CSDDDChecklistEU

CSDDD due diligence Checklist

A checklist for applying Directive (EU) 2024/1760 as amended: scope assessment, due diligence policy, risk mapping, prevention, corrective action, remediation, complaints, monitoring, public communication, and climate-duty status.

Use it to test whether a CSDDD programme has the required records and decision points before management review, supplier engagement, or public reporting.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

readiness starts with amended scope and timing, then moves through a reasonably-available-information scoping exercise, in-depth assessment where impacts are most likely and most severe, impact prioritisation, proportionate action, stakeholder engagement, complaints, remediation, five-year and event-driven monitoring, and public communication. Directive (EU) 2026/470 removed the standalone climate-plan duty.

Section 1

1. Confirm CSDDD scope before building the programme

Record the legal entity, group position, financial year, employee count where relevant, worldwide turnover, EU turnover for non-EU companies, and any franchising or licensing model. Do not treat supplier pressure or customer requests as proof that the company itself is directly in scope.

For EU companies, check whether the company or ultimate parent exceeds the Article 2 employee and turnover thresholds. For third-country companies, check EU net turnover and group status. For franchising or licensing models, capture royalty and turnover facts separately because the directive treats them as a distinct route into scope.

EU company check after Directive (EU) 2026/470: generally more than 5,000 employees on average and more than EUR 1.5 billion net worldwide turnover, including the relevant ultimate-parent group route.
Third-country company check after Directive (EU) 2026/470: generally more than EUR 1.5 billion net turnover in the Union, including the relevant ultimate-parent group route.
Franchise or licence check: more than EUR 75 million in qualifying royalties in the Union and more than EUR 275 million turnover, using worldwide turnover for EU companies and Union turnover for third-country companies.
Duration check: the relevant Article 2 conditions must be met for two consecutive financial years; a company ceases to be covered if it no longer meets them for each of the last two relevant financial years.
Holding-parent exception: an ultimate parent whose main activity is holding shares and that does not make management, operational, or financial decisions affecting the group may obtain the Article 2(3) exemption only if an EU subsidiary is designated to fulfil the parent's obligations and the competent supervisory authority grants the exemption.
Group governance check: if a parent intends to perform due diligence obligations for subsidiaries, document the information flow, delegated authority, subsidiary adaptation, and remaining subsidiary responsibilities.
Evidence to keep: two-year threshold calculation, entity chart, financial statement reference, EU turnover basis, franchise or royalty analysis, any holding-parent exemption and designated-subsidiary record, and the supervisory authority or authorised representative assessment for non-EU companies.

Sources for this answer

Directive (EU) 2026/470

Binding current amendment for CSDDD scope, due diligence, monitoring, enforcement, and status changes discussed on this page.

Directive (EU) 2024/1760 on corporate sustainability due diligence

Supports the Article 2 scope checks for EU companies, third-country companies, groups, and franchising or licensing structures.

European Commission: Corporate sustainability due diligence

Supports the public Commission framing that CSDDD applies to in-scope companies' operations and global value chains.

Section 2

2. Integrate due diligence into policies and risk management

The policy step is not a standalone statement. Article 7 requires due diligence to be integrated into relevant policies and risk management systems, with a due diligence policy developed after prior consultation with employees and their representatives.

The checklist should verify that the policy explains the company's long-term due diligence approach, includes a code of conduct for the company, subsidiaries, and relevant business partners, and describes how due diligence processes are implemented, verified, and extended to business partners.

Assign owners for policy, risk management, procurement, sustainability, legal, human rights, environment, and subsidiary coordination.
Map each policy control to Articles 5 and 7 to 16: identify, prioritise, prevent, correct, remediate, engage, receive complaints, monitor, and communicate.
Define how the code of conduct flows to direct and indirect business partners in the chain of activities.
Set update triggers for significant changes and a scheduled policy review at least every 24 months.
Evidence to keep: policy version, employee consultation record, code of conduct, business-partner flow-down mechanism, risk-management integration note, and policy review log.

Sources for this answer

Directive (EU) 2026/470

Binding amendment read with the original Directive for current CSDDD status; it does not amend Article 7's policy requirements.

Directive (EU) 2024/1760 on corporate sustainability due diligence

Supports the Article 5 due diligence actions and Article 7 policy, code of conduct, consultation, and review requirements.

Section 3

3. Map the chain of activities and identify adverse impacts

Build the risk map around the CSDDD chain of activities, not an undefined supply-chain label. The directive covers own operations, subsidiaries, and, where related to chains of activities, business partners.

