CSDDD or CS3D: due diligence at the heart of the new European regulation

The CSDDD introduces the concept of corporate due diligence regarding environmental protection and human rights into European law. This new tool, which reinforces the CSRD, will also hold companies operating in the EU accountable for the potential impact of their operations and the activities across their entire value chain.

François Tréfois
CSR & ESG Expert
Mise à jour : 
22.07.2026
Publication : 
18.01.2024
Table of Contents
Example H2
Request a demo

🔎 Key takeaways

  • Scope and core principle: The European CSDDD (or CS3D) directive mandates that large companies exercise due diligence regarding human rights and the environment. This duty applies to their own operations, their subsidiaries, and their entire supply chain, including upstream and downstream business partners (excluding the end-of-life phase of products).
  • Key obligations and link to the CSRD: Complementary to the CSRD (which governs non-financial reporting), the CS3D requires a preventive approach: risk mapping, action plans to prevent and mitigate negative impacts, complaint management, and a climate transition plan that is mandatory and aligned with the 1.5°C trajectory of the Paris Agreement.
  • Sanctions and civil liability: In the event of non-compliance, companies face administrative fines of up to 5% of their global net turnover, "name and shame" reputational sanctions, and civil liability if a proven breach results in direct damage.
  • Timeline and European harmonization: Adopted in 2024, the directive must be transposed by Member States by July 26, 2026. Its phased rollout is scheduled between 2027 and 2029, depending on company size (starting with organizations with more than 5,000 employees and €1.5 billion in turnover).

Please note: This article concerns French legislation. The requirements described may not apply in other countries.

The Corporate Sustainability Due Diligence directive was definitively adopted on April 24, 2024, following intense negotiations between the European Parliament, the European Commission, and the European Council. It entered into force on July 25, 2024.

This new directive is directly aligned with the CSRD and introduces the concept of due diligence at the European level that companies will soon be required to comply with regarding human rights and environmental protection.

It will also help harmonize the various national laws that have already integrated this concept across the European Union.

‍

What is the CSDDD or CS3D?

The CSDDD, for Corporate Sustainability Due Diligence Directive, is a European directive aimed at imposing a corporate sustainability due diligence duty regarding human rights and environmental protection. It is also known as the CS3D.

This directive will require companies to ensure that their activities do not harm the environment and are conducted in compliance with the Universal Declaration of Human Rights. This due diligence duty applies not only to a company's direct operations but also to a large part of its value chain, meaning it includes its subsidiaries, supply chain, and the activities of all its business partners. However, the end-of-life of products (destruction, recycling, and waste management) is not covered by the directive.

Companies subject to the CSRD will be required to publish information on identified risks, measures taken to mitigate those risks, and the results observed following those measures in their CSRD sustainability reporting.

Those not subject to the CSRD will be required to publish an annual statement on their website regarding the topics covered by the CSDDD.

The key concept of due diligence

In practical terms, what is corporate due diligence?

While this concept has relatively different scopes around the world, within the framework of the CSDDD, it can be defined as the obligation for companies to prevent risks related to human rights, the environment, and governance linked to their operations and those of their subsidiaries, subcontractors, and suppliers.

The concept of prevention is key. It implies that companies must be able to anticipate these risks rather than simply addressing problems once they have occurred. This therefore compels companies to carry out a comprehensive mapping of the risks they and their stakeholders are likely to face, as well as to implement a vigilance plan aimed at preventing the identified risks.

Any failure to meet these obligations is subject to penalties. In the event of a proven issue, the company must be able to prove that it occurred despite the implementation of a reliable prevention process aimed at reducing its occurrence and mitigating its impact.

What are the obligations for companies?

The CSDDD therefore introduces new obligations for companies, in connection with the duty of vigilance and the objectives set by the European Union as part of theEuropean Green Deal.

Regarding human rights and environmental due diligence, companies will be required to:

  • Integrate due diligence into their governance policies (codes of conduct, procedures, etc.) and their risk management systems
  • Identify actual or potential adverse impacts related to their operations and those of their value chain (excluding product end-of-life)
  • Develop a system to prevent, mitigate, or bring an end to potential or actual adverse impacts
  • Establish procedures for receiving and handling complaints
  • Monitor the effectiveness of the due diligence policies and measures implemented
  • Publicly communicate on due diligence and the policies pursued in this area

The CS3D also includes obligations regarding a company's environmental policy. Companies must commit to adopting a transition plan aligned with the goal of limiting global warming to 1.5°C, in line with the ambition set by the 2015 Paris Agreement. This is an obligation of means. To achieve this, they must:

  • Identify the risks that climate change poses to their business activities
  • Implement concrete actions to track the progress of their transition plan
  • Create a financial plan to support these actions and anticipate climate-related risks

Initially, the European Commission also wanted to link executive compensation to the effective implementation of the climate transition plan to ensure that the actions taken were not merely performative. This requirement was not adopted by the European Council.

