Policy integration | Embed due diligence into company policies and management systems | Board-approved environmental due diligence policy with clear accountability |
| 2. Identify & assess impacts | Map operations and supply chain to find actual or potential adverse environmental and human rights impacts | Geocode supplier locations, run land cover analysis, screen for climate hazards at each site |
| 3. Prevent & mitigate | Take appropriate measures to prevent potential impacts and mitigate actual ones | Require contractual assurances from high-risk suppliers; provide capacity-building support to SMEs |
| 4. Monitor effectiveness | Track whether due diligence measures are working | Reassess supplier sites at regular intervals (at least every 5 years, and without undue delay after a significant change) |
| 5. Communicate | Report publicly on due diligence activities and findings | Publish an annual due diligence statement, first for financial years starting January 1, 2030 (companies that report under the CSRD are exempt) |
| 6. Remediate | Provide or cooperate in remediation when adverse impacts occur | Establish grievance mechanisms; engage with affected communities; fund remediation where harm is confirmed |
Environmental Scope
The CSDDD covers a broad range of environmental harms listed in the Annex to Directive 2024/1760. These include harmful soil changes, water and air pollution, harmful emissions, excessive water consumption, land degradation, deforestation that impairs food production, denial of access to safe drinking water, and damage to ecosystem services.
The directive adopts a “One Health” approach, recognizing that environmental degradation can cause adverse human health effects. Due diligence must account for this link between ecosystem damage and public health outcomes.
The directive says due diligence should also contribute to preserving and restoring biodiversity and improving the state of air, water, and soil at sites where companies operate or source. This scope goes beyond deforestation. While the EUDR focuses exclusively on deforestation-free supply chains for seven specific commodity groups, the CSDDD covers all forms of environmental harm: pollution, excessive water consumption, land degradation, emissions, and damage to ecosystem services.
After the Omnibus, companies first run a scoping exercise, based only on reasonably available information, to find the general areas where adverse impacts are most likely and most severe. They then carry out an in-depth assessment in those areas. The directive does not require them to identify every individual impact.
In practice, meeting the identification and assessment requirement (Step 2) means companies need geolocation data for their supplier sites, environmental baselines showing land cover composition, and hazard screening for physical climate risks like flooding, wildfire, or deforestation due diligence verification.
Supply Chain Coverage
The CSDDD defines a “chain of activities” covering upstream partners (extraction, sourcing, manufacturing, transport, storage, supply) and downstream partners (distribution, transport, storage) under certain conditions. After the Omnibus I amendments, the scoping exercise covers business partners at every tier, and the in-depth assessment targets the areas where harm is most likely and most severe. For how this works with suppliers, see the supply chain due diligence section below.
Free Nature Risk Report
Screen your supplier locations for nature and deforestation risk
Free land-cover change, deforestation exposure, and protected-area proximity for any site. No call required.
What Changed Under the Omnibus?
The Omnibus I Directive (EU) 2026/470, published on February 26, 2026 and in force since March 18, 2026, narrowed the CSDDD’s scope and several of its core duties.
| Provision | Original CSDDD (2024) | After Omnibus I (2026) |
|---|---|---|
| Scope | Phased: 1,000+ employees / EUR 450M+ (final phase) | Single threshold: 5,000+ employees / EUR 1.5B+ |
| Climate transition plans | Companies must adopt and implement Paris-aligned plans | Deleted entirely |
| Civil liability | Harmonized EU-wide regime; NGOs and unions could bring representative actions | EU-wide liability rule deleted; national law applies, with a right to full compensation |
| Penalties | Maximum fine of at least 5% of net worldwide turnover | Maximum fine capped at 3% of net worldwide turnover; Commission to issue penalty guidance |
| Monitoring frequency | At least every 12 months | At least every 5 years, and after significant changes |
| Stakeholder engagement | Broad stakeholder definition; engagement throughout due diligence | Workers, their representatives, and directly affected individuals and communities, at set stages |
| Supply chain depth | Mapping of own operations and business partners, then in-depth assessment of the riskiest areas | Scoping exercise on reasonably available information, then in-depth assessment of the riskiest areas; direct partners first only where risks are equal |
| Member State flexibility | Full harmonisation for a few provisions; stricter rules allowed elsewhere | Full harmonisation extended to the core due diligence steps; stricter rules still allowed on other provisions |
| Last resort | Suspend, and terminate where the impact is severe | Stop new business and suspend; duty to terminate removed |
The deletion of climate transition plans is the most significant change. Under the original directive, every in-scope company had to adopt and put into effect a transition plan aimed at limiting warming to 1.5C, including, where appropriate, Scope 1, 2 and 3 reduction targets. That obligation no longer exists under the CSDDD. Companies subject to the CSRD must still disclose a transition plan under ESRS E1 if they have one, or say whether and when they will adopt one.
