EU Corporate Sustainability Due Diligence Directive Requirements

Article 2 sets the company scope. EU companies are in scope where they meet the employee and net worldwide turnover route, where they are an ultimate parent of a group meeting that route, or where the franchising or licensing route is met. Third-country companies use Union net turnover rather than EU employee headcount for the main route, with parallel group and franchising or licensing routes.

The general scope threshold in the adopted Directive is more than 1,000 employees and more than EUR 450 million net worldwide turnover for EU companies, or more than EUR 450 million net turnover in the Union for third-country companies. Franchise and licensing coverage is narrower: it depends on qualifying Union agreements, royalties above EUR 22.5 million, and more than EUR 80 million turnover. Scope is tested over consecutive financial years, and AIFs and UCITS are excluded.

Article 5 is the control map for CSDDD due diligence. It requires risk-based human rights and environmental due diligence covering policy and risk management, identification and assessment of actual or potential adverse impacts, prioritisation where not all impacts can be addressed at once, prevention and mitigation, ending actual impacts and minimising their extent, remediation, stakeholder engagement, complaints and notifications, monitoring, and public communication.

Article 7 turns that map into internal governance. The company must integrate due diligence into relevant policies and risk management systems and maintain a due diligence policy developed after prior consultation with employees and their representatives. The policy must describe the company's due diligence approach, include a code of conduct for the company, subsidiaries, and business partners, and describe the processes used to integrate and implement due diligence.

Article 8 requires companies to identify and assess actual and potential adverse impacts from their own operations, subsidiaries, and, where related to chains of activities, business partners. The required method starts with mapping operations and chain-of-activities areas where adverse impacts are most likely and most severe, then carrying out deeper assessment in those areas.

Article 9 applies when the company cannot prevent, mitigate, end, or minimise all identified impacts at the same time and to their full extent. Prioritisation must be based on severity and likelihood. Once the most severe and most likely impacts are addressed within a reasonable time, less severe and less likely impacts must be addressed.

Article 10 covers potential adverse impacts: companies must prevent them, or adequately mitigate them where prevention is not possible or not immediately possible. Relevant measures include prevention action plans, contractual assurances with verification, investments or operational changes, changes to business plans or purchasing practices, targeted and proportionate support for SME business partners, collaboration, and, as a last resort for severe impacts, suspension or termination where the legal and impact conditions are met.

Article 11 covers actual adverse impacts: companies must bring them to an end or minimise their extent where they cannot immediately be ended. Relevant measures include neutralisation or minimisation proportionate to severity and the company's implication, corrective action plans, contractual assurances with verification, investments and operational changes, SME support, collaboration, remediation, and last-resort suspension or termination for severe impacts where the required assessment supports that step.

Article 12 requires remediation where the company has caused or jointly caused an actual adverse impact. The definition in Article 3 frames remediation as restoring affected people, communities, or the environment to an equivalent or as-close-as-possible situation, in proportion to the company's implication in the impact. That can include financial or non-financial compensation and, where applicable, reimbursement of public-authority remedial costs.

Where the actual adverse impact is caused only by a business partner, the Directive allows voluntary remediation and allows the company to use its influence to encourage the business partner causing the impact to provide remediation.

Article 13 requires effective engagement with stakeholders at defined due diligence stages, including gathering impact information, developing prevention and corrective action plans, deciding on suspension or termination, adopting remediation measures, and developing monitoring indicators where appropriate. Consulted stakeholders must receive relevant and comprehensive information, may request additional information, and must be protected from retaliation or retribution, including through confidentiality or anonymity.

Article 14 requires a notification mechanism and complaints procedure. People affected or with reasonable grounds to believe they might be affected, legitimate representatives, trade unions and workers' representatives, and experienced civil society organisations for environmental complaints must be able to submit complaints. The procedure must be fair, publicly available, accessible, predictable, and transparent, with follow-up rights and protection against retaliation.

Article 15 requires periodic effectiveness assessments of operations, subsidiaries, and business partners where related to the chain of activities. Assessments must happen after significant change, at least every 12 months, and whenever there are reasonable grounds to believe new adverse-impact risks may arise. Article 16 requires an annual public statement unless the company is already subject to specified sustainability reporting requirements under Directive 2013/34/EU.

Article 22 requires covered companies to adopt and put into effect a transition plan for climate change mitigation. The plan must aim, through best efforts, to make the company's business model and strategy compatible with the transition to a sustainable economy, the Paris Agreement 1.5 degrees Celsius objective, and the EU climate-neutrality objective, including intermediate and 2050 targets.

The plan design must include time-bound climate targets for 2030 and in five-year steps to 2050, and, where appropriate, absolute scope 1, scope 2, and scope 3 greenhouse gas emission reduction targets for significant categories. It must also describe decarbonisation levers and key actions, explain and quantify investments and funding, and describe the role of administrative, management, and supervisory bodies. Companies reporting a transition plan under the relevant CSRD provisions are deemed to have complied with the CSDDD obligation to adopt a plan, but Article 22 still requires annual updates describing progress.

A defensible CSDDD requirements file should show that the company has translated Articles 2, 5, 7 to 16, and 22 into owned processes. The evidence should connect the legal requirement to business systems: procurement, supplier management, operations, enterprise risk, sustainability reporting, complaints handling, remediation, legal governance, and board or management-body oversight.

The evidence should also separate current law from monitoring items. Proposal-stage Omnibus simplification material should stay in a watchlist until an adopted act is available in the source set being used for implementation.