CSDDD grievance, notification, and remediation workflow guide

Start by defining two CSDDD intake routes. A complaint route is for legitimate concerns raised by the eligible Article 14(2) persons and entities about actual or potential adverse human rights or environmental impacts in the company's own operations, subsidiaries, or business partners in the chain of activities. Its procedure must be fair, publicly available, accessible, predictable, and transparent, including when the company considers a complaint unfounded. A notification route is open to persons or entities with information or concerns about actual or potential adverse impacts, and it must support anonymous or confidential submissions in accordance with national law.

Do not treat the CSDDD mechanism as a renamed whistleblowing channel. The directive describes the Article 14 complaints procedure as separate from the internal reporting procedure under the EU Whistleblowing Directive, although a directly affected employee may sometimes be able to use both.

Triage should answer whether the issue concerns an actual or potential adverse impact, where it sits in the company's own operations, subsidiaries, or chain of activities, and which due-diligence step owns the next action. Article 8 allows companies to use information from the Article 14 notification mechanism and complaints procedure when identifying and assessing adverse impacts.

A well-founded complaint belongs in the due-diligence process, not only in customer service. Article 14 deems the adverse impact identified for Article 8 and requires the company to take appropriate measures under Articles 10, 11, and 12.

After Directive (EU) 2026/470, Article 13 requires consultation of relevant stakeholders when gathering information to identify, assess, and prioritise impacts; when developing prevention, corrective, and enhanced action plans; and when adopting Article 12 remediation measures. The amendment removed consultation when deciding on suspension and when developing monitoring indicators from Article 13's mandatory-stage list.

The workflow should identify who must be consulted, what information they need, whether additional information requests can be answered, what barriers or retaliation risks exist, and when experts should be consulted because direct engagement is not reasonably possible.

Test the mechanism with the people who may need it, including workers, community members, and users outside corporate teams. A web form in one language may be unusable for migrant workers without private phone access, people with disabilities, communities with low connectivity, children, or people who reasonably fear retaliation from an employer, recruiter, security provider, or local authority.

The intake route should let a person raise the concern safely and understand what happens next. Where direct access is impractical, accept submissions through legitimate representatives, trade unions, human rights defenders, civil society organisations, or another trusted channel without forcing the affected person to repeat sensitive facts unnecessarily.

Article 12 draws an important boundary. Where the company caused or jointly caused an actual adverse impact, it must provide remediation. Where the impact was caused only by a business partner, the company may provide voluntary remediation and may use its influence to enable the business partner to provide remediation.

This means the case file needs a causation and contribution analysis before the remedy decision. A remedy promise should not be broader than the company's role supports, and a refusal to provide remediation should not ignore the company's ability to influence the partner, corrective action, or stakeholder engagement duties elsewhere in the directive.

The evidence record should show that the channel is accessible, that confidentiality and retaliation controls were applied, that well-founded complaints entered the due-diligence process, and that remediation decisions match the company's role in the impact. Amended Article 15 requires assessment without undue delay after a significant change, whenever there are reasonable grounds to doubt that measures remain adequate or effective or to identify new risks, and at least every five years.

Evidence should be case-based enough for an authority, auditor, board committee, or affected stakeholder to understand what happened without exposing identities or sensitive information unnecessarily. Separate the access log from the working case file, restrict identities to staff who need them, and record every disclosure decision so follow-up does not endanger the complainant or notifying person.

A published complaints channel does not prove meaningful stakeholder engagement. A collaborative procedure or mechanism may cover specified Article 14 duties only if it meets Article 14's requirements. An industry or multi-stakeholder initiative may support Article 13 consultation, but it cannot replace consultation with the company's own employees and their representatives.

Stop the case before closure if the file cannot explain the scope boundary, why a complaint was founded or unfounded, how confidentiality was protected, which due-diligence measure was triggered, or why remediation was required, voluntary, enabled through influence over a partner, or not provided.