On February 26, 2026, the European Union published the long-awaited final text providing for the simplification of the Corporate Sustainability Due Diligence Directive (“CSDDD”) and the Corporate Sustainability Reporting Directive (“CSRD”) in its Official Journal, Directive (EU) 2026/470. Clients who have been seeking clarity on the parameters of these far-reaching and precedent-setting sustainability regulations can now prepare for them in earnest.
This client alert: (i) summarizes the substance of the final agreement on certain key provisions that were heavily negotiated for the CSDDD and CSRD; and (ii) explains the timelines for Member State transposition, upcoming delegated and implementing rules, and other key mandated Commission steps, including publication of Commission guidelines and model contract clauses.
The two key pieces of imminent Commission action for companies to track are likely: for CSRD, the final adoption of the European Sustainability Reporting Standards (“ESRS”) in Q2 this year; and for CSDDD, the Commission’s adoption of the first CSDDD Guidelines statutorily required by July 2027. The CSDDD Guidelines will be particularly important because they will provide more concrete guidance on operationalizing CSDDD compliance.
- Applicability Thresholds:
- For EU-incorporated companies: 5,000+ employees and over EUR 1.5 billion in net worldwide turnover (on a consolidated basis for EU ultimate parent companies of corporate groups).
- For non-EU incorporated companies: EUR 1.5 billion in net turnover generated in the EU (on a consolidated basis for non-EU ultimate parent companies of corporate groups).
- Timing:
- Transposition: Member States’ CSDDD transposition deadline has been pushed to July 26, 2028 (one year before CSDDD application starts).
- Application: In-scope companies must comply by July 26, 2029. The new amending Directive aligns all in-scope companies on a single 2029 application date (as opposed to the staggered application dates set out in the original CSDDD).
- Level of Harmonization: To reduce fragmentation and legal uncertainty, the final agreement further expands the harmonization requirement for Member States as they transpose CSDDD into national law. Harmonization now also covers the CSDDD obligations related to prioritization, monitoring due diligence measures, and reporting. However, the revised harmonization clause still leaves room for Member States to adopt additional due diligence obligations concerning specific products, services, or situations where the Member State seeks to achieve a different level of protection. Monitoring Member State transposition will therefore continue to be important.
- Changes to Due Diligence Obligations: The amended CSDDD preserves and further defines a risk-based approach to identifying and assessing adverse impacts across a company’s broader value chain. This includes all business partners within the “chain of activities,” rejecting proposals that would have fundamentally distinguished between direct and indirect partners. Key elements include:
- Risk Factors: When taking appropriate measures to identify and assess adverse impacts, companies must consider relevant risk factors. The CSDDD now provides a non-exhaustive list of these relevant risk factors, including:
- Whether business partners fall outside the scope of the CSDDD or are not covered by comparable mandatory sustainability due diligence laws;
- Geography and context, such as the level of law enforcement with respect to specific adverse impact types; and
- The context of the sector, level of business operations, and product or service in question.
- Risk Identification and Assessment Steps: Article 8 was the most heavily negotiated of the substantive due diligence obligations and now works as follows:
- Step One – Scoping Exercise: Companies must first carry out a “scoping exercise” based solely on reasonably available information, where the in-scope company must identify general areas across its own operations, those of its subsidiaries, and, where related to its chain of activities, those of its business partners where adverse impacts are most likely to occur and to be most severe.
- Step Two – In-Depth Assessment: Based on the results of their scoping exercise, companies must then carry out an in-depth assessment in the areas where adverse impacts were identified to be most likely to occur and most severe. Where adverse impacts are identified as equally likely to occur or equally severe in several areas, companies may prioritize assessing such areas which involve direct business partners.
- Value Chain Information Cap: For in-depth assessments in “Step Two” above, companies must only seek information from business partners where necessary and, for business partners with fewer than 5,000 employees, only when the information cannot reasonably be obtained by other means.
- Prevention and Remediation: In-scope companies are no longer required to terminate, as a last resort, their business relationships with business partners where adverse impacts have arisen, though complex suspension rules will still apply. If there is a “reasonable expectation” that a company’s enhanced prevention or corrective action plan will succeed, the mere fact of continuing to engage with the specific business partner will not expose the company to penalties or civil liability.
- Stakeholder Engagement: While the amended CSDDD narrows the definition of “stakeholders” (for example, consumers are no longer in scope), the definition of stakeholders with which companies must engage within the context of various due diligence obligations remains fairly broad. The circumstances in which relevant stakeholder engagement must be undertaken has been narrowed. For example, consultation is no longer required when deciding to suspend business relationships.
- Deletion of Climate Transition Plans: The amended CSDDD fully deletes the requirement to adopt or “put into effect” climate transition plans. However, the ESRS provisions on reporting climate transition plans are poised to be maintained, meaning companies that have such plans must continue to report on them under the CSRD in line with the ESRS.
