CSDDD after the Omnibus: what large companies should do before 2029

After the Omnibus I Directive, the CSDDD applies only to companies with more than 5,000 employees and over EUR 1.5 billion net worldwide turnover, or non-EU groups with EUR 1.5 billion EU turnover, from 26 July 2029. The climate transition plan duty and EU-wide civil liability are gone. Supplier due diligence is not.

Most of the commentary on the Omnibus has been about who escaped. That is fair: the Corporate Sustainability Due Diligence Directive (CSDDD, or CS3D) now covers a small fraction of the companies it originally targeted. But if you run sustainability at a large group, the more useful question is what the remaining rules will ask your team to know about suppliers, and how long it takes to build that knowledge. Our answer is longer than the 2029 date suggests.

What changed in the CSDDD after the Omnibus?

Directive (EU) 2026/470 was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. Covington, Arthur Cox and Linklaters all summarise the CSDDD changes in similar terms:

• Scope: EU companies with more than 5,000 employees and more than EUR 1.5 billion net worldwide turnover. Non-EU companies come in with more than EUR 1.5 billion net turnover generated in the EU.
• Timing: Member States must transpose by 26 July 2028, and the rules apply from 26 July 2029. Linklaters notes that CSDDD disclosures must be published by 1 January 2030.
• Climate transition plans: the CSDDD duty to adopt and put a plan into effect is deleted. Transition plan reporting continues under CSRD and the ESRS.
• Civil liability: the harmonised EU regime is removed and liability is left to national law.
• Penalties: capped at 3% of net worldwide turnover.
• Ending relationships: termination as a last resort is no longer required where a corrective plan has a reasonable expectation of success.

Read that list quickly and it sounds like the directive has been hollowed out. Read the due diligence mechanics and it looks different.

Does CSDDD still require supply chain due diligence beyond tier 1?

Yes. Covington's summary is clear that proposals to limit the duty to direct suppliers were rejected. The risk-based approach still covers the whole "chain of activities", in two steps:

1. A scoping exercise across your chain of activities, based solely on reasonably available information.
2. An in-depth assessment of the areas where adverse impacts are most likely and most severe. Where several areas are equally likely or severe, you may prioritise those involving direct business partners.

The Omnibus also limits how you get the information. You may ask partners only where necessary, and for partners with fewer than 5,000 employees, only where the information cannot reasonably be obtained by other means.

This is the part we think large companies are underestimating. Put those rules together and the burden shifts onto what you already hold. If you cannot send a questionnaire to most of your supply base until you have exhausted other sources, the quality of your existing supplier data decides how good your scoping is. Spend data, sector and country codes, certifications, prior EcoVadis or CDP responses, audit results: that is your "reasonably available information". Most groups keep it in five places owned by five teams.

Why 2029 is closer than it looks

Work back from the application date. National laws land by July 2028, and the Commission's guidance on due diligence processes, stakeholder engagement and model contract clauses is due by 26 July 2027, according to Covington. That leaves roughly two years in which to build a supplier data set good enough to scope from, before the guidance that tells you how to use it arrives.

CSRD runs on a faster clock. Newly in-scope companies report on financial year 2027, so the supplier and value chain data you collect next year serves both. We set out the new CSRD thresholds and dates in our guide to CSRD after the Omnibus.

There is also a ceiling on what you can ask smaller suppliers for CSRD purposes. The value chain cap limits requests to companies with up to 1,000 employees to the Voluntary Standard datapoints. We covered how to design requests within that cap in what large companies can ask suppliers under the VSME value chain cap. The combined effect is that one well designed request, sent once, has to do a lot of work.

What should a CSDDD-scope company do in 2027?

None of this needs a new compliance programme yet. It needs the data foundations that CSRD, CDP and EcoVadis already require, organised so that a due diligence team can use them. Our suggested order:

1. Build one supplier register. Pull procurement spend, supplier country and sector, and any certifications into a single list with an owner for each field.
2. Reuse what suppliers already publish. EcoVadis scorecards, CDP responses and published reports count as reasonably available information. Store them against the supplier with a date.
3. Map spend to risk. Your Scope 3 category mapping already groups spend by what you buy and where. The same view is a decent first pass at where human rights and environmental impacts are likely.
4. Design one request. For suppliers below 1,000 employees, keep within the Voluntary Standard. Ask the large ones for more, and only where the gap matters.
5. Keep the evidence. Record the source and date behind each risk call, because a regulator will ask why an area was ranked low.

What we hear from sustainability teams

On a recent sales call, the sustainability lead at a large services group was halfway through CDP on an extension, had EcoVadis due in December and listed automated data collection as the first priority, ahead of any framework. That is typical. The frameworks change every year; the work of getting numbers and documents out of procurement, facilities and finance stays the same, and it is where the hours go.

Suppliers feel it from the other side. When the same mid-sized supplier receives four different questionnaires from four customers, the answers get worse, and the value chain cap now limits what customers can ask of them for CSRD. We wrote about that experience in how suppliers respond to a sustainability assessment when they have no ESG data.

Our view is that the large companies that come out of 2029 well will be the ones that treated CSRD value chain data, Scope 3 and supplier due diligence as one data set from 2027. Splitting them across three teams and three tools means asking suppliers three times, which the new rules discourage and suppliers will not tolerate.

How Ella helps

Ella is AI-native ESG reporting software, built as an agent for sustainability teams at large and fast-growing companies. It sends collect links to colleagues and suppliers, chases them, tracks missing responses and reads the bills, certificates and spend exports they drop in. Every number and document keeps its source, so the same data set feeds CSRD, Scope 3, CDP and EcoVadis, and is ready when your due diligence team needs to show why a supplier was ranked the way it was. For the wider picture on ESG data collection software, see our guide.