CSDDD compliance guide

A defensible CSDDD programme starts by mapping each obligation to an internal control owner and an evidence record. Article 7 is the anchor: due diligence must be integrated into relevant policies and risk management systems, and the company must have a due diligence policy that supports risk-based due diligence.

The policy record should include the company's long-term due diligence approach, a code of conduct for the company, subsidiaries, and relevant business partners, and the processes used to implement due diligence and verify code-of-conduct compliance. Keep phase-in dates and national transposition status in a separate legal tracker, because timing can change through EU amendments and Member State implementation.

Amended Article 8 starts with a scoping exercise based solely on reasonably available information across own operations, subsidiaries, and relevant business partners. The company then performs an in-depth assessment in the areas where impacts are most likely and most severe. A generic supplier score does not meet that sequence.

Article 9 allows prioritisation when all identified impacts cannot be handled at the same time and to their full extent. Prioritisation must be based on severity and likelihood, and the record should show why the most severe and most likely impacts were handled first.

CSDDD separates potential and actual impacts. For potential impacts, Article 10 requires appropriate measures to prevent them or, where prevention is not possible or not immediately possible, adequately mitigate them. For actual impacts, Article 11 requires appropriate measures to bring the impact to an end or, where that is not immediately possible, minimise its extent.

A useful compliance file should show whether the impact is caused by the company, jointly caused, or linked through a business partner. That analysis drives prevention, corrective action, contractual assurance, verification, operational change, SME support, collaboration, suspension, or remediation. Directive (EU) 2026/470 removed termination but retained last-resort restrictions on new or extended relationships, enhanced action plans, and suspension where legally available and not expected to cause manifestly more severe impacts.

Article 12 remediation remains tied to the company's involvement in an actual adverse impact. For Article 13 engagement, use the stakeholder definition and consultation stages as amended by Directive (EU) 2026/470 rather than the broader original list.

Article 14 requires a notification mechanism and complaints procedure. The procedure should be fair, publicly available, accessible, predictable, and transparent. It should allow affected or potentially affected persons and their legitimate representatives, trade unions and worker representatives for workers in the chain concerned, and civil society organisations active and experienced in the relevant area for environmental complaints to raise concerns. Complaints require confidentiality and anti-retaliation safeguards; the notification mechanism must permit anonymous or confidential submissions under national law.

Run a change-event review before an acquisition, merger, restructuring, new country entry, major product or service launch, material input change, or new form of business relationship. The review should identify impacts that the current policy, partner map, complaint channel, and action plans do not cover.

After closing an acquisition or restructuring, integrate the acquired entity or changed operation into the CSDDD system without waiting for the five-year cycle. Current Article 15 requires assessment without undue delay after a significant change and when there are reasonable grounds to believe new risks have arisen or existing measures are no longer adequate or effective.

Article 15 requires assessment of implementation, adequacy, and effectiveness. Directive (EU) 2026/470 moved the regular cycle from at least every 12 months to at least every five years, while retaining event-driven reassessment after significant change or when reasonable grounds indicate new risks or ineffective measures.

Article 16 requires public communication through an annual website statement unless the company is subject to the listed sustainability-reporting requirements, including the relevant exemptions. Publish in the required Union language and, where different, a language customary in international business, no later than 12 months after the balance-sheet date; a third-country company's statement also identifies its authorised representative. The delegated acts specifying content and criteria are due by 31 March 2029, and the reporting measures apply for financial years starting on or after 1 January 2030. Directive (EU) 2026/470 removed the separate CSDDD Article 22 climate-transition-plan duty.

CSDDD compliance evidence should be built for supervisory review, not only internal assurance. Member States must designate supervisory authorities to supervise compliance with national provisions adopted under the amended Directive. Track the final transposition law for information powers, investigations, orders, remediation, penalties, interim measures, and appeal procedures.

Directive (EU) 2026/470 requires Member States to set the maximum limit for pecuniary penalties at 3% of the company's net worldwide turnover in the preceding financial year, or 3% of consolidated worldwide turnover for the specified ultimate-parent routes. National law still determines the penalty process and the amount imposed in a case. Track administrative supervision, substantiated concerns, investigation records, remedial-action periods, effective, proportionate, and dissuasive penalties, and possible public statements for unpaid pecuniary penalties.