CSDDD chain of activities and supplier due diligence

Article 3 defines the chain of activities in two parts. Upstream coverage includes business-partner activities related to producing goods or providing services for the company, including design, extraction, sourcing, manufacture, transport, storage, supply of raw materials, products or product parts, and product or service development.

Downstream coverage is narrower. It covers business partners that distribute, transport, or store the company's product for the company or on its behalf. It does not turn every customer use, product disposal route, or downstream service relationship into CSDDD chain-of-activities scope.

The CSDDD separates subsidiaries from business partners. A subsidiary is part of the corporate group definition, while a business partner is an entity connected to the company's operations, products, or services. Direct business partners have a commercial agreement with the company or receive services from it; indirect business partners are not direct partners but still perform related business operations.

This classification matters because group-level due diligence support is possible, but subsidiaries remain subject to supervisory powers and civil liability. Supplier maps should therefore record whether a risk sits in the company's own operation, a subsidiary, a direct business partner, or an indirect business partner.

The Directive does not require every supplier to receive the same questionnaire or the same contractual package. Article 8 requires mapping of own operations, subsidiaries, and business partners to find areas where adverse impacts are most likely to occur and most severe. Article 9 then allows prioritisation when all impacts cannot be addressed at the same time and to their full extent.

A useful segmentation model starts with legal relationship and activity boundary, then adds risk factors: sector, geography, product or service, business operation, company-level factors, stakeholder information, complaints, and known impact history. The output should tell teams where an in-depth assessment is needed, not merely rank suppliers by spend.

Supplier controls should follow the impact finding. Potential adverse impacts point to prevention or mitigation measures; actual adverse impacts point to bringing the impact to an end, minimising its extent, and remediation where the company caused or jointly caused the impact.

The CSDDD examples include prevention and corrective action plans, contractual assurances from direct partners with cascading to relevant partners, verification of those assurances, investments or operational changes, purchasing-practice changes, collaboration, and targeted support for SME business partners where necessary.

Evidence should show why a partner is inside or outside the chain of activities, why a risk was prioritised or deferred, and which measure was selected. A reviewer should be able to trace the decision from the CSDDD definition to supplier facts, impact evidence, owner approval, and monitoring results.

Do not keep only supplier self-attestations. The Directive points to quantitative and qualitative information, independent reports, complaints and notifications, stakeholder input, qualitative and quantitative indicators, and periodic assessments after significant changes and at least every 12 months under the current Directive text.

The current binding CSDDD text covers direct and indirect business partners where their activities fall within the chain of activities. The 2025 Omnibus material in the grounding set describes proposed simplifications, including a proposal to focus normal due diligence on direct business partners with exceptions where there is plausible information about adverse impacts beyond tier 1.

Because that material is a proposal, do not rewrite live supplier policies as if the tier-1 limitation were already the binding rule unless national implementation or adopted EU amendments require it. A practical evidence file can track both views: current Directive basis and proposed-change watch item.