CSDDD Explained: Requirements, Timeline, and Compliance After the Omnibus

The Corporate Sustainability Due Diligence Directive (CSDDD) makes human rights and environmental due diligence a legal obligation for the largest companies operating in the EU. After the Omnibus I package entered into force in March 2026, the directive looks substantially different from its original 2024 version: higher thresholds, a risk-based approach, reduced penalties, and a delayed timeline. Yet one common misconception persists—the Omnibus weakened the CSDDD, but it did not abolish it.

This guide explains who is subject to the directive, what companies must do, how the CSDDD differs from the CSRD, and why suppliers well below the thresholds should prepare now.

What Is the CSDDD? The Corporate Sustainability Due Diligence Directive

The Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760) entered into force on July 25, 2024, and establishes mandatory human rights and environmental due diligence for the largest companies active in the EU market. The Omnibus I Directive (EU) 2026/470, in force since March 18, 2026, substantially amended it.

Who is in scope after the Omnibus amendments:

• EU companies with more than 5,000 employees and a net worldwide turnover above €1.5 billion, including on a consolidated basis for ultimate parent companies

• Non-EU companies generating more than €1.5 billion net turnover within the EU—headquarters location does not shield foreign companies with significant EU business

• Franchising and licensing arrangements can also bring companies into scope where royalty and turnover thresholds are met

The raised thresholds narrowed the directive from roughly 13,000 companies to about 6,000. Many readers will find their company formally out of scope—but as the supply chain section below shows, that does not mean the CSDDD is irrelevant for them.

CSDDD Requirements: The Due Diligence Process

The CSDDD builds on the OECD due diligence framework. Companies in scope must embed a continuous process covering their own operations, subsidiaries, and direct business partners in their chain of activities:

• Integrate due diligence into policies and risk management systems

• Identify and assess actual and potential adverse human rights and environmental impacts—focusing on areas where impacts are most likely to occur and most severe

• Prioritize impacts based on severity and likelihood where full simultaneous action is not possible

• Prevent, mitigate, and remediate identified impacts through appropriate measures, contractual assurances, and support for business partners

• Monitor the effectiveness of measures through periodic assessments

• Communicate publicly on due diligence via an annual statement

Covered impacts include forced labor, child labor, unsafe working conditions, harmful soil changes, water and air pollution, deforestation, and excessive water consumption. The risk-based approach introduced by the Omnibus allows companies to rely on reasonably available information instead of exhaustively mapping every tier of the value chain.

CSDDD Timeline: Key Dates After the Omnibus Amendments

The CSDDD timeline has shifted multiple times. After the Stop-the-Clock Directive (2025) and the Omnibus I amendments (2026), the current dates are set out below. The original phased rollout by company size no longer exists—the Omnibus amendments consolidated the application into a single compliance date for all in-scope companies.

CSDDD timeline: from entry into force in 2024 to annual public statements applying from 2030.

CSDDD vs. CSRD: Key Differences

The CSDDD and the CSRD are complementary but fundamentally different instruments. The CSRD requires companies to report on sustainability matters; the CSDDD requires companies to act on adverse impacts. A company can be subject to both, only the CSRD, or neither.

CSDDD vs. CSRD: a behavioral obligation to act compared with a disclosure obligation to report.

Because the CSRD threshold sits far lower, many companies must report under the CSRD without falling under the CSDDD. Due diligence data and reporting data overlap heavily in practice—companies subject to both benefit from a unified data foundation. Details on the Omnibus changes to the CSRD: CSRD Omnibus: EU postpones sustainability reporting requirements.

CSDDD Compliance: Penalties and Liability

Non-compliance carries substantial consequences even after the Omnibus softened the original framework:

• Administrative penalties: Supervisory authorities in each Member State can impose fines of up to 3% of a company's net worldwide turnover. For a company at the €1.5 billion threshold, this means a maximum potential penalty of €45 million—larger companies face proportionally higher caps. Authorities can also issue injunctions requiring companies to cease violations.

• Civil liability: The Omnibus deleted the harmonized EU-wide civil liability regime. Liability for damages now follows the national law of each Member State, which means exposure varies across the EU. Procedural facilitations for affected persons remain, including rules on limitation periods and court-ordered disclosure of evidence. A review clause allows the EU to reassess a harmonized liability framework in the future.

• Market consequences: CSDDD compliance can become a criterion in public procurement. Companies that fail to address adverse impacts also risk losing business partners who must enforce due diligence standards contractually.

CSDDD and the Supply Chain: Why SMEs Should Prepare

The CSDDD formally targets only the largest companies. In practice, its obligations cascade through entire supply chains: in-scope companies must obtain information from business partners, secure contractual assurances, and terminate relationships where severe impacts cannot be mitigated.

For suppliers, this means: customer questionnaires on human rights and environmental risks, contractual due diligence clauses, requests for emissions and sourcing data, and audits. Suppliers that cannot deliver credible data risk losing key accounts to better-prepared competitors.

The Omnibus introduced safeguards limiting information requests to companies below 5,000 employees—in-scope companies may only request such information where they cannot obtain it by other means. This protects SMEs from excessive data demands but does not eliminate the trickle-down effect. Preparing early with structured sustainability data, for instance on Product Carbon Footprints, turns a compliance burden into a competitive advantage.

From Compliance to Intelligence: The Better Question

Companies that treat the CSDDD as a checkbox exercise collect data once, file a statement, and repeat the scramble every year. Companies that treat due diligence data as a strategic asset answer a better question—not "How do we comply with the CSDDD?" but "How do we use this data for better decisions?"

Supply chain risk data, supplier assessments, and impact analyses feed procurement decisions, product design, and investor communication. The path leads from collecting data through analyzing, governing, and reporting it, toward evolving and scaling sustainability intelligence across the organization.