Corporate Sustainability Due Diligence (CSDDD)due diligence obligations for sustainable supply chains
Procurement glossary · Updated · 10 min read
Also known as: CSDDD, CSDD, EU Due Diligence Directive, Unternehmerische Sorgfaltspflicht, Lieferkettensorgfaltspflicht
Short answer
- The CSDDD is an EU Directive that obliges large companies to identify, prevent and remediate human rights and environmental risks in their own operations and along the supply chain.
- For procurement, this means: sustainability requirements must be integrated into supplier selection, contracts, vendor onboarding and periodic supplier monitoring.
- Even suppliers that are not themselves directly obligated are de facto covered through evidence and cooperation obligations imposed by their major customers.
The Corporate Sustainability Due Diligence (CSDDD) is an EU Directive that obliges companies to identify, prevent, mitigate and remediate human rights and environmental risks in their own operations and in the value chain. It tightens the obligations already existing under the German Supply Chain Due Diligence Act (LkSG) and targets large companies with a substantial European connection. For technical buyers, the CSDDD thus becomes a strategic topic that directly influences supplier selection, contract design and supplier monitoring.
Key facts
- The CSDDD is an EU Directive that requires corporate due diligence obligations regarding human rights and the environment along the entire value chain.
- It typically applies to very large companies above certain turnover and headcount thresholds and enters into force in stages with staggered timing.
- Core obligations are risk analysis, prevention and remediation measures, complaints procedures and public reporting.
- Violations can result in supervisory measures, fines and civil liability, as worded in the Directive.
- Procurement is centrally affected: supplier selection, contracts, audits and data maintenance must be structured in line with due diligence obligations.
- Digital tools such as a supplier portal, supplier rating and structured RFX processes support practical implementation.
Contents
- Definition: Corporate Sustainability Due Diligence (CSDDD)
- Scope of application: who is affected by the CSDDD
- Methods and approach: operationalising the due diligence process
- The role of procurement: responsibilities and levers in practice
- Key KPIs and metrics for due diligence
- Risks and controls: liability, costs and implementation stumbling blocks
- Current developments and practical outlook
- Typical metrics
- Practical example
- Conclusion
- Frequently asked questions
Definition: Corporate Sustainability Due Diligence (CSDDD)
The CSDDD (Directive on corporate sustainability due diligence) is a legal act of the European Union that prescribes company-wide due diligence to respect human rights and the environment. It covers the company's own operations, the operations of direct and indirect business partners and – within defined limits – the entire value chain. The aim is to systematically prevent or mitigate adverse impacts such as child labour, forced labour, environmental pollution or biodiversity loss.
Distinction from the Supply Chain Due Diligence Act (LkSG)
In Germany, the Supply Chain Due Diligence Act (LkSG) already applies, with due diligence obligations for companies above certain headcount thresholds. The CSDDD goes beyond it in several respects: broader scope of application, more extensive climate obligations (transition plan towards climate neutrality) and stronger harmonisation in the EU single market. Companies with an existing LkSG process therefore have a viable foundation, but must review and, where necessary, expand their scope and methodology.
Relationship to other sustainability regulations
The CSDDD forms part of an interconnected regulatory framework with the CSRD (sustainability reporting), the EU deforestation regulation regime (EUDR) and product-related regulations such as the Ecodesign Regulation. While the CSRD primarily governs reporting obligations, the CSDDD requires active risk management action. For buyers, this means that data on suppliers, materials and production sites must be prepared in such a way that it can be used both for due diligence and for reporting. A data structure built once in supplier management can be reused multiple times.
Scope of application: who is affected by the CSDDD
The Directive is primarily aimed at companies of considerable size and economic significance, whereby the specific thresholds and transition periods must be taken from the finally adopted versions and the national implementation acts. Crucially, suppliers are also indirectly affected when they supply covered companies.
Directly obligated companies
Directly covered are typically companies with very high turnover and large numbers of employees in the EU as well as equivalent undertakings from third countries with EU business activities. In practice, the magnitudes discussed are several hundred million euros in turnover and well over 1,000 employees; the exact figures should be checked against the national implementation act. Many corporations from mechanical engineering, automotive, chemicals and electronics fall within the scope of application.
