CSDDD chain of activities and supplier due diligence

Article 3 defines the chain of activities in two parts. Upstream coverage includes business-partner activities related to producing goods or providing services for the company, including design, extraction, sourcing, manufacture, transport, storage, supply of raw materials, products or product parts, and product or service development.

Downstream coverage is narrower. It covers business partners that distribute, transport, or store the company's product for the company or on its behalf. It does not turn every customer use, product disposal route, or downstream service relationship into CSDDD chain-of-activities scope.

The CSDDD separates subsidiaries from business partners. A subsidiary is part of the corporate group definition, while a business partner is an entity connected to the company's operations, products, or services. Direct business partners have a commercial agreement with the company or receive services from it; indirect business partners are not direct partners but still perform related business operations.

This classification matters because group-level due diligence support is possible, but subsidiaries remain subject to supervisory powers and civil liability. Supplier maps should therefore record whether a risk sits in the company's own operation, a subsidiary, a direct business partner, or an indirect business partner.

The Directive does not require every supplier to receive the same questionnaire or contractual package. Amended Article 8 requires a scoping exercise based solely on reasonably available information, followed by in-depth assessment in areas where impacts are most likely and most severe. Article 9 then allows prioritisation when all impacts cannot be addressed at the same time and to their full extent.

A useful segmentation model starts with legal relationship and activity boundary, then adds the amended risk factors: business-partner status under comparable mandatory due diligence law, geography and law enforcement, sector, business operation, and product or service. Stakeholder information, complaints, notifications, and known impact history can then sharpen the assessment. The output should tell teams where an in-depth assessment is needed, not merely rank suppliers by spend.

Supplier controls should follow the impact finding. Potential adverse impacts point to prevention or mitigation measures; actual adverse impacts point to bringing the impact to an end, minimising its extent, and remediation where the company caused or jointly caused the impact.

The CSDDD examples include prevention and corrective action plans, contractual assurances from direct partners with cascading to relevant partners, verification of those assurances, investments or operational changes, purchasing-practice changes, collaboration, and targeted support for SME business partners where necessary.

Evidence should show why a partner is inside or outside the chain of activities, why a risk was prioritised or deferred, and which measure was selected. A reviewer should be able to trace the decision from the CSDDD definition to supplier facts, impact evidence, owner approval, and monitoring results.

Do not keep only supplier self-attestations. Use quantitative and qualitative information, independent reports, digital tools, industry or multi-stakeholder initiatives, complaints, notifications, and relevant stakeholder input. Directive (EU) 2026/470 moved the regular assessment cycle to at least every five years while retaining event-driven reassessment for significant changes, credible new risk information, or evidence that measures are ineffective.

Protect trade secrets and classified or state-security information when collecting partner data. The Directive does not require a partner to disclose a trade secret, but it preserves disclosure of partner identity or essential impact-identification information where necessary and duly justified. Record the necessity, requested field, confidentiality control, and any lawful refusal.

Directive (EU) 2026/470 requires a scoping exercise across own operations, subsidiaries and relevant business partners using reasonably available information, followed by in-depth assessment in areas where impacts are most likely and most severe. It does not make direct partners the legal boundary.

Request partner information only where necessary. For a business partner with fewer than 5,000 employees, request it only when the information cannot reasonably be obtained by other means; where equally likely or severe areas remain, the company may prioritise assessment involving direct partners.