EU CSDDD (Directive (EU) 2024/1760) Due diligence steps playbook

Before Article 7 policy drafting, confirm which entity is in scope, whether a parent performs duties for subsidiaries, and which activities are inside the chain of activities. Otherwise later controls attach to the wrong perimeter.

Use one scope memo and one chain boundary log so every team works from the same assumptions.

Article 7 requires a due diligence policy and integration into relevant policies and risk management systems. This is where you establish the code of conduct and the implementation process that later supplier and remediation work depends on.

If the policy is vague, teams will improvise thresholds and action standards later.

Article 8 requires mapping and assessment. Article 9 requires prioritization when not all impacts can be addressed at once. Use quantitative and qualitative information and keep a clear rationale for why one area was escalated ahead of another.

This is the foundation for defensible supplier requests and for later supervisory explanations.

Article 10 focuses on prevention and mitigation of potential impacts. Article 11 focuses on bringing actual impacts to an end or minimizing their extent. Both need action plans, leverage strategy, and verification rather than generic supplier promises.

Contractual assurances help, but the law expects verification and measured follow through.

Article 12 remediation, Article 13 stakeholder engagement, Article 14 complaints, and Article 15 monitoring should be built together. Complaints feed identification. Monitoring tests whether action plans are working. Stakeholder engagement informs all three.

This is also where many programs become credible or fail. If the complaint route is weak and the monitoring cycle is not real, the rest of the program looks cosmetic.