CSDDD supplier human rights impact scoring template

Start each scoring row by fixing the CSDDD boundary. Article 8 covers the company's own operations, subsidiaries, and business partners where their activities are related to the company's chain of activities. The directive defines that chain to include upstream activities such as design, extraction, sourcing, manufacture, transport, storage and supply, and downstream distribution, transport and storage when carried out for or on behalf of the company.

Do not score a supplier as high risk merely because it is strategic, expensive, or hard to replace. Score the actual or potential adverse impact linked to a defined activity, site, product, service, sector, geography, or operating context.

Sector examples help identify plausible impacts; they do not create a fixed risk score. Combine sector, geography, product, workforce, business-model, and enterprise evidence, then confirm the specific activity and affected rightsholder through the Article 8 scoping and in-depth-assessment sequence.

Do not narrow the register to first-tier suppliers. The relevant risk may sit with a mine, farm, labour recruiter, contract factory, data-labeling workforce, warehouse, or other indirect partner whose activity is inside the chain of activities.

A generic vulnerable-group flag is not enough. Record which people may be affected, how the impact differs for them, what blocks participation or remedy, and whether the available evidence hides those differences.

The assessment can name indigenous peoples, women, children, persons with disabilities, migrant workers and their families, minorities, human rights defenders, and other context-specific groups where the facts support it. Do not assume that every person in a named group faces the same risk.

Use Article 8 as the intake structure. First scope broad areas, using only reasonably available information, where adverse impacts are most likely and most severe. Then run an in-depth assessment for the supplier activities, locations, products, or services identified by that scoping exercise.

The evidence column should combine quantitative and qualitative information where available. Request business-partner information only when necessary. For a partner with fewer than 5,000 employees, request it only when the information cannot reasonably be obtained by other means. Supplier questionnaires should not displace credible complaints, worker or trade-union input, independent reports, or other relevant sources.

Article 5 does not require a business partner to disclose trade secrets merely because the company is conducting due diligence. That protection does not prevent disclosure of direct or indirect partner identities or essential information needed to identify impacts when the request is necessary and duly justified. Classified information and information whose disclosure would risk essential state-security interests are never required.

Article 9 prioritisation applies when it is not feasible to address every identified impact at the same time and to the full extent. The score should therefore rank impacts by severity and likelihood, then show which impacts will move first into prevention, mitigation, corrective action, remediation, or monitoring.

The CSDDD does not prescribe a numeric scoring scale or a formula that combines severity and likelihood. If the company uses numbers, define each level and require a written reason. Each row should explain who may be harmed, the nature, scale, scope, and irremediable character of the harm, how likely the impact is, and which evidence would change the assessment. For example, credible forced-labour indicators or a risk of fatal exposure can require high-severity escalation even where the supplier is low-spend or the affected group is small. The case evidence controls the final score.

The completed template should produce an impact register. Each high-priority row needs a linked due diligence action: prevention or mitigation for potential impacts, corrective action for actual impacts, remediation where the company caused or jointly caused an actual impact, and stakeholder engagement at the Article 13 stages relevant to the row.

Before using suspension as an output, record why the specified measures are insufficient, whether governing law permits suspension, whether an enhanced plan can reasonably be expected to succeed, and whether suspension could cause manifestly more severe impacts. Mandatory termination was removed in 2026. Keep notice, impact-mitigation, monitoring, and review evidence attached to the impact row. Rescore without undue delay after a significant change and whenever a complaint, verification result, or other evidence gives reasonable grounds to believe a control is ineffective or a new impact may arise; the five-year Article 15 cycle is only the maximum regular interval.