CSDDD Compliance: Requirements, Scope and Timeline
CSDDD compliance means building a risk-based process that finds, prevents, ends and fixes human rights and environmental harm across your own operations, your subsidiaries and your chains of activities. After the Omnibus I changes, the duty applies only to the very largest companies, and not before 26 July 2029. If you are a UK or other non-EU business, it can still reach you through your turnover in the EU market. This guide sets out who is covered, what the Directive asks for, which dates matter and how to get ready.
Key Takeaways
The Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760) requires in-scope companies to identify and address adverse human rights and environmental impacts, not just report on them.
From 26 July 2029 it applies to EU companies with more than 5,000 employees and net worldwide turnover above €1.5 billion, and to non-EU companies with more than €1.5 billion turnover in the EU.
Penalties are set nationally, with a maximum of at least 3% of net worldwide turnover for the most serious violations, and victims can claim full compensation where a company is held liable under national law.
Smaller suppliers are outside the Directive’s formal scope, but they can feel its effects through contract terms and information requests from larger customers.
Starting now with policies, impact mapping and a complaints channel is the sensible way to be ready well before the application date.
What CSDDD compliance actually means
The CSDDD is a behavioural law. It does not ask a company only to disclose what it knows. It asks the company to act. According to the European Commission, in-scope companies must identify and address actual and potential adverse human rights and environmental impacts in their own operations, in those of their subsidiaries and in their chains of activities. That work is backed by complaints and notification procedures, monitoring and public communication.
The phrase “chains of activities” matters. It is narrower and different from the older idea of a full supply chain, because it focuses on the business partners involved in producing and distributing a company’s products and services. If you are used to supplier audits, expect the scope to be wider in some respects and more risk-driven in others.
We covered the political path to the law in our earlier piece on how the CSDDD got its green signal. This article focuses on what has changed since and what you need to do.
Who the Directive applies to after Omnibus I
The original text reached far more companies than the current one. Following the Omnibus I amendments, the Commission states that from 26 July 2029 the Directive applies to EU companies with more than 5,000 employees and a global net turnover above €1.5 billion, and to non-EU companies generating more than €1.5 billion in turnover within the EU market.
In practice that gives you three groups.
Group | In scope? | What it means |
EU company, over 5,000 employees and over €1.5 billion net worldwide turnover | Yes, from 26 July 2029 | Full due diligence duties |
Non-EU company, over €1.5 billion turnover generated in the EU market | Yes, from 26 July 2029 | Same duties, tied to EU turnover, not to where you are headquartered |
Smaller companies and SMEs | Not directly | Possible indirect effects through customers’ contracts and requests |
What this means for UK and other non-EU businesses
The test for a non-EU company is turnover generated in the EU, not a registered office or a branch. A UK group that sells heavily into EU markets should therefore check its EU turnover against the €1.5 billion threshold, using the definitions in the national law of the relevant Member State once it is published. Working out where revenue is generated is a finance and legal task that is worth starting early, because group structures and intercompany sales can make it less obvious than it looks.
What this means for smaller suppliers
SMEs are not in the Directive’s personal scope. They may still be affected through their business relationships. The legal text requires that where a large company seeks contractual assurances from a smaller partner, the terms must be fair, reasonable and non-discriminatory, and the Commission is to provide guidance and model contractual clauses, as the Business & Human Rights Resource Centre summarises. If you supply a large buyer, expect questionnaires and clauses. Having your policies and evidence organised makes those conversations quicker.
The core CSDDD requirements
The EUR-Lex summary of the Directive lays out the main duties. They work as a continuous cycle, not a one-off project.
1. Integrate due diligence into policies and risk management
Due diligence has to be part of how the company runs, not a stand-alone compliance file. That means a policy that is approved at the top, linked to your code of conduct, and reflected in procurement, sales and operational risk processes. Board and senior management ownership is what makes the other steps stick.
2. Identify and assess adverse impacts
Companies must find actual and potential adverse human rights and environmental impacts. A sensible starting point is a map of your operations, subsidiaries and business partners, followed by a scoping exercise that shows where harm is most likely, for example by sector, country or product input.
3. Prioritise by severity and likelihood
You are not expected to tackle everything at once. The Directive asks companies to prioritise impacts according to how severe and how likely they are. Document the reasoning, because it will be the first thing a supervisor or a stakeholder asks about.
4. Prevent, mitigate, end and minimise
For potential impacts, the duty is to prevent or mitigate them. For actual impacts, the company must bring them to an end or minimise their extent. Typical tools include supplier action plans, contract clauses, training, capacity building and, where needed, changes to purchasing practices.
5. Provide remediation
Where a company has caused or contributed to an actual adverse impact, it must provide remediation. Plan for this in advance: who decides, what budget exists, and how affected people are heard.
6. Notifications and complaints procedures
Companies must set up accessible, publicly available notification and complaints procedures with appropriate follow-up. Individuals and organisations can raise concerns anonymously and confidentially, in line with national law, according to the EUR-Lex summary. A channel that is hard to find or to use in the local language is a weak point worth fixing early.
7. Monitor and communicate
The Commission’s description also includes monitoring of the effectiveness of your measures and public communication on your due diligence. Build indicators and an evidence trail from the start so the monitoring is genuine and the communication is accurate.
Our practical guide to human rights due diligence for businesses walks through the same cycle with working examples, and is a good companion to the list above.
Timeline: the dates to track
The dates have moved, so use the official sources when planning. Per the European Commission:
25 July 2024: the CSDDD entered into force.
26 February 2026: Directive (EU) 2026/470, the Omnibus I amending act, was published in the Official Journal, and it entered into force on 18 March 2026.
