TL;DR
The Corporate Sustainability Due Diligence Directive (CSDDD) is still law. What changed is the timeline and scope. The Omnibus I amendments, published as Directive (EU) 2026/470 in the Official Journal on 26 February 2026, moved the transposition deadline to 26 July 2028 and the application date to 26 July 2029. Direct scope now covers companies with more than 5,000 employees and more than 1.5 billion euros in net worldwide turnover. But the operational reality has not changed. If you sell to a large EU buyer, you will feel CSDDD indirectly, through cascading compliance requirements, supplier-data requests, and audit documentation your enterprise customers now owe their regulators. This article walks through what changed, what still applies, what your procurement team should do in 2026, and how to prepare without waiting for 2028.
What Omnibus I actually changed
Omnibus I is the EU simplification package that amended both CSDDD and CSRD. After trilogue negotiations, the European Parliament approved the text in December 2025 and the Council adopted it on 24 February 2026. It was published as Directive (EU) 2026/470 on 26 February 2026 and entered into force on 18 March 2026 (Noerr, European Commission). Three changes matter most for procurement teams.
First, the scope was narrowed. Direct obligations now apply to EU companies with more than 5,000 employees and more than 1.5 billion euros in net worldwide turnover, up from 1,000 employees and 450 million euros. Non-EU companies are covered when they generate more than 1.5 billion euros of net turnover in the EU. Second, the timeline was extended. Member States must transpose the rules by 26 July 2028, and the obligations apply from 26 July 2029. Third, the due diligence method was softened. Companies no longer have to map their entire value chain. They run a scoping exercise based on reasonably available information, then carry out an in-depth assessment where adverse impacts are most likely and most severe. That focus can still reach business partners beyond Tier 1: the Commission had proposed limiting obligations to direct business partners, but the final text applies the risk-based approach across the chain of activities. Omnibus I also deleted the climate transition plan obligation, removed the harmonised EU civil liability regime, and capped maximum fines at 3% of worldwide net turnover.
None of these changes removed the directive. They delayed it and focused it.
Why mid-market procurement teams should not relax
If your company sits below the raised thresholds, you might assume Omnibus I moved the target off your back. In practice, it did not. Three forces keep mid-market procurement teams squarely inside the compliance envelope.
The first is cascading obligation. Companies that remain in direct scope — large enterprises and EU-listed groups — are legally required to identify and mitigate adverse impacts across their chain of activities. That means their procurement teams will now formally push compliance obligations down to you, their supplier. You will see new supplier questionnaires, new data-access requirements in contracts, new attestation schedules, and new audit windows even if you are not directly regulated.
The second is Member State gold-plating. When EU directives are transposed into national law, several Member States — Germany, France, the Netherlands — have a track record of lowering thresholds below the directive’s floor. The German Supply Chain Act (LkSG) already applies to companies with 1,000 or more employees in Germany, far below the new CSDDD threshold. A government bill, first debated in the Bundestag in January 2026, would drop the reporting duty and narrow the fines, but the core duties stay: risk analysis, preventive and remedial measures, a complaints procedure and internal documentation (Taylor Wessing). If you supply German customers of that size, you are already in the LkSG envelope.
The third is buyer sophistication. Enterprise procurement teams are not waiting for 2029. Most of them have already started building supplier-due-diligence capabilities to answer their own board and audit pressure. What they build in 2026 and 2027 will be the standard you need to meet.
What CSDDD still requires operationally
The underlying operational shape of CSDDD has not changed. Procurement teams still need to be able to do five things.
1. Governance integration. The directive expects a single accountable owner for due diligence design inside the organization. That person needs to sit high enough to make decisions across procurement, legal, and operations. Anonymous accountability — “the sustainability team owns it” — does not satisfy regulators.
2. Living risk registers. A one-off supplier assessment does not meet the standard. The amended directive requires companies to reassess without undue delay after a significant change, whenever there are reasonable grounds to believe new risks have arisen, and at least every five years (Article 15). In practice, supplier risk has to be reassessed as new information on geography, sector, and specific incidents comes in. This is one of the most expensive operational upgrades for procurement teams that still work in Excel.
3. Preventive measures. Procurement teams must be able to demonstrate what they did to prevent adverse impacts before they happened. Supplier codes of conduct, contractual clauses, supplier training, and supplier data-access requirements all count, but only if there is evidence they are actively enforced.
4. Accessible complaints procedures. A whistleblowing or grievance mechanism must exist and be reachable by anyone in the value chain, including third-party workers at supplier sites. Most procurement teams do not run this today.
5. Audit-ready documentation. The directive does not reward year-end heroics. Regulators expect continuous monitoring and clear evidence trails: what was known, when it was known, what decision was made, and who made it. If your documentation is reconstructed at audit time, you have already failed the standard.
The indirect pressure pattern
The operational pattern most mid-market procurement teams are already seeing works like this. A large EU customer sends a supplier questionnaire that now includes scope-3 emissions data, human-rights incident history at your Tier-2 suppliers, and a request to attest to your own supplier due diligence. The questionnaire is a contract gate — answer it or lose the renewal. You answer it by pulling data from spreadsheets, emailing your own suppliers, and writing best-effort responses for what you do not know.
