Preparing for the CSDDD: a practical guide for businesses
GoodBlog | read time: 8 min
Published: 30 September 2026
The Corporate Sustainability Due Diligence Directive: from legislation to implementation
The European Union’s Corporate Sustainability Due Diligence Directive (CSDDD) marks a significant milestone in the regulation of responsible business conduct. It translates long-standing international standards on human rights and environmental responsibility into binding legal obligations for large companies operating in, or generating significant turnover within, the EU market.
Companies within scope will now be legally required to undertake risk-based human rights and environmental due diligence across their own operations, subsidiaries and chains of activities.
The directive is grounded in the UN Guiding Principles on Business and Human Rights (UNGPs) and the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct, reflecting a growing expectation that companies should not only avoid causing harm directly, but also address actual and potential adverse impacts linked to their wider business relationships.
Following the Omnibus I reforms, several elements of the original directive have been adjusted to streamline implementation and reduce administrative burdens. These include changes to reporting and governance requirements and a reinforcement of the risk-based, proportionate approach to due diligence. However, the core obligation remains unchanged: companies must be able to identify, prevent, mitigate and address adverse human rights and environmental impacts.
Although enforcement is still some way off, organisations should not underestimate the scale of preparation required. Building effective scoping processes, risk assessment methodologies and governance structures will take time, particularly where these need to be embedded across complex global operations.
Who is in scope?
The CSDDD applies to an estimated 6,000 EU companies and approximately 900 non-EU companies, including:
• EU companies with more than 5,000 employees and a net worldwide turnover exceeding €1.5 billion
• non-EU companies generating more than €1.5 billion turnover within the EU.
All in-scope companies will be subject to the directive from 26 July 2029, following the removal of the previous phased approach.
Businesses outside the thresholds may still be affected
Even where companies fall below the thresholds, they may still be directly impacted if they form part of the chain of activities of an in-scope business. Under the CSDDD, ‘chain of activities’ means activities of upstream business partners related to the production of the company’s goods or provision of its services, and the activities of downstream business partners related to distribution, transport and storage of the company’s products.
As companies build their due diligence systems, they will increasingly require suppliers and business partners to provide reliable information on human rights and environmental risks, governance processes and remediation mechanisms.
For many smaller businesses, a key early step will be determining whether they are likely to be within the chain of activities of in-scope companies. If so, they will need to consider whether they have the systems in place to respond to any information requests they are likely to receive.
Handled well, this can become a commercial advantage. Businesses that can evidence their own due diligence measures and responsible human rights and environmental practices are more likely to retain and win contracts with larger customers seeking to meet these new compliance obligations.
The road to implementation
Although the CSDDD will not be enforceable until July 2029, the next few years will be decisive in shaping how companies prepare.
In July 2027, the European Commission is expected to publish guidance to support implementation, particularly on practical aspects of due diligence, including risk assessment.
By July 2028, Member States must transpose the directive into national law, clarifying supervisory structures and enforcement approaches.
Attention will then shift to reporting requirements. By 31 March 2029, the Commission must adopt delegated acts setting out the content and criteria for annual due diligence statements, which will apply to financial years beginning on or after 1 January 2030.
While enforcement is not immediate, the companies that use this period to design, test and embed their approaches will be far better positioned when the legislation comes into effect.
What does the CSDDD require?
The CSDDD establishes a structured approach to managing human rights and environmental risk. It sets out a continuous human rights and environmental due diligence (HREDD) process that in-scope companies are expected to follow. Critical to this is the two-stage scoping and in-depth assessment process.
The scoping exercise involves using reasonably available information to identify where risks are most likely and most severe. This will typically include consideration of geography, sector, products, nature of business activities, workforce characteristics and environmental risk factors.
Where higher-risk areas are identified, companies are then expected to carry out more detailed assessments to better understand the actual and potential impacts and how they affect stakeholders and the environment, including analysing the root causes contributing to the occurrence of these impacts.
The six-step due diligence process
The CSDDD sets out the full due diligence duty as a continuous cycle which follows the best practice and recommendations set out in the UNGPs and OECD Due Diligence Guidance for Responsible Business Conduct, with its mandatory elements broadly mirroring the OECD’s six-step HRDD process.
Step 1. Integrate due diligence into governance and risk management
Embed human rights and environmental due diligence into policies, governance structures and systems.
Step 2. Identify and assess adverse impacts
Use the two-stage scoping and in-depth assessment process to identify and assess actual and potential impacts in your own operations, those of your subsidiaries and in your supply chains.
Step 3. Prevent, mitigate or end impacts
Take appropriate measures to prevent, mitigate or cease potential and actual impacts, prioritising addressing those impacts which pose the most severe risk to people.
Step 4. Provide for or cooperate in remediation
Where your company has caused or contributed to harm, or where the harm is linked to your business relationships, ensure or help ensure that affected stakeholders have appropriate access to remedy. The steps taken will depend on the level of involvement in the impact.
Step 5. Monitor implementation and progress
Periodically assess whether measures have been implemented and remain both adequate and effective. This can include developing meaningful KPIs to track progress.
Step 6. Communicate on activities
Report publicly on due diligence activities and the measures in place to manage both human rights and environmental impacts in line with requirements.
