EU Corporate Sustainability Due Diligence Directive Requirements

Article 2 sets the company scope. EU companies are in scope where they meet the employee and net worldwide turnover route, where they are an ultimate parent of a group meeting that route, or where the franchising or licensing route is met. Third-country companies use Union net turnover rather than EU employee headcount for the main route, with parallel group and franchising or licensing routes.

Directive (EU) 2026/470 narrowed the general scope. EU companies generally require more than 5,000 employees and more than EUR 1.5 billion net worldwide turnover; third-country companies generally require more than EUR 1.5 billion net turnover in the Union. Relevant ultimate-parent routes remain. The separate franchise and licensing route also remains, but its thresholds rose to more than EUR 75 million in qualifying Union royalties and more than EUR 275 million turnover. Scope is tested over two consecutive financial years and ends only after two relevant years below the conditions.

Article 2 excludes alternative investment funds (AIFs) and undertakings for collective investment in transferable securities (UCITS). That exclusion does not automatically cover an external fund manager or every regulated financial undertaking, so test the legal person performing the management or financial activity separately.

A positive Article 2 scope result does not make the operating duties immediately applicable. Record the 26 July 2028 national transposition deadline, the 26 July 2029 application date, the separate Article 16 financial-year trigger, and the national laws that will govern procedure and enforcement.

Article 5 is the control map for CSDDD due diligence. It requires risk-based human rights and environmental due diligence covering policy and risk management, identification and assessment of actual or potential adverse impacts, prioritisation where not all impacts can be addressed at once, prevention and mitigation, ending actual impacts and minimising their extent, remediation, stakeholder engagement, complaints and notifications, monitoring, and public communication.

Article 7 turns that map into internal governance. The company must integrate due diligence into relevant policies and risk management systems and maintain a due diligence policy developed after prior consultation with employees and their representatives. The policy must describe the company's due diligence approach, include a code of conduct for the company, subsidiaries, and business partners, and describe the processes used to integrate and implement due diligence.

The Directive requires appropriate measures that can address the impact, match its severity and likelihood, and are reasonably available in the specific circumstances. It does not prescribe one identical control for every operation, partner, or impact.

Amended Article 8 requires a scoping exercise based solely on reasonably available information across own operations, subsidiaries, and relevant business partners. The company then performs an in-depth assessment in areas where adverse impacts are most likely and most severe.

Article 9 applies when the company cannot prevent, mitigate, end, or minimise all identified impacts at the same time and to their full extent. Prioritisation must be based on severity and likelihood. Once the most severe and most likely impacts are addressed within a reasonable time, less severe and less likely impacts must be addressed.

Human-rights examples include child labour, forced labour, unsafe work, interference with freedom of association, and unlawful displacement when the Annex conditions are met. Environmental impacts are not any sustainability concern: they arise from breaches of the prohibitions and obligations listed in the CSDDD Annex, including specified rules on hazardous substances, pollution, waste, biodiversity, and natural resources.

Article 10 covers potential adverse impacts through prevention or adequate mitigation, using action plans, contractual assurance with verification, investment or operational change, purchasing-practice change, SME support, collaboration, and the amended last-resort measures. Directive (EU) 2026/470 removed termination but retained restrictions on new or extended relationships, enhanced action plans, and suspension where legally available and not expected to cause manifestly more severe impacts.

Article 11 covers actual adverse impacts through action to end them or minimise their extent, corrective plans, verification, investment, operational change, SME support, collaboration, remediation, and the same last-resort structure. A suspension decision requires notice, measures addressing the impacts of suspension, and continuing review.

Article 12 requires remediation where the company has caused or jointly caused an actual adverse impact. The definition in Article 3 frames remediation as restoring affected people, communities, or the environment to an equivalent or as-close-as-possible situation, in proportion to the company's implication in the impact. That can include financial or non-financial compensation and, where applicable, reimbursement of public-authority remedial costs.

Where the actual adverse impact is caused only by a business partner, the Directive allows voluntary remediation and allows the company to use its influence to encourage the business partner causing the impact to provide remediation.

Article 13 retains meaningful engagement but Directive (EU) 2026/470 narrowed the stakeholder definition and mandatory consultation stages. Identify the affected stakeholders or legitimate representatives relevant to the decision, provide usable information, address access barriers, and protect confidentiality and non-retaliation.

Article 14 requires a notification mechanism and complaints procedure. People affected or with reasonable grounds to believe they might be affected, legitimate representatives, trade unions and workers' representatives, and experienced civil society organisations for environmental complaints must be able to submit complaints. The procedure must be fair, publicly available, accessible, predictable, and transparent, with follow-up rights and protection against retaliation.

Article 15 requires effectiveness assessments. Under Directive (EU) 2026/470, the regular cycle is at least every five years, plus reassessment after significant change or when reasonable grounds indicate new risks or ineffective measures. Article 16 requires public communication under the amended reporting rules.

Directive (EU) 2026/470 removed the standalone CSDDD Article 22 climate-transition-plan requirement. A company may still have transition-plan, reporting, national-law, sector, contractual, financing, or public-commitment duties, but those must be mapped to their own current sources rather than presented as CSDDD requirements.

Where a climate plan is retained, label its actual basis and keep it connected to environmental adverse-impact analysis only where that connection is supported. Do not carry forward the former CSDDD 12-month update, target, funding, or governance requirements as current law without a separate binding source.

A defensible CSDDD requirements file should show that the company has translated amended Article 2 and Articles 5 and 7 to 16 into owned processes. The evidence should connect the legal requirement to business systems: procurement, supplier management, operations, enterprise risk, sustainability reporting, complaints handling, remediation, legal governance, and board or management-body oversight.

The evidence should separate current law from legislative history: Directive (EU) 2026/470 is the adopted amendment, while the original Article 22 and proposal-stage Omnibus alternatives belong in the history record.

Article 5 requires the company to retain documentation of its due diligence actions, including supporting evidence, for at least five years from when the material was produced or obtained. If related judicial or administrative proceedings are still open when that period ends, retention continues until the matter concludes.