Directive (EU) 2024/1760 enters into force after final adoption by the European Parliament and Council.
CSDDD: Corporate Sustainability Due Diligence Directive
In-scope EU and non-EU companies must identify, prevent, and address human rights and environmental impacts across their own operations and value chain, with documented due diligence and supervisory oversight in every Member State.
Next deadline
26 July 2029: Application date for in-scope companies under the revised CSDDD
The data layer behind CSDDD compliance is built over multiple procurement cycles. Supplier engagement frameworks, contract clauses and risk methodologies signed today determine what is available when due diligence obligations begin to apply. Companies that already report under CSRD or run national supply chain regulations are using the transition period to consolidate one supplier-data foundation across all relevant regimes.
Regulation timeline
osapiens Guide
CSDDD after Omnibus I: Build a Defensible Due Diligence Setup
The CSDDD has narrowed in scope, but the operational expectations for companies still affected remain demanding. Due diligence must be risk-based, traceable, and backed by reliable evidence.
This guide explains what changed under Omnibus I and shows how to build a continuous due diligence process connecting risk analysis, corrective measures, complaints, monitoring, and documentation.
What you will learn:
- How the CSDDD scope, thresholds, and timelines have changed
- What a defensible, risk-based due diligence process should include
- How to connect risk signals with actions and evidence
- Warning signs that may indicate gaps in your setup
- How software can support supplier engagement and audit readiness
Download the guide to assess your due diligence setup and close the gaps.
What the regulation requires
In-scope companies must identify, assess, and address adverse impacts on human rights and the environment across their own operations, subsidiaries, and chain of activities.
The revised scope applies to EU companies with more than 5,000 employees and net worldwide turnover above €1.5 billion, and to non-EU companies generating more than €1.5 billion in EU turnover.
Direct (Tier 1) business partners are the primary focus for due diligence. Evidence of risk in deeper tiers triggers further investigation.
Due diligence obligations cover six areas:
- Integrating due diligence into company policy and risk management
- Identifying and prioritizing impacts
- Preventing and mitigating potential harms
- Remediating actual harms
- Engaging stakeholders
- Operating a grievance mechanism
Member States designate supervisory authorities and set penalties up to 3% of worldwide net turnover.
Operational challenges of CSDDD compliance
Scoping the chain of activities correctly
The revised CSDDD focuses in-depth assessment on direct business partners, with deeper investigation triggered only by plausible information of risk further upstream. Determining which partners are in scope, which trigger points warrant escalation, and how downstream relationships are treated requires a defined methodology applied consistently across the business.
Collecting due diligence data without overburdening smaller partners
The revised CSDDD codifies that information requests must be necessary, targeted, and proportionate, with smaller business partners subject to reduced requirements. The voluntary VSME framework provides a reference point for what smaller companies can reasonably share, but applying that calibration consistently across thousands of partners requires a structured system.
Manual data collection across fragmented systems
Supplier data collection through emails, spreadsheets, and separate tools per regulation generates duplicate requests across CSDDD, CSRD, EUDR, and national supply chain laws. The resulting documentation trail is spread across disconnected systems that supervisory authorities cannot easily reconcile.
Building defensible prioritization and remediation evidence
Risk-based due diligence requires companies to demonstrate which impacts they prioritized, what corrective action they took, and how they monitored effectiveness. Records must capture each decision at the point it is made, with version history, approver records, and underlying data sources preserved.
The full CSDDD due diligence cycle in one platform
The osapiens HUB for Supply Chain Compliance covers risk identification, supplier engagement, prevention and remediation tracking, and audit-ready documentation across every business partner in the chain of activities. The same 360° Business Partner profile that powers EUDR traceability and CSRD value-chain disclosures makes CSDDD data available across every connected workflow without re-entry.
Risk-based due diligence on one supplier profile
Country, sector, and commodity risk indicators identify and prioritize adverse impacts across direct business partners. Heat maps, severity scores, and prioritization workflows are captured against each supplier record, and the same profile automatically feeds EUDR traceability and CSRD value-chain disclosures.
