CSDDD: Duty of Vigilance for Human Rights and the Environment, the Applicable Framework after Omnibus I Amendments (2026)

I. Context

Directive (EU) 2024/1760 on the duty of vigilance for companies regarding sustainability (CSDDD) aims to regulate the impact of companies on human rights and the environment.

It translates existing international standards—most notably the United Nations Guiding Principles on Business and Human Rights (UNGPs) and the OECD Guidelines—into binding legal obligations.

In 2026, the directive was substantially amended by the so-called “Omnibus I” initiative, aiming for simplification of European institutions. These modifications notably affected the scope of application, certain operational obligations, and the liability regime.

II. Who is concerned?

The CSDDD now applies to:

• EU companies with more than 5,000 employees and €1.5 billion in net turnover
• Non-European companies generating an equivalent turnover within the European Union
• Ultimate parent companies of groups reaching these thresholds
• Certain companies operating via franchising or licensing under specific conditions

This scope is a major reduction compared to the initial version, now covering only a limited number of groups (about 1,400).

However, the directive has indirect effects on a much larger number of companies via commercial relationships, which will need to prepare for requests from key business partners.

III. What is the scope?

The CSDDD requires the companies concerned to exercise their duty of vigilance over their own activities, those of their subsidiaries, and, under certain conditions, those of their business partners within their "chain of activities."

This chain of activities includes:

• Upstream: design, extraction, sourcing, manufacturing, transport, and storage
• Downstream: only certain activities (distribution, transport, storage), when carried out for the company or on its behalf

The coverage is therefore broad upstream and limited downstream, which is a significant restriction. Business partners include both direct and indirect partners.

IV. What is the scope of impacts covered? The directive targets:

• Negative impacts on human rights
• Negative impacts on the environment

These impacts are defined by reference to a list of international instruments in the annex, as well as to specific conditions (notably foreseeability and violation of a protected interest).

Integration of the duty of vigilance in risk management policies and systems

• Identification and assessment of actual or potential negative impacts
• Prioritisation of negative impacts, where necessary
• Prevention and mitigation of potential negative impacts, as well as cessation and minimisation of actual negative impacts
• Remediation of actual negative impacts
• Dialogue with stakeholders (meaningful engagement with stakeholders)
• Implementation of a notification mechanism and grievance procedure
• Monitoring effectiveness of the policy and due diligence measures
• Public communication on duty of vigilance

Climate and environment

Environmental impacts, including those relating to climate, are included within the scope of the duty of vigilance. Companies must therefore integrate these issues into their risk analysis, without a currently autonomous specific requirement for a transition plan.

Liability, supervision, and sanctions

The directive provides for the establishment of national supervisory authorities with investigative and sanctioning powers. Member States must introduce effective, proportionate, and dissuasive sanctions, including fines of at least 5% of the company’s global turnover, as well as publicity measures in case of non-compliance.

VI. In practice

To anticipate implementation, companies should in particular:

• Map their activity chain (upstream/downstream)
• Identify priority risks in terms of human rights and the environment
• Structure their relationships with business partners
• Establish vigilance tools (codes of conduct, audits, whistleblowing mechanisms)
• Document steps in a way that supports proof
• Integrate a risk-based approach, beyond a strictly formal reading of the text

VII. Next steps

Member States must transpose the directive by 26 July 2027 at the latest, with progressive application between 2028 and 2029.