Corporate Sustainability Due Diligence Directive

Article 1 Subject matter

This Directive establishes rules requiring companies to conduct due diligence on actual and potential harmful effects on human rights and the environment across their own operations, those of subsidiaries, and those of business partners, and sets out liability for breaching these obligations. The Directive does not lower existing protections for human rights, employment rights, social rights, environmental protection or climate protections in any Member State, and other EU laws with more extensive or specific obligations take precedence in cases of conflict.

Article 2 Scope

5 billion, or ultimate parent companies of groups meeting those thresholds, or with franchising/licensing royalties exceeding EUR 75 million and net turnover above EUR 275 million; EU parent companies with EUR 5 billion net turnover in the Union are also covered. Ultimate parent companies that only hold shares and do not make management or financial decisions may obtain an exemption if a Union subsidiary designated to fulfil their obligations is given all necessary means and legal authority, though the ultimate parent remains jointly liable for failures. Application requires conditions to be met in two consecutive financial years and ceases when conditions are not met for two relevant years.

Article 3 Definitions

Company means EU legal persons in specified forms or comparable third-country entities or regulated financial undertakings; adverse environmental impact means harm from breaching environmental law prohibitions; adverse human rights impact means harm from human rights abuse where the company could reasonably foresee the risk; business partners are entities with commercial agreements or related operations (direct or indirect), including downstream partners in distribution and transport; independent third-party verification means objective assessment by an independent expert with human rights or environmental expertise; appropriate measures are effective, proportionate actions reasonably available; remediation means restoring affected persons or environment through compensation; risk factors affect impact severity and likelihood; severity means scale, scope or irreversibility of impact. The Commission may adopt delegated acts amending the Annex to add or modify references to international human rights and environmental instruments ratified by all Member States.

Article 4 Level of harmonisation

Member States must not adopt national laws that diverge from the core due diligence and liability rules set out in specified articles of the Directive. However, Member States may introduce laws that are more stringent or specifically address particular products, services or sectors to provide greater protection for human rights, employment, environmental or climate interests.

Article 5 Due diligence

Companies must implement risk-based due diligence across their operations by integrating it into policies, identifying and assessing adverse impacts, preventing and ending harmful effects, providing remedies, engaging stakeholders, establishing complaints mechanisms, monitoring effectiveness, and publicly reporting on these activities. Companies may share resources and information across their groups, business partners cannot be forced to disclose trade secrets except the identity of other partners or information essential for impact assessment, and documentation of due diligence actions must be kept for at least 5 years.

Article 6 Due diligence support at a group level

Parent companies may fulfil the due diligence obligations on behalf of subsidiary companies falling under the Directive's scope if it ensures effective compliance, though subsidiaries remain subject to supervisory oversight and civil liability. Such group-level fulfilment requires the subsidiary and parent to exchange necessary information, the subsidiary to adopt the parent's due diligence policy, the subsidiary to integrate due diligence into its own policies and systems, and the subsidiary to undertake certain preventive and remedial actions and seek contractual assurances from business partners as required.

Article 7 Integrating due diligence into company policies and risk management systems

Requires companies to incorporate due diligence into all relevant policies and risk management systems and establish a comprehensive due diligence policy developed after consulting employees and representatives. The policy must describe the company's approach to due diligence, set out a code of conduct for the company, subsidiaries and business partners, and detail the processes used to implement due diligence and verify compliance. Companies must update their policies promptly when significant changes occur and conduct formal reviews every two years, considering previously identified adverse impacts and completed assessments.

Article 8 Identifying and assessing actual and potential adverse impacts

Member States must require companies to conduct appropriate scoping and in-depth assessments to detect negative impacts across their own operations, subsidiaries, and business partners' activities, considering risk factors related to business partner characteristics, geographic context, and sector-specific circumstances. Companies may gather information from available sources such as independent reports, digital tools, and stakeholder initiatives to support their impact identification and evaluation.

