Draw the CSDDD boundary between own operations, subsidiaries, upstream business partners, and limited downstream product activities.
Use the boundary record to decide which entities, activities, partners, and evidence records belong in the due diligence file.
Structured answer sets in this page tree.
Cited legal and guidance references.
Under the Corporate Sustainability Due Diligence Directive, the chain of activities is not the same as the whole value chain. It covers a company's own operations and subsidiaries through the due diligence duties, then defines which business-partner activities count upstream and which downstream product activities count only when they are carried out for or on behalf of the company.
Build the boundary map in three layers. First list the company's own operations. Second list subsidiaries, because CSDDD due diligence covers actual and potential adverse impacts arising from the company's own operations or those of its subsidiaries. Third list business partners only where their activities relate to the company's chain of activities.
The directive defines a direct business partner as an entity with a commercial agreement related to the company's operations, products, or services, or an entity to which the company provides services under the chain-of-activities definition. An indirect business partner is not direct, but performs business operations related to the company's operations, products, or services.
For borderline cases, use the chain test: include the partner if its activity is part of producing, moving, storing, or servicing the company's goods or services, and exclude it if the link is only a general commercial relationship. For downstream services, include distribution, transport, and storage only when the partner acts for or on behalf of the company.
Use Sorena to keep CSDDD chain-of-activities classifications tied to the source rule, partner record, contract evidence, and monitoring review.
Upstream coverage is broad. It includes activities of upstream business partners related to production of goods or provision of services by the company, including design, extraction, sourcing, manufacture, transport, storage, supply of raw materials, products or product parts, and development of the product or service.
Downstream coverage is narrower. It covers activities of downstream business partners related to distribution, transport, and storage of the company's product only where those partners carry out those activities for the company or on behalf of the company. The directive does not make ordinary customer use, product disposal, or unrelated downstream services part of this definition.
A parent company may fulfil certain CSDDD obligations on behalf of in-scope subsidiaries where the conditions in Article 6 are met, but that does not erase the subsidiary from the boundary map. The subsidiary and parent must provide each other necessary information, the subsidiary must integrate due diligence into its policies and risk management systems, and the subsidiary remains subject to supervisory powers and civil liability.
For boundary evidence, keep one record for the group-level allocation and another record for each subsidiary's operational perimeter. This avoids the common mistake of treating a group policy as proof that subsidiary-specific operations, partners, and impacts have been mapped.
The direct or indirect label matters because CSDDD uses it in the control design. Prevention and corrective measures can include contractual assurances from direct business partners, cascading assurances to partners where their activities are part of the chain of activities, and, where impacts cannot otherwise be addressed, assurances from indirect business partners.
Do not classify every lower-tier supplier as out of reach. Article 8 requires mapping business partners where related to the chain of activities and directs companies to request information, where reasonable, from business partners at the levels where adverse impacts are most likely to occur.
A defensible boundary file should let a reviewer reproduce the classification. It should show the product or service, the entity, the partner relationship, the activity performed, the upstream or downstream side, the inclusion or exclusion rule, the source citation, and the owner who approved the decision.
The record should also connect to due diligence monitoring. Article 15 requires periodic assessments of the company's own operations and measures, those of subsidiaries, and, where related to the chain of activities, those of business partners. Boundary records should therefore be reviewed after significant changes and against regular monitoring outputs.
"at least every 12 months"
"keeping all documentation"