What is corporate sustainability due diligence?
Corporate sustainability due diligence is how a company finds and addresses harm to people or the environment. It starts where harm is most likely and severe.
Under the EU Corporate Sustainability Due Diligence Directive (CSDDD), companies must set a policy, assess risks, prevent likely harm, correct actual harm, provide remediation, involve affected people, handle complaints, monitor results, and communicate publicly (Article 5 and Articles 7-16). Remediation means restoring people or the environment as close as possible to their position before the harm.
Why does corporate sustainability due diligence matter to you?
You may receive a question even when your company is not directly covered. For an in-depth assessment, Article 8(2a) lets an in-scope company ask only for information it needs. If your company has fewer than 5,000 employees, the in-scope company may ask only when it cannot reasonably obtain the information elsewhere.
A questionnaire is a customer request. A contract may separately require an answer. Neither transfers the customer's duty to assess the risk and decide what to do.
The German Supply Chain Due Diligence Act (LkSG) is already in force. Since 2024, it has covered companies with at least 1,000 employees in Germany. Sections 3-10 require risk management, analysis, prevention, corrective action, complaints, and documentation. BAFA's supplier guidance says covered companies keep their own duties.
How does corporate sustainability due diligence work?
- Set responsibility: adopt a policy, assign decision-makers, and state what it covers.
- Assess harm: find where harm is most likely and severe, then examine those areas.
- Act: prevent potential harm, correct actual harm, and provide remediation where required.
- Check: hear affected people, maintain complaints channels, monitor measures, and communicate results.
Connect documents to the named risk, entity, site, worker group, and period. A policy shows intent; operating records show whether a control worked.
What mistakes should you avoid?
- Saying "not legally in scope" without checking a specific customer request or contractual requirement.
- Treating a questionnaire as a legal duty, or accepting a blanket clause that transfers the customer's whole due diligence duty.
- Sending a broad policy when the question concerns a specific risk, site, worker group, material, or period.
- Claiming "no risk" because no incident was reported or an audit certificate exists.
Is the CSDDD already mandatory?
The directive has been in force since 25 July 2024 and was amended by Directive (EU) 2026/470. EU countries must transpose it by 26 July 2028 and apply national measures from 26 July 2029. Public communication starts for financial years from 1 January 2030. The main scope test is more than 5,000 employees and more than EUR 1.5 billion in net worldwide turnover for an EU company, or more than EUR 1.5 billion in EU turnover for a non-EU company. An ultimate parent company can also be covered when its consolidated group meets the relevant threshold. Qualifying franchise and licensing arrangements have separate tests. The European Commission confirms the amended timetable.
Does the CSDDD apply directly to every supplier?
No. A supplier is covered only if it meets the directive's employee and turnover test, EU-turnover test, or franchise and licensing tests. Otherwise, it may receive a customer request or have a contractual requirement. The covered customer remains responsible.
How is the CSDDD different from the LkSG?
The CSDDD is an EU directive that countries must put into national law for application from 2029. The LkSG is German law already in force. Their processes overlap, but their scope, risk definitions, and legal tests are not interchangeable.
Is due diligence the same as sustainability reporting?
No. Due diligence is the process of finding and addressing harm. Reporting communicates what a company found and did. A report without the underlying decisions, actions, and checks is not due diligence.