CSDDD for companies: The EU law at a glance

Abstract

The CSDDD has been in effect since July 25, 2024, but was amended twice before it was first applied. The “Stop-the-Clock” Directive (EU) 2025/794 initially postponed the deadlines. This was followed by a substantive realignment through amending Directive (EU) 2026/470 from the Omnibus I package, published on February 26, 2026, and in effect since March 18, 2026. This brings an end to the legal uncertainty at the EU level.

The group of companies directly subject to the directive has shrunk significantly. Instead of 1,000 employees and 450 million euros in revenue, the thresholds are now set at 5,000 employees and 1.5 billion euros. The directive has also been scaled back in terms of its scope: Companies may focus on the areas where the most severe and likely impacts occur, rather than mapping the entire supply chain.

For decision-makers, this means: First, check whether your company or corporate group still falls within the scope of the law. Those affected have until July 2029 to establish an effective due diligence system. Those not affected will, for the time being, remain subject to the LkSG in Germany and, as suppliers to large customers, will still be required to provide evidence, albeit to a more limited extent.

What is the CSDDD?

The Corporate Sustainability Due Diligence Directive (CSDDD) is the European supply chain directive. It stipulates that large companies must systematically manage risks to human rights and the environment in their own business operations, at their subsidiaries, and among their business partners. In German, it is usually referred to as the EU Supply Chain Act or the EU Supply Chain Directive.

Legal Basis and Origin

Directive (EU) 2024/1760 was published in the Official Journal of the EU on July 5, 2024, and entered into force on July 25, 2024. Its content is based on the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises. The CSDDD makes the due diligence process outlined in these guidelines mandatory for covered companies.

CSDDD and CSRD: What's the difference?

The CSRD (Corporate Sustainability Reporting Directive) governs how companies report on sustainability. The CSDDD governs how they manage risks in their supply chain. One is a reporting requirement, the other an obligation to take action. For companies subject to both sets of regulations, however, data and structures can be easily integrated—for example, when due diligence findings are incorporated into ESRS reporting.

Current Status: What Has Changed as a Result of Omnibus I?

The Omnibus I Package has significantly streamlined the CSDDD. Amending Directive (EU) 2026/470 was published in the Official Journal of the EU on February 26, 2026, and entered into force 20 days after its publication, on March 18, 2026. The European Parliament approved the agreement on December 16, 2025, and the Council on February 24, 2026. In some respects, the amendments go significantly beyond the European Commission’s original proposal.

An overview of the key changes to the EU Supply Chain Directive:

• Scope of Application: The thresholds increase from 1,000 to 5,000 employees and from 450 million to 1.5 billion euros in net revenue (Art. 2 CSDDD, as amended).
• Timeline: Implementation by July 26, 2028; uniform application beginning July 26, 2029. The phased implementation based on company size will no longer apply.
• Risk-based approach: Companies may focus on the areas where negative impacts are most likely and most severe (Art. 8(2) CSDDD, as amended). A scoping analysis replaces a full mapping of the value chain.
• Protection of Smaller Business Partners: Requests for information from partners with fewer than 5,000 employees are permitted only if the information cannot be obtained by other means (Art. 8, para. 2a, CSDDD, as amended).
• Climate Transition Plan: The requirement has been completely removed from the EU Supply Chain Act. Provisions regarding climate plans are now found only in the CSRD.
• Civil Liability: The EU-wide basis for liability is eliminated. A review clause and procedural simplifications for affected parties remain in place.
• Fines: The cap is set at 3% of global net revenue instead of at least 5%.

Why the risk-based approach is the biggest practical change

Under the original version, companies would have had to document their entire chain of activities down to the lowest levels of the supply chain. Now, a scoping analysis is sufficient, for which companies may rely on information that is reasonably available. A more in-depth review is conducted where the risks are highest.

However, the risk-based approach is not a free pass. If there is objective evidence of violations by a business partner, a company must take a closer look—even beyond its direct suppliers. And the prioritization itself must be justified in a transparent manner and documented.

What's Next

The European Commission is expected to publish guidelines on the application of the European Supply Chain Directive by July 2027, including guidelines on the calculation of fines. At the same time, member states are working on their implementing legislation. Both developments are crucial for how the directive will be implemented within companies.

