CSDDD Explained: EU Supply Chain Due Diligence After the Omnibus Rewrite

The Corporate Sustainability Due Diligence Directive (CSDDD) has had one of the bumpier journeys of any recent EU sustainability law — delayed, narrowed, and reshaped by the European Commission's "Omnibus" simplification process before it has even taken effect. For finance and compliance teams tracking ESG regulation alongside CSRD, it's worth understanding exactly where CSDDD now stands, because the rules that will eventually apply look quite different from what was originally agreed.

What is CSDDD?

CSDDD requires large companies to identify, prevent, mitigate and account for adverse human rights and environmental impacts in their own operations, their subsidiaries, and — this is the distinctive part — their chains of activities, including certain business partners. It's a due diligence obligation, not just a disclosure one: unlike CSRD, which is primarily about reporting what a company is doing, CSDDD requires companies to actually run a due diligence process and take action on what it uncovers.

Core obligations include: embedding due diligence into corporate policies and risk management systems; identifying actual and potential adverse impacts; preventing and mitigating potential impacts; bringing actual impacts to an end or minimising their extent; providing remediation where the company caused or contributed to harm; carrying out meaningful engagement with affected stakeholders; establishing a complaints and notification mechanism; and monitoring the effectiveness of the due diligence measures with public communication on the process.

The Omnibus rewrite: what changed

CSDDD was formally adopted in 2024 with a phased transposition timeline starting in 2027. But the European Commission's Omnibus I simplification package, finalised in 2026, substantially reworked the directive before most companies had even begun preparing for it. The key changes:

• Later timeline. The deadline for member states to transpose CSDDD into national law has moved from July 2026 to July 2028, with company-level applicability now expected from July 2029 — giving companies roughly an extra year of runway compared to the original schedule.
• Narrower scope. The original directive would have captured a much broader band of large companies. Under the revised thresholds, CSDDD now applies only to EU companies with more than 5,000 employees and over €1.5 billion in net worldwide turnover, and to non-EU companies generating more than €1.5 billion in turnover within the EU. This is a significant narrowing that removes many mid-sized multinationals from scope entirely.
• Risk-based rather than exhaustive due diligence. Companies can now focus due diligence effort on the impacts "most likely to occur" within their operations and value chain, rather than being expected to conduct universal, exhaustive assessments across every supplier and business relationship.
• Less frequent monitoring. The obligation to monitor and update due diligence measures has moved from an annual cycle to at least every five years, easing the ongoing compliance burden considerably.
• Civil liability softened. The original directive's harmonised EU-wide civil liability regime — which would have let claimants sue companies directly for CSDDD breaches under a common standard — has been removed. In its place is a review clause considering whether an EU-wide regime is needed in future, with individual member states retaining discretion over their own national liability frameworks in the meantime. Maximum administrative penalties remain capped at 3% of a company's consolidated worldwide net turnover.

How CSDDD relates to CSRD and existing supply chain rules

It's easy to conflate CSDDD with CSRD, and finance teams already stretched across CSRD reporting obligations may reasonably wonder whether CSDDD is just more of the same. It isn't: CSRD is a disclosure regime requiring companies to report on sustainability matters using a standardised framework, largely sitting with finance and reporting teams. CSDDD is an operational and legal obligation to actually run due diligence and remediate harm, and typically sits more with legal, procurement, risk and sustainability functions — though finance teams are frequently pulled in for budgeting, supplier risk assessment and internal controls work.

CSDDD also isn't the only EU or UK due diligence law in this space. UK-headquartered or UK-operating businesses should already be familiar with modern slavery and supply chain due diligence obligations under existing law — see our guide to modern slavery and supply chain due diligence for the UK-specific picture, which continues to apply regardless of how CSDDD's EU timeline develops.

What finance teams should do now

• Check whether your organisation, or your ultimate parent, now falls within the narrowed 5,000-employee / €1.5 billion turnover threshold — many companies that expected to be in scope under the original directive no longer are.
• Don't discard CSRD or existing supply chain due diligence work done in anticipation of CSDDD — much of it remains relevant to disclosure obligations and to national due diligence laws that predate CSDDD (such as France's duty of vigilance law or Germany's Supply Chain Act).
• Build the 2028–2029 timeline into medium-term compliance planning rather than treating it as urgent — but keep monitoring, since the Omnibus process has shown EU sustainability legislation can still move.
• Watch for national transposition choices, since member states retain some discretion, particularly around civil liability.

FAQ

Does CSDDD still apply to mid-sized companies?
No — the Omnibus revisions narrowed scope to companies with over 5,000 employees and over €1.5 billion in turnover (or non-EU companies generating that turnover within the EU), removing most mid-sized businesses from scope.

When does CSDDD actually take effect?
Member states must transpose it into national law by July 2028, with applicability to in-scope companies from July 2029.

Is there still an EU-wide right to sue companies under CSDDD?
Not currently — the harmonised civil liability regime was removed during the Omnibus process, replaced by a future review clause, with liability left to national frameworks in the meantime.

CSDDD is a good example of how quickly ESG and sustainability regulation continues to shift, even after formal adoption. Learnsignal's CPD courses are updated to reflect exactly this kind of regulatory movement, so your sustainability and compliance knowledge doesn't go stale between sittings.