The CSDDD is the EU rule that stops a company from treating what happens in its supply chain as somebody else's problem. It has also just been rewritten. If you read a guide to it from 2024, most of the numbers in it are now wrong, so this is the current picture after the 2026 reforms.
This is the canonical guide to the CSDDD: what it requires, who it now applies to, the reset timeline, and what it means for fashion, as one of the rules reshaping the fashion supply chain.
What is the CSDDD?
The Corporate Sustainability Due Diligence Directive, CSDDD or CS3D, is an EU directive that makes large companies responsible for finding and fixing human-rights and environmental harms connected to their business. Not just in their own operations, but across their subsidiaries and their value chain.
It is a duty to act, not just to disclose. A company in scope has to run a risk-based due-diligence process: identify where its business causes or contributes to harm, prevent or reduce it, and account for how it is being addressed. The obligations follow the OECD due-diligence guidelines, and they cover both actual and potential adverse impacts.
Who does the CSDDD apply to?
After the Omnibus reforms, the CSDDD applies only to the very largest companies. The thresholds were raised sharply from the original 2024 text, cutting the number of directly regulated firms dramatically.
- Large EU companies: at least 5,000 employees and net worldwide turnover above 1.5 billion euros, including groups measured on a consolidated basis.
- Large non-EU companies: net turnover above 1.5 billion euros generated inside the EU, regardless of where the company is based.
That is a big change. As originally enacted in 2024, the CSDDD reached companies with more than 1,000 employees and 450 million euros in turnover, an estimated 5,500 firms. The revised thresholds leave only a few thousand of the largest corporations directly in scope, which is central to understanding who actually has to comply, and who is affected indirectly.
The CSDDD timeline after the Omnibus
The dates moved too. A pair of 2025 to 2026 laws reset the schedule, so the original 2026 to 2027 deadlines no longer apply.
- July 2024: the CSDDD (Directive 2024/1760) entered into force with a phased 2026 to 2027 rollout.
- 2025: the Stop-the-Clock directive pushed the CSDDD back by a year and replaced tiered phasing with a single start date.
- March 2026: the Omnibus I amending directive entered into force, narrowing scope and confirming the reset dates.
Under the amended directive, EU member states must transpose the CSDDD into national law by 26 July 2028, and in-scope companies must comply from 26 July 2029, with the first annual disclosures from 2030. Commission guidance on how to run the due diligence is due before then. It is the same simplification wave that reshaped the green-claims rules, part of a broader EU reset of sustainability law.
What the directive requires
At its core the CSDDD asks an in-scope company to build human-rights and environmental due diligence into how it runs, as an ongoing cycle rather than a one-off audit.
- Embed it in policy: integrate due diligence into company policy and risk management, with board-level responsibility.
- Identify impacts: map and assess actual and potential adverse impacts across own operations, subsidiaries and the chain of activities.
- Prevent and mitigate: take appropriate measures to prevent, stop or minimise those impacts, using leverage with business partners.
- Remediate and monitor: provide or cooperate in remedy where harm has occurred, and monitor whether the measures are working.
- Adopt a climate plan: put in place a transition plan for climate-change mitigation aligned with the Paris goal of limiting warming to 1.5 degrees.
Enforcement is national. Member states designate supervisory authorities that can order companies to comply and impose fines, with the maximum penalty capped at 3% of net worldwide turnover for the most serious breaches.
What the Omnibus changed
The 2026 Omnibus I package did not scrap the CSDDD, but it simplified it substantially. The headline changes are the ones that decide who is affected and how hard.
- Far fewer companies: thresholds jumped to 5,000 employees and 1.5 billion euros, so only very large corporations are directly regulated.
- A later, simpler start: one unified application date of July 2029 instead of a tiered 2027 to 2029 rollout.
- Civil liability handed back to national law: the planned EU-wide civil-liability regime was removed, so liability now depends on each member state's own tort law rather than a harmonised rule.
- Lighter trickle-down: the rules were adjusted to limit how much large companies can push due-diligence burdens onto small suppliers and partners.
- A lower penalty cap: the maximum fine was set at 3% of turnover, down from the 5% in the original text.
CSDDD vs CSRD, EUDR and devoir de vigilance
The CSDDD sits in a crowded field of EU sustainability rules, and the confusion between them is real. Each does a distinct job.
- CSDDD: a duty to act. Do the due diligence, prevent and address harms in the value chain.
- CSRD (reporting): a duty to disclose. The Corporate Sustainability Reporting Directive makes companies report their sustainability impacts, but does not require them to act on them.
- EUDR (deforestation): product-specific due diligence proving certain commodities are not linked to deforestation, a narrower, goods-level obligation.
- Devoir de vigilance: France's 2017 duty-of-vigilance law was the direct precursor to the CSDDD, imposing a similar due-diligence duty on large French companies years before the EU acted, and it remains in force. Together these rules push in the same direction as sustainable sourcing and supply-chain transparency.
What the CSDDD means for fashion brands
Read the thresholds and it looks like the CSDDD is only a problem for the giants, the LVMHs and Inditexes of the industry. That is half the story.
- Directly in scope: the largest fashion groups, which must run full value-chain due diligence and can be fined for failing to.
- Indirectly in scope, which is most brands: if you supply, or want to supply, one of those groups, you will be asked for human-rights and environmental data and corrective actions, because their due diligence runs through you. It is the same reason the digital product passport is pushing traceability down the chain.
- Already regulated in France: a French company large enough under the devoir de vigilance already has a version of this duty today, ahead of the EU dates.
So the practical takeaway is not the 2029 date; it is that the biggest buyers are building the expectation now. A brand that can already show clean, sourced data on its suppliers is ready for the questions before they are mandatory, and it turns compliance into a reason to be chosen.
From a compliance duty to a sourcing advantage
The CSDDD turns supply-chain visibility from a nice-to-have into a condition of doing business with the biggest brands. That makes connected, sourced data on your suppliers a competitive asset, not just a compliance cost. Apshan builds exactly that read on supply and materials. See how it feeds sustainable sourcing, request access, or view the plans and pricing.