Share
What is the CSDDD (Corporate Sustainability Due Diligence Directive)?
The CSDDD now applies to companies with 5,000+ employees and €1.5bn turnover from 26 July 2029. See what Omnibus I changed and what your complaints procedure has to do.
The Corporate Sustainability Due Diligence Directive (CSDDD, also written CS3D) is EU law that requires large companies to identify, prevent, end, and remediate adverse human rights and environmental impacts in their own operations, in their subsidiaries, and across their chains of activities. It is Directive (EU) 2024/1760, substantially amended in February 2026 by the Omnibus I Directive, Directive (EU) 2026/470.
The CSDDD is a conduct directive rather than a reporting one. The CSRD asks you to disclose; the CSDDD asks you to act, and to show what you did when a supervisory authority looks.
Who the CSDDD applies to after Omnibus I
EU companies
Both tests must be met: more than 5,000 employees and more than €1.5 billion in net worldwide turnover, measured on a consolidated basis for ultimate parent companies of groups. The original thresholds were 1,000 employees and €450 million, so many companies that were building CSDDD programs are no longer directly in scope. A separate route into scope applies to franchising and licensing arrangements, now set at €75 million in royalties and €275 million in net worldwide turnover.
Non-EU companies
There is no employee test. Turnover alone triggers scope: more than €1.5 billion in net turnover generated inside the EU in the preceding financial year. US, UK, and Asian groups with large EU sales should run this test even where their EU headcount is modest.
If you fell out of scope
Direct obligations no longer apply, but you may still receive due diligence requests as a supplier to an in-scope company, and you may be covered by other EU rules such as the EU Deforestation Regulation or the Forced Labour Regulation. Germany's LkSG also continues to apply within its own scope until Germany transposes the CSDDD.
What the CSDDD requires
The directive follows the OECD six-step due diligence process, and Omnibus I brought most of these obligations under full harmonization, so Member States can no longer add divergent national rules to the core steps.
Identify impacts, then act on them
Due diligence has to sit inside your corporate policies and risk management systems rather than in a standalone document. Article 8 now works in two steps: a scoping exercise based solely on reasonably available information, identifying the general areas where impacts are most likely and most severe, followed by an in-depth assessment in those priority areas. You are no longer required to map every entity or catch every impact. Where you find impacts, you prevent, end, or minimize them, and provide remediation proportionate to your involvement where you caused them. Suspension of a business relationship is the last resort; termination is no longer required. Effectiveness reviews are due at least every five years, and sooner after a significant change.
Run a notification mechanism and a complaints procedure
Article 14 is the operational heart of the directive for compliance teams, and Omnibus I left its substance intact.
What Article 14 asks for
- A complaints procedure that is fair, publicly available, accessible, predictable, and transparent, including a defined route for complaints you consider unfounded. Workers' representatives and trade unions must be told how it works.
- Complaints accepted from affected persons and their legitimate representatives, from trade unions and workers' representatives in the chain of activities, and from experienced civil society organizations where the complaint concerns an environmental impact.
- Rights for the complainant to request follow-up, meet company representatives to discuss severe impacts and possible remediation, and be given your reasoning plus the steps you are taking.
- A separate notification mechanism that accepts submissions anonymously or confidentially in line with national law.
- Protection against retaliation, delivered by keeping identities confidential and sharing information in a way that does not put people at risk.
- The option to use collaborative mechanisms run jointly with other companies or through industry associations, provided they meet the same requirements.
One consequence is easy to miss and expensive to get wrong. Where a complaint is well founded, the impact it describes is treated as identified under Article 8, which triggers your duty to prevent, end, and remediate it. Your complaints channel is an input to your due diligence obligations, not a separate customer service function.
What Omnibus I changed
The transition plan change is the one most often misreported. Omnibus I deleted Article 22 in full, so the CSDDD no longer requires a climate transition plan to be adopted or put into effect. The separate CSRD disclosure obligation on transition plans is unaffected.
Enforcement and whistleblower protection
Each Member State designates supervisory authorities with powers to investigate, issue injunctive orders, and impose penalties capped at 3% of net worldwide turnover. The Commission must issue penalty guidance for those authorities. Actual fine levels will be set in national law.
