CSDDD: kas patenka į taikymo sritį ir ko reikalaujama?

The Corporate Sustainability Due Diligence Directive (CSDDD), Directive (EU) 2024/1760, obliges the largest companies on the EU market to identify, prevent and end adverse human rights and environmental impacts in their own operations and their chain of activities. Since the Omnibus I amendments of February 2026 it applies only to EU companies with more than 5,000 employees and over €1.5 billion net worldwide turnover, and to non-EU companies with over €1.5 billion net turnover in the EU, from 26 July 2029.

Smaller companies are not addressees, but they will feel the CSDDD through contracts with in-scope customers. This article explains the current scope, the duties, enforcement and liability, and the Dutch implementation through the draft Wet internationaal verantwoord ondernemen (Wivo).

Kas yra CSDDD?

The CSDDD is a conduct rule, not a reporting rule: it tells companies what to do about the risks they find. The Corporate Sustainability Reporting Directive (CSRD) tells them what to disclose.

The Directive codifies the due diligence standard of the OECD Guidelines for Multinational Enterprises and the UN Guiding Principles on Business and Human Rights. It was published in the Official Journal on 5 July 2024. Directive (EU) 2025/794 (the “stop-the-clock” directive) then postponed its dates, and Directive (EU) 2026/470 (Omnibus I), published on 26 February 2026, rewrote its scope and content.

The CSDDD is an obligation of means, not a guarantee of a clean value chain. The company must take appropriate measures: measures that can achieve the aim and are reasonably available, given its influence over the party causing the harm.

What did Omnibus I change in 2026?

Omnibus I narrowed the scope to one tier, introduced a risk-based two-step assessment, removed the EU civil liability regime and the duty to adopt a climate transition plan, and capped fines at 3 percent of turnover. Compliance plans made under the 2024 text need revisiting.

• Scope: the staggered thresholds of 5,000, 3,000 and 1,000 employees are gone; one threshold and one application date (26 July 2029) remain.
• Assessment: first a general scoping exercise based on reasonably available information, then an in-depth assessment only in the areas where impacts are most likely and most severe.
• Civil liability: the harmonised EU right of action was deleted; claims now run under national tort law.
• Climate: the CSDDD no longer requires a transition plan; CSRD reporting on an existing plan can still apply.
• Penalties: Member States must cap fines at 3 percent of net worldwide turnover.

Which companies fall within the scope?

An EU company is in scope if it had on average more than 5,000 employees and over €1.5 billion net worldwide turnover. A non-EU company is in scope if it generated over €1.5 billion net turnover inside the EU; its headcount is irrelevant.

The figures are measured on a consolidated basis for the ultimate parent. A Dutch holding company therefore counts the companies it consolidates, and the entity that carries the obligation is not always the operating company where the risk sits.

Regulated financial undertakings remain in scope for their own operations and upstream chain, but their financial services to clients are outside the due diligence duty.

What must an in-scope company do?

The Directive requires a cycle: policy, identification, prevention and remediation, a complaints procedure, monitoring and reporting. A supervisor will test that cycle as a whole.

The company integrates due diligence into its policies and risk management and adopts a due diligence policy with a code of conduct. It then runs the scoping exercise and the in-depth assessment, and records why it prioritised certain areas, because that choice is what will be examined later.

Potential impacts must be prevented and actual impacts ended, with a graduated response: a corrective action plan, contractual assurances backed by verification, support for the business partner and adjustment of the company’s own purchasing practices. Suspending or ending the relationship is the last step. Our articles on tiekėjų elgesio kodeksai bei ESG sąlygų rengimas sutartyse explain the contractual side.

Affected people, trade unions and civil society organisations must have access to a notification and complaints procedure. The company monitors its measures periodically and reports publicly, unless its CSRD sustainability statement already covers this. Where it caused an actual impact, it must provide remediation.

How is the CSDDD enforced?

Each Member State designates a supervisory authority that can investigate, order a company to stop an infringement, require remedial action and impose penalties. The maximum fine is 3 percent of net worldwide turnover.

The authorities cooperate in a European network. Publication of a decision finding an infringement is also a possible measure, which for a listed group can weigh more heavily than the fine itself.

Who is liable for damage in the value chain?

Since Omnibus I, liability towards victims is a matter of national law. In the Netherlands a claimant relies on tort (onrechtmatige daad) under Article 6:162 of the Dutch Civil Code (BW), or brings a collective action under the WAMCA.

The claimant must prove an unlawful act, attributability, damage and causation in the ordinary way. The Directive and the company’s own due diligence file then serve as evidence of what a reasonable company should have known and done. A well-kept file is both a compliance duty and a defence.

Directors are affected indirectly. Under Article 2:9 BW a director owes the company proper performance of duties, and personal liability towards third parties can arise where a serious personal reproach can be made. See our articles on direktorių atsakomybė bei direktorių atsakomybė už Nyderlandų BV direktorius.

How does the Netherlands implement the CSDDD?

The Netherlands transposes the Directive through the draft Wet internationaal verantwoord ondernemen (Wivo). The draft designates the Netherlands Authority for Consumers and Markets (Autoriteit Consument en Markt, ACM) as supervisory authority.

A first draft was consulted on in 2024, and work on it was revised after Omnibus I. The transposition deadline is 26 July 2028, and the final Dutch text still has to pass parliament. Because Omnibus I fully harmonised the core due diligence rules, there is little room for a stricter Dutch regime on top of the Directive.

What should you check as an in-scope company?

• Whether the group meets the thresholds on a consolidated basis, with the calculation recorded.
• Which legal entity carries the obligation and which board member is accountable.
• Whether your scoping exercise and prioritisation are documented.
• Whether your supplier contracts contain proportionate information, audit and remediation clauses that will still run in 2029.
• Whether your CSDDD data and your CSRD reporting use the same sources.

Į ką turėtumėte atkreipti dėmesį kaip tiekėjas?

• Whether the information your customer requests is necessary and proportionate; from partners with fewer than 5,000 employees, information may only be requested in the in-depth assessment if it cannot reasonably be obtained otherwise.
• The audit rights, unilateral termination triggers and indemnities in the proposed ESG clauses.
• Who your own critical suppliers are and where they operate.
• Whether you have a short code of conduct and a channel for reporting problems.
• What your bank or investors ask for in sustainability information before financing.

What can we do for you with the CSDDD?

Mūsų įmonių teisininkai advise Dutch and international companies on the Directive and its contractual effects.

• We determine whether your group is in scope and record the calculation.
• We draft or review your due diligence policy and code of conduct.
• We draft and negotiate CSDDD and ESG clauses in supplier and customer agreements.
• We assess a customer’s information request and draft a proportionate response for you as a supplier.
• We advise the board on governance and directors’ liability in the value chain.

Santrauka

• The CSDDD applies from 26 July 2029 to EU companies with more than 5,000 employees and €1.5 billion turnover, and to non-EU companies with €1.5 billion EU turnover.
• Omnibus I (Directive (EU) 2026/470) introduced a two-step risk assessment and removed the EU civil liability regime and the climate plan duty.
• Fines are capped at 3 percent of net worldwide turnover; in the Netherlands the ACM is to supervise under the draft Wivo.
• Suppliers below the thresholds meet the CSDDD through contracts, but can push back on disproportionate information requests.

Dažnai užduodami klausimai