Effects on suppliers and the Mittelstand
Even if a supplier is not itself directly obligated, the CSDDD has a de facto effect as an obligation to provide evidence and cooperate: covered customers demand contractual assurances, self-disclosures, audits and remediation plans. Suppliers unable to meet these requirements risk, in practice, a downgrade in the supplier rating or removal from the supplier pool. Those who link vendor onboarding processes with sustainability questions at an early stage gain a competitive advantage.
Areas of activity along the chain
Covered activities include, by definition, raw material extraction, manufacturing, logistics and transport services (within certain limits), distribution and utilisation or disposal. For technical buyers, this means that specialised processes such as galvanising, foundries, printed circuit board manufacturing or disposal services must also be included in the risk analysis.
Methods and approach: operationalising the due diligence process
The CSDDD follows a six-step due diligence process that builds on internationally recognised guidelines. For procurement organisations, it is worthwhile to integrate this process firmly into the existing source-to-contract (S2C) workflows rather than organising it as a parallel compliance project.
Risk analysis and risk mapping
The starting point is a risk-based analysis: in which countries, procurement markets and procurement categories do human rights and environmental risks occur with increased frequency? In practice, a two-stage approach has proven effective: first an abstract risk mapping by commodity group and country of procurement (for example raw materials, textiles, electronics and mining products as classic risk areas), followed by a company-specific consolidation based on supplier data, sites, production processes and media monitoring. A systematic market analysis prior to supplier search (Supplier Discovery) should include sustainability criteria from the outset.
Anchoring prevention and remediation in contracts
Effective prevention in practice means above all: clear contractual obligations, documented measures and verifiable standards. Proven instruments include sustainability clauses in framework orders and individual contracts, binding codes of conduct, audits and certifications as well as training measures for the company's own buyers and supplier contacts. Where violations are identified, a remediation plan with deadlines must be agreed – as a last resort, termination of the business relationship may be provided for. Conversely, good governance also strengthens the negotiating position: anyone who diversifies suppliers away from sole sourcing, for example through nearshoring strategies, simultaneously reduces their due diligence and procurement risk exposure.
Complaints procedure and documentation
A complaints procedure is mandatory that enables affected parties and their representatives to submit reports with a low threshold – also beyond internal group reporting channels. Relevant for procurement: complaints from the supply chain must flow to the responsible internal functions and result in remediation measures. The entire process documentation (analysis, measures, results, contracts, audits) must be retained for the prescribed periods and must be traceable vis-à-vis a supervisory authority. A digital supplier portal through which self-disclosures, certificates and audit reports are consistently maintained considerably reduces the documentation workload.
The role of procurement: responsibilities and levers in practice
Procurement is operationally the most important interface for implementing the CSDDD, because all relationships with direct and indirect business partners run through it. At the same time, buyers face conflicting objectives: price, availability and sustainability must be assessed together.
Supplier selection and RFX processes
Sustainability requirements belong in the award criteria. In procurement RFX (RFI, RFP, RFQ), sustainability questions should be included as weighted criteria – for example questionnaires on social standards, emissions data, conflict minerals and audits. In this way, sustainability transparency becomes a performance requirement, and supplier selection becomes more risk-based. A structured vendor onboarding with a sustainability self-disclosure creates the data foundation needed for recurring risk analyses and reporting.
Monitoring and supplier rating
The obligation to prevent extends to direct business partners; where there is substantiated knowledge of violations, also to indirect partners in the next tiers. In practice, this means periodic monitoring: annual self-disclosures, audit cycles depending on the risk level, follow-up on deficiencies. A supplier rating that maps sustainability criteria alongside delivery quality, on-time delivery and price development makes the risk situation visible and provides arguments for development discussions with strategic suppliers. Those who organise supplier management as a supplier network via central platforms significantly reduce the effort for data maintenance and communication.