Which companies are affected?

According to Omnibus I, only very large companies are affected by the EU Supply Chain Directive. The key factors are the number of employees and revenue, not the industry. The directive applies across all industries to corporations and comparable legal forms; in Germany, this includes, in particular, AGs, KGaAs, and GmbHs, as well as partnerships such as GmbH & Co. KG.

CSDDD Thresholds for EU Companies

EU companies fall within the scope of this regulation if they meet both of the following criteria:

• more than 5,000 employees on average, and
• More than 1.5 billion euros in global net revenue.

Upper-level parent companies whose corporate groups exceed these thresholds are also included. For corporate groups, therefore, it is not just the individual company but the group level that must be examined.

Does the CSDDD apply to non-EU companies?

Yes. Non-EU companies are subject to this requirement if they or their corporate group generated more than 1.5 billion euros in net revenue in the EU during the second-to-last completed fiscal year. There is no employee threshold in this case. The sole determining factor is EU revenue, regardless of whether the company has a branch in the EU.

Are small and medium-sized businesses still affected?

Generally speaking, not directly. With the threshold raised to 5,000 employees, most companies currently covered by the German Supply Chain Act (LkSG) will fall outside the direct scope of the Supply Chain Directive. This particularly affects upper-mid-sized companies, which had previously been preparing for the 1,000-employee threshold.

What does the CSDDD mean for SMEs and suppliers?

SMEs and suppliers are not directly obligated, but they are indirectly involved. Major customers subject to the CSDDD pass on requirements through contracts, codes of conduct, supplier questionnaires, and audits. This so-called trickle-down effect was one of the main points of criticism regarding the original version.

Omnibus I now explicitly limits this. Information may be requested from business partners with fewer than 5,000 employees only if, based on reasonable judgment, it cannot be obtained by any other means. For suppliers, this means that requests from customers must be proportionate and targeted. Blanket questionnaires without a risk-related basis are therefore more difficult to justify.

When does the CSDDD take effect?

The CSDDD will apply to companies starting July 26, 2029. Member states must transpose the directive into national law by July 26, 2028. This means the EU Supply Chain Act has been postponed twice: Originally, the first companies were supposed to begin compliance as early as 2027.

Key milestones:

1. July 25, 2024: The EU Supply Chain Directive (Directive (EU) 2024/1760) enters into force.
2. April 2025: The “Stop-the-Clock” Directive (EU) 2025/794 postpones its implementation and application by one year.
3. February 26, 2026: Amending Directive (EU) 2026/470 from the Omnibus I package is published in the Official Journal.
4. March 18, 2026: The changes take effect.
5. July 2027: The European Commission is expected to present its guidelines on implementation.
6. July 26, 2028: Deadline for transposition into national law.
7. July 26, 2029: The due diligence requirements apply to all covered companies.

Unlike in the original version, there is no longer a tiered system based on company size. All companies included in the survey will begin on the same reference date.

Why Companies Shouldn't Wait Until 2029 After All

An effective due diligence system cannot be established in just a few months. Experience shows that risk analysis, supplier contracts, complaint procedures, and data flows require one to two years of lead time in large corporations. In addition, the LkSG will continue to apply in Germany until it is implemented. Those who structure their processes now to cover both sets of regulations will avoid duplicating work.

What due diligence requirements does the CSDDD impose?

The CSDDD does not require a one-time audit, but rather an ongoing management process. Companies must identify, prioritize, prevent, or address adverse impacts on human rights and the environment, and report on them. The individual steps are set forth in Articles 7 through 16 of the Directive.

Which measures are effective in practice?

Measures are most effective when they address the root causes. For example, unrealistic delivery times often lead to overtime for suppliers. In this case, another questionnaire won’t help; what’s needed is adjusted procurement planning. The following, among other things, have proven effective:

• Supplier Code of Conduct with clear requirements for each product category and risk level
• Contract clauses that transfer obligations to suppliers and safeguard inspection rights
• Corrective action plans with deadlines, responsible parties, and measurable objectives
• Training for Purchasing and Suppliers
• Independent inspections where the risk is high, rather than blanket audits

If a serious risk cannot be mitigated despite all efforts, companies must, as a last resort, suspend or terminate the business relationship. In doing so, they should consider the consequences that a withdrawal would have for local employees.