Supply Chain Due Diligence Under the CSDDD
The CSDDD’s supply chain obligations are where most compliance effort will concentrate. Unlike reporting frameworks that ask companies to disclose risks, the CSDDD requires companies to take concrete steps with their business partners. Here is what that looks like in practice after the Omnibus I amendments.
Contractual Assurances and Suspension as a Last Resort
Where relevant, in-scope companies seek contractual assurances from direct business partners that they will follow the company’s code of conduct and, where needed, a prevention action plan. Verification measures must back these assurances up, such as site audits, satellite-based monitoring, third-party assessments, or industry schemes.
Those assurances can extend down the chain: the partner is asked to seek matching assurances from its own partners. In practice, this creates a chain of documented commitments flowing from the in-scope company down through the supply chain.
When a business partner is linked to an adverse impact, the company first works to prevent, mitigate, or end it, for example through an action plan with the partner. As a last resort, and until the impact is addressed, the company must stop entering new or extending existing relationships with that partner, suspend the relationship where the governing law allows, and adopt an enhanced action plan. The Omnibus removed the duty to terminate. A company may decide not to suspend if suspension would cause more severe harm, and must be able to explain that decision to the supervisor.
Scoping Business Partners at Every Tier
Under the Omnibus I amendments, companies do not need to assess every supplier in their extended value chain. For how physical climate risk specifically is identified and disclosed across that chain under ESRS E1, see physical climate risk in the value chain. Companies start with a scoping exercise, based only on reasonably available information, that covers their own operations, their subsidiaries and their business partners at every tier. They then assess in depth the areas where adverse impacts are most likely and most severe. Where risks are equally likely or severe in several areas, they may assess the areas involving direct business partners first.
The scoping exercise generally does not involve asking business partners for information. In the in-depth assessment, a company asks partners for information only where it is necessary, and asks partners with fewer than 5,000 employees only when the information cannot reasonably be obtained another way. Independent reports, digital tools, and industry or multi-stakeholder initiatives all count as sources.
SME Proportionality
The CSDDD does not expect large companies to simply impose compliance costs on their smaller suppliers. Information requests to smaller partners are limited, as described above, and any request must be targeted and proportionate.
Where relevant, in-scope companies must provide targeted and proportionate support to SME business partners, such as training, capacity building, upgraded management systems, or financial support where compliance would put the SME at risk.
The German Supply Chain Act (LkSG)
Germany’s Lieferkettensorgfaltspflichtengesetz (LkSG) has been in force since January 2023, and since January 2024 it covers companies with 1,000 or more employees in Germany. It is enforced by the German Federal Office for Economic Affairs and Export Control (BAFA).
Companies already complying with LkSG have a significant head start on CSDDD compliance. The core due diligence steps, risk analysis methodology, and documentation requirements overlap substantially. However, the two laws differ in scope: LkSG applies to companies with 1,000+ employees in Germany, while the CSDDD applies only to companies with 5,000+ employees and EUR 1.5 billion+ turnover across all EU Member States. Germany must transpose the CSDDD by July 26, 2028.
