What Omnibus I Actually Changed (and What It Didn’t)

The amended Corporate Sustainability Due Diligence Directive was published on 26 February 2026 and enters into force on 18 March 2026, closing a bruising political fight. Transposition into member-state law runs to 26 July 2028, with obligations applying from a single date — 26 July 2029, phasing abolished.

Provision Original CSDDD (2024) After Omnibus I (2026)
Scope Phased: 1,000+ employees / €450M+, plus high-impact sectors Single test: 5,000+ employees and €1.5B worldwide turnover (non-EU: €1.5B EU turnover, no employee test)
Climate transition plans Adopt and implement Paris-aligned plans Deleted entirely (CSRD ESRS E1 disclosure unaffected)
Civil liability Harmonised EU regime; NGO/union representative actions Removed — national law applies, with a right to full compensation; no EU-wide representative actions
Monitoring cadence At least every 12 months At least every 5 years, plus on significant change
Fines Floor of “not less than 5%” of turnover Capped at no more than 3%
SME burden Uncapped requests downstream Information requests capped at VSME-standard data
Value-chain mapping Comprehensive Risk-based scoping exercise

Do not misread deregulation as disappearance. The core duty survived intact: risk-based human rights and environmental due diligence across the chain of activities, aligned with the OECD six-step framework. Roughly 6,000 companies remain directly in scope — and their expectations cascade contractually to tens of thousands of suppliers who will never see a regulator. If you sell into a large EU value chain, this guide is about you regardless of headcount.

Pair with CSRD and EU Omnibus, ESG Reporting Frameworks, ESG Materiality, and Scope 3.

Step 1: Run the Scoping Exercise (Not a Map-Everything Project)

Omnibus I replaced comprehensive mapping with an explicit risk-based scoping exercise. Operate it as a scored triage, updated on significant change:

  1. Segment the chain by activity and geography: own operations, subsidiaries, direct suppliers, and — for high-risk categories — deeper tiers where leverage or severity demands it.
  2. Score severity × likelihood per segment: child labour, forced labour, unsafe conditions, water stress, deforestation, hazardous substances. Use country-sector indices plus your own incident and audit history — not gut feel.
  3. Rank and draw the line. In-depth assessment concentrates where severity is highest; low-risk segments get lighter-touch monitoring with documented rationale. The scoping memo is the audit artifact — an assessor or regulator asks why a segment got light treatment, and “we ran out of time” fails while “scored low on severity and likelihood with these sources, reviewed [date]” passes.
  4. Re-scope on triggers: new country, new commodity, M&A, substantiated complaint, or regulatory change — not just on the five-year clock.

File the methodology, sources, and review sign-off with the same discipline as Month-End Close binders: who scored, when, with what data, reviewed by whom.

Step 2: Standardize Supplier Questionnaires (VSME-Capped by Design)

The Omnibus caps what you may demand of SME suppliers at VSME-standard data — design the questionnaire to that ceiling once, then use it everywhere:

  • Company basics + workforce profile: headcount bands, contract vs permanent mix, use of agencies or migrant labour channels.
  • Policy existence (not essays): human-rights policy, health-and-safety procedures, environmental permits — “attach or link,” not “describe in 500 words.”
  • Incident and grievance data: recorded incidents in 24 months, open corrective actions, whether workers have an accessible complaint channel.
  • Environmental footprint basics: energy, water, waste, and hazardous-substance handling relevant to the purchased category — scaled to what the supplier can actually measure.
  • Certifications held (with validity dates and scope), treated as inputs, never as verdicts — certificates reduce sampling, they do not replace it.

Tier depth by scoping score: VSME-light for low-risk indirect spend, full questionnaire plus evidence for high-risk direct suppliers. Validate a sample every cycle (site visits for the top tier, document review below), because self-assessments without verification measure form-filling skill. Track response rates, overdue follow-ups, and refusal patterns as KPIs — systematic non-response from one region or category is itself a risk signal. Coordinate supplier onboarding checks with Vendor Due Diligence so financial, security, and sustainability reviews share one vendor file instead of three.

Step 3: Write Contracts That Permit Auditing (Before You Need Them)

Audit rights negotiated after a finding are worthless. Every high-risk supplier agreement should carry:

  • Right to audit and inspect, including unannounced visits within reason, access to relevant records and workers, and flow-down to critical sub-suppliers.
  • ESG representations and warranties tied to specific standards (no child/forced labour, permit compliance, hazardous-substance controls), not boilerplate “complies with all laws.”
  • Corrective-action machinery: notice, time-bound remediation plan, verification re-audit, and — crucially — support before termination: the directive expects engagement and remediation first, disengagement as last resort with documented justification.
  • Data and reporting duties: incident notification windows, annual self-assessment delivery, and cooperation with grievance investigations.
  • Commercial linkage: sustained non-cooperation after support triggers volume reduction or exit — without this, audit rights are advisory.