Article 9 Prioritisation of identified actual and potential adverse impacts

Where preventing or mitigating all identified adverse impacts simultaneously is not feasible, companies must prioritise them based on their severity and likelihood. Once the most severe and likely impacts are addressed within a reasonable timeframe, companies must then address less severe and likely impacts. Companies are protected from penalties simply for not addressing less significant adverse impacts as part of their prioritisation decisions.

Article 10 Preventing potential adverse impacts

Companies must take appropriate measures to prevent or mitigate identified potential adverse impacts through prevention action plans with timelines and indicators, contractual assurances from direct and indirect partners with compliance verification, financial or operational investments, modifications to business strategy, proportionate support to small or medium-sized partners, and collaboration with other entities, considering whether impacts are caused solely by the company, jointly, or only by partners and the company's ability to influence them. Companies must adopt and implement a plan to strengthen prevention of a specific potential adverse impact without delay if reasonably likely to succeed, and continuing engagement under such a plan does not trigger penalties or liability. Before suspending a business relationship, companies must assess whether suspension would cause manifestly more severe impacts than the unpreventable adverse impact and may report justifications to supervisory authorities; when suspending, they must take steps to mitigate impacts, give reasonable notice, and review the decision; when not suspending, they must monitor and periodically reassess.

Article 11 Bringing actual adverse impacts to an end

Companies must take appropriate measures to end actual adverse impacts identified under Article 8, considering the source of the impact and their influence over responsible parties, minimizing extents where immediate cessation is not possible; appropriate measures include developing corrective action plans, obtaining contractual assurances from direct and indirect business partners with independent verification, making investments, modifying business practices, supporting SMEs, and providing remediation. Companies may engage business partners about expectations and provide capacity-building and financial support, with contractual assurances from indirect partners requiring independent third-party verification and fair non-discriminatory terms for SMEs, with companies bearing verification costs unless the SME agrees to share them. Companies must create and carry out an improved corrective action plan when stopping a specific harm is likely, and continuing engagement under such a plan incurs no penalties or liability; before ending a relationship, companies must assess whether doing so would cause substantially worse impacts than continuing, and if so may maintain the relationship while reporting this to the supervisory authority.

Article 12 Remediation of actual adverse impacts

Where a company caused or caused jointly an actual negative impact, it must provide remediation measures. If only a business partner caused the impact, the company may voluntarily provide remediation or use its influence to encourage the business partner to offer remediation.

Article 13 Meaningful engagement with stakeholders

Requires companies to conduct effective stakeholder engagement at key stages of due diligence, providing relevant information and allowing stakeholders to request additional details with written justification if refused. Companies must identify and prevent retaliation, can use industry initiatives for consultation, and must separately consult employees and their representatives in accordance with employment and social rights law.

Article 14 Notification mechanism and complaints procedure

Companies must enable affected persons, their representatives (including civil society organizations and human rights defenders), trade unions, worker representatives, and relevant civil society organizations to submit complaints about actual or potential adverse impacts in their operations, subsidiaries, or business partners' activities through a fair, transparent, accessible procedure that maintains confidentiality, prevents retaliation, and treats well-founded complaints as identified impacts requiring appropriate measures; complainants have rights to request follow-up, meet company representatives, and receive reasons and information on actions taken. Member States must require companies to establish accessible reporting channels allowing anonymous or confidential reports and protecting reporters from retaliation, which may be satisfied through joint complaint systems run by companies together, trade bodies, joint initiatives, or international agreements meeting these requirements. Submitting a report does not require or prevent access to procedures in Articles 26 and 29 or other non-judicial remedies.

Article 15 Monitoring

Requires companies to regularly assess the adequacy and effectiveness of their own measures, those of subsidiaries, and business partners' measures at least every five years or without delay after significant changes, updating their policies and identified impacts based on assessment outcomes and stakeholder information.

