We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

CSDDDChecklistEU

CSDDD due diligence Checklist

A checklist for applying Directive (EU) 2024/1760 as amended: scope assessment, due diligence policy, risk mapping, prevention, corrective action, remediation, complaints, monitoring, public communication, and climate-duty status.

Use it to test whether a CSDDD programme has the required records and decision points before management review, supplier engagement, or public reporting.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
8 sections4 primary sources
Overview

readiness starts with amended scope and timing, then moves through a reasonably-available-information scoping exercise, in-depth assessment where impacts are most likely and most severe, impact prioritisation, proportionate action, stakeholder engagement, complaints, remediation, five-year and event-driven monitoring, and public communication. Directive (EU) 2026/470 removed the standalone climate-plan duty.

Section 1

1. Confirm CSDDD scope before building the programme

Record the legal entity, group position, financial year, employee count where relevant, worldwide turnover, EU turnover for non-EU companies, and any franchising or licensing model. Do not treat supplier pressure or customer requests as proof that the company itself is directly in scope.

For EU companies, check whether the company or ultimate parent exceeds the Article 2 employee and turnover thresholds. For third-country companies, check EU net turnover and group status. For franchising or licensing models, capture royalty and turnover facts separately because the directive treats them as a distinct route into scope.

  • EU company check after Directive (EU) 2026/470: generally more than 5,000 employees on average and more than EUR 1.5 billion net worldwide turnover, including the relevant ultimate-parent group route.
  • Third-country company check after Directive (EU) 2026/470: generally more than EUR 1.5 billion net turnover in the Union, including the relevant ultimate-parent group route.
  • Franchise or licence check: more than EUR 75 million in qualifying royalties in the Union and more than EUR 275 million turnover, using worldwide turnover for EU companies and Union turnover for third-country companies.
  • Duration check: the relevant Article 2 conditions must be met for two consecutive financial years; a company ceases to be covered if it no longer meets them for each of the last two relevant financial years.
  • Holding-parent exception: an ultimate parent whose main activity is holding shares and that does not make management, operational, or financial decisions affecting the group may obtain the Article 2(3) exemption only if an EU subsidiary is designated to fulfil the parent's obligations and the competent supervisory authority grants the exemption.
  • Group governance check: if a parent intends to perform due diligence obligations for subsidiaries, document the information flow, delegated authority, subsidiary adaptation, and remaining subsidiary responsibilities.
  • Evidence to keep: two-year threshold calculation, entity chart, financial statement reference, EU turnover basis, franchise or royalty analysis, any holding-parent exemption and designated-subsidiary record, and the supervisory authority or authorised representative assessment for non-EU companies.
Section 2

2. Integrate due diligence into policies and risk management

The policy step is not a standalone statement. Article 7 requires due diligence to be integrated into relevant policies and risk management systems, with a due diligence policy developed after prior consultation with employees and their representatives.

The checklist should verify that the policy explains the company's long-term due diligence approach, includes a code of conduct for the company, subsidiaries, and relevant business partners, and describes how due diligence processes are implemented, verified, and extended to business partners.

  • Assign owners for policy, risk management, procurement, sustainability, legal, human rights, environment, and subsidiary coordination.
  • Map each policy control to Articles 5 and 7 to 16: identify, prioritise, prevent, correct, remediate, engage, receive complaints, monitor, and communicate.
  • Define how the code of conduct flows to direct and indirect business partners in the chain of activities.
  • Set update triggers for significant changes and a scheduled policy review at least every 24 months.
  • Evidence to keep: policy version, employee consultation record, code of conduct, business-partner flow-down mechanism, risk-management integration note, and policy review log.
Section 3

3. Map the chain of activities and identify adverse impacts

Build the risk map around the CSDDD chain of activities, not an undefined supply-chain label. The directive covers own operations, subsidiaries, and, where related to chains of activities, business partners.

For goods and services, record upstream production or service inputs and covered downstream distribution, transport, and storage activities. Keep regulated financial undertakings separate because the directive describes a narrower chain-of-activities treatment for them.

