CSDDD After Omnibus I: Supply-Chain Due Diligence Guide for Companies in France

Following the publication of Omnibus I (Directive (EU) 2026/470, in force 18 March 2026), the scope and timetable of both the Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CSDDD) have been materially revised, reducing the number of companies subject to mandatory supply-chain due diligence while shifting key transposition deadlines. For companies operating in France – whether as French-registered entities, EU subsidiaries of non-EU groups, or foreign businesses with significant French market exposure – understanding how these revised rules interact with France's existing devoir de vigilance framework is essential to managing legal and reputational risk before the new deadlines take effect. This guide sets out, step by step, what France-based businesses need to do now, what remains pending, and where the most common errors arise.

France in Context: Why This Jurisdiction Requires Particular Attention

France occupies a distinctive position in the European supply-chain due diligence landscape. The Loi de vigilance (Law No. 2017-399) has required large French companies to publish and implement a plan de vigilance since 2017, predating the CSDDD by several years. This means French companies and their counsel have developed operational experience that many peer-jurisdiction businesses lack – but it also means that the interaction between the existing national regime and the incoming EU framework creates genuine complexity.

The AMF and ACPR both play a role in monitoring sustainability-related disclosures for listed and regulated entities respectively. Enforcement of the Loi de vigilance runs through the civil courts, and the Cour de cassation has confirmed that the injonction de faire mechanism – not the injonction de payer – is the appropriate remedy for compelling a company to establish or update its vigilance plan. Foreign groups with French subsidiaries should note that French courts have shown willingness to assert jurisdiction over parent-level due diligence obligations where the French operating entity forms part of the relevant supply chain.

What Omnibus I Actually Changed: The Revised Thresholds

Before mapping out the procedural steps, it is worth being precise about what Omnibus I altered, because the scope reduction is significant and directly affects whether a given company falls within the CSDDD regime at all.

• CSRD (reporting): Under Omnibus I, mandatory sustainability reporting is now limited to EU undertakings with more than 1,000 employees and more than EUR 450 million in net turnover. For non-EU groups, the trigger is more than EUR 450 million in EU turnover combined with an EU subsidiary or branch exceeding EUR 200 million.
• CSDDD (due diligence): The substantive supply-chain due diligence obligations under the CSDDD are subject to parallel revision. Member States must transpose the Omnibus I amendments to the CSDDD by 26 July 2028. Until that transposition is complete, the amended framework does not have direct effect in French domestic law.
• CSRD transposition deadline: Member States must implement the CSRD amendments by 19 March 2027.
• ESRS revision: The Commission is to revise the European Sustainability Reporting Standards (ESRS) by delegated act; the timing and content of that revision remain pending.

For in-scope businesses, the practical consequence is a two-track obligation: continued compliance with the existing French Loi de vigilance now, and phased preparation for the incoming CSDDD regime ahead of the 2028 transposition deadline.

Step-by-Step Procedure: Building a Compliant Supply-Chain Due Diligence Programme in France

Step 1 – Determine Whether You Are In Scope

The first task is a threshold analysis. Apply the Omnibus I criteria to your group structure: employee headcount, net turnover (EU and global), and the structure of any EU-facing subsidiaries or branches. French corporate law and the rules governing sociétés anonymes, sociétés par actions simplifiées and other vehicles affect how headcount and turnover are aggregated at group level. If your group sits close to the thresholds, document the analysis carefully, as regulatory and enforcement risk attaches to the decision itself.

For non-EU parent groups with a French holding company or operational subsidiary, the analysis must also consider whether the French entity independently triggers the Loi de vigilance threshold – a separate and currently applicable obligation that does not wait for CSDDD transposition.

Step 2 – Map the Value Chain

A compliant programme requires a documented map of the company's upstream and downstream value chain. In the French market context, this typically involves identifying Tier 1 and Tier 2 suppliers, subcontractors, and – where the business model requires – distributors and end-service providers. The plan de vigilance under existing French law already requires a risk-mapping exercise (cartographie des risques); companies that have maintained this document are well-placed to adapt it to the broader CSDDD framework.