Why the complaint process plays a key role

A complaint procedure brings to light risks that do not appear in audits or databases. It must be easily accessible, even to affected individuals outside the EU, and provide protection against retaliation. Equally important is a clear process for how reports are investigated, escalated, and addressed. Many companies use a digital whistleblower system for this purpose, which they have already set up to comply with the Whistleblower Protection Act and the LkSG.

Case Study: Risk Analysis at a Mechanical Engineering Group

A German mechanical engineering group with 8,000 employees and 2.4 billion euros in revenue falls within the scope of the CSDDD. It sources castings from several foundries in Asia and electronic components containing tin, tantalum, and gold.

The scoping study shows that the risks lie less with German system suppliers than with foundries (occupational safety, working hours) and in the electronics raw materials supply chain (conflict minerals). The Group is focusing its in-depth review on these two areas. For all other product groups, the Supplier Code of Conduct and contractual clauses are sufficient.

An electronics supplier with 300 employees is required to provide information on the origin of the metals. Before the corporation makes a request, it reviews public sources, certifications, and smelter lists from industry initiatives. Only if this information is insufficient does it specifically request the missing data. This ensures that the request remains proportionate, as required by Art. 8(2a) of the CSDDD (as amended).

What fines and penalties can be imposed for violations?

Violations of the CSDDD may result in fines of up to 3% of global net revenue (Art. 27(4) CSDDD, as amended). Member States will determine the exact amount in their implementing legislation. The European Commission is expected to publish guidelines on this matter.

Who monitors compliance?

Each Member State designates one or more supervisory authorities. These authorities may request information, initiate investigations, conduct on-site inspections, and issue orders. At the EU level, a network of supervisory authorities coordinates cooperation in cross-border cases. In Germany, the Federal Office for Economic Affairs and Export Control (BAFA) is currently responsible for the LkSG.

Individuals and organizations may contact the agency directly. If there is objective evidence of a violation, they may submit substantiated concerns.

What other penalties are possible besides fines?

• Orders: The agency may require a company to cease violations, improve its processes, or take corrective action within a specified time frame.
• Publication: Decisions regarding violations may be made public. For many companies, this “naming and shaming” carries a heavier burden than the fine itself.
• Public Procurement: Depending on national implementation, compliance with the CSDDD may be taken into account in public procurement.

Are companies liable under civil law?

Under Omnibus I, there is no longer a uniform EU civil liability regime. Whether and how companies are liable for damages is governed by the national laws of the member states. However, a review clause allows the EU to reexamine a harmonized liability framework at a later date.

Procedural concessions for those affected also remain in place. For example, under Art. 29 of the CSDDD (as amended), courts must continue to have the authority to order companies to disclose evidence within their control. For companies, this means that maintaining thorough documentation of their due diligence measures remains their best defense.

The Main Differences Between the CSDDD and the LkSG

• Scope of Application: The LkSG has been in effect since January 1, 2024, for companies with at least 1,000 employees in Germany. Under Omnibus I, the CSDDD applies only to companies with 5,000 or more employees and revenue of 1.5 billion euros, which is a significantly smaller group.
• Environmental obligations: The EU directive takes a broader view of environmental impacts, while the German Supply Chain Act is limited to specific environmental obligations under international agreements.
• Scope within the supply chain: The LkSG focuses on the company’s own business operations and direct suppliers; indirect suppliers become relevant only when there is substantiated knowledge of them. The CSDDD considers the entire chain of activities but, under Omnibus I, allows for a clear focus on key risk areas.
• Oversight: The LkSG oversees the BAFA. The CSDDD is enforced by national authorities in all member states, which coordinate their efforts at the EU level.

LkSG Amendment: What Will Change Before It Takes Effect

The federal government has introduced an amendment to the LkSG that will serve as a transitional measure until the law is fully implemented. The key points are:

• The annual reporting requirement under Section 10 of the LkSG is to be retroactively eliminated. The BAFA has not been reviewing reports since the fall of 2025.
• Fines should only be imposed in cases of serious breaches of duty.
• The fundamental duties of care remain fully in effect.

