CSDDD After Omnibus I: A Plain-English Guide for Legal, Compliance and Sustainability Teams (2026)

The Corporate Sustainability Due Diligence Directive (CSDDD, also written CS3D) is the EU law that most legal and compliance teams have heard of but fewest have read in full. That is partly because it kept changing - and it changed again, fundamentally, in early 2026.

Directive (EU) 2026/470 - the Omnibus I Directive - was published in the Official Journal of the European Union on 26 February 2026 and entered into force on 18 March 2026. It amended both the CSRD and the CSDDD in a single instrument. This guide focuses on the CSDDD side of that package: what the directive actually requires, who is now in scope, what the Omnibus changed, and what your team should be doing before the 2029 application date arrives.

A note on legal certainty. The Omnibus I text is final and in force. However, Member States have not yet transposed it into national law, and the European Commission's implementation guidelines are still being developed (a public consultation ran until 24 July 2026). Specific penalty levels, civil liability rules, and procedural details will vary by Member State. Treat this guide as a framework, not legal advice, and verify against the final transposed text in each relevant jurisdiction.

---

What the CSDDD is - and how it differs from CSRD

The CSDDD and the CSRD are siblings, not twins. They share the same EU sustainability policy family, but they do fundamentally different things.

CSRD is a reporting directive. It requires in-scope companies to disclose sustainability information - impacts, risks, opportunities, targets - in their management reports, using the European Sustainability Reporting Standards (ESRS). If you have been working on a double materiality assessment or ESRS data collection, that is CSRD work.

CSDDD is a conduct directive. It does not primarily ask companies to report on sustainability; it requires them to act. Specifically, it imposes a legal obligation to identify, prevent, mitigate, bring to an end, and remediate actual and potential adverse human rights and environmental impacts across the company's own operations, its subsidiaries, and its wider chain of activities.

As Deloitte has noted, the CSRD focuses on reporting and disclosure of social and environmental impacts, risks, and opportunities, while the CSDDD imposes action-oriented obligations, requiring companies to actively examine and address the environmental and human rights impacts of their own operations and supply chain. The two directives are designed to complement each other: CSDDD due diligence work feeds into CSRD disclosures, and for companies in scope of both, the CSDDD relies on CSRD reporting to avoid duplicating disclosure obligations.

The CSDDD operationalises the UN Guiding Principles on Business and Human Rights (UNGPs) and the OECD Guidelines for Multinational Enterprises, translating voluntary international standards into binding EU law for the first time at regional scale.

---

Who is in scope after the Omnibus

This is where the Omnibus I changes are most dramatic.

EU companies

After the Omnibus, the CSDDD applies to EU companies with more than 5,000 employees AND more than €1.5 billion net worldwide turnover. Both tests must be met. This is a substantial increase from the original CSDDD thresholds of 1,000 employees and €450 million turnover.

Non-EU companies

Non-EU companies (including US, UK, and other third-country groups) fall within scope if they generated more than €1.5 billion in net turnover within the EU in the preceding financial year. There is no employee test for non-EU companies - turnover alone is the trigger. A large US manufacturer or Asian conglomerate with significant EU sales needs to assess this carefully.

Franchising and licensing

Companies or parent companies of groups that have entered into franchising or licensing agreements in the EU may also fall within scope where the royalty and turnover thresholds set out in the directive are met. This is a specialist area; take specific advice if your business model involves significant franchise or licensing arrangements in the EU.

The CSRD comparison

To put the CSDDD thresholds in context: CSRD applies to EU companies with more than 1,000 employees and €450 million net turnover. The CSDDD bar is therefore roughly five times higher on employees and more than three times higher on turnover. It has been estimated that the Omnibus I amendments narrowed the CSDDD from approximately 13,000 companies to roughly 6,000 directly in-scope entities.

*Non-EU CSRD scope also requires an EU subsidiary or branch above €200m turnover.

---

The core obligations: what CSDDD actually requires

For companies that are in scope, the CSDDD imposes a structured, ongoing due diligence programme. The framework follows the OECD's six-step due diligence process for responsible business conduct, applied to human rights and environmental impacts.

1. Integrate due diligence into policies and management systems

Companies must embed due diligence into their corporate policies - including a code of conduct - and their risk management systems. This is not a one-off exercise; it must be a living part of how the company operates.

2. Identify and assess adverse impacts (the scoping exercise)

This is the analytical core of the directive. Companies must identify actual and potential adverse human rights and environmental impacts in their own operations, subsidiaries, and chain of activities.

The Omnibus introduced an important refinement here. Companies must begin with a scoping exercise based solely on reasonably available information, to identify the general areas where adverse impacts are most likely to occur and most severe. Only then do they move to in-depth assessment in those priority areas. As Covington noted in its June 2026 analysis of the Commission's guidelines consultation, Article 8 of the CSDDD introduces this two-step approach: a scoping exercise based on "reasonably available information," followed by an in-depth assessment in areas where adverse impacts have been identified as most severe and most likely.

