Supply-chain due diligence under the EU CSDDD

Introduction

Supply-chain due diligence is a continuing process for finding and addressing serious impacts on people and the environment. It is not the same as collecting a code-of-conduct signature from every supplier or sending the same questionnaire to every vendor.

The EU Corporate Sustainability Due Diligence Directive (CSDDD) has also changed since its original 2024 text. As of 1 October 2026, the European Commission says Directive (EU) 2024/1760 has been amended by the Omnibus I simplification measures, including Directives (EU) 2025/794 and (EU) 2026/470. The amended EU-level timetable requires Member States to transpose the CSDDD-related measures by 26 July 2028 and apply them from 26 July 2029; the Article 16 reporting measures apply for financial years starting on or after 1 January 2030. The Commission's current CSDDD overview and the current consolidated EUR-Lex text should be checked before making a legal decision.

Those dates are not a substitute for checking national law. Existing national requirements, contracts, sector rules, and other EU measures may apply on a different timetable. A supplier receiving a customer's information request does not by itself become a company in scope of the CSDDD. Applicability depends on the current legal text, the relevant company and group facts, and national implementation. Obtain advice from qualified counsel for a specific business.

What the process is meant to do

The CSDDD sits within a wider responsible-business-conduct approach. The OECD's due-diligence materials describe a risk-based cycle: embed expectations in policies and management systems, identify and assess impacts, prevent or mitigate them, track results, communicate, and provide for or cooperate in remediation where appropriate. The OECD due-diligence overview explains that this is an ongoing process for addressing real and potential adverse impacts, not a one-time supplier ranking exercise.

For a business team, that means the quality of the process depends on what it learns and changes. A long supplier list can help with scoping, but a spreadsheet of country scores is not proof that the company understood where workers, communities, or the environment may be harmed.

Build a risk map before building a questionnaire

Start by drawing a practical map of the company's own operations, subsidiaries, key products, and business relationships. Use the information already held by procurement, operations, sustainability, legal, and complaints teams. Record what is known and what is uncertain instead of giving every supplier a polished but unsupported risk score.

Screen for areas where the type of activity, product, location, or working arrangement may create serious impacts. Then investigate the specific relationship or operation with the best evidence available. Risk to people and the environment should drive attention; spend, supplier size, and ease of collecting data are not reliable substitutes for impact severity.

A useful prioritisation note answers:

• What adverse impact could occur, or has occurred?
• Which people or ecosystems could be affected, and how serious or difficult to remedy might the impact be?
• What evidence supports the assessment, and what information is still missing?
• Is the company causing, contributing to, or linked to the impact through a business relationship?
• Who owns the next investigation or prevention step, and when will it be reviewed?

This approach helps teams focus limited capacity without pretending that lower-priority areas have no risk. Revisit priorities when credible new information arrives, a product or sourcing location changes, a grievance is raised, or a serious incident occurs.

Engage people who know the conditions

Supplier questionnaires can help identify missing information, but they often describe management systems rather than the conditions experienced by workers or communities. A signed policy does not show whether wages are paid correctly, protective equipment is used, or local water access has changed.

Use several evidence sources where appropriate: purchase and production records, worker or union feedback, grievance channels, credible site assessments, civil-society or regulator information, and follow-up discussions with the business partner. Give affected people a safe and accessible way to raise issues. Explain how the information will be used and protect sensitive details.

Design questions around the risk being examined. A request for details about working hours at a labour-intensive production site is more useful than a generic request for every supplier to complete a lengthy environmental, social, and governance form. If the answer is missing, contradictory, or implausibly uniform, treat that as an evidence gap to investigate rather than as a clean result.

Turn findings into actions

An action plan should connect the identified impact with an outcome, owner, deadline, and way to check progress. Depending on the company's involvement and the issue, actions can include changing its own purchasing practices, supporting a supplier's improvement plan, using contractual leverage, collaborating on a sector solution, or ensuring remediation for people already harmed.

For example, if short lead times and last-minute order changes contribute to excessive overtime, asking the supplier to repeat a working-hours policy will not address the buyer's role. Procurement may need to change forecasting, order approval, or delivery penalties while working with the supplier to verify hours and pay. If a serious harm is found, the response must prioritise affected people and the relevant legal obligations, not only protect the company's reputation.

Record the expected result rather than just the activity. “Supplier training delivered” is an activity. A result might be that overtime has fallen during the high season without reducing wages or shifting the work to an unmonitored subcontractor. Define how the result will be verified and what happens if progress stalls.

Track, learn, and report honestly

Review whether actions changed the impact, not only whether meetings, audits, and questionnaires were completed. Use a small set of indicators connected to the risk: for example, worker-reported access to a grievance channel, verified payment records, water withdrawal in a stressed basin, or the time taken to resolve a substantiated complaint. Use more than one source for sensitive outcomes and record gaps in coverage.

Keep an evidence trail with the date, source, scope, owner, confidence, decision, and follow-up. This makes it possible to explain why one issue was prioritised and another deferred. Share enough information for stakeholders to understand the approach, but protect personal and commercially sensitive data under the applicable rules.

Review the process when a mitigation measure does not work. An independent audit can provide useful evidence, but it is a snapshot. It should not replace ongoing engagement, investigation of new information, or follow-up on corrective actions.

A practical first-quarter plan

1. Ask legal counsel to confirm the company's current scope and national-law obligations using the latest consolidated directive and country rules.
2. Bring procurement, operations, sustainability, legal, and grievance owners together to identify existing risk information and gaps.
3. Select one salient product, activity, location, or business relationship for a deeper assessment; document why it was selected.
4. Speak with relevant stakeholders and test whether supplier data matches other evidence.
5. Agree on one or two outcome-focused actions, owners, dates, and ways to verify progress.
6. Report what is known, what remains uncertain, and when the assessment will be revisited.

This is a management starting point, not a legal compliance checklist. The correct sequence and obligations depend on the company, impacts, and current national law.

Conclusion

Good due diligence makes a company more capable of noticing serious impacts and responding to them with evidence. It combines a risk-based map, meaningful engagement, actions connected to causes, follow-up on outcomes, and remediation where appropriate. For CSDDD planning, keep the legal timetable current and separate the question “Are we in scope?” from the practical question “Where could our business cause or be linked to harm?”

Updated 1 October 2026. This article is general information, not legal advice. The dates and law status below were checked on the sources listed; confirm national implementation and later changes before acting.

Sources

• European Commission: Corporate sustainability due diligence — amended CSDDD status and EU-level transposition and application timetable.
• EUR-Lex: Directive (EU) 2024/1760, consolidated text — official legal text and consolidated versions.
• OECD: Due diligence for responsible business conduct — the broader risk-based due-diligence process and practical guidance.

Sources checked 1 October 2026.