Article 30 requires Member States to apply the EU Whistleblowing Directive to reports of breaches of national law transposing the CSDDD, and Article 32 amends that directive to make the link explicit. In practice: someone who reports that your company is failing its CSDDD due diligence obligations is a protected whistleblower under the same framework that already governs your internal reporting channel. If your speak-up program and your supply chain grievance mechanism sit in different systems with different rules, close that gap before transposition. Our guide to supply chain grievance mechanisms versus internal whistleblowing sets out where the two overlap.
Filing a complaint with a company does not prevent anyone from raising substantiated concerns with a supervisory authority or pursuing other remedies.
Key dates
- 26 July 2027 — Commission must issue the first implementation guidelines, covering due diligence processes, stakeholder engagement, and model contractual clauses.
- 26 July 2028 — Member States must adopt and publish national transposition measures.
- 26 July 2029 — In-scope companies must comply with the due diligence obligations.
- 1 January 2030 — Article 16 public reporting applies for financial years starting on or after this date.
As of August 2026 no Member State has transposed the amended directive, so penalty levels, supervisory authority designations, and civil liability conditions remain open everywhere.
How the CSDDD relates to Germany's LkSG
The LkSG has applied since January 2023 to companies with 1,000 or more employees and already requires a complaint procedure, the Beschwerdeverfahren. Germany has announced plans to replace it with legislation implementing the CSDDD. If you run a Beschwerdeverfahren today, much of your Article 14 groundwork exists, and our guide to the LkSG complaint procedure for non-German companies covers what carries over. The same applies if you have tested your mechanism against the eight UNGP effectiveness criteria, which the directive turns into binding law.
How SpeakUp helps you meet the CSDDD
Article 14 asks for a channel people outside your organization can reach, a procedure they can predict, and a record showing what you did with what they told you. That is a case management problem before it is a policy problem.
One channel for internal reports and external grievances
With SpeakUp Report, employee misconduct reports and supply chain grievances arrive in one system, with separate intake forms, routing, and retention settings for each. Because Article 30 pulls CSDDD reports into the EU Whistleblowing Directive, running both on one platform means the same confidentiality and non-retaliation controls apply automatically. See supply chain grievance software and whistleblowing software.
Two-way follow-up, which is what complainants are entitled to
Article 14 gives complainants the right to request follow-up and be told your reasoning. Anonymous channels usually break at exactly this point. SpeakUp keeps a secure two-way thread open with anonymous reporters, so you can ask for detail and give reasons without ever learning who they are. Across the platform, 49% of reporters check back for a response. Factory workers and community members rarely have a corporate email address, so intake works by web, phone, or app in more than 100 languages across 30+ countries.
A record you can put in front of a supervisory authority
Every case carries a full audit trail: when the complaint arrived, how it was triaged, who assessed it, what you decided, and what you did next. When a complaint becomes an identified impact under Article 8, the link between it and the measures you took is documented rather than reconstructed. Certifications include ISO 27001, ISO 27701, ISAE 3000 Type II, SOC 2, and TISAX, detailed on our assurance page.
For implementation detail on designing an Article 14 mechanism, read CSDDD grievance mechanism requirements.
Book a demo to see how a CSDDD-ready complaints channel works end to end.
CSDDD FAQ
Does the CSDDD require a grievance mechanism?
Yes. Article 14 requires in-scope companies to operate a complaints procedure and a separate notification mechanism, or participate in a collaborative mechanism meeting the same requirements. The notification mechanism must accept anonymous or confidential submissions.
What are the CSDDD thresholds after Omnibus I?
EU companies need more than 5,000 employees and more than €1.5 billion net worldwide turnover. Non-EU companies need more than €1.5 billion net turnover generated in the EU, with no employee test.
Are whistleblowers protected when they report CSDDD breaches?
Yes. Article 30 applies the EU Whistleblowing Directive to reports of breaches of national law transposing the CSDDD, and Article 32 amends that directive accordingly.
Does the CSDDD still require a climate transition plan?
No. Omnibus I deleted Article 22 in full. The separate CSRD disclosure obligation on transition plans is unchanged.