Directive (EU) 2024/1760 enters into force after final adoption by the European Parliament and Council.
CSDDD: Corporate Sustainability Due Diligence Directive
In-scope EU and non-EU companies must identify, prevent, and address human rights and environmental impacts across their own operations and value chain, with documented due diligence and supervisory oversight in every Member State.
Next deadline
26 July 2029: Application date for in-scope companies under the revised CSDDD
The data layer behind CSDDD compliance is built over multiple procurement cycles. Supplier engagement frameworks, contract clauses and risk methodologies signed today determine what is available when due diligence obligations begin to apply. Companies that already report under CSRD or run national supply chain regulations are using the transition period to consolidate one supplier-data foundation across all relevant regimes.
Regulation timeline
osapiens Guide
CSDDD after Omnibus I: Build a Defensible Due Diligence Setup
The CSDDD has narrowed in scope, but the operational expectations for companies still affected remain demanding. Due diligence must be risk-based, traceable, and backed by reliable evidence.
This guide explains what changed under Omnibus I and shows how to build a continuous due diligence process connecting risk analysis, corrective measures, complaints, monitoring, and documentation.
What you will learn:
- How the CSDDD scope, thresholds, and timelines have changed
- What a defensible, risk-based due diligence process should include
- How to connect risk signals with actions and evidence
- Warning signs that may indicate gaps in your setup
- How software can support supplier engagement and audit readiness
Download the guide to assess your due diligence setup and close the gaps.
What the regulation requires
In-scope companies must identify, assess, and address adverse impacts on human rights and the environment across their own operations, subsidiaries, and chain of activities.
The revised scope applies to EU companies with more than 5,000 employees and net worldwide turnover above €1.5 billion, and to non-EU companies generating more than €1.5 billion in EU turnover.
Direct (Tier 1) business partners are the primary focus for due diligence. Evidence of risk in deeper tiers triggers further investigation.
Due diligence obligations cover six areas:
- Integrating due diligence into company policy and risk management
- Identifying and prioritizing impacts
- Preventing and mitigating potential harms
- Remediating actual harms
- Engaging stakeholders
- Operating a grievance mechanism
Member States designate supervisory authorities and set penalties up to 3% of worldwide net turnover.
Operational challenges of CSDDD compliance
Scoping the chain of activities correctly
The revised CSDDD focuses in-depth assessment on direct business partners, with deeper investigation triggered only by plausible information of risk further upstream. Determining which partners are in scope, which trigger points warrant escalation, and how downstream relationships are treated requires a defined methodology applied consistently across the business.
Collecting due diligence data without overburdening smaller partners
The revised CSDDD codifies that information requests must be necessary, targeted, and proportionate, with smaller business partners subject to reduced requirements. The voluntary VSME framework provides a reference point for what smaller companies can reasonably share, but applying that calibration consistently across thousands of partners requires a structured system.
Manual data collection across fragmented systems
Supplier data collection through emails, spreadsheets, and separate tools per regulation generates duplicate requests across CSDDD, CSRD, EUDR, and national supply chain laws. The resulting documentation trail is spread across disconnected systems that supervisory authorities cannot easily reconcile.
Building defensible prioritization and remediation evidence
Risk-based due diligence requires companies to demonstrate which impacts they prioritized, what corrective action they took, and how they monitored effectiveness. Records must capture each decision at the point it is made, with version history, approver records, and underlying data sources preserved.
The full CSDDD due diligence cycle in one platform
The osapiens HUB for Supply Chain Compliance covers risk identification, supplier engagement, prevention and remediation tracking, and audit-ready documentation across every business partner in the chain of activities. The same 360° Business Partner profile that powers EUDR traceability and CSRD value-chain disclosures makes CSDDD data available across every connected workflow without re-entry.
Risk-based due diligence on one supplier profile
Country, sector, and commodity risk indicators identify and prioritize adverse impacts across direct business partners. Heat maps, severity scores, and prioritization workflows are captured against each supplier record, and the same profile automatically feeds EUDR traceability and CSRD value-chain disclosures.
Proportionate supplier engagement at scale
The free osapiens Supplier Portal delivers questionnaires in 29 languages, with pre-built templates for CSDDD, EUDR, CSRD, and other frameworks scoped by partner size, sector, and applicable regulation. A single survey covers multiple regulatory frameworks simultaneously, reducing duplicate requests to each business partner.
Audit-ready documentation built into every workflow
Prevention action plans, corrective actions, stakeholder engagement records, and grievance cases are recorded with full data lineage, approver history, and a timestamp trail against each supplier record. Reports go directly to supervisory authorities or feed the osapiens HUB Reporting Cockpit for CSRD disclosures.
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-iad-kcgs7200145-IAD 1792115673 124962684
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-iad-kcgs7200145-IAD 1792115673 124962684
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-iad-kcgs7200145-IAD 1792115673 124962684
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-iad-kcgs7200145-IAD 1792115673 124962684
Varnish cache server
Error 429 Too many requests
Too many requests
Error 54113
Details: cache-iad-kcgs7200145-IAD 1792115673 124962684
Varnish cache server