EU CSDDDScope Boundary

EU CSDDD (Directive (EU) 2024/1760) Chain of activities and supplier scope

This is the page to use when internal teams argue about what the Directive actually covers.

Get the perimeter right first. Otherwise your mapping, supplier questionnaires, complaint routes, and corrective actions will all be inconsistent.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

The Directive does not cover every commercial relationship. It uses the defined term chain of activities, and that perimeter has sharp boundaries. A good implementation separates what is legally inside the chain from what may still be relevant as business risk but is outside the due diligence duty in Directive terms.

Section 1

Upstream coverage: more than tier one and more than sourcing only

Upstream chain-of-activities coverage includes activities of business partners related to the production of goods or provision of services by the company. The recitals and Article 3 definition point to design, extraction, sourcing, manufacture, transport, storage, supply of raw materials, products or parts, and development of the product or service.

That is why a weak mapping limited to direct suppliers is not enough. The legal question is not whether the partner signs your contract, but whether the activity is connected to the company product or service in the covered part of the chain.

Include direct and indirect business partners where the activity is related to the covered production or service chain.
Capture production design and development steps, not only physical supply.
Use risk based depth so the most severe and likely impacts get more granular analysis.

Section 2

Downstream coverage: narrow for products and excluded for service distribution

Downstream coverage is much narrower than many teams assume. The Directive covers downstream business partners related to distribution, transport, and storage of the product where those activities are carried out for the company or on its behalf.

It does not cover disposal of the product. It also does not include downstream business partners related to the services of the company. That distinction matters for software, platforms, logistics, and service heavy business models.

Product distribution, transport, and storage can be in scope if performed for the company or on its behalf.
Product disposal is outside the chain-of-activities definition.
Downstream services are outside the definition, even if commercially important.

Section 3

Direct and indirect business partners: what changes in practice

The Directive allows companies to use contractual assurances and verification not only with direct business partners but, in certain situations, with indirect business partners as well. That is one reason the chain map has to distinguish contractual reach from factual risk exposure.

A practical operating model keeps one partner register with fields for direct versus indirect, activity type, product or service link, geography, sector, leverage level, and current risk score.

Tag each partner as direct or indirect, but do not stop the analysis there.
Record the activity performed and why it falls inside or outside the chain definition.
Use the same register for prioritization, corrective action plans, and complaints intake routing.

Section 4

Special rule for regulated financial undertakings

For regulated financial undertakings, the downstream part of the chain is carved back even further. The definition does not include downstream business partners that receive their services and products.

That means financial institutions still need upstream analysis, but the customer side is not pulled into the Directive through a generic downstream concept.

Do not copy a manufacturing perimeter into a regulated financial undertaking without checking this rule.
Explain the upstream only downstream treatment in the scope memo.
Coordinate the legal perimeter with any broader voluntary ESG or sector risk work so teams know which controls are legally required and which are discretionary.

Section 5

Boundary decisions that should be written down

Every CSDDD program should maintain a boundary log. This is where you explain why a distributor, warehouse, licensee, platform operator, service reseller, recycler, or logistics partner was treated as inside or outside the chain of activities.

That log becomes critical when complaints arrive, when a supervisory authority asks why a partner was not prioritized, or when legal teams need to defend the scope of an investigation.

Create one boundary memo per material business model or product family.
Cross reference the boundary memo to supplier questionnaires, contract clauses, and grievance channels.
Review the log whenever the business model, product route, or distribution structure changes.

Recommended next step

Operationalize EU CSDDD (Directive (EU) 2024/1760) Chain of activities and supplier scope across ESG workflows

ESG Compliance can take EU CSDDD (Directive (EU) 2024/1760) Chain of activities and supplier scope from operationalizing this sustainability obligation across workflows and reporting to a reusable workflow inside Sorena. Teams working on EU CSDDD (Directive (EU) 2024/1760) can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

ESG workflow

Open ESG Compliance for EU CSDDD (Directive (EU) 2024/1760) Chain of activities and supplier scope

Start from EU CSDDD (Directive (EU) 2024/1760) Chain of activities and supplier scope and manage cross team sustainability work, reporting, and evidence from one workflow.

Explore next step

Talk to Sorena

Talk through EU CSDDD (Directive (EU) 2024/1760)

Review your current process, evidence gaps, and next steps for EU CSDDD (Directive (EU) 2024/1760) Chain of activities and supplier scope.

Explore next step

Primary sources