CSDDD grievance, notification, and remediation workflow guide

Start by defining two CSDDD intake routes. A complaint route is for legitimate concerns about actual or potential adverse human rights or environmental impacts in the company's own operations, subsidiaries, or business partners in the chain of activities. A notification route is for persons or entities with information or concerns about actual or potential adverse impacts, and it must support anonymous or confidential submissions in accordance with national law.

Do not treat the CSDDD mechanism as a renamed whistleblowing channel. The directive describes the Article 14 complaints procedure as separate from the internal reporting procedure under the EU Whistleblowing Directive, although a directly affected employee may sometimes be able to use both.

Triage should answer whether the issue concerns an actual or potential adverse impact, where it sits in the company's own operations, subsidiaries, or chain of activities, and which due-diligence step owns the next action. Article 8 allows companies to use information from the Article 14 notification mechanism and complaints procedure when identifying and assessing adverse impacts.

A well-founded complaint should not end as a customer-service ticket. Article 14 says that where a complaint is well-founded, the adverse impact is deemed to be identified for Article 8 purposes and the company must take appropriate measures under Articles 10, 11, and 12.

Article 13 requires effective stakeholder engagement at specific due-diligence stages, not only after a public dispute. For grievance and remediation work, the important stages are information gathering, prevention or corrective action planning, suspension or termination decisions, remediation measures, and monitoring indicators.

The workflow should identify who must be consulted, what information they need, whether additional information requests can be answered, what barriers or retaliation risks exist, and when experts should be consulted because direct engagement is not reasonably possible.

Article 12 draws an important boundary. Where the company caused or jointly caused an actual adverse impact, it must provide remediation. Where the impact was caused only by a business partner, the company may provide voluntary remediation and may use its influence to enable the business partner to provide remediation.

This means the case file needs a causation and contribution analysis before the remedy decision. A remedy promise should not be broader than the company's role supports, and a refusal to provide remediation should not ignore leverage, corrective action, or stakeholder engagement duties elsewhere in the directive.

The evidence record should show that the channel is accessible, that confidentiality and retaliation controls were considered, that founded complaints were routed into due diligence, and that remediation decisions were linked to the company's role in the impact. Article 15 also requires periodic assessment of the adequacy and effectiveness of due-diligence measures, and the directive identifies notifications and complaints as documentation relevant to compliance.

Evidence should be case-based enough for an authority, auditor, board committee, or affected stakeholder to understand what happened without exposing identities or sensitive information unnecessarily.

The workflow should be explicit about what it does not prove. A published complaints channel does not prove meaningful stakeholder engagement, a collaborative industry mechanism is usable only if it meets Article 14 requirements, and participation in an industry or multi-stakeholder initiative is not enough to replace consultation with the company's own employees and representatives.

Stop the case before closure if the file cannot explain the scope boundary, why a complaint was founded or unfounded, how confidentiality was protected, which due-diligence measure was triggered, or why remediation was required, voluntary, enabled through leverage, or not provided.