Corporate Sustainability Due Diligence Directive (CSDDD) —

Does our supply chain expose us to personal liability for human rights or environmental harm — and what does the CSDDD actually require before 2028?

Companies with more than 3,000 employees and EUR 900 million turnover must conduct mandatory human rights and environmental due diligence across their entire chain of activities from 26 July 2028, or face fines of at least 5% of net worldwide turnover [Art. 27(4)] and civil liability claims [Art. 29].

Short Answer

The CSDDD requires in-scope companies to identify, prevent, mitigate and remedy adverse human rights and environmental impacts in their own operations, subsidiaries and business partners' operations across the full chain of activities [Art. 5(1)]. Companies must also adopt a Paris-aligned climate transition plan covering Scope 1, 2 and 3 emissions with five-year targets through 2050 [Art. 22(1)]. National supervisory authorities will enforce compliance and may impose pecuniary penalties of at least 5% of net worldwide turnover [Art. 27(4)]. Separately, affected persons can bring civil liability claims with a minimum five-year limitation period [Art. 29(3)].

Who is affected

EU companies with more than 1,000 employees and more than EUR 450 million net worldwide turnover, or the ultimate parent company of a group meeting those thresholds [Art. 2(1)]. Third-country companies generating more than EUR 450 million net turnover in the EU [Art. 2(2)]. Franchise/licensing companies with more than EUR 22.5 million in royalties and more than EUR 80 million turnover [Art. 2(1)(c), Art. 2(2)(c)]. Thresholds must be met in two consecutive financial years [Art. 2(5)].

Deadline

Phase 1 applies from 26 July 2028 to companies with more than 3,000 employees and EUR 900 million turnover (EU and third-country equivalents). Phase 2 applies from 26 July 2029 to all remaining in-scope companies [Art. 37(1) as amended by Directive (EU) 2025/794]. Member States must transpose by 26 July 2027. Reporting obligations under Art. 16 apply for financial years starting on or after 1 January 2029 (phase 1) or 1 January 2030 (phase 2).

Risk

Pecuniary penalties of at least 5% of net worldwide turnover [Art. 27(4)]. Non-payment triggers a mandatory public statement naming the company and the infringement [Art. 27(3)(b)]. In addition, civil liability for damage caused by intentional or negligent failure to prevent or bring to an end adverse impacts [Art. 29(1)], with a minimum five-year limitation period. Penalty decisions are published for at least five years [Art. 27(5)].

Proof

Legal status

• In force
• as of 2026-04-17
• Consolidated version of 17.04.2025, incorporating Directive (EU) 2025/794

Primary sources

• EUR-Lex — Full text of the legal act
• European Commission — Corporate sustainability due diligence — EU CSDDD policy page

What to do now

Legal / DPO

•Assess whether the company meets the scope thresholds (employees, turnover, franchise royalties) and determine the applicable phase-in date under the amended transposition schedule [Art. 2, Art. 37(1)].
•Review existing contractual frameworks with direct and indirect business partners to ensure they support contractual assurances on code of conduct compliance and corrective action plans [Art. 10(2)(b), Art. 11(3)(c)].
•Prepare for civil liability exposure by mapping the company's chain of activities and assessing where intentional or negligent failures to prevent or bring to an end adverse impacts could trigger claims with a five-year limitation period [Art. 29].

Compliance

•Establish a due diligence policy integrated into all relevant risk management systems, including a code of conduct and a process description, with mandatory review at least every 24 months [Art. 7].
•Set up a complaints procedure and a notification mechanism enabling affected persons, trade unions and civil society organisations to submit concerns, including anonymous or confidential submissions [Art. 14].
•Implement a monitoring system with qualitative and quantitative indicators and periodic assessments at least every 12 months to track the effectiveness of due diligence measures [Art. 15].

IT / Security

•Build or procure a supply chain mapping platform to identify and assess actual and potential adverse impacts across own operations, subsidiaries and business partners, prioritised by severity and likelihood [Art. 8, Art. 9].
•Implement a secure, accessible notification and complaints channel that supports anonymous and confidential submissions, with identity protection measures, as required under [Art. 14(3), Art. 14(5)].
•Ensure due diligence documentation is retained for at least five years in a tamper-evident, auditable format, with extended retention during ongoing proceedings [Art. 5(4)].