  • Create a chain-of-activities inventory by entity, subsidiary, business partner, activity, country, sector, product or service, and relationship type.
  • Use company-level, business-operation, geographic and contextual, product and service, and sectoral risk factors when selecting areas for in-depth assessment.
  • Use quantitative and qualitative information, including independent reports, stakeholder input, notification data, and complaints data where appropriate.
  • Request information only when necessary for the in-depth assessment. For a business partner with fewer than 5,000 employees, request it only when it cannot reasonably be obtained by other means; where several partners can provide it, prioritise the partner where the impact is most likely to occur.
  • Evidence to keep: risk map, methodology, data sources, country and sector risk factors, selected in-depth assessment areas, and reasons for any missing chain data.
Section 4

4. Prioritise impacts by severity and likelihood

CSDDD prioritisation is allowed when not all identified impacts can be addressed at the same time and to their full extent. The record should therefore show why an impact was addressed first, not only that it appeared on a risk register.

Use severity and likelihood as the prioritisation test. Severity should capture scale, scope, and irremediable character, including how many people may be affected, environmental extent, irreversibility, and the ability to restore people or the environment within a reasonable period.

  • Score potential and actual adverse impacts separately so prevention and corrective work are not blurred.
  • Document severity, likelihood, affected stakeholders, environmental receptors, location, sector, product or service, and business-partner relationship.
  • Do not rank impacts lower because the company has limited influence over a partner or because the impact is remote in the chain; consider that influence later when selecting measures.
  • After the most severe and most likely impacts are addressed within a reasonable time, schedule work on less severe and less likely impacts.
  • Evidence to keep: prioritisation criteria, scored impact register, rationale for sequencing, management approval, and next review trigger.
Section 5

5. Choose prevention, corrective action, and remediation measures

Separate potential adverse impacts from actual adverse impacts. Potential impacts need prevention or mitigation measures under Article 10; actual impacts need measures to bring the impact to an end, minimise its extent, and, where the company caused or jointly caused the impact, provide remediation under Articles 11 and 12.

The action-plan record should explain the company's involvement, whether the issue sits in own operations, a subsidiary, a direct business partner, or an indirect business partner, and what influence the company can reasonably exercise.

  • For potential impacts, prepare a prevention action plan where needed, with clear timelines and qualitative or quantitative improvement indicators.
  • For actual impacts, prepare a corrective action plan where the impact cannot immediately be brought to an end, with clear timelines and improvement indicators.
  • Use contractual assurances only with verification measures; do not rely on contract language alone as proof of due diligence.
  • Consider operational changes such as investments, purchasing-practice changes, product or service changes, supplier capacity-building, SME support, and lawful collaboration with other entities.
  • Do not list termination as a mandatory CSDDD step: Directive (EU) 2026/470 removed it. When ordinary measures fail, Articles 10(6) and 11(7) instead require restrictions on new or extended relationships, an enhanced action plan, and suspension where the governing law permits it, unless suspension can reasonably be expected to cause manifestly more severe impacts.
  • If the company suspends, record impact-mitigation steps, reasonable notice, and continuing review. If it does not suspend because greater harm is expected, record the reasons, monitor the impact, and reassess whether further measures are available.
  • Evidence to keep: prevention plan, corrective action plan, remediation decision, verification record, SME support record, disengagement assessment, and implementation status.
Section 6

6. Run stakeholder engagement, complaints, and notification controls

Stakeholder engagement should be attached to the stages and relevant affected stakeholders retained in amended Article 13. Do not carry the original broader list of mandatory consultation stages forward without checking Directive (EU) 2026/470.

Article 14 also requires a and complaints procedure for legitimate concerns about actual or potential adverse impacts in own operations, subsidiaries, or business partners in the chain of activities.

  • Identify directly affected people, communities, workers, relevant trade unions or workers' representatives, and legitimate representatives. Treat civil society, human-rights, or environmental organisations as Article 13 stakeholders only where they legitimately represent directly affected individuals or communities; Article 14 complaint eligibility is a separate test.
  • Provide relevant and comprehensive information for consultation, with a process for reasoned requests for additional information and written justification when refused.
  • Make the complaints procedure fair, publicly available, accessible, predictable, and transparent, including reasons for founded or unfounded complaints.
  • Protect confidentiality and anonymity where available under national law, and take reasonably available measures to prevent retaliation.
  • When a complaint is well founded, treat the adverse impact as identified and route it into prevention, corrective action, or remediation handling.
  • Evidence to keep: stakeholder list, consultation materials, barrier assessment, complaint intake, follow-up record, confidentiality controls, retaliation controls, and remediation discussion notes.
Section 7

7. Monitor, communicate, and maintain defensible evidence

CSDDD monitoring should test whether the due diligence policy and measures are adequate and effective across own operations, subsidiaries, and relevant business partners. It should use qualitative and quantitative indicators where appropriate and update the policy, identified impacts, and measures when assessments show that change is needed.