Risk factors to consider include geographical context, sector, product or service type, and whether the business partner is itself covered by the CSDDD.

3. Prevent, mitigate, and bring to an end adverse impacts

Once identified, companies must take appropriate measures to prevent potential adverse impacts and bring actual adverse impacts to an end (or minimise them where immediate cessation is not possible). This may involve contractual assurances from business partners, investment in supplier capacity, or - as a genuine last resort - suspension or disengagement from a business relationship.

4. Remediation

Where a company has caused or jointly caused an actual adverse impact, it must provide remediation. The directive defines this as restoration of the affected person(s), communities, or environment to a situation equivalent, or as close as possible, to the situation they would have been in had the adverse impact not occurred - proportionate to the company's degree of involvement. This can include financial or non-financial compensation.

5. Stakeholder engagement

The CSDDD includes a cross-cutting obligation to conduct meaningful consultation with stakeholders at different stages of the due diligence process. Companies must consult with affected parties - including employees, communities, and civil society organisations - providing them with relevant and comprehensive information. Consultation should take place on an ongoing basis, with notable points of engagement during impact identification, corrective action planning, and remediation decisions.

6. Notification mechanism and complaints procedure

Companies must establish or participate in an accessible, transparent complaints procedure through which affected persons and relevant organisations can raise concerns about adverse impacts. As Gibson Dunn has observed, such mechanisms act not only as a tool to remedy and redress harm but can be harnessed preventively as an early warning system for identifying and analysing adverse impacts.

7. Monitoring and public communication

Companies must monitor the effectiveness of their due diligence measures. The Omnibus eased the frequency: the minimum cadence for periodic effectiveness reviews shifts from annual to at least every five years, with ad hoc reviews required upon significant change or where there are reasonable grounds to believe the current assessment is no longer adequate.

Public communication on due diligence - the Article 16 reporting obligation - is a separate requirement, discussed in the timeline section below.

---

What the Omnibus I changed

The Omnibus I Directive made five categories of change to the CSDDD that compliance teams need to understand precisely.

1. Higher thresholds (scope reduction)

As described above, the employee and turnover thresholds were raised sharply. Many companies that were preparing for CSDDD compliance under the original 2024 text are no longer directly in scope.

2. The transition plan obligation - removed, not just eased

This is the change most often mischaracterised. The original CSDDD required companies to adopt and put into effect a climate change mitigation transition plan aligned with the 1.5°C goal of the Paris Agreement. The Omnibus I Directive deleted this obligation in its entirety from the CSDDD. As Linklaters confirmed at the time of publication, "the provision requiring undertakings to adopt and put into effect a climate transition plan has been deleted in its entirety."

What remains: The CSRD still requires companies in scope of that directive to disclose a transition plan if they have one (under ESRS E1-1). The CSDDD no longer independently requires one to be adopted or put into effect. These are different obligations under different directives. If your company is in scope of both CSRD and CSDDD, the CSRD disclosure obligation on transition plans is unaffected by the Omnibus CSDDD amendment.

3. Limiting the trickle-down effect on smaller firms

One of the Omnibus's stated goals was to prevent large in-scope companies from cascading disproportionate compliance burdens onto their smaller suppliers. The amended directive limits the information that companies within scope may request from SME and small midcap business partners (companies with no more than 500 employees) to the information specified in the CSRD voluntary sustainability reporting standard for SMEs (the VSME standard). In-scope companies must also provide proportionate support - training, capacity building, or financial assistance - to SME suppliers that struggle with due diligence requirements, rather than simply terminating those relationships.

4. Civil liability - harmonised EU regime removed

The original CSDDD contained a harmonised EU-wide civil liability regime, giving victims a right to seek compensation in European courts. The Omnibus I Directive deleted the harmonised EU-wide civil liability regime; civil liability is now governed by Member State national law. Member States must still ensure a right to full compensation for damages caused by a failure to comply with due diligence obligations, and the existing civil procedural provisions around limitation periods, costs, and injunctive measures are retained. But the specific conditions of liability will now vary by jurisdiction - making it essential to monitor national transposition carefully.

5. Penalties capped, not floored

Under the original CSDDD, Member States were required to set maximum fines of at least 5% of global net worldwide turnover. The Omnibus removed this minimum floor and instead capped penalties at a maximum of 3% of net worldwide turnover. The Commission is expected to issue penalty guidance. Specific fine levels will be set by Member States in their national transposition legislation.

6. Harmonisation - limiting gold-plating

The Omnibus introduced a stronger harmonisation requirement, preventing Member States from adopting national laws that exceed the relevant core due diligence obligations set out in the CSDDD. This is intended to create a more level playing field across the EU. However, Member States retain some discretion for specific adverse impacts or specific sectors to achieve higher levels of environmental or human rights protection. Monitoring national transposition will therefore remain important.