Assessing costs and value creation
Due diligence incurs costs – for audits, certifications, data maintenance and, where applicable, more expensive but compliantly sourced materials. Tools such as should-costing and target costing help to feed these expenses into price negotiations in a structured manner instead of accepting them as blanket sustainability surcharges. Project procurement and investment decisions – for example for new production facilities or new countries of procurement – should also reflect due diligence costs in the economic assessment.
Key KPIs and metrics for due diligence
Due diligence must be made measurable, otherwise it remains a declaration of intent. Meaningful metrics link process quality, data transparency and risk reduction. The following benchmark values are typical target corridors in practice and depend on industry and maturity level.
Coverage and data quality metrics
Core metrics are the percentage of risk suppliers with a current self-disclosure and audit status, data completeness in the supplier master and the currency of certificates. In established organisations, target values typically lie above 90 to 98 per cent for the risk group. In addition, the number of identified serious violations and the proportion of these with a completed remediation plan form an important pair of steering metrics.
Process and measure metrics
Also relevant: the share of new contracts and framework orders with sustainability clauses (typically close to 100 per cent for new contracts), the average time from report to remediation measure and the proportion of suppliers that have participated in development measures. These KPIs can be readily combined with existing procurement metrics, such as supplier loyalty, the single-source quota or metrics on availability, in order to detect conflicting objectives early.
Risks and controls: liability, costs and implementation stumbling blocks
The CSDDD provides for supervisory and sanction mechanisms, including fines for breaches of obligations and – within the limits defined by the Directive – civil liability for certain damages. In addition, non-legal consequences such as reputational damage and the loss of customers loom.
Legal risks at a glance
Key legal risks are fines imposed by the supervisory authorities, liability claims from injured parties and – as an indirect consequence – contractual downgrades or recalls by the company's own customers. Important: this description is of a general nature; the specific levels of sanctions, transition periods and liability rules follow from the final Directive, the national implementation acts and the individual case and should be legally examined. Some provisions, such as a step-in right to secure critical sources of supply, concern adjacent topics and must not be confused with the CSDDD sanctions.
Operational risks in procurement
The most common implementation stumbling blocks include incomplete supplier data, a lack of visibility of indirect partners in deeper tiers (sub-N-tier transparency) and the conflict between schedule pressure and elaborate review processes. These risks are mitigated in a practical way through risk-based segmentation, standardised questionnaires, the establishment of a structured supplier portal and clear escalation paths. The timing of tenders (RFX) should also be planned so that sustainability evidence is obtained in good time before the supplier decision is made.
Origin and material risks
For raw materials and stock-kept materials, due diligence often only applies at deeper tiers – for example with metals, rare earths or agricultural products. Origin preference evidence from the customs domain provides useful building blocks here, as they document origin and processing. Those who also maintain goods receipt note (GRN) data in a structured manner and use batch traceability can, in the event of damage, prove which batches are affected – and react in a targeted rather than blanket manner.
Current developments and practical outlook
Sustainability regulation in Europe is in a state of flux: between the adoption of the CSDDD, national implementation acts and ongoing omnibus discussions about simplifications, a dynamic legal situation is emerging. Companies therefore need flexible, scalable processes rather than rigid one-off solutions.
Omnibus debate and pressure for simplification
Following the adoption of the CSDDD, a political discussion has begun about simplifications, adjusted thresholds and relieving combinations with the CSRD. For affected companies this means: the magnitude of the requirements is tending to decrease rather than increase, but the substantive core obligations remain. In practical terms, it is sensible to reduce due diligence to a lean, risk-based core process level that will also withstand weaker regulatory requirements – particularly because large customers enforce sustainability requirements contractually regardless of thresholds.
Digitalisation as an enabler
Without digital tools, due diligence can hardly be mapped economically across thousands of suppliers. Important are a central supplier portal for self-disclosures and documents, automation in vendor onboarding, platforms for country and industry risk monitoring as well as interfaces to ERP and e-procurement systems. Supply chain data management also benefits: consistent article and supplier master data are a prerequisite for any robust risk analysis.
