The Corporate Sustainability Due Diligence Directive (CSDDD), often referred to as the EU Supply Chain Directive, establishes for the first time a harmonised and binding framework in the EU requiring certain companies to integrate human rights and environmental due diligence into their supply chains.
Since 18 March 2026, the revised framework introduced through the Omnibus Package I has been in force. Companies will be required to comply with the Directive's obligations from 26 July 2029, following its transposition into national law. Until then, the German Supply Chain Due Diligence Act (LkSG) remains the relevant legal framework in Germany.
If your company already complies with the requirements of the LkSG, you are well positioned to meet the requirements of the CSDDD.
Does the CSDDD Apply to Your Company?
The CSDDD applies to companies both within and outside the European Union. Unlike the German Supply Chain Due Diligence Act (LkSG), the Directive uses both the number of employees and turnover as thresholds for determining its scope.
From 26 July 2029, your company may be subject to the CSDDD if it:
- is established in the EU and has more than 5,000 employees and a net worldwide turnover exceeding EUR 1.5 billion
- is established outside the EU and generates a net turnover of more than EUR 1.5 billion within the EU
- operates under franchise or licensing agreements generating royalties of more than EUR 75 million in the EU and a net turnover of more than EUR 275 million in the EU
These thresholds are laid down by the Directive. However, Member States may choose to introduce lower thresholds when transposing the CSDDD into national law.
What Is the Chain of Activities – and What Does It Mean for Your Company?
The CSDDD refers to a chain of activities, rather than a supply chain as defined under the German Supply Chain Due Diligence Act (LkSG). In the upstream part of the chain, all relevant activities are generally covered, from the extraction of raw materials, procurement, processing and transportation to delivery and storage. In the downstream part of the chain, the activities of your direct business partners are covered where they carry out the distribution, transportation or storage of a product for or on behalf of your company.
What Do You Need to Do?
The due diligence process under the CSDDD is based on the same fundamental principles as the LkSG but is broader in scope in certain respects. If your company is already implementing the requirements of the LkSG, you will already be familiar with the underlying logic of the process.
Step 1: Integrate Due Diligence into Your Business Operations
Embed due diligence obligations into all relevant policies, guidelines and your risk management system, and establish clear responsibilities in your company.
You must designate a responsible person or function, such as a Human Rights Officer, who serves as the official point of contact for the competent supervisory authority.
You must also develop a Due Diligence Policy that brings together your company's approach, the Code of Conduct and concrete implementation steps. This policy must be reviewed and updated at least every 24 months and whenever significant changes occur.
Step 2: Identify Risks – Scoping and Risk Assessment
The first step is to conduct a scoping, meaning an overview of possible risks in your company, in daughter companies and the entire chain of activities. Use existing and accessible information (for example initial research and public sources) A complete mapping of the entire chain of activities is explicitly not required. Collect additional data only if it is necessary and cannot reasonably obtained by other means.
The second step is a more detailed assessment. The objective is to assess and prioritise the areas where adverse human rights and environmental impacts are most likely and most severe. but only in those areas where the scoping has identified high risks. Prioritise these identified risks based on their severity and likelihood.
Your risk assessment must be updated at least every five years or when incidents occur and significant structural changes.
Step 3: Take Preventive and Remedial Measures
Implement appropriate measures based on your risk assessment: Potential adverse impacts require preventive measures, while actual adverse impacts require remedial action.
When determining appropriate measures, consider:
- Causation: Did your company cause the impact, contribute to it, or is it caused solely by a business partner?
- Location of the impact: Does the impact occur within your own business operations, at a direct business partner, or further down in the value chain?
- Leverage: To what extent can you influence the actor responsible for the impact?
Step 4: Establish Complaint and Notification Mechanisms
Establish two complementary mechanisms: a complaints mechanism, through which affected individuals or stakeholders can raise concerns regarding actual or potential adverse impacts; a notification mechanism, through which information about potential risks can be reported.
Both mechanisms must be fair, accessible, transparent, predictable, and provide effective protection against retaliation.
Step 5: Reporting
If your company is not subject to the Corporate Sustainability Reporting Directive (CSRD), you must publicly report on your human rights and environmental due diligence activities on an annual basis.
For companies subject to the CSRD, the reporting requirements under the CSDDD are considered fulfilled through CSRD reporting.
Are You a Small or Medium-Sized Enterprise?
As a small or medium-sized enterprise, you do not fall directly under the scope of the CSDDD. However, you may still be affected if you operate as a supplier or business partner of a company that is subject to the Directive.
The CSDDD sets forth specific requirements for collaboration in the supply chain. Your customer may only request information from you if that information is reasonably necessary for fulfilling its due diligence obligations. If your company has fewer than 5,000 employees, a business partner may only request such information where it cannot be obtained through other reasonable means.
Timeline of the CSDDD
- Since 18 March 2026: Omnibus I has entered into force
- By 2027/2028: The European Commission will develop guidance documents
- By 26 July 2028: Transposition into national law
- From 26 July 2029: Obligations apply to all companies within the scope of the Directive
Frequently asked questions
What is the objective of the European Supply Chain Directive?
The CSDDD establishes, for the first time, a harmonised and binding EU-wide framework requiring companies to integrate human rights and environmental due diligence into their chain of activities. Its objective is to identify, prevent, mitigate and bring to an end adverse impacts of business activities on human rights and the environment.
When does the CSDDD enter into force?
The Directive formally entered into force on 25 July 2024. However, companies will only be required to comply with its obligations from 26 July 2029 onwards. Member States have until 26 July 2028 to transpose the Directive into national law.
Which activities are covered by the Directive?
The CSDDD refers to a chain of activities, rather than a supply chain as defined under the LkSG. The upstream part of the chain covers all activities related to the production of your goods or the provision of your services. The downstream part covers only the activities of your direct business partners where they carry out distribution, transport, or storage for or on behalf of your company.
How do scoping and risk assessment work under the CSDDD?
The risk assessment process begins with a risk-based scoping exercise, providing an overview of your entire chain of activities. Based on this assessment, identified risks are then analysed in greater depth and prioritised according to their severity and likelihood.
Which criteria should be applied when determining appropriate preventive and remedial measures?
The suitability of measures depends on three key criteria: causation, location of the impact, and your ability to influence the responsible actor (leverage).
What are the benefits of participating in multi-stakeholder initiatives?
Multi-stakeholder initiatives enable companies to pool resources and increase their collective leverage. However, participation in such initiatives may help companies fulfil their due diligence obligations, but it does not replace those obligations.
What sanctions does the CSDDD provide for non-compliance?
Companies may face financial penalties for non-compliance. In addition, failure to meet CSDDD requirements may result in exclusion from public procurement procedures within the EU. The CSDDD does not establish a harmonised EU-wide civil liability regime.
Does the European Union provide support for companies?
Yes. The EU provides practical guidance as well as central information and support services. The Helpdesk Business & Human Rights is also available to assist companies free of charge.