CSDDD and CSRD: your customers' due diligence and reporting duties

In brief

Two EU directives determine what large customers in Europe want to know about sustainability. The Corporate Sustainability Reporting Directive (CSRD, Directive (EU) 2022/2464) requires sustainability reports under the European Sustainability Reporting Standards (ESRS), including information on the value chain. The Corporate Sustainability Due Diligence Directive (CSDDD, Directive (EU) 2024/1760) requires very large companies to identify, prevent and bring to an end adverse impacts on human rights and the environment in their chain of activities.

Both directives were cut back sharply in 2025 and 2026. First, the “stop-the-clock” Directive (EU) 2025/794 postponed the deadlines. Then the Omnibus I package, Directive (EU) 2026/470, changed their scope and content. It was published in the Official Journal on February 26, 2026 and entered into force 20 days later.

Neither directive applies directly to suppliers in South America unless they are very large themselves and generate a lot of revenue in the EU. The requirements reach them through customers' questionnaires, codes of conduct and contract clauses.

Who it affects in South America

Only large groups from the region with substantial EU business are directly affected, for example in agricultural trading, mining or the food industry. For them, the CSDDD applies from 2029; the CSRD applies as soon as the EU turnover thresholds are reached.

The usual case is indirect. An auto parts maker in Córdoba, a winery in Mendoza or a coffee exporter in Huila gets requests from customers that have to report or meet due diligence obligations themselves. They ask about working conditions, wages, occupational safety, environmental impact and the emissions data the customer needs for its own greenhouse gas inventory.

National laws continue to apply alongside the EU directives, such as the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz) and the French duty of vigilance law (“Loi de vigilance”). Customers from these countries therefore often ask detailed questions already today.

In practice, the requests land with sales, not with management. Decide who answers them and who signs off on the answers. Contradictory information given to different customers does more harm than an open gap that you name, together with a plan and a date.

Deadlines

The largest listed companies in the EU have been reporting under the CSRD since financial year 2024. Many of your customers have therefore already published a report and know what data they need. The financial year from which a particular company reports under the new CSRD depends on its size and on the national implementing law. Ask your customer directly when it will need your data.

Omnibus I removed the obligation to adopt a climate transition plan from the CSDDD and set a uniform cap on fines of 3% of worldwide net turnover.

What EU customers actually ask for

One change matters especially to suppliers: the value chain cap on information requests. Companies with an average of no more than 1,000 employees are protected. A customer that has to report may not ask them, for its CSRD report, for more information than the voluntary standard for such companies provides. If it asks for more, it must point out that you are not required to supply the additional information.

For due diligence under the CSDDD, the cap does not apply in the same form. A large customer has to identify risks in its chain of activities and can require contractual assurances from direct business partners for this purpose, such as compliance with its code of conduct. The directive provides that it should support small and medium-sized business partners and not impose disproportionate costs on them. If there is a specific suspicion, for example reports of child labor at supplier farms, it will ask more detailed questions and demand remediation. Under the directive, ending the business relationship is a last resort.

Typical requests:

• A signed supplier code of conduct.
• A questionnaire or a rating through platforms such as EcoVadis, Sedex or IntegrityNext.
• A sustainability report under the voluntary standard for SMEs (VSME).
• A greenhouse gas inventory for Scope 1 and 2 under the GHG Protocol or ISO 14064.
• Social audits, such as SMETA, amfori BSCI or SA8000.
• A grievance mechanism through which employees and local residents can report abuses.
• ISO 14001 and ISO 45001 certificates.

First steps

1. Count your employees. Below 1,000, you are protected against CSRD requests and can politely limit excessive questionnaires.
2. Gather your EU customers' requests and look for the overlaps. The same metrics usually come up again and again.
3. Prepare a greenhouse gas inventory once and update it every year.
4. Write a short report under the VSME standard. It answers many questions in one go.
5. Set up a simple grievance channel and document how you handle reports.
6. Check your own upstream suppliers for labor and environmental risks, especially where seasonal work, subcontractors or raw materials from high-risk areas play a role.

The free EU Readiness Check shows where you stand overall.

How it relates to certifications

Neither directive requires a certificate. ISO 14001 demonstrates orderly environmental management and supplies data for your customers' reports. ISO 9001 shows documented processes, which auditors like to see. For food exporters, the food safety standards come on top. If you supply carbon-intensive industries, you will also need the emissions data for CBAM.

The due diligence obligations of the CSDDD overlap with the EUDR and the Forced Labour Regulation. Once you know your supply chain, you can serve all three. A tool such as Sightadel helps you keep evidence and answers for many customers in one place.

FAQ