CSDDD After Omnibus I: Supply-Chain Due Diligence Guide for Companies in the EU

Following the publication of Omnibus I (Directive (EU) 2026/470, in force 18 March 2026), the EU's supply-chain due diligence framework has been substantially recalibrated. The revised Corporate Sustainability Due Diligence Directive (CSDDD) now sits alongside a narrowed Corporate Sustainability Reporting Directive (CSRD), and companies that previously mapped their compliance obligations must reassess their position against the updated thresholds, revised timelines and still-pending national transposition rules.

What Omnibus I Changed – and What It Did Not

Omnibus I was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. Its primary effect on the CSRD was to restrict the personal scope: only EU undertakings with more than 1,000 employees and more than EUR 450 million net turnover now fall within the mandatory reporting regime. For non-EU groups, the trigger is more than EUR 450 million in EU-generated turnover, provided there is an EU subsidiary or branch that itself exceeds EUR 200 million.

These thresholds represent a significant contraction from the pre-Omnibus trajectory, which had been moving towards coverage of large numbers of mid-market companies. Many businesses that had begun CSRD readiness programmes will find themselves outside the mandatory scope, at least for now. However, voluntary or contractual sustainability disclosure obligations – imposed by banks, institutional investors or large-company counterparties – often persist regardless of regulatory thresholds.

On the CSDDD side, Omnibus I adjusts the framework but does not abolish it. Member States must transpose the CSRD amendments by 19 March 2027 and the CSDDD amendments by 26 July 2028. Until those deadlines pass, companies are dealing with a dual layer of uncertainty: the EU text is settled, but national implementing rules remain pending in most jurisdictions.

The European Commission has also been mandated to revise the European Sustainability Reporting Standards (ESRS) by delegated act. The precise content of the revised ESRS is not yet available as of the date of this guide, which means any compliance programme built on the current ESRS should include a structured review process tied to Commission publications.

Who Is Now In Scope – A Practical Threshold Analysis

Determining whether your business is in scope requires a careful analysis at the group level, not just the entity level. The key questions are:

• Employee count: Does the EU undertaking, on a consolidated basis, employ more than 1,000 persons?
• Turnover: Does net turnover exceed EUR 450 million for EU undertakings, or does the non-EU group generate more than EUR 450 million from EU-based customers or operations?
• EU footprint of non-EU groups: Is there an EU subsidiary or branch with net turnover above EUR 200 million that anchors the group to the EU regime?
• Contractual exposure: Even if below the regulatory thresholds, is the company a first-tier supplier to an in-scope company that will pass due diligence requirements down the value chain?

Companies structured through holding entities – including those that have pursued company re-domiciliation or holding company reorganisations – must map group boundaries with care. Corporate governance arrangements that spread employees across multiple entities can affect how thresholds are calculated, and beneficial ownership structures may influence which entity is treated as the EU undertaking for regulatory purposes.

If your threshold analysis is genuinely borderline, document the methodology and retain it. Regulators and, where relevant, CJEU case law on analogous EU directives consistently indicate that defensible methodology matters even where the outcome is uncertain.

Step-by-Step Supply-Chain Due Diligence Under the Revised Framework

Step 1: Map Your Value Chain

The CSDDD requires companies to identify and assess actual and potential adverse impacts on human rights and the environment across their operations and, to a defined extent, their value chains. Begin with a tiered mapping exercise: direct (first-tier) suppliers are the primary focus, but the framework also reaches upstream in cases where there is plausible information suggesting adverse impacts at deeper tiers.

Document the geographic spread of your supply base. Suppliers in jurisdictions with weaker labour or environmental enforcement regimes will warrant heightened scrutiny and should be flagged for enhanced due diligence protocols.

