The Corporate Sustainability Due Diligence Directive (CSDDD, Directive 2024/1760) introduces mandatory human rights and environmental due diligence obligations for large companies operating in or selling into the EU market. It requires companies to identify, prevent, mitigate, and account for actual and potential adverse impacts across their own operations and those of their business partners.

Who does CSDDD apply to?

The Directive applies in two phases based on company size and, for non-EU companies, EU-generated turnover.

EU companies with more than 5,000 employees and a global net turnover exceeding €1.5 billion must comply from July 2027. EU companies with more than 1,000 employees and a global net turnover exceeding €450 million must comply from July 2028.

Non-EU companies are in scope where their EU-generated net turnover exceeds €1.5 billion (applying from July 2027) or €450 million (applying from July 2028).

Certain sectors – including financial services – are subject to specific provisions and timelines that differ from the general application dates.

What does CSDDD require companies to do?

CSDDD establishes a six-step due diligence process derived from the UN Guiding Principles on Business and Human Rights and the OECD Guidelines.

Step 1 – Integrate due diligence: Embed human rights and environmental due diligence into policies and risk management systems. Companies must adopt a due diligence policy describing the approach to the process, updated annually.

Step 2 – Identify adverse impacts: Map actual and potential adverse human rights and environmental impacts in the company's own operations, subsidiaries, and across the chain of activities of business partners. The chain of activities covers upstream supply chain relationships and, for certain industries, downstream activities.

Step 3 – Prevent and mitigate potential impacts: Take appropriate measures to prevent potential adverse impacts from occurring. This includes contractual obligations with business partners, capacity building, and adjusting business relationships where necessary.

Step 4 – Remediate actual adverse impacts: Where adverse impacts have already occurred, take remediation action. Companies must establish a complaints mechanism accessible to affected individuals and civil society organisations.

Step 5 – Monitor effectiveness: Review the effectiveness of the due diligence measures at least annually and update them accordingly.

Step 6 – Communicate: Publish an annual statement on due diligence, in accordance with the EU Corporate Sustainability Reporting Directive (CSRD) for companies also subject to that regime.

What are the penalties for non-compliance?

Member states must establish civil liability regimes permitting individuals and organisations to bring claims for damages caused by failure to comply with the due diligence obligations. Supervisory authorities will have powers to investigate and impose administrative sanctions. Maximum administrative fines must be set at not less than 5% of global net turnover.

What this means for your organisation

  • If your organisation meets the employee and turnover thresholds, CSDDD compliance is mandatory – not a voluntary sustainability commitment. The civil liability provisions mean affected individuals and organisations can bring legal claims for damages.
  • The 2027 and 2028 application dates are closer than they appear. The six-step due diligence process requires supply chain mapping that takes time to complete properly. Organisations should begin now regardless of which application date applies to them.
  • Non-EU companies selling into the EU at significant scale are within scope. This is not a framework that applies only to European businesses.
  • CSDDD does not replace existing obligations – it adds a value chain dimension to human rights and environmental compliance that most organisations have not previously had to manage.

What you should do now

  1. Confirm whether your organisation meets the CSDDD scope thresholds based on employee numbers and EU or global turnover.
  2. Conduct an initial supply chain mapping exercise to identify your direct business partners and, where indicated, indirect suppliers.
  3. Adopt a due diligence policy covering human rights and environmental risks in line with CSDDD Article 5.
  4. Design or review your grievance mechanism against the UNGP Principle 31 effectiveness criteria.
  5. If you are also subject to CSRD reporting obligations, align your due diligence and reporting cycles to avoid duplication.

How Priventia helps

Priventia's Corporate Due Diligence module covers CSDDD obligation mapping, supplier risk assessment, human rights impact assessment, and grievance mechanism design. The six-step due diligence process maps directly to the platform's controls architecture, producing audit-ready documentation at each stage.