The EU’s Corporate Sustainability Due Diligence Directive (CSDDD)

European and global companies alike are deep into preparations for the EU’s Corporate Sustainability Reporting Directive (CSRD), a regulation that requires more than 50,000 companies to report on hundreds of data points across sustainability topics from water usage to impacts on consumers. It’s a sustainability regulation that’s unprecedented in scope.

But the CSRD is just one part of the EU’s work to transform corporate accountability. The Corporate Sustainability Due Diligence Directive (CSDDD), often referred to as the CS3D, is a new law designed to work alongside the CSRD. Where the CSRD is focused on requiring companies to disclose sustainability data, goals and plans, the CSDDD requires companies to act on sustainability.

This includes company action on climate change. One of the CS3D’s most consequential obligations is for companies to adopt and put into effect a climate transition plan. This plan must detail how the company will evolve its business model and strategy to decarbonise in line with the Paris Agreement (i.e., keeping warming below 1.5 °C).

Which companies are in the scope of the CSDDD?

The rule applies to companies inside and outside the EU, subject to certain thresholds. EU-based companies with more than 1000 employees and a net worldwide turnover exceeding €450M in the previous financial year are in scope. For companies based outside the EU, the rules apply to those that generate more than €450M in turnover within the EU. In both cases, the rules apply to the ultimate parent company of a group meeting the relevant financial thresholds.

Similarly, companies inside and outside the EU are caught if they have franchising or licensing agreements in the EU generating royalties greater than €22.5M and net worldwide turnover of >€80M in the last financial year.

Reporting deadlines are phased in by company size—see the table below for details.

Most sectors have the same due diligence obligations under the CSDDD, with financial services companies as the one significant exception. They are required to conduct due diligence only on upstream activities, excluding any services to clients.

What does the CSDDD require?

The requirements under CSDDD are broken down into two pillars. The first is due diligence of a company's value chain, the second is mandatory action on a company’s climate impact.

Due diligence of the value chain

This is about companies identifying and addressing the adverse social and environmental impacts from their business, and embedding due diligence into the way they run themselves. It’s a multi-layered set of obligations, inspired by the OECD’s Due Diligence Guidance for Responsible Business Conduct. Under the CSDDD, companies must:

• Work with employees to create a due diligence policy, and integrate due diligence into other relevant policies and risk management systems.
• Identify and assess actual and potential adverse impacts arising from their own operations, those of their subsidiaries and, their supply chain, and activities of downstream business partners, related to the distribution, transport and storage of the product.
• Prevent and mitigate the impacts identified, prioritising by severity and likelihood. Actions could include developing prevention action plans and seeking contractual assurances from business partners.
• Bring adverse impacts to an end, including if appropriate, the termination of contracts. Companies must provide remediation where they are responsible, with the option to provide voluntary remediation where a business partner is responsible.
• Carry out meaningful engagement with stakeholders to inform the steps above.
• Monitor the adequacy and effectiveness of this due diligence, including periodic assessments.
• Communicate progress. For companies in scope of the CSRD, their reporting provides the vehicle for this communication. Companies not in scope of the CSRD must publish an annual compliance statement on their website, with guidance on the specific content due from the EU in 2027.

Climate transition plans

CSDDD requires in-scope companies to adopt and implement a climate transition plan. That transition plan should align the business model and strategy of the company with the goal of limiting global warming to 1.5 °C and achieving net zero emissions by 2050, in line with the Paris Agreement.

The transition plan should include time-bound targets for 2030, and then include further targets in five-year increments up to 2050. These targets should be science-based and include absolute emissions reduction targets for scope 1, 2 and 3 greenhouse gas emissions.

Furthermore companies will need to identify and describe the decarbonisation levers being used to reach these targets, explain and quantify the investments and funding supporting the implementation of the transition plan, and describe the role of management with respect to the plan. Companies will need to execute on that plan on a best efforts basis.

National regulatory authorities will be responsible for supervising the adoption and design of the plan. It is expected that the European Commission will publish further guidelines on the precise details of transition plans, and we are yet to see how they will align with transition plan guidance being developed as part of the CSRD. In the meantime, a useful place for companies to start is the recently published guidance from the UK’s Transition Plan Taskforce.

When will the CSDDD go into effect?

Once the rule becomes law, EU member states will have two years to transpose it into their national laws. The rule will begin applying to some companies from 2027, with the following phase-ins:

Enforcement and penalties

The implications for companies failing to meet their obligations under the CSDDD received more attention than a typical EU regulation, reflecting the scale of potential penalties and the importance of effective compliance.

Each EU member state will designate one or more supervisory authorities to enforce compliance with the CSDDD, and there is some flexibility about the rules on penalties. However, in every member state, financial penalties for non-compliance can be up to 5% of a company’s net worldwide turnover. Furthermore, if a subsidiary receives a fine, the amount will still be based on group turnover.

Companies can also be held liable for intentionally or negligently failing to prevent potential adverse impacts or failing to bring actual adverse impacts to an end, and causing damage to a natural or legal person as a result.

How should companies prepare?

Many companies in the scope of the CSDDD will have to produce a report under the CSRD. This will help those companies prepare for the CSDDD by making sure they’re building an understanding of ESG impacts across their value chains.

Beyond understanding the data, companies will need to build new motions for integrating human rights and environmental due diligence into policies and actions across their value chain. That includes finding ways to reliably surface potential issues and mitigate adverse impacts.

The CSRD asks companies to disclose on their transition plan if they have one, and—given the additional requirements in the CSDDD on transition plans—companies should take extra care to ensure these plans are both credible and have sufficient internal buy-in across the business to become a reality. To get there, companies should measure emissions, understand emissions hotspots, identify decarbonisation opportunities, and plan annual reductions to meet targets.

What opportunities does the CSDDD present?

At a macro level, the CSDDD is a critical piece of legislation for accelerating the net-zero transition. It also presents an opportunity for individual companies to respond to the transition to a lower emissions economy, and stand out from the pack in the eyes of consumers, investors, and employees.

Timeline of deadlines and guidelines

• June 2024: Entry into force.
• 2026: Directive transposed into the national laws of EU member states.
• 2026: First batch of European Commission guidelines, on due diligence best practises; prioritisation of impacts; purchasing practises; responsible disengagement; remediation; and assessment of risk factors.
• 2027: Second batch of European Commission guidelines on climate transition plans and on how to engage with stakeholders.
• Implementation begins, according to company size and turnover. See table above for more details.