CSRD and CSDDD: How the Two Rules Interact After the Omnibus

If your company is in scope of the Corporate Sustainability Reporting Directive (CSRD), it is almost certainly in scope of the Corporate Sustainability Due Diligence Directive (CSDDD) as well. After the Omnibus Simplification Package, the two directives share the same quantitative size test, overlap heavily on data and governance, and are being transposed on the same regulatory timetable. Yet most companies — and more than a few advisers — still run them as two separate programmes, with two separate workstreams, two separate budgets, and two sets of supplier questionnaires landing in procurement's inbox a month apart.

That is not the shape the legislation calls for. The Omnibus deliberately knitted CSRD, CSDDD and the EU Taxonomy together, so a company running them as one programme spends less, learns faster, and arrives at assurance with a cleaner evidence file. This guide walks through what CSDDD is, what the Omnibus actually changed, where the two directives overlap, where they diverge, and how to structure a CSRD engagement — and the consultant who runs it — to cover both at the same time.

What CSDDD Is, in One Section

The CSDDD — Directive (EU) 2024/1760, adopted in July 2024 — is a substantive due diligence obligation, not a reporting rule. Where the CSRD tells you what to disclose, the CSDDD tells you what to do: identify the actual and potential adverse human rights and environmental impacts of your own operations and those of your direct business partners, prevent and mitigate them, provide remediation when harm has occurred, and adopt a climate transition plan.

The duty maps onto frameworks sustainability practitioners already know — the UN Guiding Principles on Business and Human Rights (UNGPs) and the OECD Guidelines for Multinational Enterprises — and translates them from voluntary standards into a hard EU obligation enforced by member-state authorities.

Four pillars sit at the heart of the directive:

• A due diligence policy, integrated into the company's risk management and corporate strategy
• A risk-based identification process for adverse impacts across the company's own operations, its subsidiaries, and its direct business partners
• Preventive and corrective action — including supplier contract clauses, support for SME partners, and, where necessary, suspending or terminating business relationships
• A climate transition plan aligned with the Paris Agreement, with time-bound targets and implementation actions

A statement describing all of this is published annually. For companies also in CSRD scope, that statement is inside the sustainability statement in the management report — not a separate document.

What the Omnibus Actually Changed

The Omnibus — Directive (EU) 2026/470, signed 24 February 2026 — amended both the CSRD and the CSDDD in the same instrument. The amendments to the CSDDD sit in Article 4 of the directive and have a separate transposition deadline of 26 July 2028. Four changes matter for the CSRD programme:

1. Scope aligned with the revised CSRD

The quantitative size test for CSDDD was aligned with the revised CSRD Wave 2 threshold: more than 1,000 employees and more than €450 million net turnover, both conditions to be exceeded. The old staggered thresholds — which brought in companies down to 1,000 employees and €450M, then 3,000 and €900M — were simplified so that CSDDD scope sits inside the pool of CSRD Wave 2 reporters. For most groups the practical rule is: if you are in scope of the revised CSRD, assume you are in scope of the revised CSDDD until a legal review tells you otherwise.

2. Due diligence focus on direct business partners

The due diligence duty was narrowed in practice to direct business partners — Tier 1 suppliers and immediate downstream counterparties — rather than the full chain of activities. Deeper tiers come into scope only when there is credible information of adverse impacts, in which case the company must act. For CSRD programmes this changes how value chain reporting interacts with CSDDD: the ESRS still expect you to describe material impacts across the value chain, but the CSDDD action duty bites hardest at Tier 1.

3. Climate transition plan aligned with ESRS E1

The CSDDD transition plan requirement is explicitly aligned with the ESRS E1 climate transition plan. The Omnibus wording is designed to let a single plan — drafted once, approved by the board, governed by named owners — satisfy both the ESRS E1-1 disclosure and the CSDDD substantive duty. Two plans is not the compliant answer, nor the economic one.

