CSDDD after Omnibus: a due diligence guide

What is the CSDDD

The Corporate Sustainability Due Diligence Directive, officially Directive (EU) 2024/1760, requires certain large companies to conduct risk-based human rights and environmental due diligence across their operations, subsidiaries, and chains of activities. It was adopted on 24 May 2024, published in the Official Journal on 5 July 2024, and entered into force on 25 July 2024. The directive aligns corporate obligations with the UN Guiding Principles on Business and Human Rights (UNGPs) and the OECD Guidelines for Multinational Enterprises.

However, the CSDDD as originally adopted will cease to represent the operative legal framework from 18 March 2026, when the Omnibus I Directive enters into force. On 26 February 2026, the Omnibus I Directive (EU) 2026/470 was published in the Official Journal, amending both the CSDDD and the CSRD in a single legislative act. The Omnibus I Directive enters into force on 18 March 2026. The changes to the CSDDD are structural: the scope has been dramatically narrowed, the climate transition plan obligation has been deleted, the EU harmonised civil liability regime has been removed, and the due diligence process has been recalibrated around a scoping exercise rather than entity-by-entity mapping.

The Omnibus overhaul: what changed

The Omnibus I Directive resulted from the Commission's February 2025 simplification proposals, the Council position of June 2025, the provisional agreement of 9 December 2025, European Parliament adoption on 16 December 2025, and Council formal adoption on 24 February 2026. It was driven by the same competitiveness and proportionality concerns that reshaped the CSRD.

Who is in scope

The Omnibus I Directive raises the CSDDD scope thresholds significantly. SOMO’s April 2026 analysis estimated a 71% reduction in EU corporate groups covered compared with the directive adopted in 2024. This is a dataset-based estimate, not a count of every directly in-scope company worldwide. The thresholds must be met in two consecutive financial years (Article 2(5) of Directive 2024/1760). The directive ceases to apply if the thresholds are no longer met for each of the last two relevant financial years. This provision does not appear to have been amended by Directive 2026/470, but companies should verify against the consolidated text once available.

Timeline

Core due diligence obligations

The CSDDD requires in-scope companies to conduct risk-based human rights and environmental due diligence across their own operations, subsidiaries, and business partners within their "chains of activities." The downstream scope is defined restrictively: limited to distribution, transport, and storage of products. The due diligence process follows a structured sequence, aligned with the UNGPs and OECD Guidelines.

The two-step assessment process (post-Omnibus)

The Omnibus I Directive replaces the previous entity-by-entity mapping obligation with a scoping exercise followed by an in-depth assessment:

1. Scoping exercise: based solely on reasonably available information, companies must identify general areas across their chain of activities (including both direct and indirect business partners) where adverse impacts are most likely to occur and most severe. This is an area-based exercise, not an entity-based mapping of every business partner.
2. In-depth assessment: focused on the areas identified as highest risk. Companies may prioritise obtaining information from direct business partners and may prioritise areas involving direct business partners where risks are equally likely or severe across different areas.

The six-step due diligence process

• Integrate due diligence into policy and risk management: embed due diligence into corporate policies, governance structures, and risk management systems
• Identify and assess adverse impacts: conduct the two-step scoping and in-depth assessment process described above
• Prevent, mitigate, or end adverse impacts: take appropriate measures to address potential and actual impacts. Initial response measures include action plans and seeking contractual guarantees from business partners. If initial measures fail, follow-up measures are required
• Provide remediation: where adverse impacts have occurred, provide or cooperate in providing remediation
• Stakeholder engagement: meaningfully engage with relevant stakeholders. The definition of stakeholders has been narrowed under Omnibus I: consumers are no longer explicitly included. The core categories remain employees, trade unions, communities directly affected by the company's activities, and their legitimate representatives
• Establish a notification and complaints mechanism: implement a procedure allowing individuals and organisations to submit complaints about actual or potential adverse impacts

Monitoring and reporting

Companies must monitor the effectiveness of their due diligence measures at least every five years (previously annually), with ad hoc assessments where circumstances warrant. Unless also subject to the CSRD, companies must publish an annual statement describing their due diligence activities, adverse impacts identified, and measures taken. The Commission must adopt delegated acts setting out the content and criteria for this annual statement by 31 March 2029.

What was removed: transition plans, civil liability, and termination

Climate transition plans: deleted entirely

The original CSDDD required in-scope companies to adopt and put into effect a transition plan for climate change mitigation. The Omnibus I Directive deletes this requirement entirely. Companies are no longer required to adopt or implement a climate transition plan under the CSDDD. However, this deletion does not eliminate climate reporting obligations: companies subject to the ESRS under the CSRD must still disclose whether they have a transition plan and, if so, report on it. Investor expectations, financing conditions, and national laws may also continue to drive transition planning independently of the CSDDD.

Civil liability: returned to national law

The original CSDDD established a harmonised EU-wide civil liability regime, including provisions allowing trade unions and NGOs to bring claims on behalf of injured parties. The Omnibus I Directive removes this regime. Civil liability for CSDDD breaches is now governed by the national tort law of individual Member States. The directive retains the principle that, where liability arises under national law, injured persons must have a right to full compensation (without overcompensation). The harmonised provisions allowing representative actions by NGOs and trade unions have been deleted, though national procedural laws may still permit such claims. The practical implications will vary significantly by jurisdiction. Companies should obtain jurisdiction-specific legal advice on their civil liability exposure once national transposition is complete.

