Following the adoption of Directive (EU) 2026/470 ("Omnibus I"), the civil liability provisions of the Corporate Sustainability Due Diligence Directive have been restructured in material ways, yet a meaningful liability exposure for in-scope companies survives. The revised framework narrows the personal scope of the CSDDD considerably, delays the transposition deadline for CSDDD amendments to 26 July 2028, and leaves several interpretive questions – including the precise conditions for third-party civil claims – to be resolved at Member State level. Companies and their investors should not interpret the narrowing of scope as an elimination of legal risk: the liability architecture that remains is enforceable and, in several respects, more exposed to cross-border litigation than the pre-Omnibus position.
The Legislative Context: Omnibus I and What Changed
Omnibus I – formally Directive (EU) 2026/470, published on 26 February 2026 and entering into force on 18 March 2026 – was the European Commission's response to sustained pressure from industry and Member States to recalibrate the compliance burden of the CSDDD and the Corporate Sustainability Reporting Directive (CSRD). The package addressed both instruments simultaneously, producing a set of interlinked changes to personal scope, substantive obligations, and enforcement architecture.
On scope, the CSRD threshold was raised to EU undertakings with more than 1,000 employees and more than EUR 450 million net turnover. For non-EU groups, the equivalent test requires more than EUR 450 million EU-generated turnover and the presence of an EU subsidiary or branch with a net turnover above EUR 200 million. These thresholds matter for the liability analysis because they define which entities fall under the disclosure regime that underpins private enforcement claims. A company excluded from the CSRD may still fall within the CSDDD's value-chain obligations, but the absence of mandatory disclosure removes one evidentiary tool that claimants would otherwise rely upon.
The CSDDD transposition deadline was extended to 26 July 2028, giving Member States additional time to implement the amended civil liability provisions into national law. The Commission is also required to revise the European Sustainability Reporting Standards (ESRS) by delegated act, which introduces further uncertainty about the standards against which due diligence conduct will ultimately be measured.
The Civil Liability Architecture: What Survives Omnibus I
The original CSDDD imposed an obligation on companies to establish and implement due diligence processes addressing adverse human rights and environmental impacts throughout their operations and value chains. Civil liability was attached to a failure to fulfil those obligations where that failure caused or contributed to harm. Omnibus I did not abolish this structure – it refined it.
The liability provisions that survive the reform rest on several pillars:
- Fault-based liability, not strict liability. The CSDDD framework requires that a claimant demonstrate that the company failed to take the due diligence measures it was required to take, and that this failure caused or contributed to the harm. This is a higher bar than strict liability, but it is not a bar that industry should assume will be insurmountable in practice.
- Representative action mechanisms. Trade unions and civil society organisations with a legitimate interest retain the right to bring claims on behalf of affected parties under national procedural law. This route was preserved through Omnibus I and remains one of the most significant vectors for large-scale civil litigation in the EU.
- Value-chain liability. In-scope companies retain obligations regarding their established business relationships. The scope of those relationships – and the depth of due diligence required at each tier – remains subject to national implementing rules, creating uneven exposure across Member States.
- Interaction with CSRD disclosure. Where a company falls within the revised CSRD thresholds, its sustainability disclosures may be adduced as evidence in civil proceedings. Disclosures that overstate the quality of due diligence processes create a distinct litigation risk, independent of whether actual harm can be proven.
One dimension that Omnibus I did not resolve is the standard of care applicable to indirect value-chain relationships. The amended text preserves national discretion on this point, meaning that companies operating across multiple jurisdictions face a patchwork of liability standards pending full transposition by July 2028.
If your organisation is reviewing its exposure under the revised CSDDD liability framework, Ferraz & Whitmore's team can assist with a structured risk assessment and an analysis of how the rules apply to your specific corporate structure. Please write to info@ferrazwhitmore.com or visit our contacts page to arrange a consultation.
Open Interpretive Questions and Litigation Risk
Several questions of interpretation remain genuinely unresolved after Omnibus I, and they are material to any practical risk assessment.
Causation thresholds. The CSDDD uses "caused or contributed to" as the causation standard, which is broader than traditional "but for" causation in most civil law systems. Member States have discretion in how they translate this standard into their national liability rules, and this discretion is unlikely to be exercised uniformly. In jurisdictions where courts have historically applied a broad conception of contributory causation – as seen in some environmental litigation at Member State level – the practical threshold for successful claims may be considerably lower than companies currently model.
Interaction with ESRS revisions. The Commission's obligation to revise the ESRS by delegated act introduces a moving target into the disclosure-based liability calculus. Companies whose current CSRD disclosures reflect the existing ESRS standards may find those disclosures evaluated against revised standards in future litigation, particularly if claims arise from conduct during a transitional period.
Holding company and group structures. The amended CSDDD does not fully resolve the question of whether a holding company at the top of a corporate group can be held liable for failures at subsidiary level. This question has both a corporate governance dimension and a jurisdictional dimension for groups that have undergone company re-domiciliation or that maintain complex beneficial ownership structures. National courts will likely develop divergent approaches pending any clarification from the Court of Justice of the European Union (CJEU).
