CSDDD: the Corporate Sustainability Due Diligence Directive

The Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760) entered into force on 25 July 2024. It requires in-scope companies to identify, prevent, mitigate and bring to an end adverse human rights and environmental impacts in their own operations, their subsidiaries and their “chains of activities”.

The Directive is built on the international standards most multinationals already use: the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises. What it adds is legal force, a supervisory authority in every Member State and penalties.

It is a due diligence law, not a reporting standard. Its reporting sister is the Corporate Sustainability Reporting Directive, covered on our CSRD guide. The two were amended together by the Omnibus I Directive (EU) 2026/470, published on 26 February 2026 and in force from 18 March 2026.

Omnibus I raised every threshold. The consolidated Article 2 of the CSDDD now reads as follows.

The thresholds must be met in two consecutive financial years. Alternative investment funds and UCITS remain outside scope. Every limb says “more than”: a company with exactly 5,000 employees is outside the EU limb, and so is one with exactly €1.5 billion of turnover.

A UK company is caught directly in two ways. It is caught through the non-EU limb if it generates more than €1.5 billion of net turnover in the EU in two consecutive years. It is also caught if one of its EU subsidiaries meets the EU thresholds on its own.

The indirect route matters more for most UK businesses. An in-scope EU customer must run a risk-based scoping exercise across its chain of activities. Where risks look most likely and most severe, it must assess them in depth, and that is when UK suppliers get questionnaires.

Omnibus I limits those requests. A company may only ask business partners with fewer than 5,000 employees for information that it cannot reasonably obtain by other means.

The UK has no CSDDD equivalent. The closest domestic duty is the annual modern slavery statement under section 54 of the Modern Slavery Act 2015, explained in the Home Office's transparency in supply chains guidance. UK reporting on sustainability runs through UK SRS S1 and S2, which ask for disclosure, not for due diligence.

The core duty is risk-based due diligence. Omnibus I made the first step a scoping exercise “based solely on reasonably available information”, followed by an in-depth assessment only where adverse impacts are most likely and most severe. Companies are not required to map every impact at every entity.

Omnibus I removed the obligation to terminate business relationships as a last resort; suspension remains. It also narrowed who counts as a stakeholder, as Weil's briefing on the final text sets out.

The in-depth assessment carries its own ordering rules in Article 8(2a). A company may request information only where it is necessary. Where several business partners could supply it, the company prioritises asking, where reasonable, the partner where the adverse impact is most likely to occur. Where impacts are equally likely or equally severe in several areas, it may prioritise the areas involving direct business partners. For a UK supplier, that means the questions should arrive only when the customer has flagged a high-risk area, and they should be about that area.

Most CSDDD guidance published before March 2026 now describes repealed law. These are the changes made by Directive (EU) 2026/470. Our Omnibus I guide covers the CSRD side of the same package.

The Stop-the-Clock Directive of April 2025 changed only the dates: it postponed the first application by a year, to July 2028. Omnibus I then replaced the phased tiers altogether with one set of thresholds and one date.

Transition planning has not disappeared entirely. Companies in scope of the CSRD still disclose any climate transition plan they have under the European Sustainability Reporting Standards, explained on our ESRS guide.

The two directives are often read as one package because Omnibus I amended both. They ask different things of different companies on different dates, and each has its own cap on what a customer can demand from a supplier. Switch between them below.

A company can be in scope of the CSRD and not the CSDDD, but not usually the other way round. For the reporting side, see double materiality and our guide to CSRD reporting for UK companies. The European Commission's CSDDD page tracks the guidelines as they are published.

The two caps sit in different directives, protect different suppliers and work in different ways. The CSRD cap is in Article 19a(3) of Directive 2013/34/EU: a reporting undertaking may not require a “protected undertaking”, one with an average of no more than 1,000 employees in the preceding financial year, to provide more than the voluntary standard, and the supplier has a statutory right to decline the excess. The CSDDD cap is in Article 8(2a) of Directive 2024/1760: for the in-depth assessment, a company may ask partners with fewer than 5,000 employees for information only when it cannot reasonably be obtained by other means.

