CSDDD liability and penalties without fixed-fine guesswork

Member States must designate one or more supervisory authorities for CSDDD. For EU companies, the competent authority is generally tied to the Member State of the registered office. For non-EU companies, competence is tied to the Member State of a branch, or, if there is no branch or branches are in several Member States, the Member State where the company generated the most EU turnover in the relevant reference period.

Supervisory authorities must have powers and resources to request information and conduct investigations on compliance with the national rules transposing CSDDD due diligence obligations. They may start investigations on their own initiative or after substantiated concerns are submitted by natural or legal persons.

Where a failure is identified, the authority must grant an appropriate period for remedial action if such action is possible. That does not block penalties or civil liability: remedial action can sit alongside Article 27 penalties and Article 29 liability analysis.

CSDDD requires Member States to lay down penalties, including pecuniary penalties, for infringements of national law adopted under the Directive. The EU text sets minimum design features; it does not create an automatic fixed fine for every breach.

Penalties must be effective, proportionate, and dissuasive. When deciding whether to impose a penalty and setting its nature and level, authorities must account for the infringement's nature, gravity, and duration; severity of impacts; investments and targeted support under prevention and mitigation provisions; collaboration with other entities; prioritisation decisions; previous final infringements; remedial action; financial benefits gained or losses avoided; and other aggravating or mitigating factors.

If pecuniary penalties are imposed, they must be based on the company's net worldwide turnover. The Directive says the maximum limit of pecuniary penalties must be not less than 5% of net worldwide turnover in the financial year preceding the fine decision. That is a minimum level for national maximum limits, not a claim that every Member State fine will be exactly 5% or that every breach triggers that amount.

CSDDD civil liability is tied to specific conditions. A company can be held liable for damage caused to a natural or legal person where it intentionally or negligently failed to comply with the obligations in Articles 10 and 11, the relevant Annex right, prohibition, or obligation is aimed at protecting that person, and the failure caused damage to legal interests protected under national law.

The Directive also draws limits. A company cannot be held liable under Article 29 if the damage was caused only by its business partners in its chain of activities. If the company is liable, the injured person has a right to full compensation under national law, but full compensation must not create overcompensation through punitive, multiple, or other damages.

Contractual clauses, industry initiatives, multi-stakeholder initiatives, or independent third-party verification do not automatically remove civil-liability risk. Article 29 states that companies using those tools may nevertheless be held liable if the liability conditions are met.

Because CSDDD is a directive, liability and penalty handling depends on national transposition. The EU text requires the result Member States must achieve, but national law will determine the detailed authority setup, procedure, remedies, sanction rules, court route, cost rules, and any stricter civil-liability regime that applies in that Member State.

The consolidated EUR-Lex record shows Directive (EU) 2025/794 amended CSDDD timing. It lists a transposition date of 26 July 2027 and application dates from 26 July 2028 for the largest listed cohorts and from 26 July 2029 for other covered companies. Use those dates only as grounded CSDDD timing context; do not use them to invent national penalty start dates or court deadlines.

Article 29 also preserves stricter Union or national civil-liability rules related to adverse human rights or environmental impacts. A company can therefore face CSDDD supervisory enforcement, CSDDD civil-liability claims, and other national or sector-specific liability routes in parallel where the facts support them.

A defensible CSDDD evidence file should let an authority, court, board, or decision owner reconstruct the due diligence decision. The file should connect the adverse impact, the relevant Article 10 or Article 11 obligation, the affected right or environmental prohibition in the Annex, the company's role, the chosen preventive or corrective action, and the follow-up result.

Evidence should be kept at the level where the decision was actually made. A generic sustainability policy is weak evidence for a specific penalty or liability question unless it is connected to the affected operation, subsidiary, business partner, risk assessment, prioritisation decision, contract measure, remediation step, or grievance record.

For civil-liability readiness, keep a clear record of what was known, when it was known, who assessed it, why a measure was considered appropriate, how affected stakeholders were considered, what support or collaboration was offered, and whether remediation occurred.