CSDDD (Corporate Sustainability Due Diligence Directive)

What is the CSDDD? 

The Corporate Sustainability Due Diligence Directive (CSDDD) is European Union Directive (EU) 2024/1760. It requires in-scope companies to identify, prevent, mitigate and account for adverse human rights and environmental impacts in their own operations, their subsidiaries and their business partners in the chain of activities. 

Why it matters in procurement?

For procurement, the directive turns supplier conduct into a legal duty for the buyer. Supplier selection, contracts, audits and corrective action plans become the evidence a company uses to show it exercised due diligence. Suppliers outside the formal scope are still affected through contract terms and questionnaires from in-scope customers. 

The rules have changed since adoption. The Omnibus I package, in force since 18 March 2026, narrowed the scope to EU companies with more than 5,000 employees and more than €1.5 billion net worldwide turnover, plus non-EU companies with more than €1.5 billion turnover in the EU. It also moved the application date to 26 July 2029 and removed the climate transition plan duty. Member States must transpose the directive by 26 July 2028. 

Read More About What is Directive 2014/24/EU

The core process / lifecycle 

• Integrate Due Diligence into Policies. The company adopts a due diligence policy and a code of conduct for itself, its subsidiaries and its business partners, and builds the duty into management systems. 
• Identify and Prioritize Impacts. The company maps its operations and chain of activities, scopes where adverse impacts are most likely, and ranks the most severe and most likely impacts first, without needing to map every supplier. 
• Prevent and Mitigate. For potential impacts, the company draws up prevention plans, seeks contractual assurances from partners, and supports them with investment, training or collaboration. 
• End and Remedy. For actual impacts, the company takes steps to bring them to an end and to remedy the harm, or minimizes their extent where ending them is not possible at once. 
• Engage and Handle Complaints. The company talks with affected stakeholders and runs a notification and complaints procedure that people can use to raise concerns. 
• Monitor and Report. The company checks the effectiveness of its measures and publishes an annual statement. The first statements cover financial years starting on or after 1 January 2030. 

Core components 

• Scope defines which companies must comply, by employee count and turnover.
• Chain of activities covers upstream business partners and certain downstream activities, rather than the whole supply chain without limit.
• Adverse impacts are the human rights and environmental harms listed in the directive’s annex.
• Contractual assurances are commitments from direct partners, backed by cascading terms and verification.
• Enforcement sits with national supervisory authorities, which can impose penalties. 

Key benefits 

Preparing for the directive gives procurement a structured way to see supplier risk beyond tier one. 

Clear supplier standards in contracts reduce disputes later, because expectations on audits, corrective actions and termination are agreed at the start. The same evidence supports sustainability reporting and other regimes, so one process serves several obligations. 

Common pitfalls 

• Treating it as a one-time supplier survey. The duty is continuous and risk-based, so a single questionnaire without follow-up does not show due diligence. 
• Assuming only the largest companies are affected. In-scope companies push requirements to smaller suppliers through contracts, although the amended directive limits information requests to smaller partners to cases where the data cannot be obtained otherwise. 
• Relying on tier-one data alone. The most severe impacts often occur deeper in the chain, so prioritization needs some visibility beyond direct suppliers. 
• Using dates and thresholds from before the 2026 amendments. Older guidance quotes earlier thresholds and deadlines that no longer apply, which leads to wrong planning. 

Due diligence duty and what procurement does about it 

The table links the directive’s main duties to the actions procurement usually leads or supports. It is a planning aid, not legal advice. 

KPIs 

Key terms 

• Adverse Impact. A harm to human rights or the environment that the directive requires companies to address. 
• Chain of Activities. The upstream activities of business partners, plus certain downstream activities, that fall within the due diligence duty. 
• Due Diligence Statement. The annual public report on how a company has met its duty. 
• Prevention Action Plan. A time-bound plan to avoid or reduce a potential adverse impact. 
• Corrective Action Plan. A plan to end an actual adverse impact and remedy the harm. 
• Contractual Assurance. A commitment from a business partner to follow the company’s code of conduct. 
• Omnibus I. The 2026 EU package that narrowed the scope and timeline of the directive. 
• Business Partner. A direct or indirect supplier, customer or other party in the chain of activities. 

FAQs

1. What is the Corporate Sustainability Due Diligence Directive (CSDDD)?

The Corporate Sustainability Due Diligence Directive (CSDDD) is an EU regulation that requires qualifying companies to identify, prevent, mitigate, and address adverse human rights and environmental impacts. It covers company operations, subsidiaries, and relevant business partners within their chain of activities. The directive establishes a risk-based approach to corporate sustainability due diligence, making supplier risk assessment, responsible sourcing, and ongoing monitoring important components of compliance.

2. Which companies must comply with the CSDDD under the 2026 rules?

Under the 2026 EU Omnibus I amendments, the CSDDD applies to EU companies with more than 5,000 employees and over €1.5 billion in net worldwide turnover. Non-EU companies generating more than €1.5 billion in net turnover within the EU are also covered. Smaller suppliers may be indirectly affected when qualifying companies introduce sustainability requirements into supplier contracts, assessments, and due diligence processes.

3. When does the CSDDD come into effect, and what are the compliance deadlines?

The amended CSDDD becomes applicable on July 26, 2029. EU Member States must transpose the directive into national legislation by July 26, 2028. The first annual due diligence reporting requirements apply to financial years beginning on or after January 1, 2030. Companies covered by the directive should prepare their supplier risk assessments, due diligence policies, contractual safeguards, and monitoring processes before the compliance deadline.

4. Does the CSDDD apply to suppliers and businesses outside the European Union?

Yes, the CSDDD can affect businesses outside the EU through both direct and indirect obligations. Non-EU companies meeting the EU turnover threshold may fall directly within its scope. Smaller international suppliers may face indirect requirements from covered customers, including supplier codes of conduct, sustainability assessments, contractual assurances, and corrective action plans. These measures help qualifying companies identify and address human rights and environmental risks across their global supply chains.

5. What are the key CSDDD compliance requirements for procurement teams?

Procurement teams support CSDDD compliance by identifying high-risk suppliers, assessing potential human rights and environmental impacts, and implementing preventive measures. Key activities include integrating supplier codes of conduct into contracts, obtaining contractual assurances, monitoring supplier performance, and tracking corrective actions. Organizations must also maintain appropriate stakeholder engagement and complaint procedures. A risk-based supplier due diligence process helps prioritize the most severe and likely impacts without requiring exhaustive assessments of every supplier.

6. What is the difference between the CSDDD and the Corporate Sustainability Reporting Directive (CSRD)?

The CSDDD focuses on identifying, preventing, mitigating, and addressing adverse human rights and environmental impacts through corporate due diligence. The Corporate Sustainability Reporting Directive (CSRD) focuses on how companies disclose sustainability-related information, including relevant environmental, social, and governance matters. While the CSDDD establishes due diligence obligations, the CSRD establishes sustainability reporting requirements. Companies covered by both directives must understand their separate obligations while maintaining consistent sustainability data and governance processes.

7. What are the penalties for non-compliance with the CSDDD?

Companies that fail to comply with the CSDDD may face regulatory enforcement and financial penalties imposed by national supervisory authorities. Under the 2026 amendments, financial penalties are capped at 3% of a company’s net worldwide turnover. The amendments also removed the EU-wide harmonized civil liability regime, leaving civil liability matters subject to applicable national laws. Organizations can reduce compliance risks through documented due diligence procedures, supplier monitoring, effective remediation, and appropriate governance.