26 July 2028: the deadline for Member States to transpose the CSDDD-related Omnibus I amendments into national law.
26 July 2029: the amended rules apply to companies within the thresholds above.
Financial years starting on or after 1 January 2030: the Article 16 reporting measures apply.
The practical point is that your real obligations will be defined by national laws, which will differ in detail between Member States. Watch for transposition drafts in the countries where you have most EU turnover or subsidiaries.
How CSDDD differs from CSRD
The two laws are often mentioned together and often confused. Accountancy Europe describes the CSRD as a reporting framework that requires companies to disclose high-quality, standardised sustainability information, while the CSDDD is a behavioural framework that requires companies to identify and address adverse human rights and environmental impacts.
Put simply, the CSRD asks “what do you disclose?” and the CSDDD asks “what do you do about it?” The two are designed to complement each other: the information you gather for due diligence feeds your reporting, and your reporting makes your due diligence visible.
If you need to see where your company stands on reporting, our guides to CSRD requirements after Omnibus I and CSRD reporting: who must report and how to start set out the scope. Our explainer on double materiality is useful because impact materiality, the “inside-out” view of your effect on people and the environment, overlaps closely with the impact identification step in due diligence.
Enforcement, penalties and liability
Enforcement runs on two tracks, both described by the European Commission.
Administrative supervision. Each Member State designates supervisory authorities with powers that include injunctive orders and effective, proportionate and dissuasive penalties. The maximum limit for pecuniary penalties is set at 3% of the company’s net worldwide turnover for the most serious violations. The Commission will also set up a European Network of Supervisory Authorities to coordinate national enforcement.
Civil liability. Where a company is held liable under national law for damage caused by failing to meet the due diligence requirements, affected persons have a right to full compensation.
For a board, the message is that this is a risk managed with evidence. A company that can show a documented, proportionate, regularly reviewed process is in a far stronger position than one that can only show a policy statement.
A practical preparation plan
There is no need to wait for national laws before starting. Most of the groundwork will be useful whichever way the final details land. Treat the steps below as a sensible order of work, not a legal checklist.
Check your scope. Compare your employee numbers and net worldwide turnover with the thresholds, or, if you are outside the EU, your turnover in the EU market. Record the calculation and the date.
Appoint an owner. Give one senior person accountability and a cross-functional team drawn from procurement, legal, sustainability, HR and finance.
Map operations and business partners. Start with your own sites and subsidiaries, then move to direct partners and the wider chain of activities, focusing first on the highest-risk sectors and geographies.
Run a risk assessment. Score potential and actual impacts for severity and likelihood, and record why you ranked them the way you did.
Update policies and contracts. Align your code of conduct, supplier code and contract language with the due diligence process. If you ask smaller partners for assurances, keep terms fair and proportionate.
Open a complaints channel. Make it easy to find, available in the languages of the people who may use it, and able to take anonymous and confidential reports.
Create an action plan with owners and deadlines. Cover prevention, mitigation, ending harm and remediation, and keep the evidence.
Monitor and review. Define indicators, review them regularly and adjust the plan as you learn.
Connect to reporting. Make sure the data you collect feeds your sustainability reporting, so you collect it once.
Where organisations usually get stuck
Three things slow teams down. The first is data: supplier information sits in different systems and formats. The second is ownership: due diligence falls between procurement and sustainability, and nobody leads. The third is depth: companies map first-tier suppliers well and then lose sight of what lies beyond. Tackle these by agreeing a single register of business partners, a named lead and a risk-based approach to going deeper.
Europe and Africa: why the law matters on both continents
Many of the impacts the Directive targets occur in raw material extraction, agriculture, manufacturing and logistics in regions outside Europe, including across Africa. Businesses and public bodies on the continent that supply European buyers should expect more detailed questions on labour conditions, land use, water and emissions. Local communities and workers gain from clearer complaint routes, and suppliers who can show good practice are better placed to keep and win contracts. This is also why our coverage follows both regions: the rules are written in Brussels, but their effects are felt along the whole chain.
How Exereco can help
Exereco brings together sustainability news and analysis for Europe and Africa with ESG reporting software, advisory and compliance support, ESG training courses and networking events. If you are mapping your obligations, building a due diligence process or aligning your reporting with the data it produces, you can find out how we work with organisations on our site.
We aim to tailor our support to both European and African audiences, so that companies, public bodies and local organisations can move from understanding the rules to putting them into practice. Explore Exereco’s ESG services and resources to start the conversation.
FAQ
Does the CSDDD apply to UK companies?
Not because they are British, but it can apply to a UK company that is a non-EU company generating more than €1.5 billion in turnover within the EU market. The Commission states that this applies from 26 July 2029. UK businesses below that threshold are not directly covered, though they may receive requests from EU customers that are.
What is the difference between CSDDD requirements and CSRD requirements?
The CSRD is a reporting framework: companies disclose standardised sustainability information. The CSDDD is behavioural: companies must identify and address adverse human rights and environmental impacts. Accountancy Europe describes them as complementary.
What are the penalties for non-compliance?
Member States set penalties through national law, and the Commission states that the maximum limit for pecuniary penalties is 3% of net worldwide turnover for the most serious violations. Supervisory authorities can also issue injunctive orders. Separately, where a company is held liable under national law, affected persons have a right to full compensation.
When do I need to be compliant?
The amended rules apply from 26 July 2029 to companies within the thresholds, after Member States transpose them by 26 July 2028. The Article 16 reporting measures apply for financial years starting on or after 1 January 2030. Check the Commission’s page and your national transposition law for the current position.
Do SMEs have to comply with the CSDDD?
SMEs are not within the Directive’s formal scope. They can be affected indirectly, because larger companies must address impacts across their chains of activities and may ask partners for assurances. The legal text says contract terms with SMEs must be fair, reasonable and non-discriminatory.
Recommended
Comments