Step 2: Conduct a Risk Prioritisation Assessment

Not all suppliers carry equal risk. The revised CSDDD framework is risk-based, meaning companies are expected to concentrate resources on the most severe and most likely adverse impacts. A risk matrix should weigh:

• The nature of the adverse impact (human rights, environmental, or both);
• The likelihood of occurrence given the supplier's jurisdiction and sector;
• The severity and reversibility of the potential harm;
• The company's leverage over the supplier.

This prioritisation should be documented in a formal risk register that can be produced to national competent authorities if required. Given that ESRS are under revision, your risk register format should be designed to accommodate updates without requiring a full rebuild.

Step 3: Integrate Due Diligence into Procurement and Contracts

Contractual clauses are the primary practical instrument for translating CSDDD obligations into supplier relationships. Standard supplier codes of conduct, contractual audit rights, and corrective action plan provisions should be reviewed against the post-Omnibus I requirements once national transposition rules become clear.

For corporate governance purposes, the board or designated senior management body should have oversight of the due diligence framework. The CSDDD links civil liability and supervisory enforcement to whether adequate group-level governance structures were in place. Boards should receive regular, structured reporting on supply-chain risk, not merely a one-time policy adoption.

Step 4: Implement Monitoring and Verification

Ongoing monitoring is not optional. The CSDDD requires periodic verification that adopted measures remain effective. This typically involves:

• Annual or biennial supplier audits (either by internal teams or independent third parties);
• Grievance and whistleblower mechanisms accessible to affected stakeholders in the supply chain;
• Regular board-level reviews of the due diligence report and corrective action tracking.

Third-party verification by a body accredited under frameworks recognised by ESMA or EBA-supervised entities (where financial institution clients are involved) adds defensibility. However, accreditation standards for sustainability verifiers remain in flux, and companies should monitor developments at the Commission and relevant European Supervisory Authority level.

Step 5: Prepare Disclosure and Reporting Materials

For companies that remain within the revised CSRD scope, the due diligence process feeds directly into the sustainability statement in the annual report. For those now below the CSRD threshold, the CSDDD still requires a standalone due diligence statement to be published on the company's website. The precise content requirements are governed by national implementing rules, which will emerge from Member State transposition processes concluding by 26 July 2028.

It is worth tracking EUR-Lex and national Official Journals actively during this period, because early-transposing Member States may set requirements ahead of the deadline, creating an asymmetric compliance environment across the single market.

If you are navigating the intersection of CSRD and CSDDD obligations for a cross-border group and would welcome a structured discussion of your specific position, please contact our team at info@ferrazwhitmore.com or visit our contacts page.

Key Documents and Evidence to Retain

Regardless of the final shape of national transposition, companies should begin assembling a compliance file now. Core documents include:

• The board-approved due diligence policy and its version history;
• Value chain mapping records with data sources noted;
• Risk prioritisation methodology and the resulting risk register;
• Supplier contracts containing sustainability clauses and audit rights;
• Audit reports, corrective action plans and evidence of follow-up;
• Grievance mechanism records (anonymised in accordance with applicable data protection rules);
• Annual due diligence statements or CSRD sustainability statements, as applicable.

Retention periods will be subject to national rules, but a minimum of five to seven years is a common benchmark across comparable EU regulatory regimes. Structure your document management system to allow rapid retrieval in the event of a supervisory request or civil claim.

Realistic Timelines and Cost Drivers

Companies frequently underestimate both the time and resources required to build a defensible CSDDD compliance programme. Based on the current regulatory timeline, the practical milestones are:

• Now to March 2027: CSRD amendments must be transposed by Member States. Companies should monitor national legislation and adjust reporting scope determinations accordingly. Begin or update value chain mapping and risk registers.
• March 2027 to July 2028: CSDDD amendments transposed. This is when national civil liability rules, supervisory authority designations and enforcement mechanisms become concrete. Contractual frameworks and governance structures should be finalised before transposition completes.
• Ongoing: Commission revision of ESRS by delegated act. The timing is not fixed; monitor EUR-Lex for consultation documents and draft delegated acts.