4. Civil liability regime trimmed

The harmonised EU-wide civil liability regime that the original CSDDD introduced was removed from the directive. Civil liability for breaches of due diligence duties now falls back on national law, which varies by member state. This does not change what a company has to do; it changes the enforcement risk map and belongs in the group's legal register, not in the sustainability team's workbook.

The transposition deadline for the CSDDD part of the Omnibus is 26 July 2028. First-application dates sit in each member state's transposition act — plan to that, not to a date on the Commission's original roadmap.

Where the Two Directives Overlap

Four overlaps are big enough that an experienced consultant will design them to share a single workstream.

Scope and in-scope entity list

The entity list is almost identical. Both directives apply to EU-registered groups above the 1,000-employee / €450M-turnover test; both apply to non-EU groups above a (separate) EU-turnover threshold. One group entity register, maintained by legal and tax, serves both. Debating scope twice — once for the CSRD team and once for the CSDDD team — is wasted effort.

Transition plans

The climate transition plan is the clearest shared artefact. Both directives require a plan consistent with limiting warming to 1.5°C and the Paris Agreement; both expect time-bound targets, implementation actions, and board-level governance. A single plan serves both. For the detail on what a defensible plan looks like under ESRS E1-1 — targets, financial resources, decarbonisation levers, CapEx alignment — see our transition plans guide.

Supplier data and the value chain

Both directives need structured data about direct suppliers: identity, country, sector, materiality on human rights and environment. The CSRD side uses it for ESRS 2 SBM-1, ESRS G1-2 (relationships with suppliers), ESRS S1–S4 (workforce, workers in the value chain, affected communities, consumers), and parts of ESRS E1 Scope 3. The CSDDD side uses the same data to run the risk-based identification exercise, prioritise prevention, and build contractual cascades.

Running one supplier survey, one data pipeline and one risk register for both reduces procurement fatigue and keeps the number consistent across the sustainability statement and the due diligence statement.

Stakeholder engagement and grievance mechanisms

Both directives require meaningful stakeholder engagement — in the double materiality assessment for CSRD and in impact identification and remediation for CSDDD — and both require accessible grievance mechanisms. Design one mechanism, one engagement cadence, one record. The ESRS 2 MDR disclosures and the CSDDD complaints procedure both read off the same evidence.

Where They Diverge

Four divergences matter enough that treating them as the same is a programme risk.

Reporting vs. action

The CSRD is a reporting rule — tell investors and other stakeholders what you do, with assurance over the statement. The CSDDD is a substantive rule — do the due diligence, prevent and mitigate impacts, remedy harm. A clean CSRD report that describes an underpowered due diligence process is a CSDDD breach, not a reporting defect.

Enforcement

The CSRD is enforced through audit opinions, member-state oversight of statutory reporting, and the market consequences of a qualified or adverse opinion — see our penalties and non-compliance guide. The CSDDD is enforced by designated supervisory authorities in each member state, which may impose administrative fines based on worldwide turnover and require corrective measures. The remedies — orders to stop a conduct, to remediate harm — have no equivalent in the CSRD toolkit.

Timeline

The two directives are being transposed on different clocks. The CSRD amendments in the Omnibus must be transposed by 19 March 2027 (Article 5(1) of the directive); the CSDDD amendments by 26 July 2028 (Article 4). Within that, each member state sets its own first-application date for CSDDD. A single programme plan still works — but mark the two deadlines in it and don't assume one date covers both.

Non-EU scope

Both directives reach non-EU groups above an EU-turnover threshold, but the thresholds and tests differ. For CSRD, non-EU parents come in via Article 40a — more than €450M net turnover in the EU in each of the last two years, plus a qualifying EU subsidiary or branch. CSDDD's reach into non-EU groups is set by its own text and the national transposition. If you are a non-EU parent, map the two separately and do not assume one answer carries over.