---

The timeline to 2028, 2029, and 2030

Here are the key dates, confirmed by the European Commission:

• 18 March 2026 - Omnibus I (Directive (EU) 2026/470) entered into force.
• 26 July 2027 - European Commission must issue the first wave of implementation guidelines (on due diligence processes, stakeholder engagement, model contractual clauses, and sector-specific guidance). A public consultation on these guidelines ran until 24 July 2026.
• 26 July 2028 - Member States must transpose the CSDDD-related Omnibus I amendments into national law.
• 26 July 2029 - National measures apply; in-scope companies must comply with the CSDDD's due diligence obligations from this date.
• 1 January 2030 - The Article 16 public reporting measures apply for financial years starting on or after this date.

As Norton Rose Fulbright confirmed in its post-Omnibus FAQ, the requirements of CS3D will apply to companies from 26 July 2029, save for the reporting requirements under Article 16 which will apply from 1 January 2030.

Important caveat: As of July 2026, no Member State has yet transposed the amended CSDDD. Until transposition is complete, the specific national rules - including penalty levels, supervisory authority designations, and civil liability conditions - remain pending. Companies should monitor developments in each relevant jurisdiction.

---

What in-scope companies should do now

The 2029 application date may feel distant, but the due diligence programme the CSDDD requires takes time to build. Value chain mapping, supplier engagement, grievance mechanism design, and governance integration are multi-year projects. The Commission's guidelines, due in 2027, will provide important implementation detail - but waiting for them before starting is not a viable strategy.

Here is a summary of priority actions:

Immediately (now-end 2026)

• Confirm your scope status. Recheck against the revised thresholds. For non-EU groups, the test is EU turnover only - no employee threshold applies.
• Map your chain of activities. Identify upstream and downstream business partners. The scoping exercise must be based on reasonably available information; you do not need to survey every supplier before you start.
• Assign internal ownership. CSDDD cuts across legal, compliance, procurement, sustainability, and finance. Governance clarity now prevents duplication and gaps later.
• Monitor the Commission's guidelines consultation. The guidelines, expected in Q1 2027, will shape how supervisory authorities and courts interpret the directive's obligations. Companies with substantive views should consider engaging with the consultation process.

2027

• Conduct in-depth impact assessments in the areas identified as highest risk in your scoping exercise.
• Review supplier contracts and questionnaires. Align information requests with the VSME standard for SME partners. Ensure contractual clauses reflect the CSDDD's appropriate measures framework.
• Design or upgrade your complaints mechanism. It must be accessible, transparent, and known to affected persons and organisations.

2028

• Monitor national transposition. Member States must transpose by 26 July 2028. The specific penalty levels, supervisory authority powers, and civil liability conditions will be set at national level. Germany, for example, is expected to replace its existing Supply Chain Act (LkSG) with a new law implementing the CSDDD.
• Finalise your due diligence programme documentation. Audit-proof records of your scoping exercise, impact assessments, preventive and corrective measures, and stakeholder engagement will be essential for supervisory authority reviews.

By 26 July 2029

• Full compliance with all CSDDD due diligence obligations required.

From 1 January 2030

• Article 16 public reporting on due diligence applies for financial years starting on or after this date.

---

The broader regulatory context

The CSDDD does not sit in isolation. It is part of a wider EU framework of supply chain due diligence obligations that includes the EU Deforestation Regulation (EUDR, applying from December 2026), the EU Forced Labour Regulation (applying from December 2027), and the EU Conflict Minerals Regulation. Data collected and due diligence implemented under these sector-specific regulations can support CSDDD compliance, and vice versa.

For companies in scope of both CSRD and CSDDD, the two directives are designed to work together: CSDDD due diligence work informs the sustainability disclosures required under CSRD, and the CSDDD relies on CSRD reporting to avoid duplicating disclosure obligations for companies covered by both.

---

Key takeaways

• The CSDDD is a conduct directive, not a reporting directive. It requires companies to identify, prevent, mitigate, and remediate adverse human rights and environmental impacts across their value chains.
• After Omnibus I, it applies to EU companies with >5,000 employees AND >€1.5bn turnover, and to non-EU companies with >€1.5bn EU turnover. These thresholds are significantly higher than CSRD's.
• The obligation to adopt and put into effect a climate transition plan was deleted from the CSDDD by the Omnibus. The CSRD disclosure obligation on transition plans is separate and unaffected.
• Civil liability is now national, not harmonised EU-wide. Penalties are capped at 3% of global net turnover (the previous 5% floor was removed).
• The trickle-down of obligations onto SME suppliers is limited: information requests must be capped at VSME-standard data.
• Member States must transpose by 26 July 2028; companies must comply from 26 July 2029; Article 16 reporting applies from 1 January 2030.
• Implementation guidelines from the Commission are expected by 26 July 2027 - but building a due diligence programme takes years. Start the scoping exercise now.