EU Due Diligence Rules Now Bind Your U.S. Supply Chain

Scope of This Guide

This guide addresses the European Union's Corporate Sustainability Due Diligence Directive (CSDDD), approved by the European Council on May 24. It applies to U.S. companies meeting specific revenue and employee thresholds when operating in EU markets or through EU-based subsidiaries.

Included:

• Due diligence requirements for human rights and environmental impacts
• Phased implementation timeline (2027-2029)
• Climate transition planning obligations
• Supply chain mapping and third-party oversight
• Notification mechanisms and complaints procedures

Excluded:

• Corporate Sustainability Reporting Directive (CSRD) disclosure requirements
• Sector-specific environmental regulations
• Non-EU market sustainability frameworks

Key Concepts and Definitions

Chain of Activities: The full spectrum of your operations from upstream production and service provision through downstream distribution, transport, and storage. This includes business partners connected to your products or services.

Adverse Impact: Actual or potential harm involving human rights violations (such as child labor) and environmental damage (like biodiversity loss).

Meaningful Engagement: Ongoing dialogue with stakeholders throughout your due diligence process. The CSDDD requires continuous consultation with workers, communities, trade unions, and civil society organizations.

Remediation: Restoring affected persons, communities, or environments to their pre-impact state. This involves substantive restoration, not just compensation.

Notification Mechanism: A publicly accessible channel distinct from your internal whistleblower system, enabling any impacted person or organization to report environmental and human rights harms.

Requirements Breakdown

Phase 1: 2027 Application

Threshold: EU companies and group parent companies with 5,000 employees and €1,500 million in global turnover.

Core obligations:

• Conduct risk-based assessments identifying actual and potential adverse impacts
• Develop and publish a due diligence policy
• Map your entire chain of activities
• Implement prevention and mitigation strategies
• Establish a notification mechanism
• Review assessments annually

Phase 2: 2028 Application

Threshold: Companies with 3,000 employees and €900 million global turnover.

Same core obligations as Phase 1, with an additional year to prepare.

Phase 3: 2029 Application

Threshold: Companies with 1,000 employees and €450 million global turnover.

Additional requirements:

• EU and non-EU franchisors/licensors where royalties exceed €22.5 million and turnover exceeds €80 million
• Annual statement on due diligence processes (if not already subject to CSRD)
• Climate transition plan with time-bound targets

Climate Transition Plan Requirements

Your transition plan must align with the Paris Agreement's 1.5°C warming limit and the climate neutrality targets in Regulation (EU) 2021/1119.

Mandatory elements:

• Assessment of exposure to coal-, oil-, and gas-related activities
• Time-bound targets for 2030 and in five-year intervals through 2050
• Targets based on conclusive scientific evidence
• Scope 1, Scope 2, and Scope 3 greenhouse gas emission reduction targets (where appropriate)

Implementation Guidance

Step 1: Conduct a Threshold Analysis (Q1 2025)

Calculate whether your organization meets employee and revenue thresholds for any phase. Include all EU subsidiaries and assess whether your U.S. parent company's activities trigger in-scope status through EU operations.

Step 2: Map Your Chain of Activities (Q2-Q4 2025)

Start with tier-one suppliers and work upstream. Document:

• Direct suppliers and their geographic locations
• Sub-tier suppliers for critical components or high-risk categories
• Distribution partners and logistics providers
• Franchisees and licensees (if applicable)

Use a risk-based approach. Identify where high-risk activities occur, such as in extractives, textiles, agriculture, and electronics manufacturing.