That pattern is sustainable exactly once. The next time the questionnaire arrives, it will ask for more, and it will ask more precisely. By 2029, the enterprise customers sending those questionnaires will themselves be under direct CSDDD audit, and their attestations will be your attestations.
The procurement teams that win this transition are the ones that stop treating supplier questionnaires as ad-hoc work and start treating them as data queries against a living supplier intelligence system.
A CSDDD due diligence workflow beyond Tier 1
The amended directive keeps the steps in Articles 7 to 16 of Directive (EU) 2024/1760. For a procurement team they translate into a repeatable workflow.
Embed due diligence in policy (Article 7). Write the policy, supplier code of conduct and escalation rules, and name the owner.
Scope the chain of activities (Article 8). Use reasonably available information, such as sector, country, raw material and product risk, to find the general areas where adverse impacts are most likely and most severe. This covers your own operations, subsidiaries and business partners in the chain, not only direct suppliers.
Assess the high-risk areas in depth (Article 8). Go deeper only where the scoping points. This is where Tier 2 and Tier 3 mapping belongs.
Prioritise (Article 9). Rank impacts by severity and likelihood when you cannot address all of them at once.
Prevent, end and remediate (Articles 10 to 12). Use corrective action plans, contractual assurances and supplier support. Keep a bench of qualified alternative suppliers so that acting on a finding does not stop production.
Engage stakeholders and run a complaints channel (Articles 13 and 14). Make the notification mechanism reachable for workers at supplier sites.
Monitor (Article 15). Reassess after significant changes, when new risks appear, and at least every five years.
Communicate (Article 16). Public reporting applies to financial years starting on or after 1 January 2030.
One rule shapes how you collect data beyond Tier 1. Companies may request information from business partners only where it is necessary, and from partners with fewer than 5,000 employees only when it cannot reasonably be obtained by other means (Directive (EU) 2026/470). Start with public and third-party data, and send questionnaires second. The Commission will also publish guidelines and voluntary model contractual clauses, with the main guidelines due by 26 July 2027 (European Commission).
What to do in 2026
If you are a procurement leader at a mid-market or enterprise company, a reasonable 2026 agenda looks like this.
Q2 2026 — audit what you have. Inventory every piece of supplier data you hold today. Where does it live? What is the refresh cadence? Who owns each field? Where do your current supplier questionnaires break? You cannot plan the transition until you know the baseline.
Q3 2026 — pick a data spine. You will not meet a living-risk-register standard with spreadsheets. Choose the platform that will own continuous supplier monitoring. This does not need to be a full rip-and-replace of your ERP or procure-to-pay. The smart move for most mid-market teams is an intelligence layer. A system that sits on top of your existing stack and continuously vets, scores, and monitors your supplier base.
Q4 2026 — connect governance. Assign the single accountable owner the directive expects. Draft the supplier code of conduct. Rewrite the standard supplier contract to include data-access and on-site audit clauses.
2027 — operate. Run the intelligence layer in production. Answer supplier questionnaires out of the system, not out of spreadsheets. Start receiving your first continuous-monitoring alerts. Iterate on the contract templates.
2028–2029 — audit readiness. By the time the transposition deadline hits, your procurement team should be able to answer every CSDDD-adjacent question with a timestamp, a source, and a documented decision.
A note on database size
Supplier intelligence vendors often lead with the size of their database. Coverage matters when you are looking for alternatives, but for CSDDD work size alone is the wrong measure.
The operational requirement is a defensible, documented view of the specific suppliers your business actually uses: what you know about each one, where that evidence came from, and when it was last checked. When you compare platforms, ask how each claim about a supplier is sourced and how often it is refreshed, not only how many suppliers are in the index.
“The procurement teams that handle CSDDD well will not be the ones with the biggest supplier database. They will be the ones who can tell you, on demand, which suppliers they actually work with, what they know about each one, when they last verified it, and what they did when a red flag appeared.” — Adam Wessling, CMO, Speya (formerly Find My Factory)
CSDDD tools: the landscape by category
No single tool covers the whole workflow. Most compliance stacks combine several categories.
Category | What it does | CSDDD steps it supports |
|---|---|---|
Supplier discovery and screening | Finds suppliers and screens them against certification, ESG and financial criteria before onboarding. | Scoping, prevention, alternative sourcing |
ESG ratings and assessments | Scores supplier sustainability performance through structured assessments. | In-depth assessment, prioritisation |
Due diligence and risk monitoring platforms | Run risk analysis, track suppliers over time and raise alerts on incidents. | Assessment, monitoring, documentation |
Supplier questionnaires and data-sharing platforms | Collect self-assessments, audits and certificates, often shared across buyers. | In-depth assessment, monitoring |
Grievance and whistleblowing channels | Let workers and communities report concerns. | Notification and complaints |
ERP and P2P systems | Hold the supplier master, contracts and spend data. | Policy enforcement, documentation |
When you compare vendors, ask whether every data point carries a source and a date, and whether the tool reduces the questionnaires your smaller suppliers receive.