The strong links between the CS3D and the CSRD

The Corporate Sustainability Due Diligence Directive has close ties to the CSRD, which came into effect on January 1, 2024. It effectively complements this directive on non-financial reporting for ESG indicators by making certain elements mandatory, which companies must then report on under the CSRD.

The most obvious links concern, unsurprisingly, the environmental dimension. The due diligence process requires companies to map the sustainability-related risks associated with their operations. Under the CSRD, this is a topic they are required to report on during their double materiality analysis.

Similarly, the CSDDD requires companies to have a climate transition plan that includes a carbon trajectory. This is also a topic they are required to report on under the CSRD by setting targets for reducing their GHG emissions for 2030 and 2050, in line with the European Green Deal, which is itself linked to the Paris Agreement.

‍

🔄 REGULATORY UPDATE: RAISED THRESHOLDS AND SIMPLIFICATION (OMNIBUS I PACKAGE)

Following the entry into force of the EU simplification directive (Omnibus I - Directive (EU) 2026/470), several CS3D rules have been relaxed:

  • Raised thresholds: The directive now targets only very large companies with more than 5,000 employees generating at least €1.5 billion in turnover.
  • Single timeline: The national transposition deadline has been pushed back to 26 July 2028, and companies now have a single compliance deadline of 26 July 2029.
  • Capped penalties: Maximum financial fines are reduced to 3% of net worldwide turnover.

To learn more, check out our article breaking down the Omnibus Directive

‍

Who is affected by the CSDDD?

While the CSDDD was initially expected to affect tens of thousands of companies, the latest negotiations within the European Council have significantly raised the application thresholds.

It will apply to European companies that meet the following criteria:

  • More than 1,000 employees
  • A global turnover exceeding €450 million

This represents approximately 5,300 companies, compared to 15,000 in the initial version of the directive.

Finally, much like the implementation of the CSRD, certain non-European companies will be subject to the same obligations if they meet the following criterion: 

  • Generate a turnover of at least €450 million within the European Union

Also covered areEuropean and non-European companies that fall below the established thresholds but are the parent company of a business that does meet them.

Finally, also subject to the CSDDD are European and non-European companies or parent companies that: 

  • have entered into franchise or licensing agreements in the EU with third-party companies
  • where the agreements ensure a common identity, a common business concept, and the application of uniform business methods
  • if the agreement is worth more than €22.5 million
  • and if the company or parent company generates a net worldwide turnover of more than €80 million

The CSDDD was also intended to apply to companies active in certain sectors deemed high-risk (textiles, agriculture, food industry, mining, trade in agricultural raw materials, construction activities, etc.), but this approach has currently been abandoned.

‍

Monitoring and sanctions

The implementation of the obligations linked to the CSDDD will naturally be monitored. Each European Union member state must designate a supervisory authority responsible for overseeing compliance with all obligations related to the directive within its country.

In parallel, the European Commission will establish a European network composed of representatives from the supervisory authorities of each member country.

European Union member states remain free to define the sanctions applicable to companies operating within their territory that fail to meet the obligations set by the CSDDD.

Nevertheless, the European Commission has opened the door to a range of relatively heavy sanctions which may significantly exceed those implemented under the CSRD.

The framework established by the European Commission indicates that financial penalties must be proportional to the global turnover of the company concerned, which is reminiscent of the types of sanctions already implemented under the GDPR. However, this penalty must not exceed 5% of the company's turnover.

The Commission is also relying on the “Name and Shame” principle, which involves publicly disclosing the names of companies that fail to meet their obligations in order to increase pressure from their various stakeholders.

Finally, while the initial version of the directive included corporate civil liability in the event of actual environmental damage or proven human rights violations, this option was not retained by the European Council. It would have allowed the victim, whether an individual or a legal entity, to receive financial compensation for damages. It is therefore up to the individual states to decide whether or not to add this provision later when transposing the directive into their national legislation.

Corporate liability

In addition to this package of sanctions, there are those related to corporate civil liability in the event of actual environmental damage or proven human rights violations.

