The EU has a corporate sustainability due diligence law, and a small supplier may assume it brings new obligations. It does not apply to you directly. It targets very large companies — after the March 2026 changes, a much smaller set than originally planned — and reaches suppliers only through those customers' requests.
| First question | Short answer |
|---|---|
| Am I in scope? | No. The thresholds are more than 5,000 employees and more than €1.5 billion turnover. |
| When does it apply to anyone? | From 26 July 2029. Nobody has to comply today. |
| How does it reach me? | In-scope customers ask suppliers to sign codes of conduct, answer questionnaires, and provide evidence. |
| When will those requests start? | Gradually, building through 2027–2028 ahead of the 2029 date. Some customers already include CSDDD-style questions. |
| What should I do now? | The same ESG groundwork that answers every other questionnaire: policies, labor records, basic environmental data, a grievance route. |
Regulation details and links checked 14 July 2026.
The law changed in March 2026
If your picture of CSDDD comes from the coverage around its adoption in 2024, it is out of date, mostly in a direction that favors suppliers. The Omnibus I Directive (EU) 2026/470, in force from 18 March 2026, scaled CSDDD back significantly (Clifford Chance summarizes the changes):
- Far fewer companies in scope. EU companies with more than 5,000 employees and more than €1.5 billion net turnover, and non-EU companies with over €1.5 billion EU turnover. Roughly 6,000 companies, down from around 13,000 under the original text.
- A later timeline. Member states transpose by 26 July 2028; the rules apply from 26 July 2029. The Commission's supporting guidance is due by 26 July 2027. No company is required to comply with CSDDD today.
- Risk-based due diligence. In-scope companies focus where the risk of harm is most serious rather than mapping every entity in their chain.
- Some obligations removed. The requirement to adopt a climate transition plan was deleted; the EU-harmonized civil liability regime was removed (liability now runs through national law).
The urgency in 2024-era coverage — 13,000 companies, sweeping chain mapping, imminent — no longer matches the law. The pressure on suppliers is real, but slower and lighter.
What CSDDD is
The Corporate Sustainability Due Diligence Directive requires very large companies to identify, prevent, and address adverse human rights and environmental impacts in their own operations and across their chain of activities, which includes suppliers. The European Commission maintains the official CSDDD page with the legal text and state of play.
Out of scope by design
An SME, or a mid-sized company, is nowhere near the 5,000-employee, €1.5 billion thresholds. The directive does not require your business to run a due diligence program, publish CSDDD reports, or meet its compliance obligations. That is the design: the duty sits with the largest companies.
If a consultant or customer says you "must comply with CSDDD", that is wrong as stated. What is true is narrower.
How it reaches you
An in-scope customer must do risk-based due diligence across its chain of activities, which includes you. Your largest customers may:
- Ask you to sign their supplier code of conduct and confirm you meet human rights and environmental standards
- Send questionnaires about labor practice, environmental impact, and your own supply chain
- Ask for evidence — policies, data, certifications — to support their due diligence
- Add contractual clauses requiring you to uphold standards and cooperate with their checks
Two things soften this relative to the original directive. With roughly 6,000 companies in scope, fewer of your customers run CSDDD programs. And the risk-based approach means in-scope companies concentrate on the riskiest parts of their chains; a low-risk supplier in a low-risk sector should see targeted questions rather than exhaustive audits. The directive also expects large companies to support SME suppliers rather than pass compliance costs downstream.
Requests will not arrive on one date. Expect them to build as 26 July 2029 approaches, with large companies designing programs in 2027–2028 once Commission guidance lands and rolling out codes of conduct and questionnaires ahead of the application date. Some early movers already fold CSDDD-style questions into the ESG questionnaires they send.
What is worth doing now
No CSDDD compliance department, and nothing because of CSDDD this year. What is needed is readiness for the requests that flow down from large customers, which is the groundwork every other ESG questionnaire requires:
- Core policies — human rights, supplier code of conduct, environmental, health and safety, anti-corruption
- Knowledge of your own supply chain — where key materials and inputs come from, for traceability questions
- Basic environmental data — energy and emissions, waste, water
- Current labor documentation — fair wages, working hours, no forced or child labor, a grievance route
- A grievance mechanism — a way for concerns to be raised, however simple
If emissions have never been tracked, the free carbon calculator turns a year of energy bills into a first Scope 1 and 2 figure.
This is the foundation in small supplier ESG requirements, built into a response system. Done once, it answers CSDDD-driven requests, LkSG questionnaires, and the rest.
CSDDD, LkSG, and Germany
Suppliers to German customers may know the LkSG, the German Supply Chain Act. Germany is replacing it with its CSDDD implementation; LkSG reporting has been wound down, but customer due diligence questionnaires continue. The LkSG guide covers that situation.
What not to do
- Do not build a CSDDD compliance program. You are not in scope, and nobody has to comply before July 2029.
- Do not ignore customer requests. In-scope customers will ask ahead of the deadline, and inability to answer can cost the relationship.
- Do not act on 2024-era summaries. Scope, timeline, and obligations all changed in March 2026. Check the date on anything you read.
- Do not invent data for a due diligence questionnaire. Report what you can prove; state gaps.
- Do not run CSDDD as a separate silo. The same policies and data answer it.
One caveat
CSDDD is a directive. Each member state writes it into national law by July 2028, and national implementations can add detail. If a specific obligation matters to a contract you are signing, check how the relevant country has transposed it. The Commission's page tracks the current state.
The bottom line
CSDDD is a due diligence law for roughly 6,000 very large companies, applying from July 2029. It is not a law for small suppliers and not a law anyone must comply with today. What reaches you, gradually, is the downstream effect: large customers asking you to confirm standards, answer questionnaires, and provide evidence. The response is not a compliance program. It is the same ESG groundwork that answers every buyer, done once and ready before the requests arrive.
Official References
- European Commission — Corporate Sustainability Due Diligence
- Clifford Chance — Omnibus I: CSDDD and CSRD reforms