CSDDD chain of activities where upstream and downstream due diligence boundaries stop

For CSDDD due diligence, start with three buckets: the company's own operations, the operations of its subsidiaries, and the operations of business partners where those partner activities are related to the company's chain of activities.

The upstream side is broad. It covers business partner activities related to producing goods or providing services for the company, including design, extraction, sourcing, manufacture, transport, storage, raw material supply, product or part supply, and development of the product or service.

The downstream side is narrower. It covers distribution, transport, and storage of the company's product only where the downstream business partner performs those activities for the company or on the company's behalf.

Member States must transpose the amended CSDDD by 26 July 2028 and apply the due diligence measures from 26 July 2029. Use the current EU definition for readiness and data design, then confirm the enacted national provision before treating a boundary decision as an operative legal conclusion.

Subsidiaries sit in a separate category from suppliers. The CSDDD treats due diligence as covering a company's own operations, the operations of its subsidiaries, and, where related to the chain of activities, the operations of business partners.

That means a boundary file should identify subsidiaries directly, then identify which business partners sit in each subsidiary's chain of activities. If a parent carries out due diligence obligations on behalf of in-scope subsidiaries, the subsidiary still needs enough local records to show how the parent policy, risk assessment, prevention measures, stakeholder engagement, remediation, and monitoring apply to that subsidiary.

Where a parent uses the CSDDD group-level support route, keep the parent-subsidiary information exchange, adapted policy, local risk-management integration, and any subsidiary-specific partner measures visible in the evidence file.

A direct business partner is an entity with a commercial agreement related to the company's operations, products, or services, or an entity to which the company provides services. An indirect business partner is not the direct contracting party, but performs business operations related to the company's operations, products, or services.

The distinction matters because CSDDD measures often start with direct partners, then extend to indirect partners when their activities are part of the chain of activities and where risk assessment shows adverse impacts are likely or severe. For example, contractual assurances from a direct partner may need corresponding assurances from that partner's relevant partners; in some cases, the company may seek assurances directly from an indirect partner.

Do not stop classification at the procurement system's vendor record. The useful test is whether the partner's activity is related to the company's operations, products, or services and falls inside the upstream or downstream chain-of-activities definition.

Downstream coverage is limited to distribution, transport, and storage of the company's product where a business partner carries out those activities for the company or on the company's behalf. It is not a general downstream customer, reseller, user, or end-of-life obligation.

A contracted warehouse, fulfilment provider, carrier, distributor, or logistics provider can therefore sit inside the downstream boundary when it handles the company's product for the company. A customer that buys and uses the product for its own business normally needs a separate analysis and should not be included merely because it is downstream.

The directive also states that the chain of activities does not include product disposal. It excludes distribution, transport, storage, and disposal of products subject to Member State export controls, including dual-use controls or weapons, munitions, and war material controls, once export is authorised.

The boundary map and the in-depth assessment are different steps. Article 8 first requires a scoping exercise based only on reasonably available information to identify general areas where adverse impacts are most likely and most severe. The company then performs an in-depth assessment in those areas.

For that in-depth assessment, a company may request partner information only where it is necessary. If the partner has fewer than 5,000 employees, the company may request the information only when it cannot reasonably obtain it by other means. Where several partners can provide the information, the company should request it, where reasonable, from the partner or partners where impacts are most likely to occur. Direct partners may be prioritised only where areas are equally likely or equally severe.

Keep evidence that proves why each activity is in scope, out of scope, or unresolved. A useful boundary record links the legal definition to the company's actual product, service, subsidiary, supplier, logistics, and partner facts.

The record should also show how the boundary decision fed the Article 8 scoping exercise and in-depth assessment, and how it affected prevention or mitigation measures under Article 10 or actual-impact measures under Article 11.

Because business partners are not generally required to disclose trade secrets, preserve the minimum information needed to identify direct and indirect partners and adverse-impact risks without turning the evidence request into an unsupported data grab.

The most common mistake is using a broad value-chain diagram as if every actor in it is automatically inside the CSDDD chain of activities. The directive's wording is more specific: upstream is tied to production of goods or provision of services, while downstream is limited to product distribution, transport, and storage performed for the company or on its behalf.

A second mistake is losing the distinction between subsidiaries, direct partners, and indirect partners. Those categories affect who holds information, who can influence the relevant activity, which assurances are realistic, and what evidence can be requested without overreaching.

A defensible answer is a maintained boundary file: it names the entity, activity, product or service, partner tier, inclusion decision, exclusion rationale, risk signals, and follow-up due diligence measure.