CSDDD crossroads: narrower scope, bigger questions?

The Corporate Sustainability Due Diligence Directive (CSDDD) entered into force on 25 July 2024, with the aim of fostering sustainable and responsible corporate behaviour in companies' operations and throughout their value chains. The new rules require in-scope companies to identify and address adverse human rights and environmental impacts arising from their activities, both within and beyond Europe.

In February 2025, the European Commission (the "Commission") unveiled major proposals to amend the CSDDD as part of the EU Omnibus Simplification Package ("Omnibus I"). This legislative initiative aims to streamline due diligence requirements and ease regulatory burdens for companies, marking a significant shift in the compliance landscape.

Few legal instruments have sparked as much debate and uncertainty for businesses as the CSDDD, with decision-makers engaged in protracted deliberations. So, where do things stand now? In this legal update, we outline the status, legislative process and proposed Omnibus I changes to the CSDDD, while providing practical guidance on steps companies can already take.

1 Legal framework and legislation

Postponing the CSDDD

The Stop the Clock Directive entered into force on 17 April 2025. Member States are now required to transpose these changes into national law by 31 December 2025, setting the stage for a new compliance timeline.

The directive extends the CSDDD transposition deadline for Member States by one year, now set for 26 July 2027 (previously 26 July 2026).

In practical terms, the first phase of application is now postponed by one year, to 26 July 2028. From this date, due diligence requirements will apply to companies with more than 3,000 employees and a net worldwide turnover exceeding EUR 900m. All other in-scope companies – those with more than 1,000 employees and a net worldwide turnover above EUR 450m – will follow from 26 July 2029. This staggered approach gives businesses additional time to prepare for compliance.

What is still being discussed

The Omnibus I package goes further, introducing a proposed amending directive that would significantly reshape reporting and due diligence obligations. These substantive amendments remain in the ordinary legislative process and are not yet in force. After the Commission's proposal in February 2025, the Council of the EU (the "Council") set out its position on 23 June 2025, followed by the European Parliament's (the "Parliament") adoption of its final position in November 2025.

Once the legislative bodies reach agreement in the so-called trilogue negotiations (involving the Commission, Council and Parliament), the amendments will be published in the Official Journal and immediately enter into force, marking a pivotal moment for companies preparing for compliance.

Commission proposal

The Commission aims to ease due diligence burdens by streamlining obligations and focusing on direct business partners. In terms of compliance, companies should map negative impacts across their entire value chain, but in-depth assessments target only direct partners; indirect partners are reviewed further only if there are concrete signs of risk. Business partner checks would occur every five years, not annually. To prevent a "trickle-down effect", in-scope companies cannot demand more information from SMEs and small mid-caps than what the CSRD's voluntary SME standard (VSME) requires, and stakeholder engagement is simplified. Notably, the Commission proposes scrapping an EU-wide civil liability regime in favour of national rules, while further harmonising due diligence requirements across the EU.

Council proposal

The Council largely echoes the Commission's approach to simplifying due diligence and focusing on direct business partners, while introducing some notable distinctions.

Where the Council stands out most is in its approach to the scope: while the Commission leaves the threshold unchanged, the Council proposes a significant tightening. Under its proposal, the CSDDD would apply only to EU companies with at least 5,000 employees and EUR 1.5bln in net turnover (up from 1,000 employees and EUR 450m), and to non‑EU companies with more than EUR 1.5bln in EU turnover.

Parliament proposal

The Parliament largely follows the Commission's plan to simplify due diligence obligations. Notably, it aligns with the Council's proposal to significantly narrow the CSDDD's scope. The framework also pivots from a comprehensive due diligence obligation to a risk-based model. Rather than systematically collecting information from all business partners, companies must act only where there is a credible risk of adverse human rights or environmental impacts. The proposal further recommends an appropriate level of penalties, taking into account the turnover of companies. Finally, the Parliament proposes to remove the transition plan for climate mitigation entirely.

2 What companies can do right now

The substantive simplifications and adjustments are set to remain a focal point in the upcoming trilogue negotiations, expected to continue through the last months of 2025. Formal adoption is anticipated by late 2025 or early 2026. Even as certain requirements and timelines remain under discussion, companies should take proactive steps to prepare for CSDDD and related EU sustainability obligations.

Risk identification and mitigation in the value chain

Companies likely to fall within the scope of the CSDDD should proceed mapping risks across their activities and value chains and implement proportionate mitigation measures. Reviewing existing policies, processes and controls against anticipated CSDDD requirements will help address weaknesses efficiently, reduce exposure to sanctions and enhance supply chain resilience.

Early engagement with sustainability reporting and due diligence

Implement human rights and environmental due diligence without delay. Proactively conduct targeted internal audits and trainings to assess current supply chain transparency, risk management and reporting maturity, establishing a clear baseline and identifying priority gaps. Taking these steps now positions companies to respond swiftly as regulatory requirements crystallise.

Establishing suitable systems and internal structures

Establish robust governance structures with clearly defined roles and accountability for sustainability, due diligence and compliance. Develop a practical roadmap outlining the necessary structures, processes and resources – including targeted training and technology investments – to support scalable, auditable compliance. These steps not only ensure readiness for evolving legal requirements but also position companies to demonstrate leadership in responsible business conduct.

Adapting processes and strategies

Embed due diligence into core business operations and strategic planning. Refresh policies, align internal functions and actively engage key stakeholders – including suppliers, employees and affected communities – to foster awareness, drive effective implementation and support ongoing improvement.

Stay informed and prepare for legal compliance

Stay alert to legislative updates and evolving guidance to ensure timely adaptation. Proactive steps not only provide legal certainty but also demonstrate a credible commitment to responsible business, enhancing reputation and building stakeholder trust.

Navigating the complexities of the CSDDD and related EU legislation is challenging, but it also presents a unique opportunity for forward-thinking companies to lead the way in responsible business practices. As you prepare to meet these evolving requirements, we are here to guide and support you every step of the way. Reach out to our team for expert advice and tailored solutions to ensure your business not only complies but thrives in this new regulatory landscape.

authors: Johannes Frank, Carina Fürnkranz