Non-EU companies. The revised scope thresholds mean that many non-EU groups continue to fall within the CSDDD's reach through their EU subsidiaries or branches. For such groups, the question of which national law governs civil liability claims – and whether EU courts will assume jurisdiction – is directly relevant to litigation risk modelling. The interaction between the CSDDD and Rome II Regulation rules on applicable law has not been authoritatively resolved, and neither the European Banking Authority (EBA) nor the European Securities and Markets Authority (ESMA) has issued guidance that directly addresses this intersection.
Practical Impact: Sector and Structural Vulnerabilities
The practical impact of the revised liability framework is not uniform across industries or corporate structures. Three areas of heightened vulnerability are worth identifying with precision.
Financial sector participants. Banks and asset managers subject to both the CSDDD and ESMA's sustainable finance disclosure rules face a compounded liability exposure: civil claims under the CSDDD may be reinforced by regulatory findings under the SFDR or EBA prudential frameworks. The interaction between these regimes – and the evidentiary weight that ESMA supervisory actions might carry in civil proceedings – is an underexamined risk for EU-regulated financial institutions.
Companies with complex ownership structures. Groups that have restructured through holding company arrangements or that have utilised company re-domiciliation to consolidate their EU presence may find that the beneficial ownership trail creates unexpected liability exposure. Where a holding company exercises operational control over value-chain decisions, courts may be willing to pierce the corporate veil to hold the holding entity liable, particularly where the restructuring post-dates the adoption of the CSDDD.
Mid-market companies newly within scope. The revised EUR 450 million and 1,000-employee thresholds bring a defined universe of mid-market companies within the CSRD disclosure framework for the first time, with CSRD transposition required by 19 March 2027. These companies typically lack the compliance infrastructure of large-cap groups, and their initial disclosures may contain inaccuracies or overstatements that create litigation exposure before robust due diligence systems are fully operational.
For any company operating through EU subsidiaries or branches, a review of existing corporate governance frameworks and due diligence documentation is advisable before the transposition deadlines arrive. Our corporate law practice regularly advises on the structural and governance dimensions of CSDDD compliance across EU jurisdictions.
Cross-Border Implications and Strategic Recommendations
The cross-border dimension of CSDDD civil liability is one of its most consequential and least-discussed features. Claims may be brought in the Member State where harm occurred, where the defendant company is domiciled, or – under certain conditions – where the company has an establishment. For a non-EU group with multiple EU subsidiaries, this creates a genuine risk of parallel proceedings in different jurisdictions, each applying different national implementing rules to the same factual scenario.
Strategic risk management in this environment requires a multi-layered approach:
- Audit your scope position. Confirm whether your entity falls within the revised CSRD and CSDDD thresholds as amended by Omnibus I. The interaction between employee count, turnover, and the EU-nexus criteria for non-EU groups requires a factual assessment specific to each entity in a group.
- Map your value-chain liability exposure. Identify the tier-one and beyond relationships that your current due diligence processes cover, and assess whether those processes would withstand scrutiny under the most demanding national implementing rules likely to apply.
- Review your CSRD disclosure strategy. Disclosures made before the ESRS are revised by delegated act should be drafted conservatively, with particular attention to statements about the effectiveness of due diligence programmes. Overstated disclosures create an independent litigation risk.
- Assess holding company exposure. Where a holding company exercises control over value-chain procurement decisions, consider whether the corporate governance documentation adequately reflects the allocation of responsibility within the group.
- Monitor national transposition. The CSDDD amendments must be transposed by 26 July 2028, but Member States will begin legislative processes earlier. Early transposition in key jurisdictions – particularly those with active civil society litigation ecosystems – may create de facto earlier exposure.
Tax structuring decisions for groups operating across EU jurisdictions may also intersect with CSDDD liability positioning, particularly where group financing structures affect the allocation of operational control. Our tax law team works in conjunction with the corporate practice to assess these interactions.
The Regulatory Horizon: Outlook to 2028
The period between now and the July 2028 transposition deadline is not a stable one. Several regulatory processes are running in parallel that will shape the liability environment materially.
The Commission's revision of the ESRS by delegated act will determine the disclosure standards against which due diligence conduct is measured in civil proceedings. The timeline for that revision has not been formally fixed, and the political dynamics surrounding the Omnibus package suggest that further adjustment remains possible. Companies should build flexibility into their compliance programmes rather than anchoring to the current ESRS standards.
At Member State level, several jurisdictions are likely to use the transposition window to expand or clarify the civil liability provisions in ways that go beyond the minimum requirements of the Directive. The Netherlands, France, and Germany have each already developed national due diligence legislation that will need to be reconciled with the amended CSDDD, and the interaction between pre-existing national laws and the new EU framework is a live question.
The CJEU's developing jurisprudence on value-chain liability – while not yet producing definitive rulings on CSDDD-specific questions as of the date of this analysis – may over time provide the interpretive clarity that the Omnibus I text does not. Companies and their advisers should track EUR-Lex developments and any preliminary reference proceedings that emerge from national courts grappling with value-chain causation questions.
For a current summary of how the Omnibus I amendments affect CSRD reporting scope specifically, see our CSRD Omnibus scope alert, which addresses threshold analysis and transitional provisions in detail.
The civil liability landscape under the amended CSDDD will continue to evolve as Member States transpose the Directive and courts begin to apply it. Ferraz & Whitmore monitors these developments across EU jurisdictions and can provide tailored advice on how specific corporate structures, disclosure practices, and value-chain relationships interact with the liability provisions as they stand today. To discuss your organisation's position, please contact us at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.