Sustainability Law Compliance
Companies are increasingly asked what EU sustainability regulation requires of them. There is no single answer — not because the question is unclear, but because the regulation does not form a single package.
Regulation does not arrive as one package
Sustainability regulation is often discussed as one topic. In legal terms it is not. Three different triggers decide what applies to a company:
- Company size. Sustainability reporting (CSRD) and the due diligence obligation under the Corporate Sustainability Due Diligence Directive (CSDDD) are tied to headcount and turnover.
- The product. The Forced Labour Regulation, the Deforestation Regulation, the Batteries Regulation and the Conflict Minerals Regulation are tied to what a company sells or imports — not to how large it is.
- Position in the market. Some obligations fall on whoever first places a product on the EU market, others also on operators further down the chain.
The same company can therefore fall outside one instrument and be directly bound by another. This is the most common reason why an internal assessment of “does this apply to us” goes wrong.
What binds whom, and from when
The position of the key instruments in autumn 2026:
- Sustainability reporting (CSRD)
After the Omnibus reform the scope narrowed significantly: more than 1,000 employees and more than €450 million in turnover. The first reporting financial year begins on 1 January 2027. - Corporate Sustainability Due Diligence Directive (CSDDD)
More than 5,000 employees and more than €1.5 billion in turnover. National transposition by 26 July 2028, application from 26 July 2029. In Finland, around twenty companies exceed the thresholds. More on due diligence - Forced Labour Regulation
No thresholds at all. It covers everyone who places products on the EU market or exports them from the EU. It applies from 14 December 2027, and the Commission published its guidelines in June 2026. More on the Forced Labour Regulation - Deforestation Regulation
Large and medium-sized operators from 30 December 2026, micro and small enterprises from 30 June 2027. - Batteries Regulation
The due diligence obligations for batteries apply from 18 August 2027. - Conflict Minerals Regulation
Already in force. It covers importers of certain minerals and metals.
Timetables have moved repeatedly, but the changes have not affected every instrument in the same way, and not a single obligation has been removed. Product-based regulation has not narrowed in the way size-based regulation has.
Thresholds do not tell you who is affected
Falling outside the scope does not mean the regulation leaves you alone. A company that is bound has to obtain information about its own value chain and set requirements for it — as contract terms, questionnaires, supplier requirements and audits.
Most Finnish companies meet the regulation exactly this way: as a customer’s questionnaire or a new contract annex, not through an obligation of their own. There are limits — the CSDDD restricts what information large companies may demand from smaller business partners — but the limit does not remove the pressure.
The right question, then, is not whether the company exceeds the thresholds. It is whose value chain the company is in, what it will be asked — and when.
The common core of the obligations
The instruments differ in scope, but most rest on the same logic: a company must identify its risks, assess them, act on the most significant ones, monitor the outcome and be able to show that it has done so.
Two things follow. First, the same groundwork serves several instruments: the risk mapping does not have to be repeated for each one. Second, the part that is usually missing is demonstrability — action has been taken but not documented in a way that would withstand the scrutiny of a regulator or a customer.
Which risks are material, and what level of action is sufficient, is a case-by-case legal assessment. There is no universal template for it, and this is exactly where most companies need an outside view.
Where internal assessments usually go wrong
- Regulation is treated as a reporting question. The CSRD tells you what to disclose. The CSDDD and product-based regulation tell you what to do. They are not the same obligation.
- Responsibility is given to one function. The obligations land simultaneously on procurement, legal, sustainability and management. As one department’s project, they do not get done.
- The final legislative texts are awaited. Part of the work — identifying risks, contract templates, collecting supplier information — takes years and is the same whatever the final wording.
- A system is bought before anyone knows what it is for. A tool does not decide which risks are material for this particular company.
How we help
- 01 Mapping scope and obligations
Which instrument applies to the company, on what basis and from when — and, just as important, which does not. - 02 Gap between current state and obligations
What already exists, what is missing, and which gaps are legally significant. Not every gap is equally serious. - 03 Implementation and governance
Responsibilities, decision-making and documentation, so that compliance can also be demonstrated afterwards.
Frequently asked questions
Does the CSDDD apply to us if we are a subcontractor to a large company?
Not directly. The obligation lies with your customer. In practice it reaches you as contract terms and information requests, which are worth preparing for before they arrive.
Will the regulation still be withdrawn?
The Omnibus reform narrowed the scope and moved timetables, but it did not remove the obligations. Product-based regulation — forced labour, deforestation, batteries — is not tied to thresholds and has not narrowed in the same way.
Is sustainability reporting enough?
No. The reporting obligation and the due diligence obligation are different things: one concerns disclosure, the other action. A report with no process behind it is itself a risk.
Where should we start?
With what holds true regardless of the final wording: which value chain you are in, what you know about it, and what has already been agreed in your contracts.
Unsure which regulation actually applies to you?
Establishing the scope is usually a few hours’ work — and saves months of preparing in the wrong direction. Get in touch and we will go through your situation.