For goods and services, record upstream production or service inputs and covered downstream distribution, transport, and storage activities. Keep regulated financial undertakings separate because the directive describes a narrower chain-of-activities treatment for them.

Create a chain-of-activities inventory by entity, subsidiary, business partner, activity, country, sector, product or service, and relationship type.
Use company-level, business-operation, geographic and contextual, product and service, and sectoral risk factors when selecting areas for in-depth assessment.
Use quantitative and qualitative information, including independent reports, stakeholder input, notification data, and complaints data where appropriate.
Request information only when necessary for the in-depth assessment. For a business partner with fewer than 5,000 employees, request it only when it cannot reasonably be obtained by other means; where several partners can provide it, prioritise the partner where the impact is most likely to occur.
Evidence to keep: risk map, methodology, data sources, country and sector risk factors, selected in-depth assessment areas, and reasons for any missing chain data.

Sources for this answer

Consolidated Directive (EU) 2024/1760 as at 18 March 2026

Current Article 8 source for the two-stage scoping and in-depth assessment, risk factors, necessary-information rule, smaller-partner condition, and limited direct-partner tie-breaker.

Directive (EU) 2024/1760 on corporate sustainability due diligence

Supports Article 8 mapping of own operations, subsidiaries, and chain-of-activities business partners, plus risk-factor-based in-depth assessment.

Section 4

4. Prioritise impacts by severity and likelihood

CSDDD prioritisation is allowed when not all identified impacts can be addressed at the same time and to their full extent. The record should therefore show why an impact was addressed first, not only that it appeared on a risk register.

Use severity and likelihood as the prioritisation test. Severity should capture scale, scope, and irremediable character, including how many people may be affected, environmental extent, irreversibility, and the ability to restore people or the environment within a reasonable period.

Score potential and actual adverse impacts separately so prevention and corrective work are not blurred.
Document severity, likelihood, affected stakeholders, environmental receptors, location, sector, product or service, and business-partner relationship.
Do not rank impacts lower because the company has limited influence over a partner or because the impact is remote in the chain; consider that influence later when selecting measures.
After the most severe and most likely impacts are addressed within a reasonable time, schedule work on less severe and less likely impacts.
Evidence to keep: prioritisation criteria, scored impact register, rationale for sequencing, management approval, and next review trigger.

Sources for this answer

Directive (EU) 2024/1760 on corporate sustainability due diligence

Supports Article 9 prioritisation and the directive definition of severity using scale, scope, and irremediable character.

Section 5

5. Choose prevention, corrective action, and remediation measures

Separate potential adverse impacts from actual adverse impacts. Potential impacts need prevention or mitigation measures under Article 10; actual impacts need measures to bring the impact to an end, minimise its extent, and, where the company caused or jointly caused the impact, provide remediation under Articles 11 and 12.

The action-plan record should explain the company's involvement, whether the issue sits in own operations, a subsidiary, a direct business partner, or an indirect business partner, and what influence the company can reasonably exercise.

For potential impacts, prepare a prevention action plan where needed, with clear timelines and qualitative or quantitative improvement indicators.
For actual impacts, prepare a corrective action plan where the impact cannot immediately be brought to an end, with clear timelines and improvement indicators.
Use contractual assurances only with verification measures; do not rely on contract language alone as proof of due diligence.
Consider operational changes such as investments, purchasing-practice changes, product or service changes, supplier capacity-building, SME support, and lawful collaboration with other entities.
Do not list termination as a mandatory CSDDD step: Directive (EU) 2026/470 removed it. When ordinary measures fail, Articles 10(6) and 11(7) instead require restrictions on new or extended relationships, an enhanced action plan, and suspension where the governing law permits it, unless suspension can reasonably be expected to cause manifestly more severe impacts.
If the company suspends, record impact-mitigation steps, reasonable notice, and continuing review. If it does not suspend because greater harm is expected, record the reasons, monitor the impact, and reassess whether further measures are available.
Evidence to keep: prevention plan, corrective action plan, remediation decision, verification record, SME support record, disengagement assessment, and implementation status.

Sources for this answer

Directive (EU) 2024/1760 on corporate sustainability due diligence

Supports the measures retained in Articles 10, 11, and 12; Directive (EU) 2026/470 supplies the current enhanced-plan and suspension rules.

Section 6

6. Run stakeholder engagement, complaints, and notification controls

Stakeholder engagement should be attached to the stages and relevant affected stakeholders retained in amended Article 13. Do not carry the original broader list of mandatory consultation stages forward without checking Directive (EU) 2026/470.

Article 14 also requires a and complaints procedure for legitimate concerns about actual or potential adverse impacts in own operations, subsidiaries, or business partners in the chain of activities.