Public communication should distinguish companies that must publish an annual CSDDD statement from companies already covered by sustainability reporting requirements under Directive 2013/34/EU. Article 16 measures apply for financial years starting on or after 1 January 2030; where the exemption does not apply, the statement is due no later than 12 months after the balance-sheet date, subject to the voluntary-reporting timing rule. The evidence file should support whichever reporting route applies.

  • Run monitoring after significant changes or reasonable grounds to believe new risks or ineffective measures may arise, and on the amended regular cycle of at least every five years.
  • Track implementation and outcomes for policy integration, mapping, prioritisation, action plans, stakeholder engagement, complaints, remediation, and supplier measures.
  • For the public statement route, verify language, website publication, timing, and coverage of due diligence, impacts, and measures.
  • Keep source-to-claim evidence for scope, policy, chain mapping, impact scoring, action plans, stakeholder engagement, complaints, remediation, monitoring results, and public communication.
  • Evidence to keep: monitoring indicators, assessment results, updates made, public statement or sustainability report cross-reference, supervisory authority correspondence, and investigation or enforcement records where relevant.
Recommended next step

Turn the CSDDD checklist into an evidence register

This checklist connects current CSDDD scope, risk mapping, action plans, complaints, monitoring, and communication to maintained records, while separating any retained climate work from the removed Article 22 duty.

Research workflow
Open Research Copilot

Answer CSDDD implementation questions with cited source material.

Explore next step
Talk to Sorena
Discuss CSDDD implementation

Review CSDDD scope, due diligence controls, and evidence gaps with Sorena.

Explore next step
Section 8

8. Record removal of the CSDDD climate transition plan obligation

Directive (EU) 2026/470 removed the standalone CSDDD Article 22 climate-transition-plan duty. Keep climate-plan work only after mapping it to a separate current legal, contractual, risk-management, or voluntary basis.

An existing plan may remain useful or required under another framework, but it is no longer a CSDDD control merely because the original 2024 text contained Article 22.

  • Record Directive (EU) 2026/470 as the source removing the standalone CSDDD duty.
  • Map every retained climate control to its current CSRD, national, sector, contractual, risk-management, financing, or voluntary basis.
  • Update the obligation register, training, board papers, assurance scope, and public claims.
  • Do not infer that all climate reporting or planning requirements disappeared.
  • Retire only controls with no remaining basis.
  • Evidence to keep: change log, source review, retained-obligation mapping, owner decision, and updated control descriptions.
Primary sources