Common errors at this stage include underestimating the reach of the "established business relationship" concept, failing to capture non-contractual supply arrangements, and treating the mapping exercise as a one-off rather than a living document subject to annual review.

Step 3 – Conduct Risk Identification and Prioritisation

Once the value chain is mapped, the next step is to identify actual and potential adverse impacts on human rights and the environment. The CSDDD framework, when transposed, will require companies to prioritise high-severity, high-probability risks for action. French practice under the Loi de vigilance already employs a risk-severity matrix; aligning this with the forthcoming CSDDD methodology will reduce duplication of effort.

Sector-specific guidance from French regulatory bodies and industry associations can inform the risk identification process, particularly for companies in manufacturing, agri-food, logistics, and financial services – all of which are prominent in the French economy and subject to heightened scrutiny from both the AMF (for listed entities) and civil society organisations.

Step 4 – Design and Implement Prevention and Remediation Measures

Identified risks must be addressed through concrete contractual, operational, and governance measures. This includes supplier codes of conduct, contractual due diligence clauses, on-site audit rights, and grievance mechanisms accessible to affected parties. Under the CSDDD framework, companies will also need to establish or participate in industry-level grievance and notification mechanisms.

Particular attention should be paid to corporate governance: the board or supervisory body must be shown to have oversight of the due diligence programme. For French sociétés anonymes with a two-tier board structure, responsibility for signing off on the plan de vigilance – and, prospectively, the CSDDD programme – typically falls to the conseil d'administration or directoire. Documenting board-level engagement is not merely good governance; it is a defence against liability claims.

Step 5 – Integrate with Reporting Obligations

For companies above the revised CSRD thresholds, the due diligence programme must feed into sustainability reporting. France has historically applied the Non-Financial Reporting Directive through the déclaration de performance extra-financière (DPEF), and the transition to the new CSRD reporting format – once transposed by 19 March 2027 – will require alignment between the DPEF successor report and the due diligence documentation. Gaps between the two create audit risk, particularly where a commissaire de justice or statutory auditor is reviewing the disclosure.

Companies considering a structural review – including company re-domiciliation, the creation or restructuring of a French holding company, or changes to beneficial ownership arrangements – should assess how such changes affect their scope categorisation and disclosure obligations before implementation. Restructuring that reduces a group's apparent French footprint without genuine substance changes may attract regulatory scrutiny.

If your group is reviewing its supply-chain compliance posture in light of Omnibus I, Ferraz & Whitmore can assist with scope analysis, programme design, and cross-border coordination. Please reach out at info@ferrazwhitmore.com or visit our contacts page.

Realistic Timelines and Cost Drivers

With the CSDDD transposition deadline set for 26 July 2028, companies might be tempted to treat this as a distant obligation. That assessment underestimates the lead time required. A credible due diligence programme – covering value chain mapping, risk assessment, supplier engagement, and governance integration – typically takes between 12 and 24 months to design and embed operationally in a mid-to-large group. Companies that delay until 2027 will find themselves in a compressed implementation window coinciding with the CSRD reporting transition.

Cost drivers vary considerably by group size, supply chain complexity, and the maturity of existing compliance infrastructure. The principal cost categories are:

• Value chain data gathering: Often the most resource-intensive phase, particularly for companies with extended or geographically dispersed supplier bases.
• Third-party auditing and certification: Supplier audits, whether conducted in-house or through specialist providers, represent a recurring rather than one-off cost.
• Legal and compliance advisory: Structuring contractual frameworks with suppliers, advising on liability exposure, and coordinating with local counsel in non-EU jurisdictions where key suppliers operate.
• Technology platforms: Supply chain risk management software is increasingly a baseline investment for in-scope companies; costs range widely depending on functionality and scale.
• Board and management training: Governance integration requires documented training for senior leadership, which carries both direct and opportunity costs.

Companies that have maintained a rigorous plan de vigilance under the existing French law will find that a portion of this investment is already made. For those that have treated the plan de vigilance as a compliance formality, the gap-closing exercise will be more significant.

Common Errors by Foreign Clients Operating in France

Several recurring errors arise when non-French businesses engage with supply-chain due diligence requirements in France. Awareness of these patterns can reduce both legal exposure and operational friction.