Speya belongs in the first category and works as the front end for your compliance stack. Describe the need in plain language; AI agents search millions of supplier profiles across 250+ data sources and return AI-vetted shortlists with sources beside every name. It screens at discovery and works alongside platforms such as EcoVadis and IntegrityNext, which do deep ESG scoring and monitoring. It does not replace them (Does Speya replace EcoVadis or IntegrityNext?).
Supplier risk monitoring for EU procurement teams
Under CSDDD, monitoring means checking that your measures still work and that no new risks have appeared. A practical setup has three layers.
Signals. Track the events that change a supplier's risk, such as incidents, financial stress, expiring certifications and new regulatory exposure.
Triggers. Decide in advance which signals start a reassessment and who acts on them.
Evidence. Log each signal, decision and date, so the record exists before anyone asks for it.
For the detail, see our guides to a supplier risk management framework, event-driven alerts for supplier risks, supplier financial health monitoring and key risk indicators for supplier risk profiling. Speya's role is to screen suppliers at discovery and to find compliant alternatives quickly when monitoring flags a supplier you need to replace.
How Speya helps
Speya is an AI-vetted supplier intelligence platform used by European enterprise procurement teams. For CSDDD-adjacent work, three capabilities matter.
First, continuous vetting. Every supplier in the active workspace is re-vetted on a running cadence by AI agents, not by a one-time certification. This maps directly to the living-risk-register requirement.
Second, sourced documentation. Every supplier attribute — compliance status, financial signal, certification, ownership change — has a timestamp and a source attached. When the audit question comes, you do not reconstruct the answer. You export it.
Third, intelligence-layer integration. Speya sits on top of SAP Ariba, Coupa, Ivalua, or whatever your current procurement spine is. The supplier records in your ERP stay canonical; Speya enriches and monitors them. No rip-and-replace.
Book a 30-minute CSDDD readiness review with our team if you want a structured walk-through of your current supplier-data footprint and where the gaps are.
FAQ
Did Omnibus I cancel CSDDD? No. It amended scope and timelines. Transposition into national law is due by 26 July 2028, and the obligations apply from 26 July 2029. The directive itself remains in force.
Who is still in CSDDD scope after Omnibus I? Direct obligations apply to EU companies with more than 5,000 employees and more than 1.5 billion euros in net worldwide turnover, to non-EU companies with more than 1.5 billion euros of net turnover in the EU, and to certain franchising and licensing groups. Mid-market companies below the thresholds face indirect pressure through upstream customer requirements.
Does the German Supply Chain Act (LkSG) go away because of Omnibus I? No. LkSG is a separate German national law with its own thresholds, which are lower than the revised CSDDD thresholds. LkSG obligations continue regardless of CSDDD scope. A pending amendment would remove the reporting duty, but the core due diligence duties remain.
What is the difference between CSDDD and CSRD? CSDDD is about action, identifying, preventing, and mitigating adverse human-rights and environmental impacts in your chain of activities. CSRD is about reporting, disclosing how you handle those impacts. Most procurement teams need both, but CSDDD is the operational burden.
Do I need new supplier data tools to comply? You need a data spine that supports continuous monitoring, not static annual assessment. Whether that is a new tool or an upgrade to your existing stack depends on what you have today. An intelligence layer on top of your existing ERP or P2P is usually less disruptive than a full replacement.
When should I start? Now. The 2028 transposition deadline is a legal gate, but the indirect pressure from your enterprise customers is already here and is already escalating. Teams that wait until 2027 will be meeting a higher standard than teams that start in 2026.
What tools do companies use for CSDDD due diligence? Most teams combine several categories rather than one tool: supplier discovery and screening to vet suppliers before onboarding, ESG ratings for structured assessments, due diligence and risk monitoring platforms for ongoing tracking, supplier questionnaire and data-sharing platforms, a grievance channel, and the ERP or P2P system that holds the supplier master. Map tools to the steps of the directive before you buy.
Does CSDDD require due diligence beyond Tier 1 suppliers? It can. After Omnibus I, companies run a scoping exercise across their own operations, subsidiaries and business partners in the chain of activities, then assess in depth where adverse impacts are most likely and most severe. The final text did not adopt the proposal to limit obligations to direct business partners, so a high-risk Tier 2 or Tier 3 supplier can fall inside your assessment.
About the author. Adam Wessling is CMO at Speya, a European supplier-intelligence platform used by enterprise procurement teams at IKEA, PwC, Deloitte, EY, Ahlsell, and Stark Group. He writes about AI-driven supplier discovery, procurement operations, and European regulatory compliance. Connect on LinkedIn.
Where Speya fits
Compliance starts with the suppliers you consider. Speya screens suppliers for ESG, certifications, and financial health at the point of discovery, so every shortlist already clears your compliance bar, and the data your CSDDD obligations depend on is captured up front rather than chased after the fact. Related: CSDDD.