References and citations

Directive (EU) 2024/1760 on corporate sustainability due diligence
eur-lex.europa.eu9 citations
Referenced sections
  • Original legal source for the CSDDD checklist; read it with Directive (EU) 2026/470, which amended scope and due diligence and removed Article 22.
  • Supports the Article 2 scope checks for EU companies, third-country companies, groups, and franchising or licensing structures.
  • Supports the Article 5 due diligence actions and Article 7 policy, code of conduct, consultation, and review requirements.
Show 6 more
  • Supports Article 8 mapping of own operations, subsidiaries, and chain-of-activities business partners, plus risk-factor-based in-depth assessment.
  • Supports Article 9 prioritisation and the directive definition of severity using scale, scope, and irremediable character.
  • Supports the measures retained in Articles 10, 11, and 12; Directive (EU) 2026/470 supplies the current enhanced-plan and suspension rules.
  • Supports Article 13 stakeholder engagement stages and Article 14 notification and complaints procedure requirements.
  • Supports Article 15 monitoring, Article 16 public communication, and Article 25 supervisory authority information and investigation powers.
  • Historical source for the former Article 22 duty; read with Directive (EU) 2026/470 and do not present it as current CSDDD law.
"risk-based human rights and environmental due diligence"
More quoted passages
"This Directive shall apply to companies"
"integrate due diligence into all their relevant policies"
"map their own operations"
"based on the severity and likelihood"
"provide remediation"
"Notification mechanism and complaints procedure"
"monitor the adequacy and effectiveness"
"adopt and put into effect a transition plan"
Directive (EU) 2026/470
eur-lex.europa.eu3 citations
Referenced sections
  • Binding amendment for current scope, Article 8 scoping and information requests, last-resort relationship measures, monitoring, reporting, enforcement, and deletion of Article 22.
  • Binding current amendment for CSDDD scope, due diligence, monitoring, enforcement, and status changes discussed on this page.
  • Binding amendment read with the original Directive for current CSDDD status; it does not amend Article 7's policy requirements.
European Commission: Corporate sustainability due diligence
commission.europa.eu2 citations
Referenced sections
  • Commission overview supporting the public policy purpose of CSDDD and its focus on adverse human rights and environmental impacts in operations and value chains.
  • Supports the public Commission framing that CSDDD applies to in-scope companies' operations and global value chains.
"operations and across their global value chains"
More quoted passages
"companies in scope identify and address adverse human rights and environmental impacts"

Related guides

CSDDD adverse impact prioritisation workflow

A CSDDD workflow for identifying actual and potential adverse human rights and environmental impacts, ranking severity and likelihood, and documenting prevention, mitigation, remediation, and stakeholder evidence.

CSDDD Applicability Test After 2026 Changes

Test CSDDD scope after Directive (EU) 2026/470 using the current EU and third-country thresholds, parent-company rules, exclusions, dates, and evidence.

CSDDD chain of activities and supplier due diligence

Explain CSDDD chain-of-activities scope, upstream and downstream boundaries, subsidiaries, direct and indirect business partners, supplier risk segmentation, and evidence.

CSDDD Chain of Activities Boundaries

Define CSDDD upstream and downstream chain of activities boundaries for subsidiaries, direct and indirect business partners, distribution, transport, storage, and records.

CSDDD compliance duties and evidence guide

A source-backed CSDDD compliance guide covering due diligence policy, impact scoping, prevention, corrective action, complaints, monitoring, reporting, climate-plan status, and supervisory evidence.

CSDDD Deadlines After Directive 2026/470

Current CSDDD calendar: 2027-2028 guidance, 2028 transposition, 2029 application, 2030 reporting, 2031 ESAP submission and review.

Show all related guides (35)

CSDDD Due Diligence Steps Playbook for Articles 5 and 7-16

A playbook using current CSDDD provisions for policy integration, impact assessment, prioritisation, prevention, correction, remediation, stakeholder engagement, complaints, monitoring, communication, and evidence.

CSDDD FAQ: scope, dates, duties, liability, and evidence

Practical answers on CSDDD scope, current application dates, chain of activities, due diligence duties, complaints, remediation, civil liability, climate plans, and evidence.

CSDDD grievance and remediation workflow guide

Build a CSDDD grievance, notification, stakeholder engagement, and remediation workflow under Directive (EU) 2024/1760 as amended by Directive (EU) 2026/470.

CSDDD Liability and Enforcement After 2026

Understand CSDDD supervision, national penalties, substantiated concerns, remedial orders, and civil-liability analysis after Directive (EU) 2026/470.

CSDDD Non-EU Scope and 2029 Start

Test third-country CSDDD scope using the amended EUR 1.5 billion EU-turnover route and one 26 July 2029 application date.

CSDDD Penalties After Directive 2026/470

Current CSDDD penalty guidance after the EU 5% rule was replaced by a uniform 3% maximum limit: national sanctions, authority decisions, evidence, and country-by-country monitoring.

CSDDD Remediation Plan Template: Article 12, 13 and 14 evidence

A CSDDD remediation plan template for actual adverse impacts, complaint inputs, stakeholder engagement, action records, and monitoring under the Directive as amended in 2026.

CSDDD requirements: scope, due diligence, climate plan, and evidence

A source-backed map of current CSDDD requirements across scope, due diligence policy, impact assessment, complaints, remediation, monitoring, communication, and the removed climate-plan duty.

