CSDDD Due Diligence Steps Playbook

Start with Article 7. The company needs a due diligence policy embedded into relevant policies and risk management systems, not a standalone statement that procurement, operations, product, legal, and sustainability teams do not use.

The policy should describe the company's due diligence approach, include a code of conduct for the company, subsidiaries, and direct or indirect business partners where relevant, and explain the processes used to implement and verify the code. Article 7 also requires prior consultation with employees and their representatives when developing the policy.

Article 8 turns the policy into a risk scan. Map the company's own operations, subsidiaries, and business partners related to the chain of activities to find where adverse human rights or environmental impacts are most likely and most severe. Then perform an in-depth assessment in those higher-risk areas.

Article 9 applies when the company cannot address every actual or potential impact at once. Prioritisation is based on severity and likelihood, not on which issue is easiest, cheapest, or closest to an existing audit cycle.

Split potential and actual impacts. Article 10 is for potential adverse impacts: prevent them where possible or adequately mitigate them where prevention is not possible or not immediately possible. Article 11 is for actual adverse impacts: bring them to an end, or minimise their extent if they cannot immediately be ended.

Both articles require the company to consider whether the impact is caused only by the company, jointly with a subsidiary or business partner, or only by a business partner in the chain of activities; where the impact occurs; and the company's ability to influence the relevant business partner.

Article 12 requires remediation where the company caused or jointly caused an actual adverse impact. If the impact was caused only by a business partner, the company may provide voluntary remediation and may use its influence over the business partner to support remediation.

Article 13 makes stakeholder engagement part of the due diligence process, not a communications add-on. Consultation is required when gathering information for identification, assessment, and prioritisation; when developing prevention, corrective, enhanced prevention, or enhanced corrective action plans; when deciding on suspension or termination; when adopting remediation measures; and, where appropriate, when developing monitoring indicators.

Article 14 requires a notification mechanism and complaints procedure for legitimate concerns about actual or potential adverse impacts in the company's own operations, subsidiaries, or business partners in the chain of activities. The procedure must be fair, publicly available, accessible, predictable, and transparent, with confidentiality and anti-retaliation measures.

Articles 15 and 16 close the loop. Monitoring assesses implementation, adequacy, and effectiveness using qualitative and quantitative indicators where appropriate. Communication requires an annual website statement unless the Article 16 reporting exemption applies.