Typical metrics
| Metric | Benchmark | Context |
|---|---|---|
| Coverage of risk suppliers with current self-disclosure | > 95 % | typical target corridor in established due diligence processes |
| Share of new contracts with sustainability clauses | ≈ 100 % | should apply to all new framework and individual contracts |
| Average time from violation report to remediation plan | < 30 days | practical benchmark value; deadlines depend on the severity of the case |
| Single-source quota in risk commodity groups | < 10 % | sound due diligence and procurement risk management interlock |
Typical practical benchmarks – they vary by industry, part and contract.
Practical example
A medium-sized mechanical engineering company supplies covered major customers from the automotive and energy sectors and is increasingly confronted by them with sustainability evidence. The company decides not to organise its due diligence as a separate compliance project, but to integrate it into the existing procurement function.
- A risk-based mapping by procurement category and country of origin identifies castings, electronic components and surface treatment as priority risk areas.
- A standardised sustainability questionnaire becomes mandatory in vendor onboarding; certificates and audit reports are consistently maintained and periodically updated via a supplier portal.
- New framework orders and supply contracts receive sustainability clauses with audit rights, remediation deadlines and documented escalation levels.
- An enhanced supplier rating supplements delivery quality and on-time delivery with sustainability criteria; risk suppliers undergo annual development and audit cycles, and alternative sources are gradually built up through nearshoring and targeted supplier search.
Conclusion
The Corporate Sustainability Due Diligence is far more than a regulatory obligation: it changes the structure of procurement and supplier management. Those who build due diligence as a risk-based, digitally supported process along the source-to-contract cycle reduce not only legal and reputational risks, but also operational vulnerabilities such as single-source dependencies. The key lies in integration: sustainability criteria belong in RFX, contracts, vendor onboarding and the supplier rating – not in a separate parallel universe. Companies that structure early use the data twice over, namely for compliance and for better procurement decisions. The effort is real; the alternative – reworking under time pressure after an incident – is more expensive.
Frequently asked questions
Who does the CSDDD apply to?
The CSDDD primarily targets very large companies in the EU and equivalent undertakings from third countries with business activities in the EU; the specific turnover and headcount thresholds as well as the transition periods follow from the finally adopted version and the national implementation acts and should be checked on a case-by-case basis. In addition, the Directive has a de facto effect across the entire supply chain: suppliers must provide evidence and cooperate, even if they are not directly obligated.
Difference between CSDDD and LkSG?
The German Supply Chain Due Diligence Act (LkSG) is a national precursor regulation with due diligence obligations for companies above certain headcount thresholds. The CSDDD is an EU Directive with a broader scope of application, additional climate obligations and strong EU-wide harmonisation effects. Companies with LkSG processes have a sound foundation, but must adapt their scope and methodology to the CSDDD requirements.
What specific obligations does the CSDDD contain?
Core obligations are risk identification and risk analysis, prevention and remediation measures in the event of violations, a complaints procedure, periodic risk assessments and documentation over defined periods. In addition, there are reporting obligations and, for very large companies, a transition plan towards climate neutrality. The exact design is governed by the Directive and the national implementation act.
What are the consequences of violating the CSDDD?
The Directive provides for supervisory measures and fines in the event of breaches of obligations as well as, within defined limits, civil liability for certain damages. In addition, non-legal consequences loom, such as reputational damage, the loss of major customers or a downgrade in the customer-supplier rating. The specific levels of sanctions and liability rules should be legally examined on a case-by-case basis.
How can procurement structure the implementation of the CSDDD?
In practice, integration into existing processes has proven its worth: sustainability criteria belong in RFX and supplier selection, sustainability clauses in framework and individual contracts, and self-disclosures in vendor onboarding. A supplier portal that centrally manages certificates, audit reports and questionnaires reduces the workload. In addition, a risk-based supplier rating provides transparency and helps with prioritisation.
Does the CSDDD also apply to small and medium-sized suppliers?
Typically not directly, as the turnover and headcount thresholds are well above the typical SME level. Indirectly, however, very much so: covered major customers impose contractual requirements, self-disclosures and audits on their direct business partners. SME suppliers that systematically prepare sustainability data thereby gain a competitive advantage in B2B business.