Identify directly affected people, communities, workers, relevant trade unions or workers' representatives, and legitimate representatives. Treat civil society, human-rights, or environmental organisations as Article 13 stakeholders only where they legitimately represent directly affected individuals or communities; Article 14 complaint eligibility is a separate test.
Provide relevant and comprehensive information for consultation, with a process for reasoned requests for additional information and written justification when refused.
Make the complaints procedure fair, publicly available, accessible, predictable, and transparent, including reasons for founded or unfounded complaints.
Protect confidentiality and anonymity where available under national law, and take reasonably available measures to prevent retaliation.
When a complaint is well founded, treat the adverse impact as identified and route it into prevention, corrective action, or remediation handling.
Evidence to keep: stakeholder list, consultation materials, barrier assessment, complaint intake, follow-up record, confidentiality controls, retaliation controls, and remediation discussion notes.

Sources for this answer

Directive (EU) 2024/1760 on corporate sustainability due diligence

Supports Article 13 stakeholder engagement stages and Article 14 notification and complaints procedure requirements.

Section 7

7. Monitor, communicate, and maintain defensible evidence

CSDDD monitoring should test whether the due diligence policy and measures are adequate and effective across own operations, subsidiaries, and relevant business partners. It should use qualitative and quantitative indicators where appropriate and update the policy, identified impacts, and measures when assessments show that change is needed.

Public communication should distinguish companies that must publish an annual CSDDD statement from companies already covered by sustainability reporting requirements under Directive 2013/34/EU. Article 16 measures apply for financial years starting on or after 1 January 2030; where the exemption does not apply, the statement is due no later than 12 months after the balance-sheet date, subject to the voluntary-reporting timing rule. The evidence file should support whichever reporting route applies.

Run monitoring after significant changes or reasonable grounds to believe new risks or ineffective measures may arise, and on the amended regular cycle of at least every five years.
Track implementation and outcomes for policy integration, mapping, prioritisation, action plans, stakeholder engagement, complaints, remediation, and supplier measures.
For the public statement route, verify language, website publication, timing, and coverage of due diligence, impacts, and measures.
Keep source-to-claim evidence for scope, policy, chain mapping, impact scoring, action plans, stakeholder engagement, complaints, remediation, monitoring results, and public communication.
Evidence to keep: monitoring indicators, assessment results, updates made, public statement or sustainability report cross-reference, supervisory authority correspondence, and investigation or enforcement records where relevant.

Sources for this answer

Directive (EU) 2024/1760 on corporate sustainability due diligence

Supports Article 15 monitoring, Article 16 public communication, and Article 25 supervisory authority information and investigation powers.

Recommended next step

Turn the CSDDD checklist into an evidence register

This checklist connects current CSDDD scope, risk mapping, action plans, complaints, monitoring, and communication to maintained records, while separating any retained climate work from the removed Article 22 duty.

Research workflow

Open Research Copilot

Answer CSDDD implementation questions with cited source material.

Explore next step

Talk to Sorena

Discuss CSDDD implementation

Review CSDDD scope, due diligence controls, and evidence gaps with Sorena.

Explore next step

Section 8

8. Record removal of the CSDDD climate transition plan obligation

Directive (EU) 2026/470 removed the standalone CSDDD Article 22 climate-transition-plan duty. Keep climate-plan work only after mapping it to a separate current legal, contractual, risk-management, or voluntary basis.

An existing plan may remain useful or required under another framework, but it is no longer a CSDDD control merely because the original 2024 text contained Article 22.

Record Directive (EU) 2026/470 as the source removing the standalone CSDDD duty.
Map every retained climate control to its current CSRD, national, sector, contractual, risk-management, financing, or voluntary basis.
Update the obligation register, training, board papers, assurance scope, and public claims.
Do not infer that all climate reporting or planning requirements disappeared.
Retire only controls with no remaining basis.
Evidence to keep: change log, source review, retained-obligation mapping, owner decision, and updated control descriptions.

Sources for this answer

Directive (EU) 2024/1760 on corporate sustainability due diligence

Historical source for the former Article 22 duty; read with Directive (EU) 2026/470 and do not present it as current CSDDD law.

Primary sources

References and citations

Consolidated Directive (EU) 2024/1760 as at 18 March 2026

eur-lex.europa.eu

Referenced sections

Current Article 8 source for the two-stage scoping and in-depth assessment, risk factors, necessary-information rule, smaller-partner condition, and limited direct-partner tie-breaker.

Directive (EU) 2024/1760 on corporate sustainability due diligence

eur-lex.europa.eu

Referenced sections