Review templates against Procurement Fraud segregation (requester ≠ approver of ESG waivers) and file executed versions where the close binder lives — auditors and acquirers ask for them in diligence.

Step 4: Build Grievance Mechanisms People Actually Use

A hotline nobody trusts is a disclosure liability, not a control. Design for the complainant, not the org chart:

  1. Accessibility: local language, multiple channels (phone, web, in-person via trusted intermediaries), no retaliation — ever — with the prohibition enforced visibly when tested.
  2. Triage within days: acknowledge fast, assess severity, assign an investigator outside the implicated chain. Accounting-related complaints route through Whistleblower procedures; HR and environmental complaints need equally independent paths.
  3. Track to remediation, not to closure-by-fatigue: every complaint gets an owner, a due date, and a verified outcome — apology, compensation, process fix, contract action. Report themes (never identities) to the audit committee quarterly — see Audit Committee.
  4. Test it: anonymous test complaints yearly. A mechanism with zero complaints across a high-risk supply base is evidence of failure, not success.

Step 5: Run Remediation Like an Audit Finding

Substantiated impacts get the same treatment as control deficiencies: root-cause analysis (why did scoping, questionnaires, or audits miss it?), corrective action with owner and date, verification that the fix held, and — where harm occurred — remediation to affected people, not just process tweaks. Document the proportionality judgment explicitly for any decision to suspend rather than terminate: what was tried, over what period, with what supplier response. Regulators and courts will read this file; “commercially inconvenient to exit” is not the documented standard — attempted remediation with evidence is.

Monitor effectiveness on the five-year cycle at minimum, annually in practice for high-risk segments, and immediately on trigger events. Tie the review calendar to Compliance Checklist and Enterprise Risk reporting so due diligence lives in governance, not in a sustainability silo.

Downstream Impacts Most Programs Miss

CSDDD runs both directions. Upstream gets the attention; downstream impacts — product misuse, discriminatory AI outcomes, hazardous chemical exposure in use and disposal — need the same scoping logic. Map where your products cause or contribute to harm downstream: instructions and warnings adequacy, misuse foreseeability, end-of-life handling. Link AI-product diligence to AI Governance Evidence Pack practices — model risk review is downstream due diligence for AI vendors — and chemical/product risk to Carbon and Scope 3 evidence where environmental overlap exists.

CSDDD builds the system; CSRD reports on it. The ESRS value-chain disclosures, material IROs, and — separately — transition-plan disclosures under ESRS E1 all draw on the same evidence base: scoping memos, assessment files, remediation logs. Build one dictionary and file two ways (see the interoperability playbook in IFRS S1/S2 vs GRI vs ESRS). The fastest assurance failures in 2027–2028 will be CSRD statements describing due diligence that the CSDDD file cannot evidence — align both workstreams under one owner now, with the 26 July 2029 application date as the hard backstop and 2026–2028 as the build window.

FAQ

Do SME suppliers have direct CSDDD obligations?

Generally no — the thresholds target very large companies. But expectations cascade contractually: questionnaires, audit rights, and corrective-action demands flow down regardless of headcount, capped at VSME-standard data requests.

What happens if we find child labour at a critical supplier?

Follow the remediation sequence: engage, demand time-bound correction with verification, support capacity where appropriate, and reserve suspension or termination for persistent failure — documenting each step. Immediate termination without attempted remediation is itself a defensible-position risk.

Can certifications replace our own assessments?

No. Certificates are inputs that can reduce sampling intensity, but the duty to assess, verify, and remediate stays with the in-scope company. Treat a certificate-only file as an unassessed supplier.

Next Steps

  1. Confirm in-scope status under the new thresholds (5,000 staff + €1.5B turnover, or €1.5B EU turnover for non-EU groups) with counsel, and calendar transposition (July 2028) and application (July 2029).
  2. Run the first scoping exercise this year — methodology memo, scored segments, review sign-off — even though enforcement is years out; the file compounds in value.
  3. Stand up the VSME-capped questionnaire, contract audit clauses, and grievance channel as one program, not three projects, with a single owner reporting to the audit committee.