Article 16 Communicating

Requires companies to publish an annual statement on their website within 12 months of the financial year end, in official Union or international business languages, covering due diligence matters. Companies subject to certain sustainability reporting requirements under other EU directives are exempt from this requirement, and the Commission will adopt delegated acts by March 2029 specifying reporting standards.

Article 17 Accessibility of information on the European single access point

Requires companies to submit their annual statements to a designated collection body in data-extractable or machine-readable formats from 1 January 2031, accompanied by metadata including company names, legal entity identifiers, size, industry sector, and personal data indicators for inclusion in the European single access point.

Article 18 Model contractual clauses

By 26 July 2027, the Commission shall develop and adopt guidance on optional standard contractual clauses to assist companies in meeting their contractual obligations under Articles 10 and 11, in cooperation with Member States and relevant stakeholders.

Article 19 Guidelines

The Commission shall develop guidance documents covering the practical implementation of due diligence obligations, including identification and prioritization of risks, purchasing practices, disengagement, remediation, and stakeholder engagement. Guidelines must address sector-specific issues, risk assessment across company and geographic contexts, available tools and data sources, information sharing arrangements, and stakeholder engagement processes, with adoption deadlines specified for different components.

Article 20 Accompanying measures

Member States must establish and maintain websites or platforms providing companies, business partners and stakeholders - especially SMEs - with access to reporting criteria from the Commission, voluntary contract clauses, guidance, a single helpdesk, and information on stakeholder engagement in due diligence. Member States may provide financial support to SMEs and to stakeholders exercising rights under the Directive, and the Commission may add support measures including industry or multi-stakeholder initiatives. Companies may participate in such initiatives to fulfil their obligations and use risk analysis from them, provided they monitor effectiveness, and the Commission must issue guidance on assessing initiative fitness.

Article 21 Single helpdesk

The Commission shall establish a centralized helpdesk to provide companies with information and guidance on meeting their obligations under this Directive. National supervisory authorities shall collaborate with the helpdesk to adapt guidance to their contexts and distribute it.

Article 23 Authorised representative

Companies from outside the Union operating in a Member State must appoint an authorized representative located in the Union, who receives designation confirmation and registers with supervisory authorities. The representative must be empowered to receive official communications and assist with compliance, with all Member States authorized to enforce these requirements.

Article 24 Supervisory authorities

Each Member State must appoint one or more authorities to monitor compliance with due diligence rules; the competent authority is in the country where the company is registered or, for non-EU companies, where it operates or makes the most sales in the Union, and non-EU companies may request competence changes if their main sales location shifts. Member States must ensure supervisory authority staff are legally and functionally independent, impartial, transparent, free from external influence, market interests and conflicts of interest, bound by confidentiality, and act compatibly with their duties; when a parent company meets obligations for subsidiaries, its authority must cooperate with the subsidiary's authority. Supervisory authorities must publish accessible annual reports on their activities under the Directive.

Article 25 Powers of supervisory authorities

Supervisory authorities must have adequate powers and resources to require company information and conduct investigations for compliance with due diligence obligations, and may start investigations on their own or from substantiated concerns. Inspections comply with national law and require prior warning unless warning would reduce effectiveness; cross-border inspections need assistance from the authority in the other Member State. After identifying non-compliance, authorities must give companies reasonable time for remedial action without precluding penalties or civil liability.

Article 26 Substantiated concerns

Allows individuals and organisations to report suspected breaches of the due diligence rules through accessible channels, with protection of their identity if requested. Supervisory authorities must assess concerns within a reasonable timeframe, inform the reporter of outcomes with reasoning, and allow access to court review for those with legitimate interest in the matter.

Article 27 Penalties

Requires Member States to establish effective, proportionate and dissuasive penalties for breaches, taking into account factors such as the gravity and duration of the infringement, prior violations, remedial steps taken, and financial benefits gained. Penalties must include fines and, for non-compliance with fine orders, public disclosure of the offending company's identity, with maximum fines capped at 3 percent of worldwide turnover.