Important: The elimination of the reporting requirement does not mean that documentation is no longer necessary. Companies must still be able to provide evidence of their due diligence measures if the BAFA requests it.

How is the CSDDD implemented in Germany?

According to the federal government’s plans, the LkSG is to be replaced by a new law on international corporate responsibility. This law is intended to transpose the CSDDD into German law by July 2028. Companies should closely monitor the legislative process. It is already foreseeable that the implementation of this law will significantly reduce the number of companies subject to these obligations in Germany.

Which companies must comply with both laws?

Companies with more than 5,000 employees and 1.5 billion euros in revenue are currently subject to the LkSG and, starting in 2029, to the implemented CSDDD. For these companies, a unified system is worthwhile: a risk analysis, a complaint procedure, and a compliance framework. Additional components are needed only where the EU directive goes beyond the LkSG, particularly with regard to environmental obligations.

Companies with between 1,000 and 5,000 employees will remain subject to the LkSG until it is implemented. After that, as things stand today, they are expected to be exempt from the direct requirement but will continue to be involved as suppliers to large customers.

Special Cases and Challenges in Implementing the CSDDD

Most problems with CSDDD do not arise from a lack of understanding of the obligations, but rather from their implementation within complex structures. In practice, four factors in particular often lead to misjudgments.

Corporations: Decisions Are Made at the Group Level

A single subsidiary may fall below the thresholds and still be affected because the ultimate parent company within the group exceeds the thresholds. Conversely, a parent company may fulfill its due diligence obligations for its subsidiaries on a consolidated basis. Therefore, always assess the scope of application at the group level and coordinate responsibilities between the holding company and its subsidiaries early on.

Non-EU corporations with European subsidiaries

For companies from third countries, only the group’s EU revenue counts. A U.S. corporation with European sales subsidiaries may be subject to the rules even if no single company in the EU meets the thresholds. In such cases, the German subsidiary is not automatically responsible; rather, the company that meets the criteria is responsible. Non-EU companies must also appoint an authorized representative in the EU.

Certificates are no substitute for a system

Certifications and social audits provide important insights, but they often capture only snapshots of a given moment and are susceptible to superficial compliance. Regulatory authorities expect companies to combine multiple sources: audits, complaints, internal metrics, public reports, and, where available, environmental or geographic data. Those who rely solely on certifications will find it difficult to defend their risk analysis in the event of a crisis.

Interaction with Other EU Regulatory Frameworks

The CSDDD rarely stands alone. For many companies, the Deforestation Regulation (EUDR), the Battery Regulation, chemicals legislation (REACH), or the CSRD apply in parallel. Separate, isolated solutions for each regulation result in duplicated effort and conflicting data. A more efficient approach is a shared risk and data platform that addresses multiple obligations simultaneously.

Conclusion

With Omnibus I, the EU has significantly watered down the Supply Chain Act. Fewer companies are directly affected, the obligations are more risk-based, and the climate plan and EU-wide liability have been removed. The basic idea remains, however: Large companies must demonstrably manage risks to people and the environment in their supply chains. And through the Supply Chain Act (LkSG) and the requirements of major customers, the issue remains relevant even for many companies that are not directly covered by the law.

Five questions to help you assess whether you need to take action:

• Do you know whether your company or corporate group exceeds the new thresholds of 5,000 employees and 1.5 billion euros in revenue?
• Can you identify the areas of your supply chain that pose the greatest risks, and is this prioritization documented?
• Do you have a complaint procedure that is reliably accessible to affected individuals outside the EU and protects them from retaliation?
• Are your requests to suppliers designed to be risk-based and proportionate?
• Do your current processes comply with the LkSG, and can they be expanded to meet the CSDDD requirements without having to be rebuilt?

If any of these questions remain unanswered, now is the right time to lay the groundwork. A key component is a complaint procedure that simultaneously meets the requirements of the LkSG, CSDDD, and the Whistleblower Protection Act. With lawcode’s whistleblower system, you can implement exactly that in a single system and document every report in a traceable manner, from receipt to resolution.