The principal cost drivers are supplier audit programmes (especially where global supply chains require on-the-ground verification in multiple jurisdictions), legal review of supplier contracts, and the establishment of grievance mechanisms that genuinely function across language and cultural barriers. Technology platforms for supply-chain data aggregation represent a significant upfront investment but reduce ongoing costs and improve audit-readiness.

Common Errors by International and Cross-Border Businesses

Our experience with foreign clients navigating EU sustainability law reveals a number of recurring errors that generate disproportionate compliance risk:

• Treating threshold exclusion as complete exemption. A company below the regulatory thresholds may still face CSDDD-equivalent obligations as a contractual matter, imposed by in-scope customers or lenders. Scope analysis must extend beyond the regulation itself.
• Ignoring group structure. Beneficial ownership and corporate governance arrangements that were optimised for tax or operational reasons may create unexpected aggregation of employees or turnover at the EU level, pulling the group into scope.
• Assuming uniform national implementation. The EU directive sets a floor; Member States can and do add requirements during transposition. A company with operations in multiple Member States should not assume that a single compliance model will satisfy all of them.
• Conflating CSRD and CSDDD obligations. CSRD governs disclosure; CSDDD governs conduct and carries civil liability exposure. The two instruments interact but are not interchangeable, and the consequences of non-compliance differ substantially.
• Deferring action pending "final" rules. The Omnibus I text is settled. Companies that wait for full national transposition before beginning value chain mapping will find themselves under significant time pressure from 2027 onwards.

For a detailed analysis of how scope reassessment has played out in practice in a comparable jurisdiction, our case study on CSRD scope reassessment in Spain provides useful context.

Decision Checklist: Is Your Business Ready?

Work through the following questions as a preliminary self-assessment. A "no" or "uncertain" answer to any item indicates a gap that warrants attention before national transposition completes.

• Have you confirmed, with supporting calculations, whether your group falls above or below the Omnibus I thresholds for CSRD and CSDDD purposes?
• Have you mapped your first-tier supply chain and identified higher-risk upstream relationships?
• Does your board receive formal, periodic reporting on supply-chain human rights and environmental risks?
• Do your supplier contracts include sustainability covenants, audit rights and corrective action mechanisms?
• Is there a functioning grievance mechanism accessible to workers and communities in your supply chain?
• Have you identified the national competent authorities in each Member State where you operate, and do you have a process for monitoring their guidance?
• Is your compliance documentation retained in a format that can be produced to regulators or in litigation?
• Have you reviewed your due diligence approach against ESG due diligence considerations in the M&A context under Omnibus I, particularly if acquisitions or disposals are anticipated?

Businesses that are uncertain about any element of this checklist, or that are working through the implications of the post-Omnibus I framework for a multi-jurisdictional group, are welcome to reach out to Ferraz & Whitmore for a preliminary discussion. Contact us at info@ferrazwhitmore.com or through our contacts page.

Looking Ahead: What to Watch

The post-Omnibus I landscape will continue to evolve across several fronts. The Commission's delegated act revising the ESRS will reshape the technical content of CSRD sustainability statements and, indirectly, the metrics used to assess CSDDD compliance performance. Member State transposition choices – particularly on civil liability, supervisory authority powers and the treatment of SMEs in supply chains – will create divergence across the single market that international businesses will need to track.

Enforcement posture is also uncertain. National competent authorities designated under the CSDDD will be new institutions in many Member States, and their initial enforcement priorities and procedural approaches will not be known until well into the transposition period. Early engagement with the regulatory process – through industry associations, public consultations and, where relevant, direct dialogue with authorities – can provide valuable intelligence and, in some cases, influence the practical shape of implementation.

If you would like to discuss how the evolving CSDDD and CSRD framework affects your business specifically, our team is available to assist. Please write to info@ferrazwhitmore.com or use our contacts page to arrange a conversation.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.