Product / Engineering

•Map the upstream chain of activities (design, extraction, sourcing, manufacture, transport, storage, supply) and the downstream chain (distribution, transport, storage performed for or on behalf of the company) to identify product-related adverse impacts [Art. 3(1)(g)].
•Evaluate whether purchasing practices, design decisions and distribution models need modification to prevent or mitigate identified potential adverse impacts in the product lifecycle [Art. 10(2)(d)].
•Adopt and put into effect a climate transition plan with science-based targets for 2030 and five-year steps to 2050, covering Scope 1, 2 and 3 emissions and quantified investment plans [Art. 22(1)].

Key Terms

Chain of activities: Upstream activities related to the production of goods or provision of services (design, extraction, sourcing, manufacture, transport, storage, supply) and downstream activities (distribution, transport, storage) carried out for or on behalf of the company [Art. 3(1)(g)].
Adverse impact: An adverse environmental impact or adverse human rights impact resulting from breaches of the prohibitions and obligations listed in the Annex to the Directive [Art. 3(1)(d)].
Due diligence: Risk-based human rights and environmental due diligence comprising integration into policies, identification, prevention, remediation, stakeholder engagement, complaints mechanisms, monitoring and reporting [Art. 5(1)].
Severe adverse impact: An adverse impact especially significant on account of its nature (e.g. harm to life, health or liberty), scale, scope or irremediable character, taking into account the number of affected individuals and the extent of environmental damage [Art. 3(1)(l)].
Business partner: A direct business partner (entity with a commercial agreement related to the company's operations, products or services) or an indirect business partner (entity performing related business operations without a direct agreement) [Art. 3(1)(f)].
Transition plan for climate change mitigation: A plan aiming to ensure, through best efforts, compatibility of the company's business model and strategy with the 1.5°C Paris Agreement target, including emission reduction targets, decarbonisation levers, investment quantification and governance roles [Art. 22(1)].
Appropriate measures: Measures capable of achieving the objectives of due diligence by effectively addressing adverse impacts, commensurate to the degree of severity and likelihood of the impact, and reasonably available to the company [Art. 3(1)(o)].

Frequently Asked Questions

Does the CSDDD apply to companies headquartered outside the EU?

Yes. Third-country companies generating more than EUR 450 million net turnover in the EU, or whose group reaches that threshold on a consolidated basis, fall within scope [Art. 2(2)]. They must designate an authorised representative in the EU [Art. 23].

What is the difference between phase 1 and phase 2 application?

Phase 1 (from 26 July 2028) covers companies with more than 3,000 employees and EUR 900 million turnover. Phase 2 (from 26 July 2029) covers all remaining in-scope companies, including those meeting the standard thresholds and franchise/licensing companies [Art. 37(1) as amended].

Can a parent company fulfil due diligence obligations on behalf of its subsidiaries?

Yes, provided this ensures effective compliance. The subsidiary must integrate due diligence into its own policies, continue taking appropriate measures where necessary, and seek contractual assurances from its own business partners [Art. 6].

What does the climate transition plan require?

Companies must adopt a plan aiming for compatibility with the 1.5°C Paris Agreement target, including time-bound targets for 2030 and in five-year steps to 2050, covering Scope 1, 2 and 3 emissions, decarbonisation levers, quantified investments, and governance roles. The plan must be updated every 12 months [Art. 22(1), Art. 22(3)].

How does civil liability work under the CSDDD?

A company can be held liable for damage caused by intentional or negligent failure to comply with the obligations to prevent potential adverse impacts [Art. 10] or bring actual adverse impacts to an end [Art. 11]. The limitation period is at least five years. Trade unions and NGOs may bring actions on behalf of injured parties [Art. 29].

Are SMEs directly in scope of the CSDDD?

SMEs are not directly in scope, but they may be affected as business partners in the chain of activities of in-scope companies. The Directive requires companies to provide targeted and proportionate support to SME business partners, including financial support if compliance would jeopardise the SME's viability [Art. 10(2)(e), Art. 11(3)(f)].

What must the complaints procedure cover?

Companies must establish a fair, publicly available, accessible, predictable and transparent procedure for dealing with complaints from affected persons, trade unions and environmental civil society organisations. The procedure must protect complainant confidentiality and provide follow-up, including written reasons for decisions [Art. 14].

Assessment Factors & Checklist

Premium

Start 7-day free trial

Questions for Your Lawyer

Premium

Start 7-day free trial

Conclusion & Summary

Premium

Start 7-day free trial

Detailed analysis with source links.

Schalten Sie die KI-Analyse frei — mit markierten Fundstellen und direkten Links zu EUR-Lex. 7 Tage kostenlos testen.

Start 7-day free trial →

Keine Kreditkarte heute. Kündigung jederzeit.