Running Both as One Programme

If you take only one thing from this guide, take this: do not run two sustainability programmes side by side. Design them as one, with shared data, shared governance and shared stakeholder work, and give the differences the specific airtime they need. In practice that means:

1. One governance structure. A single board sponsor, a single sustainability steering group, one risk owner at Group level. The CSRD lead and the CSDDD lead report into the same owner.
2. One data model. Suppliers, workforce, grievances, incidents, emissions, workers in the value chain — all captured once, in one system, and consumed by both disclosures and the due diligence process. See our data collection and gap analysis guide for how to size the data effort.
3. One transition plan. Build it to serve ESRS E1-1 and the CSDDD climate obligation from the start. Governance, financial resources, decarbonisation levers and CapEx tagging to the EU Taxonomy are the same inputs either way.
4. One double materiality assessment that feeds both. The impact-materiality leg of your DMA already identifies adverse impacts across operations and the value chain — exactly the input the CSDDD risk-based identification needs. Keep the methodology documented in a way that supports both.
5. One supplier engagement. A single supplier questionnaire, calibrated to pull CSRD disclosure data and the risk screen for CSDDD prevention. One cascade of contract clauses in procurement, not two. One cadence of audits.
6. One grievance and remediation mechanism. CSRD discloses it, CSDDD requires it. Build one that satisfies both and brief procurement, HR, legal and operations once.
7. One assurance file. Your limited-assurance provider under the CSRD will inspect how the due diligence process ties back to the disclosures. Build the evidence trail with that cross-reference in mind — see our pre-assurance guide for how to pressure-test it before the assurer arrives.

The right structure costs materially less than running two programmes, and it produces an evidence file that holds together under scrutiny.

What to Look For in a CSRD Consultant Who Also Covers CSDDD

If you are hiring, add these to the standard CSRD consultant screen:

• Working knowledge of the UNGPs and the OECD Guidelines. The CSDDD imports both; a consultant who cannot speak the vocabulary will reinvent methodology that already exists.
• Experience designing a human rights risk register and grievance mechanism. Reporting the existence of one is not the same as designing one that holds up to supervisory inspection.
• A transition plan methodology that is governance-first, not model-first. A plan that is a decarbonisation model with no board approval, no CapEx anchor and no implementation accountability does not satisfy either directive.
• Supplier engagement experience across tiers. Running a single CSDDD-ready supplier survey for a Tier-1 base of several thousand is procurement work, not an ESG exercise.
• A clear position on the independence constraint. The firm advising on CSDDD programme design should not also be your statutory sustainability assurance provider — the self-review threat applies here as cleanly as it does under CSRD.

A consultant who treats CSDDD as a reporting workstream has missed the point. A consultant who treats CSRD as the CSDDD annual report has, too.

Common Mistakes to Avoid

• Writing two transition plans. One board-approved plan serves both. Two creates inconsistency the assurer will question.
• Running two supplier surveys. Procurement fatigue is a scope risk — the response rate on the second survey collapses, and both the CSRD disclosure and the CSDDD risk screen suffer.
• Treating the CSDDD statement as a CSRD disclosure only. The statement describes a process the company must actually run. If the process is not there, the statement is not defensible.
• Letting legal own CSDDD and sustainability own CSRD. The two cannot be siloed. Legal must sit on the sustainability programme; sustainability must sit on the CSDDD programme.
• Assuming non-EU scope is identical. The Article 40a test and the CSDDD reach into non-EU groups are different legal tests.
• Buying "CSDDD readiness" as a bolt-on. A late bolt-on to a drafted CSRD report produces a thin due diligence statement and a brittle data model. Build both from the start.

Where This Leaves You

If your group is in scope of the revised CSRD, start from the assumption that CSDDD applies on the same clock, and plan one programme that covers both. Treat the two directives as different lenses on the same operating reality: how are we affecting people and the environment, what are we doing about it, and how do we tell investors and supervisors in a way that holds up? The Omnibus made that framing easier by aligning scope, data and transition-plan logic — and the CSRD consultants who understood that from day one are the ones delivering clean reports and defensible due diligence files on the same budget.