Thus, a company will be held liable for direct damage caused to an individual or legal entity under certain conditions:

  • it has been proven that the company intentionally or negligently failed to comply with its due diligence obligation to prevent, mitigate, or end potential or actual negative impacts
  • as a result of the aforementioned failure, it caused damage to a legal interest protected by the national law of the individual or legal entity

This liability does not apply if the damage was caused solely by one or more of the business partners in its value chain.

Once the company's liability is established, the victim, whether an individual or a legal entity, will be entitled to full compensation for the damage in accordance with the national law of the country where it was reported.

‍

What is the implementation timeline for the CSDDD?

Adopted by the European Parliament on April 24, 2024, the directive was published in the Official Journal of the European Union on July 5, 2024, and entered into force on July 25, 2024.

‍EU member states now have a two-year period to transpose it into their national legislation, i.e., until July 26, 2026.

‍Implementation will be phased in based on the size of the companies involved. They are granted a compliance period starting from the date the directive enters into force.

The implementation schedule is as follows:‍

  • 2027: Implementation for European companies with over 5,000 employees and a net global turnover exceeding €1.5 billion, and for non-European companies with a turnover exceeding €1.5 billion within the EU.
    ‍
  • 2028: Implementation for European companies with over 3,000 employees and a net turnover exceeding €900 million, and for non-European companies with a turnover exceeding €900 million within the EU.
    ‍
  • 2029: Implementation for European companies with over 5,000 employees and a turnover exceeding €450 million, and for non-European companies with a turnover exceeding €450 million within the EU.

‍

Regulations already in effect across Europe

The concept of due diligence has already been incorporated into the national legislation of several European countries.

In France, it has been in place since February 21, 2017, the date of the adoption of Law No. 2017-399. This law applies to French companies with more than 5,000 employees and foreign companies with more than 10,000 employees in France. It requires these companies to implement a vigilance plan addressing social and environmental issues related to their own activities, as well as those of their subsidiaries and business partners in France and abroad. However, it does not mention a mandatory environmental transition plan.

Germany implemented similar regulations in 2021 via the LkSG Act (Lieferkettensorgfaltspflichtengesetz), known as the Supply Chain Due Diligence Act. This requires companies with at least 3,000 employees (1,000 since January 1, 2024) in Germany to establish a plan to prevent and mitigate environmental risks and potential human rights violations within their organization. This obligation also covers the entire value chain of the companies involved, both in Germany and abroad.

Similar regulations also exist outside the EU. Notable examples include the UK's Modern Slavery Act, in effect since 2015, and the UFLPA in the United States, implemented in 2021.

The CSDDD also aims to harmonize existing regulations within the EU.

Far from being a mere copycat of national regulations, the CSDDD expands their scope and strengthens the potential for sanctions against companies that fail to comply, although these remain subject to the discretion of the member states responsible for enforcement.

‍

📊 Summary of the EU CSDDD / CS3D directive

An overview of the issues, operational requirements, penalties and implementation timeline for the EU duty of vigilance.

Regulatory area Obligations & scope of application Details, penalties & deadlines
Companies concerned • EU companies: > 1,000 employees and > €450m worldwide turnover.
• Non-EU companies: > €450m turnover generated in the EU.
• Parent companies and franchise/licensing arrangements subject to specific turnover conditions. 		Roughly 5,300 companies directly targeted in the EU.
Note: The high-risk sector criteria were removed from the final version.
Scope of the duty of vigilance Obligation to identify, prevent and mitigate adverse impacts on human rights and the environment.
• Scope: Own operations, subsidiaries, subcontractors and the value chain (excluding end-of-life). 		Deliverables:
- Risk mapping & vigilance plan.
- Complaints handling procedure.
- Annual publication (integrated into CSRD reporting or a website).
Climate transition plan Adoption of a transition plan aimed at carbon neutrality and aligned with the 1.5°C limit (Paris Agreement / Green Deal). A best-efforts obligation including a financial action plan to support the carbon transition.
Enforcement & Penalties • Supervision by dedicated national authorities and a European network.
• Financial fines of up to 5% of net worldwide turnover.
• Reputational sanctions ("Name and Shame"). 		Civil liability: Triggered where direct harm is caused to a victim as a result of an intentional or negligent breach of vigilance obligations.
Implementation timeline • 26 July 2026: Deadline for Member States to transpose the directive into national law.
• 2027: EU companies with > 5,000 employees & turnover > €1.5bn (and non-EU companies with > €1.5bn EU turnover).
• 2028: EU companies with > 3,000 employees & turnover > €900m (and non-EU companies with > €900m EU turnover).
• 2029: EU companies with > 1,000 employees & turnover > €450m (and non-EU companies with > €450m EU turnover).

‍

Sources: