CSDDD Omnibus: 2026-2031 timeline and what suppliers will be asked

What does the CSDDD Omnibus change compared with the 2024 text?

It keeps the directive for the largest groups only, replaces three application waves with a single date and lightens several duties. Three texts followed one another:

The groups still in scope are those that, under the 2024 text, would have applied the directive from 26 July 2027: they gain two years. Our supply chain due diligence page compares both texts article by article; here are five changes that get less attention:

• Thresholds over two years. The directive applies only when the thresholds are exceeded in two consecutive financial years (Article 2, paragraph 5).
• Harmonisation. For the core duties, from risk identification to reporting, a Member State cannot depart from the EU text in its transposing law (Article 4).
• Civil liability. The EU-specific regime is gone (recital 49). Liability falls under national law, with full compensation but no punitive damages, and stays joint and several where damage is caused together with a business partner (Article 29).
• Climate. The duty to adopt a climate transition plan (Article 22) has been deleted.
• Penalties and reporting. The cap on pecuniary penalties is set at 3% of net worldwide turnover, against at least 5% before (Article 27). Companies already reporting under the CSRD publish no separate due diligence statement (Article 16).

What is the CSDDD timeline up to 2031?

No duty applies to groups before 26 July 2029, but the Commission and Member States have interim deadlines that will set the wording of your contracts.

According to recital 46 of Directive (EU) 2026/470, the two-year gap between the guidelines and application gives groups time to take them on board. The first review will assess whether to extend the scope to companies with more than 1,000 employees and EUR 450 million, and to high-risk sectors: today's scope is not final.

Who does the CSDDD Omnibus affect, and how?

Directly, very few companies; indirectly, every supplier of the groups in scope. It covers EU companies with more than 5,000 employees and more than EUR 1.5 billion net worldwide turnover, and non-EU companies with more than EUR 1.5 billion net turnover in the EU. The competent Member State is the one where the group has its registered office (Article 2, paragraph 6).

Exporters in Morocco, Africa and the Middle East

An automotive parts maker in Tangier, a garment exporter in Egypt or a cocoa processor in Ghana is almost never in scope itself. It is a "business partner" of a group in scope, and three rules of the consolidated text change what it will receive:

• Narrower requests. The group first carries out a scoping exercise "based solely on reasonably available information". It may then request information only where necessary and, from a partner with fewer than 5,000 employees, only when it cannot reasonably obtain it otherwise (Article 8(2a)).
• One rulebook across the EU. Harmonised core duties mean a single evidence file can serve all your EU customers, whatever their country.
• Liability clauses to review. Joint and several liability for damage caused together pushes groups to tie suppliers down by contract; have these clauses checked by your lawyer.

Traceability data falls under other laws: see our brief on the EU Deforestation Regulation.

What will your EU customers ask, and when?

Few new CSDDD-based requests before July 2027, then revised contracts, then evidence. The requests you receive today mostly come from customers' purchasing policies and from CSRD-related ESG data: our page on ESG questionnaires, CSRD and VSME sets out their limits.

• After 26 July 2027. Once the guidelines and model clauses are out, expect renegotiated codes of conduct and due diligence clauses, and questions about public sources on your company: certifications, audit reports, industry schemes.
• Around 26 July 2028. National laws set penalties and supervisory authorities.
• From 26 July 2029. In-depth assessments of high-risk areas, action plans, verification, access to the complaints procedure, then monitoring at least every five years and after any significant change (Article 15).

What should suppliers do now?

1. In the first quarter of 2027: identify the customers concerned. List your EU customers with more than 5,000 employees and EUR 1.5 billion, and the country of their registered office.
2. During 2027: map your own risks. Sites, agency labour, subcontractors and tier 1 suppliers, by country, sector and raw material.
3. From 26 July 2027: read the Commission's texts. Compare the model clauses with the codes of conduct you have signed and prepare your proposed changes.
4. Before 26 July 2028: follow transposition. Watch the law of your main customers' countries, especially penalties and liability.
5. Before 26 July 2029: be ready to prove. An indexed social and environmental evidence file, a corrective action plan, a grievance mechanism with a log.
6. In 2031: watch the review. A wider scope would multiply your customers in scope.

To discuss the clauses or questionnaires you are receiving, contact us.