Supply Chain Due Diligence Checklist
This checklist covers the specific actions companies must take regarding their supply chain partners under the CSDDD:
- Map your own sites and business partners by geographic location, starting with the regions and sectors where adverse impacts are most likely and most severe
- Assess general areas of environmental risk by region and sector, focusing on locations with known deforestation, pollution, water stress, or climate hazard exposure
- Where relevant, seek contractual assurances from direct partners covering environmental and human rights impacts, including matching assurances from their own suppliers
- Establish verification measures including site audits, satellite-based land cover monitoring, third-party sustainability assessments, or recognized certification schemes
- Set up a grievance mechanism accessible to affected stakeholders, workers, and communities in your supply chain
- Monitor and reassess at least every five years, or sooner when significant changes occur, new information emerges, or previous measures prove inadequate
- Document your scoping exercise and in-depth assessments, including sources used and any complaints, reports, or incidents that point to new risks
- Provide targeted and proportionate support to SME suppliers through training, capacity building, or financial assistance
CSDDD vs EUDR: Key Differences
The CSDDD is triggered by company size and covers human rights and a broad range of environmental harms. The EU Deforestation Regulation (EUDR) is triggered by placing seven commodity groups on the EU market, whatever the company’s size. A small coffee importer can face the EUDR without meeting CSDDD thresholds. Where a CSDDD provision conflicts with a more specific EU law pursuing the same objectives, the other law prevails to the extent of the conflict. See our CSDDD vs EUDR comparison for the full side-by-side breakdown.
CSDDD vs CSRD: Reporting vs Action
The CSRD sets what companies must report on sustainability. The CSDDD sets what they must do about adverse impacts in their operations and chain of activities. The CSRD applies to EU companies with more than EUR 450 million in net turnover and more than 1,000 employees, a lower bar than the CSDDD. A company with 2,000 employees and EUR 600 million in turnover reports under the CSRD but falls outside the CSDDD. Companies that report under the CSRD do not publish a separate CSDDD annual statement. See our CSRD vs CSDDD comparison for scope, timelines, and Omnibus changes side by side.
Sample Climate Risk Assessment
See a full climate risk assessment, end to end
We’ll email you a complete worked example for a manufacturing site: 12 hazards, multiple scenarios, and value-at-risk out to 2050. It shows what a full climate risk assessment output looks like.
How to Prepare for CSDDD Compliance
Understanding CSDDD requirements is one step; acting on them is another. Companies that meet the scope thresholds have until July 2029 to comply. But supply chain mapping and environmental baseline work cannot happen overnight. Starting early creates audit-ready evidence and avoids last-minute scrambles when supervisory authorities begin enforcement.
Step 1: Scope assessment. Check whether your company, or the group it heads, exceeds 5,000 employees and EUR 1.5 billion in net worldwide turnover in two consecutive financial years. Check whether the holding-company exemption applies.
Step 2: Supply chain mapping. Geocode your own sites and business partner locations. Convert supplier addresses into geographic coordinates to understand where your supply chain physically operates and which regions carry elevated environmental risk.
Step 3: Environmental baseline. Run satellite-based land cover analysis at high-risk supplier sites to establish a quantitative environmental baseline. Land cover composition data shows tree cover, cropland, built-up areas, and water bodies at each location, providing measurable evidence of environmental conditions.
Step 4: Risk screening. Screen every supplier location for physical climate risk. Flood exposure, wildfire probability, drought risk, and other hazards vary dramatically by geography. Risk screening identifies which sites face the most severe environmental threats.
Step 5: Documentation. Compile audit-ready evidence of your due diligence process. Supervisory authorities will assess whether companies took “appropriate measures,” which requires demonstrating a systematic, documented approach rather than ad hoc responses.
Continuuiti automates the data-intensive steps: batch-geocode supplier addresses, run satellite-based land cover analysis to establish environmental baselines, and screen every site for 12 physical climate hazards. This gives due diligence teams quantitative evidence of environmental conditions at supplier sites, covering the identification and assessment phases of the OECD six-step process. CSDDD’s full scope extends to pollution, human rights, and contractual assurance, which require different tools.
CSDDD Penalties and Enforcement
Member States must designate supervisory authorities to enforce the CSDDD. These authorities can investigate companies, impose corrective measures, and issue financial penalties.