Stakeholder engagement and grievance mechanisms are essential elements to support these steps. Companies should meaningfully engage with people who may be affected and their legitimate representatives. They should also look to establish effective channels for raising concerns about actual or potential adverse impacts. These mechanisms can help identify impacts and support access to remediation.
What should companies do now?
The 2029 enforcement date should not obscure the fact that building an effective due diligence system will take time. The organisations making good progress are already testing methodologies, strengthening governance structures and identifying where existing systems fall short.
Five priorities stand out.
Review whether existing systems are fit for purpose
Most organisations already undertake elements of human rights and environmental due diligence. The challenge is whether these systems are coherent, consistent and sufficient under the CSDDD.
A structured gap analysis against the directive, supported by frameworks such as GoodCorporation’s Human Rights and Environmental Due Diligence Framework, can help identify where improvements are needed and where existing processes can be strengthened.
For organisations also preparing for CSRD and ESRS, there are clear opportunities to align approaches, particularly around stakeholder engagement and data collection.
Build and test your scoping and risk assessment methodologies
Scoping and assessing human rights and environmental risks are the cornerstones of effective due diligence under the revised directive.
Companies need methodologies that identify where risks are most likely and most severe, drawing on factors such as geography, sector and type of activities, product/commodity type, and workforce characteristics. This will enable companies to identify their salient risks and to prioritise where the risks to people are the highest.
This is not a static exercise and will need to be updated and repeated over time to ensure that the organisation is acting on accurate and reliable information.
The effectiveness of due diligence, especially in relation to focusing resources on most severe risk areas, will depend heavily on the quality of the risk assessment. Companies will need to ensure that their methodologies capture both actual and potential impacts, apply consistent severity and likelihood criteria, and include a root cause analysis for significant impacts.
Invest in meaningful stakeholder engagement
Stakeholder engagement is often the most challenging, and most revealing, element of due diligence. Effective systems seek to understand both the lived experience and the root causes of harm.
Depending on the risks involved, relevant stakeholders should include directly affected parties such as workers, their trade unions or other legal representatives, local communities and any other affected groups. Credible proxies such as NGOs and industry experts can also be included in the process.
GoodCorporation’s experience shows that confidential engagement through interviews, focus groups and independent consultation builds a better understanding of lived experiences and root causes of human rights issues that cannot be achieved through a desktop analysis alone. Getting this right requires both relevant expertise and good local knowledge.
Building this capability takes time, and companies should begin early, ensuring engagement processes are credible, independent where appropriate, and designed to protect participants from retaliation.
Strengthen grievance and remediation systems
Grievance mechanisms are a key indicator of whether due diligence is functioning in practice. They must be easily accessible to potentially affected stakeholders and trusted by them. Best practice is to engage with the target population (e.g. workers and community members) in the design of the grievance mechanism to ensure it is adapted to the population’s needs.
Importantly, companies should ensure that insights from grievances are actively used to improve risk management and inform remediation processes, rather than treated as isolated case management exercises. Efforts should also focus on strengthening methods for determining appropriate remedies for different human rights impacts, ensuring that remedies are adapted to the unique circumstances of each impact.
Prepare governance, monitoring and reporting
Finally, companies should focus on how due diligence will be governed, monitored and evidenced.
Boards and senior leaders will need clear visibility of the organisation’s risk exposure and assurance that mitigation measures are effective. This will require a strong governance framework, detailing clear accountability and ownership of the human rights risks identified. Developing meaningful KPIs will be key to measuring the effectiveness of actions taken to address adverse impacts, ensuring that companies appropriately monitor that mitigation measures really do reduce adverse impacts and result in better outcomes for people.
Cross-functional collaboration, stronger data systems and alignment with existing reporting obligations, including CSRD and ESRS where applicable, will also play an important role in supporting reporting activities.
The role of technology in CSDDD compliance
Managing due diligence at scale is likely to require a more systematic use of technology.
Technology-enabled tools can support data collection, scoping and risk assessment, action tracking and reporting.
GoodCorporation’s Assessment Platform (GCAP) has been developed to support human rights and compliance teams in their implementation of human rights and environmental due diligence by providing clients with a tool tailored to their operational context and needs, supplemented by GoodCorporation’s expertise to support the various elements of the HREDDD cycle.
A framework for preparation
Preparing for the CSDDD means building systems that can identify and manage risks to people and the environment in a structured and defensible way.
GoodCorporation’s Human Rights and Environmental Due Diligence Framework provides a structured approach to assessing readiness, identifying gaps and strengthening due diligence systems in line with international standards and regulatory expectations.
Companies will need to demonstrate more than an awareness of risk. They will need to show that their processes are embedded in decision-making, informed by the people affected and effective in practice.
Starting preparations now gives organisations time to assess their current approach, address weaknesses and test whether their systems are working before the CSDDD applies in 2029. This can also help them demonstrate responsible business conduct beyond regulatory compliance.
Discuss your CSDDD preparations
GoodCorporation can help you assess your current due diligence arrangements, identify areas for improvement and develop a practical plan to strengthen your systems ahead of implementation.
Explore our CSDDD services to find out how we can support your preparations, or contact us to discuss your requirements.