Step 3: Develop Your Due Diligence Policy (Q1 2026)

Convene a cross-functional working group including procurement, legal, compliance, sustainability, operations, and senior leadership. Your policy must address:

• How you'll identify adverse impacts across your chain of activities
• Prevention measures for potential harms
• Mitigation and cessation strategies for actual harms
• Stakeholder engagement protocols
• Remediation procedures

Step 4: Build Your Notification Mechanism (Q2 2026)

This cannot be your existing ethics hotline. The CSDDD requires a publicly accessible channel where external parties can report harms. Design it to:

• Accept submissions in multiple languages relevant to your supply chain
• Provide acknowledgment of receipt
• Offer timely follow-up
• Explain whether complaints are founded or unfounded
• Detail remedial actions taken

Step 5: Establish Assessment Cadence (Q3 2026)

Annual reviews are mandatory, but high-risk operations require more frequent monitoring. Create a calendar that includes:

• Quarterly supplier audits for high-risk categories
• Annual comprehensive chain-of-activities reviews
• Triggered assessments when entering new markets or onboarding new suppliers
• Stakeholder engagement sessions (at minimum, annually per region)

Step 6: Integrate with Existing Frameworks (Ongoing)

If you're already working within the COSO ERM Framework, embed CSDDD obligations into your risk identification and assessment processes. Map CSDDD requirements to existing controls:

• Supplier qualification procedures enhanced with human rights and environmental criteria
• Contract management including CSDDD compliance clauses and audit rights
• Incident response protocols expanded to cover adverse impact remediation
• Board reporting with added CSDDD compliance metrics

Common Pitfalls

Treating this as a sustainability initiative rather than a compliance mandate: The CSDDD carries fines up to 5% of global net turnover for violations. This sits with your compliance function, not just your ESG team.

Limiting due diligence to tier-one suppliers: The directive explicitly covers your entire chain of activities. A child labor violation at a tier-three supplier in your electronics component supply chain creates liability for your company if you failed to conduct appropriate due diligence.

Creating a notification mechanism that mirrors your whistleblower hotline: External stakeholders need access. If an affected community member in Southeast Asia can't easily report environmental harm in their language, you're not compliant.

Assuming "best efforts" on climate transition means optional: While the CSDDD uses "best efforts" language for Paris Agreement alignment, it mandates the transition plan itself. You must document your approach and targets, even if achieving 1.5°C alignment proves difficult.

Failing to document stakeholder engagement: "Meaningful engagement" requires evidence. Maintain records of consultations, how you incorporated feedback, and why you rejected certain suggestions. Regulators will ask.

Treating remediation as financial settlement: The directive defines remediation as restoration to the pre-harm state. Money alone rarely satisfies this standard. You need plans for environmental restoration, community rehabilitation, or worker reinstatement.

Quick Reference Table

Element	Requirement	Deadline	Documentation
Risk Assessment	Identify actual and potential adverse impacts across chain of activities	Annual minimum (Q1 recommended)	Assessment reports, risk registers, stakeholder input
Due Diligence Policy	Comprehensive policy covering identification, prevention, mitigation, remediation	Before first compliance phase	Board-approved policy document
Notification Mechanism	Publicly accessible reporting channel for external parties	Before first compliance phase	System documentation, multilingual access, response protocols
Stakeholder Engagement	Meaningful consultation with affected parties throughout process	Ongoing	Meeting records, feedback incorporation, decision rationale
Climate Transition Plan	Time-bound targets for 2030 and five-year intervals through 2050	2029 (Phase 3)	Plan document with scientific basis, scope 1-3 emissions targets
Annual Review	Reassess chain of activities and update risk assessments	Annually	Updated assessment, progress report, mitigation status
Follow-up Protocol	Timely response to founded complaints with remediation details	Within reasonable timeframe of complaint	Response logs, remediation plans, status updates
Supply Chain Mapping	Document full chain from upstream production to downstream distribution	Before first compliance phase	Supplier database, tier mapping, geographic risk analysis

Penalty for non-compliance: Fines up to 5% of global net turnover, plus potential civil liability for damages where you intentionally or negligently failed to prevent, mitigate, or remedy adverse impacts.

Member state transposition: EU member states have until May 2026 to transpose the CSDDD into national law, with enforcement beginning according to the phased timeline above.