- Civil Liability: The final agreement removes the mandatory EU-wide civil liability regime. Civil liability for CSDDD breaches remains subject to each Member State’s national rules and court procedures. However, Article 36 of the CSDDD provides for a review clause to assess the effectiveness of existing enforcement mechanisms by July 2031, and every five years thereafter, and, where appropriate, to accompany that review with a legislative proposal. This means that an EU-wide civil liability framework could be revisited in the future.
- Penalties: The Commission is responsible for issuing penalty-setting guidelines to assist supervisory authorities in determining the level of penalties in accordance with the CSDDD obligation that has been violated. While this guidance will instruct the CSDDD’s Supervisory Authority Network, Member States must ensure that the maximum cap of pecuniary penalties is set at 3% of a company’s net worldwide turnover (or for third-country ultimate parent companies, 3% of the net consolidated worldwide turnover calculated at the ultimate parent level).
- Forthcoming Commission Guidelines: The Commission must adopt extensive CSDDD implementation guidance that will directly shape compliance expectations, with materials due in various phases:
- By July 26, 2027: Guidelines on due diligence processes (including risk identification and prioritization, appropriate measures, and responsible disengagement), stakeholder engagement, available data sources, and digital tools and technologies. The Commission must also provide guidelines on model contractual clauses and guidance on the assessment of relevant risk factors at various levels.
- By July 26, 2028: Guidelines on resource- and information-sharing in line with trade-secret protection, protection from retaliation and retribution, and guidance for stakeholders engaging throughout the due diligence process.
- By March 31, 2029: The Commission shall adopt delegated acts setting forth the content and criteria for companies that publish annual website statements under the CSDDD reporting obligation because they are not exempted by virtue of their CSRD reporting.
- Applicability Thresholds:
- For EU companies: 1,000+ employees and a net turnover of EUR 450 million, with numbers consolidated for EU-incorporated (intermediate) parent companies. For EU companies, reporting starts for FYs that begin in 2027 (with reports due in 2028/29).
- For non-EU ultimate parent companies: Third-country ultimate parent companies generating EUR 450 million net turnover within the EU, with an EU subsidiary or branch that has more than EUR 200 million in net turnover. For these companies, reporting starts for FYs beginning in 2028 (with reports due in 2029/30).
- Exemption for certain financial holding companies: The final agreement exempts from direct reporting requirements “financial holding” companies that have the sole purpose of acquiring and managing shares in other companies, without directly or indirectly being involved in the management of those companies. The subsidiaries of those companies may have reporting requirements, if they meet the applicability requirements in their own right.
- Transition relief: Member States have the option to exempt “Wave 1” companies required to report under the CSRD from reporting in FY 2025 and FY 2026.
- Timing:
- Member States have until March 19, 2027, to transpose the CSRD and Audit Directive changes.
- Audit and Assurance: While reasonable assurance of sustainability reports is no longer required, limited assurance requirements are maintained. The Commission is required to adopt harmonized limited assurance standards by July 1, 2027, to allow adequate time to develop these standards. Additionally, the Audit Directive introduces simplified auditor registration requirements for a transitional period from 2025 to 2030, and an exemption from supervision for third-country auditors and audit entities issuing assurance reports.
- ESRS (“European Sustainability Reporting Standards”): The Commission is tasked with formally adopting revised and streamlined ESRS in a delegated act within six months after entry into force of the amended CSRD. On December 3, 2025, the European Financial Reporting Advisory Group (“EFRAG”) sent the Commission its technical advice on draft simplified ESRS. EFRAG’s guidance preserves the CSRD’s distinct double materiality assessment (albeit streamlined), reduces the total number of data points, introduces flexibility for data collection and the use of estimates, increases interoperability, and introduces the option of a top-down approach to materiality assessments. The Commission is not required to follow EFRAG’s technical advice, but we expect it will closely follow it.
- Value Chain Information Cap: Companies reporting under the CSRD are not allowed to request information from companies with an average of less than 1,000 employees, beyond what is required under the voluntary reporting standard for non-listed micro, small and medium enterprises (“VSME”). This cap will only apply to information requests for CSRD reporting purposes, and not to other commercial information exchanges. Within 4 months of this Directive entering into force, the Commission will adopt a delegated act providing voluntary reporting standards for undertakings protected by the information value chain cap.
- Taxonomy Reporting: As in the current CSRD, only companies within the proposed scope of CSRD reporting will be required to report under Article 8 of the Taxonomy Regulation. The Commission’s proposed option to report on partial Taxonomy alignment was deleted from the final text.
* * *
If you have any questions concerning the material discussed in this post, please contact the members of our Sustainability/Environmental, Social, and Governance (ESG) practice.
Back
