The Corporate Sustainability Due Diligence Directive (CSDDD) was formally approved by the European Council on May 24. It's a unique regulation that goes beyond typical supply chain concerns like cybersecurity and financial stability. The CSDDD requires you to identify and address human rights violations and environmental harms throughout your entire chain of activities. Non-compliance could result in fines up to 5% of global net turnover and civil liability for damages if you fail to prevent adverse impacts.
If your organization meets the directive's thresholds, you have until 2027 (for companies with 5,000+ employees and €1,500 million global turnover) to establish a due diligence program. While this deadline may seem distant, mapping a global supply chain and setting up remediation processes can take longer than expected.
What You Need Before Starting
Stakeholder alignment across functions. CSDDD compliance requires collaboration across operations, legal, sustainability, finance, and senior leadership. Schedule a kickoff meeting with representatives from each function and establish a steering committee with decision-making authority.
Your current vendor inventory and contract register. Compile a complete list of suppliers, including subsidiaries and indirect relationships. You'll need contract data showing where each vendor operates, what they produce, and how they fit into your value chain. If this isn't in a structured format, start building it now.
Budget for third-party assessments and remediation. Plan for independent human rights audits and environmental impact assessments. Be prepared for significant remediation costs if you discover forced labor or pollution in your supply chain.
A baseline understanding of your scope 1, 2, and 3 emissions. The CSDDD requires a climate transition plan with targets for 2030 and five-year intervals through 2050. If you haven't calculated your greenhouse gas footprint, engage an environmental consultant to establish your baseline.
Step-by-Step Implementation
Phase 1: Map Your Chain of Activities (Months 1-4)
Document your entire value chain, from raw material extraction to product disposal. This includes tier-1 suppliers and beyond. You're responsible for identifying risks in upstream production and downstream distribution.
Create a tiered supplier map showing:
- Direct suppliers (tier 1)
- Their suppliers (tier 2)
- Raw material sources (tier 3+)
- Distribution partners
- Franchisees and licensors (if applicable)
For each entity, document geographic location, number of workers, primary activities, and existing certifications (SA8000, ISO 14001, Fair Trade, etc.). Store this in a structured database.
Phase 2: Conduct Risk-Based Assessments (Months 3-8)
You can't audit every supplier at once. Prioritize based on inherent risk factors:
High-risk geographies: Countries with weak labor protections or environmental enforcement gaps. Consult the U.S. Department of Labor's List of Goods Produced by Child Labor or Forced Labor and the OECD Due Diligence Guidance for Responsible Business Conduct.
High-risk industries: Sectors like garment manufacturing, mining, agriculture, electronics assembly, and construction materials have documented human rights violations.
High-impact operations: Suppliers with large workforces, hazardous material handling, or significant water/energy consumption.
Develop an assessment questionnaire covering:
- Labor practices (working hours, wages, freedom of association)
- Child and forced labor controls
- Environmental permits and compliance history
- Waste management and emissions tracking
- Subcontracting practices
Send questionnaires to your tier-1 suppliers and require them to cascade the assessment downstream. Set a 45-day response deadline with escalation to contract termination for non-response.
Phase 3: Establish Your Due Diligence Policy (Months 4-6)
Draft a policy document committing your organization to prevent and remediate human rights and environmental harms. Specify:
- Which adverse impacts you'll address (reference the CSDDD's definition: child labor, forced labor, biodiversity loss, pollution, destruction of natural heritage)
- Your risk assessment methodology
- Prevention and mitigation measures
- Remediation procedures
- Monitoring frequency
- Escalation paths for severe violations
Have your legal team review the policy against the CSDDD's requirements, then get board approval. Publish it on your website and distribute it to all suppliers.
Phase 4: Build Your Notification Mechanism (Months 5-7)
The CSDDD requires a public reporting channel separate from your internal whistleblower hotline. This mechanism must be accessible to affected workers, communities, trade unions, and civil society organizations.
Set up a dedicated email address and web form (hosted on your corporate site). Translate the form into the primary languages of your supply chain regions.
Establish an intake and triage process:
- Acknowledge receipt within 48 hours
- Assign a case manager (not the procurement team member who manages the relationship)
- Investigate within 30 days
- Provide a written response explaining your findings and remediation steps
Document every complaint in a case management system with fields for reporter information (if provided), alleged harm, affected parties, investigation findings, remediation actions, and closure date.
Phase 5: Develop Remediation Protocols (Months 6-10)
When you identify actual adverse impacts, you must restore affected persons or the environment "to a situation equivalent or as close as possible to the situation they would have been in had the actual adverse impact not occurred."
Create remediation playbooks for common scenarios:
Wage theft or unpaid overtime: Calculate back pay owed, including interest. Engage an independent monitor to verify payment to affected workers.
Forced labor indicators: Immediately suspend orders. Contract with a specialized human rights organization to interview workers confidentially. If confirmed, terminate the supplier relationship and report to local authorities. Provide support to affected workers (relocation assistance, wage recovery, counseling).
Environmental contamination: Commission an environmental impact assessment. Fund cleanup efforts and compensate affected communities for health impacts and lost livelihoods.
Don't rely solely on corrective action plans from suppliers. The CSDDD places the compliance obligation on you, not your vendors.
Validation: How to Verify It Works
Annual refresh of risk assessments. The CSDDD requires at least yearly reviews. Schedule these for Q1 of each year, incorporating new suppliers added during the previous 12 months.
Independent audits of high-risk suppliers. Engage third-party auditors (not your suppliers' auditors) to conduct on-site inspections. Require unannounced visits and confidential worker interviews.
Complaints received and resolved. Track the number of reports submitted through your notification mechanism. An increase in reports may indicate that affected parties trust the process. Monitor time-to-resolution and remediation completion rates.
Climate transition plan progress. Measure your actual greenhouse gas emissions against your 2030 targets. If you're not on track, revise your mitigation strategies.
Maintenance and Ongoing Tasks
Quarterly steering committee meetings. Review new risk assessments, remediation status, and policy effectiveness. Escalate systemic issues to the board.
Supplier training. Host annual webinars for your tier-1 suppliers explaining your due diligence requirements and how to cascade them downstream.
Annual public statement. If you're not subject to the Corporate ESG Reporting Directive, publish a standalone due diligence report covering your assessment process, identified risks, mitigation actions, and remediation outcomes.
Contract updates. Add CSDDD compliance clauses to all new supplier agreements, including audit rights, remediation obligations, and termination provisions for severe violations.
The first companies subject to the CSDDD begin compliance in 2027, but building an effective due diligence program takes years. Start mapping your supply chain now to avoid racing to meet a regulatory deadline with incomplete data and untested processes.
