Sustainability Due Diligence
The question most companies want answered first is simple: does this apply to us? After the 2026 Omnibus amendments, for most Finnish companies the answer is not directly — but yes, through contracts. That is different from not at all, and it calls for different action than a full CSDDD programme.
Who the due diligence obligation covers — and who it does not
After the Omnibus I amendments, the Corporate Sustainability Due Diligence Directive (CSDDD) binds only very large companies. EU companies are in scope with more than 5,000 employees and more than €1.5 billion in worldwide turnover. Companies established outside the EU are subject to an equivalent threshold based on their EU turnover.
Member States must transpose the directive by 26 July 2028, and it applies from 26 July 2029 — uniformly, without the phase-in originally planned. Penalties can reach three per cent of worldwide turnover. EU-level civil liability was removed late in the process, so liability for damages is left to national law.
In Finland, around twenty companies exceed the threshold. If yours is not one of them, the directive does not bind you directly.
The obligation still reaches you by three routes:
- As a customer’s contract term. Companies in scope pass their obligations down the value chain, and they do it through contracts.
- As a qualification requirement in a tender. The requirement appears before any contract is negotiated.
- Through regulation that ignores company size. Most visibly the EU Forced Labour Regulation, which bans products made with forced labour from the EU market from 14 December 2027 for every economic operator, regardless of size.
For most companies, the relevant question is therefore not the CSDDD’s scope but what you have already committed to in your contracts — and what your customers will ask of you next.
What the obligation requires in practice
Due diligence is not a single document but a continuous cycle. It originates in the UN Guiding Principles on Business and Human Rights and the OECD Guidelines, and the same structure recurs throughout EU regulation:
- Embedding. The obligation is written into policies and management systems so that it steers decisions instead of sitting in a separate document.
- Identification and assessment. Actual and potential adverse impacts in your own operations, subsidiaries and business relationships.
- Prevention and cessation. Measures that prevent or mitigate an impact, or bring it to an end.
- Monitoring. Assessing whether the measures worked — not whether they were taken, but whether they were effective.
- Communication. What has been done and what has been found.
- Remediation. Corrective action when harm has already occurred.
Omnibus split the assessment into two stages: first a scoping exercise based on reasonably available information, to identify where the most severe and most likely impacts are, and only then an in-depth assessment in those prioritised areas. Business partners with fewer than 5,000 employees are asked for information only where it is necessary and not reasonably available by other means.
The change matters. The regulation does not require the whole supplier base to be examined with equal depth. It requires you to be able to explain why you looked where you looked.
Where most companies start at the wrong end
Regulation has been in motion, but the mistakes stay the same. These five come up in most assignments.
The questionnaire goes out before anyone has decided what the answers are for.
A questionnaire to a hundred suppliers produces a hundred answers and no decisions. A risk-based approach requires the opposite order: first an assessment of where severe harm is most likely, then depth in those places.
The Supplier Code of Conduct is written as an annex that binds no one.
It is not part of the contract, nothing follows from breaching it, and there is no mechanism for correcting a gap once found. The document exists; the obligation does not.
Prioritisation follows purchasing volume.
The biggest suppliers are reviewed first because they are the biggest. The regulation requires prioritisation by the severity and likelihood of harm — and those rarely point to the same supplier.
Sustainability is placed in the reporting function.
Buyers are then left out — even though purchasing decisions, lead times and forecast accuracy create a large share of the risk at the supplier’s end.
Remediation is forgotten.
It is the only stage of the cycle that requires preparation before anything has happened. Most companies have nothing in place for the day something is found.
How we help
- 01 Applicability assessment
What binds you directly, what reaches you through your customers’ contracts, and what does not apply at all. - 02 Risk mapping
Through the value chain, prioritised by the severity and likelihood of harm. - 03 Contracts and purchasing practices
The obligation turned into contract terms that actually bind — and into purchasing practices that do not create the risk with the other hand. - 04 Implementation and training
Procurement, legal and the business at the same table. - 05 Documentation
In a form that withstands a customer audit or a regulator’s scrutiny.
Frequently asked questions
Does the CSDDD apply to our company of 800 employees?
Not directly. The threshold is more than 5,000 employees and €1.5 billion in turnover. The obligations can still reach you as your customers’ contract terms, and some regulation applies regardless of size.
When do the obligations start?
Member States must transpose the directive by 26 July 2028, and it applies from 26 July 2029. As contract terms, the requirements are already circulating, because companies in scope are preparing in advance.
Is a Supplier Code of Conduct enough?
It depends on whether it is part of the contract, whether anything follows from a breach, and whether there is a mechanism for correcting a gap. A document on its own is not enough.
What is the difference between the CSRD and the CSDDD?
The CSRD is about what you report. The CSDDD is about how you act. A reporting obligation can be met without anything changing in practice — the due diligence obligation cannot.
What changed in the Omnibus package?
The scope narrowed significantly, the timetable moved by two years, the obligation to adopt a climate transition plan was removed, and EU-level civil liability was left to national law.
Let’s establish what actually binds you.
The first conversation is free of charge. We go through your company’s size, your value chain and the requirements your customers have already raised — and work out what to do first.