• Treating French and EU obligations as co-extensive: The Loi de vigilance is an existing, enforceable French law with its own scope thresholds, enforcement mechanisms, and judicial interpretation. It is not simply a domestic replica of the CSDDD, and it operates independently of the EU transposition timeline.
• Underestimating civil liability exposure: Unlike some EU Member States, France provides an explicit civil liability pathway for failure to establish or implement a plan de vigilance. NGOs and trade unions have standing to bring claims, and the courts have developed a growing body of case law on admissibility and substantive requirements.
• Failing to register a French-law holding company structure correctly: Groups that use a French holding company as the EU-facing entity for CSDDD purposes must ensure that beneficial ownership disclosures, corporate governance documentation, and intra-group supply chain agreements are consistent with the due diligence programme. Inconsistencies become apparent in regulatory reviews and litigation.
• Relying on group-level programmes without local adaptation: A parent-level due diligence programme drafted to English or German law standards will not automatically satisfy French requirements in terms of language, content, or the specific risk categories that French courts and regulators treat as material.
• Ignoring the ESRS revision risk: Because the Commission has yet to finalise the revised ESRS by delegated act, companies that lock in reporting formats now may face revision costs when the new standards are published. Building flexibility into the reporting architecture is advisable.

Decision Checklist: Are You Prepared?

The following checklist is intended as a practical prompt for in-house teams and external advisers conducting a readiness assessment. It is not exhaustive, and professional advice should be sought for any material compliance decision.

• Have you applied the Omnibus I thresholds to confirm whether your group is in scope for CSRD and CSDDD obligations?
• If in scope, does your group currently have a compliant plan de vigilance under the existing French Loi de vigilance?
• Has your value chain been mapped and risk-assessed within the last 12 months?
• Do your supplier contracts include adequate due diligence, audit, and remediation provisions?
• Is there documented board-level oversight of the due diligence programme?
• Have you assessed the impact of any recent or planned restructuring – including re-domiciliation or holding company changes – on your scope and disclosure obligations?
• Is your sustainability reporting infrastructure capable of accommodating the post-Omnibus I CSRD format ahead of the 19 March 2027 transposition deadline?
• Have you identified external advisers with French-law expertise to support enforcement response if needed?

Our corporate law practice in France covers the full range of supply-chain due diligence matters, from initial scope analysis through to enforcement response. Details are available on our France corporate law services page.

Interaction with Tax and Structural Considerations

Supply-chain due diligence and corporate tax planning intersect in ways that are not always immediately apparent. The location of a group's principal operating entity, the structure of intra-group service agreements, and the choice between branch and subsidiary in France all affect both the due diligence scope analysis and the underlying tax position. For groups considering restructuring in response to Omnibus I scope changes, it is important to ensure that tax and compliance workstreams are coordinated rather than pursued independently.

Our France tax law practice works alongside the corporate and regulatory teams to assess the combined impact of structural decisions, particularly where changes to beneficial ownership or group holding arrangements are under consideration.

For groups weighing location decisions more broadly – including comparisons with other major financial and holding company jurisdictions – our analysis of redomiciliation considerations between Singapore and Hong Kong illustrates the cross-jurisdictional framework we apply to such assessments.

Next Steps

The period between now and the 26 July 2028 CSDDD transposition deadline is not a waiting period – it is the window in which compliance programmes need to be designed, supplier relationships renegotiated, governance structures updated, and reporting frameworks aligned with the revised CSRD requirements. France's pre-existing Loi de vigilance means that enforcement risk is already live for in-scope companies.

Companies that act early will have more time to negotiate supplier contracts deliberately, build internal capacity, and respond to any preliminary AMF or judicial scrutiny from a position of documented good faith. Companies that wait until national transposition legislation is enacted will face compressed timelines and heightened scrutiny.

To discuss how the post-Omnibus I framework applies to your specific group structure and French operations, please contact our team at info@ferrazwhitmore.com or through our contacts page. We work with corporate counsel, compliance officers, and boards to develop practical, enforceable programmes that address both current French law obligations and the incoming EU requirements.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.