CSDDD Scope Thresholds After 2026

Understand amended CSDDD thresholds for EU and non-EU companies, group scope, exclusions, two-year evidence, and the 2029 application date.

CSDDD Supplier Contract Clause Review Workflow

Review supplier contract clauses against CSDDD Articles 10 and 11: contractual assurances, verification, SME fairness, support, action plans, and escalation evidence.

CSDDD Supplier Contract Clauses: Articles 10 and 11 Evidence

How to use CSDDD supplier contract clauses without treating clauses as a substitute for due diligence: contractual assurances, verification, SME support, action plans, limits, and evidence.

CSDDD supplier human rights impact scoring template

A CSDDD supplier impact scoring template for Article 8 identification, Article 9 prioritisation, severity, likelihood, stakeholder input, chain-of-activities boundaries, and evidence records.

CSDDD vs CSRD: Due Diligence and Reporting Compared

Compare CSDDD due diligence duties with CSRD sustainability reporting, including scope, timing, Article 16 reporting, evidence overlap, assurance, and enforcement.

CSDDD vs German LkSG Comparison

Compare the EU CSDDD with Germany's LkSG without mixing directive duties, national-law duties, chain boundaries, complaints, reporting, and enforcement routes.

CSDDD vs OECD Guidelines

Compare the binding EU CSDDD with the OECD Guidelines for responsible business conduct across scope, due diligence duties, business relationships, remediation, and evidence.

Did CSDDD Keep Its Climate Plan Duty?

Directive (EU) 2026/470 removed the standalone CSDDD Article 22 climate-transition-plan duty. Understand what changed and which separate obligations may remain.

CSDDD chain of activities boundaries: upstream and downstream FAQ

FAQ on how the CSDDD defines chain of activities boundaries for subsidiaries, direct and indirect business partners, upstream activities, downstream logistics, and evidence.

CSDDD complaints and notifications FAQ

FAQ on Article 14 CSDDD complaint and notification mechanisms, who may complain, follow-up rights, confidentiality, retaliation, and evidence.

CSDDD contractual assurances FAQ for Articles 10 and 11

How CSDDD Articles 10 and 11 use contractual assurances with business partners, verification, SME support, action plans, and possible suspension escalation.

CSDDD prevention vs mitigation: potential and actual adverse impacts

CSDDD FAQ on when to prevent or mitigate potential adverse impacts, when to end or minimise actual adverse impacts, and what evidence records to keep.

CSDDD remediation FAQ: when companies must remedy adverse impacts

FAQ on CSDDD remediation: when Article 12 requires remedy, how complaints and stakeholder engagement affect the response, and what evidence to keep.

CSDDD risk prioritisation FAQ: severity, likelihood, and evidence

How to prioritise CSDDD adverse impacts when teams cannot address everything at once, using severity, likelihood, stakeholder evidence, and a reviewable rationale.

Does CSDDD Still Have Scope Waves?

No separate company scope waves remain after Directive (EU) 2026/470: transposition is due in 2028 and all companies remaining in scope apply from 2029.

Does Franchising Trigger CSDDD Scope?

Directive (EU) 2026/470 retained the CSDDD franchise and licensing scope route but raised its royalty and turnover thresholds. Learn the current test.

How CSDDD overlaps with OECD, UNGP, and ILO standards

FAQ on how OECD responsible business conduct guidance, the UN Guiding Principles, and ILO labour standards inform CSDDD due diligence without being the same legal instrument.

How Does CSDDD Civil Liability Work Now?

Directive (EU) 2026/470 removed the uniform EU liability test but retained compensation and procedural safeguards. Claims still depend on Member State law.

Is a Climate Plan Still Required by CSDDD?

Directive (EU) 2026/470 removed the standalone CSDDD Article 22 climate-transition-plan duty; separate CSRD and national obligations need their own review.

What Did Omnibus Change in CSDDD?

CSDDD Omnibus amendment: what Directives (EU) 2025/794 and 2026/470 adopted, which dates apply, and which old duties were removed.

What EU Turnover Triggers CSDDD Scope?

A third-country company generally needs more than EUR 1.5 billion net turnover in the EU under Directive (EU) 2026/470; learn the evidence and timing.