The EU CSDDD: A Guide to the New Corporate Due Diligence Mandate and Global Supply Chain Liability

July 26, 2026, was supposed to be a watershed moment for global corporate accountability. It marked the original deadline for European Union member states to transpose the landmark Corporate Sustainability Due Diligence Directive (CSDDD) into national law. But a massive legislative rewrite earlier this year slammed the brakes on that timeline.

The CSDDD was designed to be the world's most comprehensive supply chain law, forcing multinational corporations to actively police their global operations for human rights abuses and environmental degradation. Instead of merely reporting on their sustainability efforts, companies would be legally required to prevent and mitigate harm.[4]

However, facing intense pressure from business groups concerned about economic competitiveness and administrative overload, the EU fundamentally altered the directive. The "Omnibus I" package, officially published in February 2026, significantly narrowed the scope of the CSDDD and pushed its compliance deadlines years into the future.[1]

Understanding the revised CSDDD is critical for any large enterprise operating in or trading with Europe. While the rules have been watered down, the core mandate remains: the era of turning a blind eye to the actions of overseas suppliers is ending.[4]

The most dramatic change introduced by the Omnibus I amendments is the drastic reduction in the number of companies directly subject to the law. The original framework would have captured EU companies with just 1,000 employees and €450 million in global turnover.[2][3]

Under the new rules, the threshold has been raised exponentially. The CSDDD now only applies to EU-based companies with more than 5,000 employees and a net worldwide turnover exceeding €1.5 billion.

Non-EU companies are not exempt, provided they do significant business within the bloc. A foreign corporation will fall under the CSDDD's jurisdiction if it generates more than €1.5 billion in net turnover strictly within the EU, regardless of its global employee count.[3]

Legal analysts estimate that these revised thresholds have removed approximately 70% of the originally targeted companies from direct regulatory scrutiny. The shift reflects a pragmatic compromise by EU lawmakers, aiming to focus enforcement on the largest, most resourced multinational conglomerates.[3]

The timeline for compliance has also been entirely restructured. The original directive featured a staggered phase-in based on company size. The Omnibus I package replaced this with a single, unified application date.[2]

Member states now have until July 26, 2028, to transpose the revised CSDDD into their national legal frameworks. Following that, all in-scope companies—both EU and non-EU—will have until July 26, 2029, to fully implement their due diligence processes.

The substantive obligations of the CSDDD require companies to adopt a "risk-based approach." They must map their "chain of activities"—which includes upstream suppliers and certain downstream logistics—to identify where severe human rights or environmental impacts are most likely to occur.[2]

Once risks are identified, companies must take appropriate measures to prevent or mitigate them. This can involve updating purchasing practices, investing in supplier capacity, or, as a last resort, responsibly disengaging from business partners who refuse to improve their practices.[4]

Notably, the Omnibus I package stripped out one of the original directive's most controversial provisions: the mandate for companies to adopt and implement a climate transition plan aligned with the Paris Agreement. While companies must still report on climate risks under the separate Corporate Sustainability Reporting Directive (CSRD), the CSDDD no longer enforces the implementation of those plans.[3]

The enforcement mechanisms, however, remain formidable. The directive relies on a dual system of administrative supervision and civil liability. National supervisory authorities will have the power to launch investigations and impose severe financial penalties.[4]

If a company fails to comply with the due diligence requirements, it can be fined up to 3% of its net worldwide turnover. For a corporation generating €2 billion annually, that equates to a potential penalty of €60 million.[3]

The EU-wide harmonized civil liability regime was dropped during the Omnibus negotiations, meaning that victims seeking compensation for supply chain harms will have to rely on the individual tort laws of the specific member states where claims are filed.[3]

Despite the reduced scope, legal experts warn that the CSDDD will still have a profound "trickle-down" effect across the global economy. The massive corporations that remain in scope cannot audit their supply chains in isolation; they must demand transparency from their partners.[2][4]

Consequently, smaller suppliers in Asia, the Americas, and Africa will find themselves subjected to rigorous new contractual clauses. To maintain their relationships with European giants, these tier-one and tier-two suppliers will be forced to elevate their own human rights and environmental standards, ensuring the CSDDD's impact resonates far beyond the borders of the EU.[4]