The Omnibus I Directive capped penalties at 3% of worldwide net turnover. For groups, the cap is based on the ultimate parent’s consolidated turnover. Penalties apply regardless of whether actual damage occurred. A company that fails to conduct due diligence faces sanctions even if no adverse environmental or human rights impact materializes.
The EU-wide civil liability regime was deleted by the Omnibus. Individuals or communities harmed by a company’s failure to conduct due diligence may still seek damages, but under national law rather than a harmonized EU framework. Where a company is held liable under national law, Member States must ensure victims receive full compensation. This means liability exposure varies by Member State.
The European Commission, working with Member States, will issue guidance to help supervisory authorities set penalty levels. The directive sets no deadline for it.
Frequently Asked Questions
What is the current status of the CSDDD?
As of September 2026, the CSDDD is in force but applies to no company yet. The Omnibus I amendments entered into force on March 18, 2026. Member States must transpose the directive by July 26, 2028, and all in-scope companies must comply from July 26, 2029.
Is the CSDDD mandatory?
Yes, for companies meeting the scope thresholds: EU companies with more than 5,000 employees on average and more than EUR 1.5 billion in net worldwide turnover, and non-EU companies with more than EUR 1.5 billion of net turnover in the EU in the financial year before the last one. Compliance is required from July 26, 2029. Smaller companies can still receive information requests as business partners.
What is the difference between the CSDDD and CSRD?
The CSDDD requires companies to conduct due diligence by identifying, preventing, and remediating adverse impacts. The CSRD requires companies to report on sustainability through ESRS disclosures. One demands action, the other demands transparency. Companies subject to both must do due diligence and report on it.
Who does the CSDDD apply to?
After the Omnibus I amendments: EU companies, or groups on a consolidated basis, with more than 5,000 employees and more than EUR 1.5 billion in net worldwide turnover. Non-EU companies with more than EUR 1.5 billion in EU turnover. Franchisors and licensors with more than EUR 75 million in EU royalties and more than EUR 275 million in net turnover.
What are the penalties for CSDDD non-compliance?
Financial penalties are capped at 3% of worldwide net turnover. Penalties apply even without actual damage. Civil liability runs through each Member State’s national law, which must give victims a right to full compensation.
Has the CSDDD been delayed?
Yes, twice. The Stop-the-Clock Directive (April 2025) moved the first application date from July 2027 to July 2028, and Omnibus I set a single date of July 26, 2029 for all in-scope companies. The lower thresholds (more than 3,000 employees and EUR 900 million, and more than 1,000 employees and EUR 450 million) were deleted.
How does the CSDDD differ from the EUDR?
The CSDDD is company-size triggered (5,000+ employees, EUR 1.5 billion+ turnover) with broad environmental scope and engagement-first enforcement. The EUDR is product-triggered (7 commodities) with a deforestation-only focus and market ban enforcement. Where a CSDDD provision conflicts with a more specific EU law with the same objectives, the other law prevails to the extent of the conflict.
What are the main requirements of the CSDDD?
The CSDDD requires in-scope companies to follow a six-step due diligence process aligned with OECD guidelines: integrate policies, identify and assess impacts, prevent and mitigate harms, monitor effectiveness at least every five years, communicate findings publicly, and provide remediation. Where relevant, companies also seek contractual assurances from direct business partners, and they must run a complaints procedure.
What is supply chain due diligence under the CSDDD?
Supply chain due diligence under the CSDDD means identifying, preventing, and mitigating environmental and human rights risks across a company’s chain of activities. Companies run a scoping exercise across their own operations, subsidiaries, and business partners at every tier, then assess in depth the areas where harm is most likely and most severe. Suspension is the last resort, and the Omnibus removed the duty to terminate.
Is the CSDDD the same as the German Supply Chain Act (LkSG)?
No. The LkSG is a German national law in force since January 2023, and since January 2024 it covers companies with 1,000 or more employees in Germany. The CSDDD is an EU-wide directive for companies with more than 5,000 employees and EUR 1.5 billion in turnover. The two share similar due diligence steps but differ in scope and enforcement. Germany must transpose the CSDDD by July 26, 2028.