Proportionate supplier engagement at scale
The free osapiens Supplier Portal delivers questionnaires in 29 languages, with pre-built templates for CSDDD, EUDR, CSRD, and other frameworks scoped by partner size, sector, and applicable regulation. A single survey covers multiple regulatory frameworks simultaneously, reducing duplicate requests to each business partner.
Audit-ready documentation built into every workflow
Prevention action plans, corrective actions, stakeholder engagement records, and grievance cases are recorded with full data lineage, approver history, and a timestamp trail against each supplier record. Reports go directly to supervisory authorities or feed the osapiens HUB Reporting Cockpit for CSRD disclosures.
Frequently asked questions
The revised CSDDD applies to EU companies with more than 5,000 employees and net worldwide turnover above €1.5 billion, and to non-EU companies generating more than €1.5 billion in net EU turnover. Group thresholds are assessed on a standalone or consolidated basis. Companies below the new thresholds may still receive CSDDD-driven data requests from in-scope customers.
CSDDD requires in-scope companies to conduct risk-based due diligence across their own operations, their subsidiaries, and their chain of activities. The due diligence cycle covers six core obligations: integrating due diligence into policies and risk management, identifying and prioritizing adverse impacts, preventing or mitigating potential impacts, remediating actual impacts, engaging with stakeholders, and operating a grievance mechanism. Companies must monitor effectiveness at least every five years, with ad hoc reviews triggered by new information.
In-depth assessment of adverse impacts is focused on direct (Tier 1) business partners. Deeper investigation into Tier 2 and beyond is triggered when plausible information indicates risk further upstream. The directive retains the broader concept of “chain of activities” covering both upstream production and selected downstream relationships, but the operational focus of detailed due diligence sits with direct partners. This is a structural change from the original CSDDD, which assumed deeper proactive investigation across the full value chain.
Individual Member States set penalties, which must be effective, proportionate, and dissuasive. The directive sets a maximum penalty cap of 3% of worldwide net turnover; the original CSDDD set a minimum floor of 5%, meaning Member States were required to go at least that high. Member States designate supervisory authorities with powers to investigate, demand corrective action, and publish information on non-compliance. National law now governs civil liability in each Member State following the removal of the harmonized EU regime under Omnibus I.
Several Member States already have national supply chain due diligence laws in place, such as Germany’s LkSG or France’s Loi de Vigilance. These typically cover a broader set of companies with risk-based due diligence focused on direct suppliers. CSDDD applies to a smaller population of much larger companies but extends the methodology across the chain of activities and adds grievance mechanism, stakeholder engagement and remediation obligations beyond most existing national frameworks. Companies in scope of both regimes can operate one due diligence program covering both; the underlying data layer is the same.
Now. Supplier engagement frameworks, contract clauses, and risk methodologies established in current procurement cycles determine what documentation is available when CSDDD obligations apply in 2029. Companies that begin in 2028 will run a compressed program across thousands of business partners with insufficient time to build defensible documentation before the first reporting cycle. Building the supplier data foundation during the transition period, alongside existing CSRD, EUDR, or national due diligence programs, produces a single structure that covers all applicable regimes.
Standalone CSDDD tools handle due diligence in isolation. The osapiens HUB for Supply Chain Compliance sits within the Supplier Intelligence suite, where the supplier profile, risk methodology, and engagement workflows built for CSDDD feed directly into EUDR traceability, CSRD value-chain disclosures, the Reporting Cockpit, Carbon Management, and other connected solutions. The osapiens Supplier Portal consolidates data requests across all applicable regulations into one questionnaire per supplier, eliminating duplicate outreach.
CSDDD, CSRD, EUDR, and national supply chain laws such as LkSG share significant overlap in the supplier data they require. A company already collecting value-chain data for CSRD disclosures or running due diligence under LkSG has a partial foundation for CSDDD. The key structural difference is that CSDDD extends in-depth due diligence across the full chain of activities rather than focusing on direct suppliers only, and sets more prescriptive requirements for stakeholder involvement in the design of grievance mechanisms than most national frameworks.
