On 26 February 2025, the European Commission introduced the Omnibus Directive. If passed, it will revise some requirements under the Corporate Sustainability Due Diligence Directive (CSDDD) and the Corporate Sustainability Reporting Directive (CSRD). This alert outlines what these changes would mean for the CSDDD. However, the Omnibus Directive is going through the legislative process and will likely change further.
What you need to know
- Most of the requirements for companies under the CSDDD have not changed. The most significant shift is the removal of civil liability.
- Companies can still be subject to penalties by regulators, but each EU government can set their own penalties, and there is no longer a common threshold that penalties will have to meet.
- Timeline delay. The CSDDD would now apply to large companies one year later in 2028 rather than 2027.
- Tier 1 is in-scope, but deeper tiers (e.g. raw materials, processing) are only in scope if there is a known risk. Companies must still map their human rights and environmental risks across their full value chain, but they only need to assess suppliers and address risks at (i) direct business partners and (ii) upstream suppliers where credible human rights and environmental risks exist. Given the well-documented risks in cotton, for example, apparel companies will still need to assess and address issues at upper-tier suppliers. Other sectors that use commodities with well-documented risks like cobalt, cocoa and polysilicon will similarly have to identify and address risks beyond tier 1.
- Stakeholder engagement requirements are still robust and focus narrowly on workers, trade unions and community members. The EU has narrowed the definition of stakeholders to include employees, workers, trade unions, community members, and those directly affected by an impact. NGOs are no longer considered stakeholders unless they are the legitimate representatives of workers or communities.
- Disengagement requirements have been revised to provide more legal flexibility. The core principle of the revised text is that companies can stay engaged with business partners despite severe risks, so long as they can demonstrate that their efforts (i.e. prevention action plans) are viable.
Next steps in the legislative process
- The proposal now (re)enters the EU legislative process. The European Parliament and the Council of the EU will review, debate, and negotiate potential amendments.
- If Parliament and the Council reach an agreement, the revised directive could be adopted within months. If there are significant disagreements, the process may extend into late 2025 or beyond. There are various outcomes at this point depending on what legislative process the Commission takes. For example, if Parliament and the Council cannot reach an agreement on a legislative proposal, the proposal fails, and the existing legal framework remains unchanged.
A full technical analysis of the changes made by Omnibus Directive to the CSDDD and sectoral implications is available upon request. This is suitable for legal counsel and senior management teams.