The CSRD cap does not reach due diligence. Its fifth subparagraph says nothing in it affects information requests for other purposes, “including requests for the purpose of complying with Union requirements on undertakings to conduct a due diligence process”. And a CSRD reporter may still ask for more than the cap, but it must say which information exceeds it and tell the supplier it has a right to decline, as the Commission's explanatory note on the value chain cap puts it.

Worked example: one supplier, two customers' questionnaires

A UK precision components maker has 640 employees on average in its last financial year. It sells to an EU machinery group with 7,200 employees and €3.1 billion worldwide turnover, which is in scope of both directives. In the autumn of 2029 the customer sends two questionnaires.

Change one number and the answer moves. At 1,400 employees the supplier is no longer a protected undertaking, so request A can require more than the voluntary standard, but request B is still limited by Article 8(2a). At 6,000 employees neither cap applies. At 640 employees but in 2027, the voluntary standard's cap datapoints already apply to request A for the customer's 2027 financial year, while request B is a commercial request: no Member State has to apply the CSDDD until 26 July 2029.

Nothing in the CSDDD binds a UK supplier directly, and the customer duties start in 2029. The CSRD cap starts sooner, and customers are already mapping their chains. These are the steps that make both kinds of request cheaper to answer.

Step 5 does the most work. Article 8(2a) lets a customer ask only for information it cannot reasonably obtain by other means, so a supplier that publishes a clear risk summary reduces the questions it receives. The voluntary standard, Delegated Regulation (EU) 2026/1560, was published on 21 September 2026 and entered into force on 24 September 2026; its Annex II is the list a protected supplier works from. Our guide to VSME for UK suppliers explains how to build that pack.

For step 8, the £36 million threshold comes from regulation 2 of SI 2015/1833, and turnover includes subsidiaries. A statement that already describes risk assessment and supplier checks answers many of the questions an EU customer's in-depth assessment will ask.

The same Directive lands differently depending on where a UK business sits in the chain. Pick the description that fits; each tab says what applies, what to do next and by when.

The timeline marks what has passed and what comes next as of the day you read it. The CSRD dates are included because the value-chain cap arrives two years before the CSDDD applies.

National laws are starting to appear. Sweden's inquiry proposes a new Corporate Responsibility Act in force on 26 July 2029, with the National Board of Trade as supervisor, according to DLA Piper's summary.

Chain of activitiesArt 3(1)(g)

Upstream business partners’ activities in producing the company’s goods or services, and downstream distribution, transport and storage done for the company.

Business partnerArt 3(1)(f)

A direct partner has a commercial agreement with the company; an indirect one performs business operations related to its operations, products or services.

Scoping exerciseArt 8(2)(a)

The first step of identification, based solely on reasonably available information, to find where adverse impacts are most likely and most severe.

In-depth assessmentArt 8(2)(b)

The second step, carried out only in the areas the scoping exercise flagged; the stage at which suppliers are asked for information.

Information-request capArt 8(2a)

The CSDDD limit on asking business partners with fewer than 5,000 employees for information that can reasonably be obtained by other means.

Value-chain capArt 19a(3), Dir 2013/34/EU

The CSRD limit on requiring more than the voluntary standard from a protected undertaking, for CSRD reporting only.

Protected undertakingArt 19a(3)

An undertaking in a reporter’s value chain with an average of no more than 1,000 employees in the preceding financial year.

Voluntary standardDR (EU) 2026/1560

The EU reporting standard for protected undertakings; its Annex II datapoints are the content of the value-chain cap.

Authorised representativeArt 3(1)

A person resident or established in the EU with a mandate to act for a non-EU company in scope on its CSDDD obligations.

Omnibus IDir (EU) 2026/470

The February 2026 directive that raised the CSDDD thresholds, set one start date and deleted Article 22.