Article 28 European Network of Supervisory Authorities

The Commission establishes a network of supervisory authority representatives to coordinate regulatory, investigative and supervisory practices, which may include Union agencies, and Member States must provide company identification and net turnover information through a secured system for the Commission to analyse and notify the competent Member State. Supervisory authorities must share relevant information and provide mutual assistance, responding to requests within one month or up to three months if justified, without charging fees except where specific exceptional expenditure is agreed. The competent supervisory authority must inform the Network when non-EU companies fall under the Directive or request a change in oversight, the Network may help coordinate solutions for jurisdictional uncertainties, and the Network must publish decisions containing financial penalties and a sample list of third-country businesses covered by the Directive.

Article 29 Civil liability of companies and the right to full compensation

Persons harmed by a company's failure to comply with due diligence requirements have a right to full compensation without overcompensation through punitive or multiple damages, with limitation periods of at least five years beginning after the infringement ends and the claimant knows the behaviour, harm and identity of the infringer; civil procedures must not be prohibitively expensive, claimants may seek injunctive relief, and courts may order disclosure of evidence held by companies when a reasoned claim is presented, balancing necessity, proportionality, confidentiality and scope of disclosure. Participation in industry initiatives or third-party verification does not prevent liability, a company's liability does not affect the liability of its subsidiaries or business partners, and they are jointly and severally liable under national law when damage was caused jointly. The Directive's liability rules do not limit liability under other Union or national legal systems or stricter provisions on civil liability for human rights or environmental harm.

Article 30 Reporting of breaches and protection of reporting persons

Member States must ensure that the whistleblower protections established under EU Directive 2019/1937 apply to disclosures of violations of national laws implementing this Directive.

Article 31 Public support, public procurement and public concessions

Member States shall allow contracting authorities to consider compliance with or voluntary adoption of this Directive's obligations as an environmental or social award criterion and performance condition in public procurement and concession contracts under EU procurement directives.

Article 32 Amendment to Directive (EU) 2019/1937

This Directive is added to the list of Union legal acts in the whistleblower protection Directive, establishing that violations of this Directive's implementing rules are covered breaches.

Article 33 Amendment to Regulation (EU) 2023/2859

This Directive is added to a list in a corporate governance regulation, integrating it into the broader EU corporate accountability framework.

Article 34 Exercise of the delegation

The Commission has authority without time limit to adopt delegated acts under Articles 3 and 16, subject to consultation with Member State experts and a two-month objection period for the European Parliament and Council; either institution may revoke this delegation at any time.

Article 35 Committee procedure

A committee shall support the Commission's work, operating under the rules established by Regulation (EU) No 182/2011, with Article 4 of that regulation governing the committee's procedures.

Article 36 Review and reporting

The Commission must report to the Parliament and Council every five years starting 26 July 2031 on implementation, effectiveness and impacts on SMEs, scope coverage, chain of activities definition, adverse impact categories, enforcement mechanisms and market-level playing field, with legislative proposals where appropriate.

Article 37 Transposition

Member States must enact implementing laws by 26 July 2028 and apply them from 26 July 2029 (or 1 January 2030 for Article 16 rules), then notify the Commission of the main measures adopted.

Article 38 Entry into force

Article 39 Addressees

Establishes children's rights to health, education and adequate living standards; prohibits employment of children under the age when compulsory schooling ends, minimum 15 years except where local law provides otherwise; prohibits worst forms of child labour on persons below 18 years including slavery, trafficking, sexual exploitation, illicit drug activities, and work harmful to children's health or development; prohibits forced or compulsory labour exacted under threat or penalty. Prohibits all forms of slavery, slave-trading and similar workplace practices including trafficking and extreme exploitation; protects freedom of association, assembly, organising and collective bargaining including forming unions and striking; prohibits unequal employment treatment and pay discrimination unless justified by job requirements; prohibits environmental degradation affecting food production, water access, sanitation or human health; protects rights to land and resources and prohibits unlawful eviction where they are used for livelihood.