Penalties: capped at 3%

The maximum penalty for non-compliance has been reduced from at least 5% to a cap of 3% of net worldwide turnover. The specific penalty structure will be determined by each Member State during national transposition.

Business relationship termination: replaced with suspension

The obligation to terminate business relationships as a last resort where other measures fail has been replaced with a requirement to suspend business relationships with respect to the relevant activities, where permitted by governing law, until the adverse impact is addressed.

Related EU regulations

The CSDDD does not operate in isolation. Several other EU regulations create overlapping or complementary due diligence obligations that companies should address in an integrated compliance framework:

Ecodesign for Sustainable Products Regulation (ESPR). The ESPR defers social product requirements to the CSDDD framework until at least 2028. See our ESPR Compliance Guide.

• CSRD / ESRS: companies subject to both the CSDDD and the CSRD must report on their due diligence activities under the ESRS (particularly S1–S4 social standards and G1 governance). CSRD reporters are not required to produce a separate annual CSDDD statement. The CSRD sustainability statement satisfies this obligation.
• EU Batteries Regulation: imposes sector-specific supply chain due diligence obligations for battery manufacturers and importers under Articles 47–52 of Regulation (EU) 2023/1542. Companies subject to both the CSDDD and the Batteries Regulation should integrate their due diligence processes to avoid duplication.
• EU Deforestation Regulation (EUDR): requires operators and traders placing certain commodities on the EU market to conduct due diligence to ensure products are deforestation-free and legally produced.
• EU Conflict Minerals Regulation: imposes supply chain due diligence obligations on EU importers of tin, tantalum, tungsten, and gold originating from conflict-affected and high-risk areas.
• National due diligence laws: the French Duty of Vigilance Law (Loi de Vigilance), the German Supply Chain Due Diligence Act (LkSG), and the Norwegian Transparency Act already impose similar obligations in specific Member States. Companies should assess how national transposition of the CSDDD interacts with these existing regimes.

How to prepare

July 2029 gives companies time to prepare, but the work will involve several teams. Scoping, stakeholder engagement, grievance mechanisms and links with CSRD reporting all need to be developed and tested. We suggest reviewing existing processes now, then refining the approach as the subject-specific Commission guidelines and national rules become available. The statutory guidance deadlines fall in July 2027 and July 2028, with national transposition due in July 2028.

Step 1: Confirm your scope status

Determine whether your organisation meets the thresholds (5,000+ employees and €1.5B+ turnover for EU companies) in two consecutive financial years. If you do not meet the thresholds directly, assess whether you are a significant business partner of in-scope companies. If so, anticipate information requests and prepare to respond.

Step 2: Conduct a gap analysis against the six-step process

Map your existing due diligence practices against the CSDDD's six-step process: policy integration, impact identification and assessment, prevention/mitigation/ending of impacts, remediation, stakeholder engagement, and grievance mechanisms. Identify where current processes meet CSDDD requirements and where gaps exist.

Step 3: Design and pilot the scoping exercise

The scoping exercise is new under Omnibus I and replaces the previous entity-by-entity mapping obligation. Develop a methodology for identifying the areas of your chain of activities where adverse impacts are most likely and most severe. Consider geography, sector, product type, and business partner risk factors. Pilot the scoping exercise before the Commission guidelines are published. Early iterations will inform your final methodology.

Step 4: Integrate with CSRD reporting and existing due diligence

If your organisation is also subject to the CSRD, design your due diligence programme to feed directly into your ESRS reporting (particularly S1–S4 and G1). If you are subject to national due diligence laws (French Loi de Vigilance, German LkSG), assess how the CSDDD interacts with those existing obligations and identify efficiencies.

Step 5: Monitor national transposition and Commission guidelines

Track transposition progress in the Member States where you operate. Watch for the subject-specific Commission guidelines (statutory deadlines in July 2027 and July 2028) and the delegated acts on annual statement content (due by March 2029). Member States retain discretion on enforcement mechanisms and penalties. The national implementation may differ from the directive text.

Frequently asked questions

Conclusion

The amendments narrow the CSDDD’s scope and change how companies will assess risks, plan their work and consider liability. For companies that remain in scope, the central task is still to identify and address human rights and environmental impacts through risk-based due diligence.

We suggest using the time before July 2029 to test the scoping method, assign responsibilities and check whether stakeholder engagement and grievance mechanisms work as intended. Where CSRD reporting also applies, connect that work to the reporting process. This gives teams a clearer basis for acting on the risks they identify and explaining what they have done.

Disclaimer: This article is intended as a practical orientation guide, not legal advice. It reflects information available as of mid-March 2026, following the publication of Directive (EU) 2026/470 in the Official Journal on 26 February 2026. Key elements remain in motion: Member State transposition of CSDDD provisions (deadline 26 July 2028), European Commission guidelines on due diligence obligations (subject-specific deadlines of 26 July 2027 and 26 July 2028), delegated acts on annual statement content and criteria (due by 31 March 2029), and potential variations in national implementation of penalties, enforcement, and civil liability. Readers should verify all compliance-critical obligations against the authoritative legal text on EUR-Lex and the transposing legislation in relevant Member States, and seek qualified legal counsel before making compliance decisions. Futureproof Solutions monitors regulatory developments continuously and updates this guidance accordingly.