The Corporate Sustainability Due Diligence Directive (CSDDD, Directive 2024/1760) introduces mandatory human rights and environmental due diligence obligations for large companies operating in or selling into the EU market. It requires companies to identify, prevent, mitigate, and account for actual and potential adverse impacts across their own operations and those of their business partners.

Who does CSDDD apply to?

Scope is set by company size and, for non-EU companies, by EU-generated turnover. Directive (EU) 2026/470 (the Omnibus I simplification package) amended the original thresholds and replaced the staggered application timetable with a single date.

EU companies are in scope where they have more than 5,000 employees and a global net turnover exceeding €1.5 billion. The lower band in the original Directive, covering companies above 1,000 employees and €450 million turnover, was removed by the amendment.

Non-EU companies are in scope where their EU-generated net turnover exceeds €1.5 billion.

Member States must transpose the Directive by 26 July 2028, and in-scope companies must comply from 26 July 2029.

Certain sectors – including financial services – are subject to specific provisions and timelines that differ from the general application dates.

What does CSDDD require companies to do?

CSDDD establishes a six-step due diligence process derived from the UN Guiding Principles on Business and Human Rights and the OECD Guidelines.

Step 1 – Integrate due diligence: Embed human rights and environmental due diligence into policies and risk management systems. Companies must adopt a due diligence policy describing the approach to the process, updated annually.

Step 2 – Identify adverse impacts: Map actual and potential adverse human rights and environmental impacts in the company's own operations, subsidiaries, and across the chain of activities of business partners. The chain of activities covers upstream supply chain relationships and, for certain industries, downstream activities.

Step 3 – Prevent and mitigate potential impacts: Take appropriate measures to prevent potential adverse impacts from occurring. This includes contractual obligations with business partners, capacity building, and adjusting business relationships where necessary.

Step 4 – Remediate actual adverse impacts: Where adverse impacts have already occurred, take remediation action. Companies must establish a complaints mechanism accessible to affected individuals and civil society organisations.

Step 5 – Monitor effectiveness: Assess the effectiveness of the due diligence measures at least every five years, and update them accordingly. An assessment is additionally required without undue delay after a significant change, and where there are reasonable grounds to believe the existing measures are no longer adequate or effective.

Step 6 – Communicate: Publish an annual statement on due diligence, in accordance with the EU Corporate Sustainability Reporting Directive (CSRD) for companies also subject to that regime.

What are the penalties for non-compliance?

Member states must establish civil liability regimes permitting individuals and organisations to bring claims for damages caused by failure to comply with the due diligence obligations. Supervisory authorities will have powers to investigate and impose administrative sanctions. Maximum administrative fines must be set at not less than 5% of global net turnover.

What this means for your organisation

  • If your organisation meets the employee and turnover thresholds, CSDDD compliance is mandatory – not a voluntary sustainability commitment. The civil liability provisions mean affected individuals and organisations can bring legal claims for damages.
  • The July 2029 application date is closer than it appears. The six-step due diligence process requires supply chain mapping that takes time to complete properly, and national transposition lands a year earlier, in July 2028.
  • Non-EU companies selling into the EU at significant scale are within scope. This is not a framework that applies only to European businesses.
  • CSDDD does not replace existing obligations – it adds a value chain dimension to human rights and environmental compliance that most organisations have not previously had to manage.

What you should do now

  1. Confirm whether your organisation meets the CSDDD scope thresholds based on employee numbers and EU or global turnover.
  2. Conduct an initial supply chain mapping exercise to identify your direct business partners and, where indicated, indirect suppliers.
  3. Adopt a due diligence policy covering human rights and environmental risks in line with CSDDD Article 7.
  4. Design or review your grievance mechanism against the UNGP Principle 31 effectiveness criteria.
  5. If you are also subject to CSRD reporting obligations, align your due diligence and reporting cycles to avoid duplication.

How Priventia helps

Priventia's Corporate Due Diligence module covers CSDDD obligation mapping, supplier risk assessment, human rights impact assessment, and grievance mechanism design. The six-step due diligence process maps directly to the platform's controls architecture, producing audit-ready documentation at each stage.