Changes in the CS3D: What the Updated Corporate Sustainability Due Diligence Directive Means for EU and UK Companies

‍

The Corporate Sustainability Due Diligence Directive (CS3D) or (CSDDD), in force since 25 July 2024, requires in-scope companies to carry out a six-step due diligence cycle on human rights and environmental impacts across their own operations, subsidiaries and chain of activities, replacing a patchwork of national laws with a single EU standard.

‍

Entered into force on 18 March 2026, the Omnibus I Directive keeps that six-step structure intact, but softens what each step requires in practice, and narrows who must follow it: around 70% of previously in-scope companies no longer qualify.

‍

While the CS3D is only law in the European Union (EU), it carries implications for extra-EU companies in the value chains of obligated in-scope companies, or companies with significant EU generated turnover.

‍

Here’s everything you need to understand what has changed in the CS3D under Omnibus I, which companies are now in scope, and how to prepare for the upcoming 2029 compliance deadline.

‍

The main changes to the CS3D at a glance:

‍

• Higher thresholds: 5000+ employees and €1.5 billion+ net worldwide turnover for EU companies; €1.5 billion+ net EU turnover for non-EU companies.
• Later deadline: a single application date of 26 July 2029, replacing the 2027/2028/2029 phase-in.
• Lighter mapping: area-based scoping replaces full entity-level mapping.
• Tighter information requests: a necessity test, with extra protection for partners under 5000 employees.
• Reduced stakeholder involvement: stakeholder consultation on indicator development is no longer mandatory.
• Less frequent monitoring: every five years instead of every 12 months.
• Reduced exposure: penalties capped at 3% of net worldwide turnover (previously at least 5%), and civil liability left to national law.
• Climate transition plan: the obligation is removed.

‍

‍

‍

Who is in scope now: EU and non-EU thresholds

‍

Under the updated CS3D threshold, EU companies or groups, assessed on a consolidated basis, with over 5000 employees and over €1.5 billion global net turnover are in scope, and therefore required to complete the due diligence process. Non-EU companies exceeding €1.5 billion net turnover generated in the EU are also in scope.

‍

Are UK based companies affected by the CS3D?

‍

UK-based companies can be affected by the CS3D directly if EU-generated turnover alone clears the non-EU threshold, or indirectly, through, membership of an in-scope EU parent group, or a position in an in-scope company's chain of activities.

‍

Are UK parent companies with EU operations affected by the CS3D?

‍

Non-EU companies are not assessed the same way as EU companies. Rather than testing employees and worldwide turnover together, the CS3D applies a single criterion to non-EU groups: net turnover generated within the EU, consolidated across the group, exceeding €1.5 billion, up from €450 million before Omnibus I. There is no separate employee threshold for non-EU companies, which means a group with a relatively lean headcount can still fall in scope if its EU sales volume is high enough. This means a UK, US or Asian parent company can be pulled into scope purely on the strength of EU-facing sales, exports, licensing income or branch revenue without ever setting up a formal EU entity.

‍

A non-EU company falling within this scope must carry out due diligence obligations covering their entire global operations, their subsidiaries, and their chain of activities (including relevant business partners upstream and, downstream, distribution, transport and storage of products).

‍

CS3D Exemptions for non-EU parent companies

‍

A non-EU parent company may designate an EU subsidiary to fulfil the CSDDD obligations on the group's behalf it has, a) no engagement in management, operational, or financial decisions affecting the group and, b) the subsidiary has the necessary capabilities. This exemption must be approved by the competent national supervisory authority, and the ultimate parent remains jointly liable alongside the designated subsidiary for any failure to comply

‍

UK companies in CS3D compliant chains of activity

UK suppliers in an in-scope company's chain of activities can be asked for information necessary to the due diligence process. If a UK supplier has fewer than 5000 employees, it can only be asked for information that cannot reasonably be obtained by other means. Where several suppliers could provide the same information, the in-scope company must prioritise its request toward the supplier where adverse impacts are most likely to occur. In practice, a UK supplier unable or unwilling to provide this information risks becoming less attractive to EU customers who need it to meet their own CSDDD obligations, even though the supplier itself has no direct legal duty to comply.

‍

Are franchises in scope for CS3D compliance ?

A separate, parallel test applies to non-EU companies operating in the EU through franchising or licensing models. These are assessed against the same raised thresholds that apply to EU franchisors: €75 million in EU-generated royalties (up from the original €22.5 million) combined with €275 million in net worldwide turnover (up from €80 million).

‍

The practical implication for UK companies is straightforward but frequently missed: not having an EU subsidiary does not mean being out of scope. Determining exposure requires consolidating turnover across every EU-facing revenue stream: direct exports, EU branch activity, and any licensing or franchising arrangements, rather than simply checking whether the group has incorporated an entity in the EU.

‍

CS3D vs. UK domestic due diligence expectations

At present, UK law regarding human rights risks in supply chains and operations only necessitates disclosure of risks, not a full due diligence process comparable to the CSDDD. Under Section 54 of the Modern Slavery Act 2015, companies operating in the UK with a global turnover equal to or exceeding £36 million must publish an annual statement describing the steps taken to address modern slavery in their operations and supply chains.

‍

While companies are required to report their actions, reporting that no steps have been taken towards risk prevention or remediation is technically legally acceptable despite carrying reputational risks.

‍

This legal landscape is evolving. The Commercial Organisations and Public Authorities Duty (Human Rights and Environment) Bill, proposed 17 June 2026, puts forth a duty to act on and prevent human rights abuses and environmental harms model for UK companies. It builds on Section 54 to require organisations to conduct thorough due diligence across their entire global value chains, extending responsibility well beyond immediate suppliers. Non-compliance carries severe penalties, including criminal liability for directors and civil fines of up to 10% of global turnover.

‍

As a Private Member's Bill, the future of the Human Rights and Environment Bill is uncertain, but a UK company building CS3D-aligned due diligence processes now gets a head start on three fronts:

‍

• Compliance readiness: if the company itself falls into CS3D scope ahead of the 2029 deadline, or becomes part of an in-scope group's chain of activities
• Commercial resilience: remaining an attractive, low-friction supplier to EU customers who need due diligence data to meet their own CS3D obligations
• Regulatory foresight: being prepared for the direction UK law is likely to take, even though the Bill itself hasn't passed

‍

Key dates: the new CS3D transposition and application timeline

The Omnibus I amendments reshape the CS3D’s entire rollout, replacing the original phased, size-based schedule with a single uniform timeline and pushing every milestone back by roughly two years. Here's what companies need to track:

• 26 July 2027: Commission guidance. The European Commission must adopt its first wave of CS3D implementation guidelines.
• 26 July 2028: Member State transposition. This is the deadline for EU Member States to transpose the amended CS3D into their own national law. Transposition sets the legal framework each country will use to enforce the Directive once it starts applying the following year.
• 26 July 2029: Single application date. Rather than the original three-tier, size-based rollout (2027/2028/2029), every in-scope company, EU and non-EU alike, now becomes subject to the CS3D's due diligence obligations on this one date, regardless of size.
• Financial years starting on or after 1 January 2030: Annual reporting begins. The CS3D's reporting and communication obligations under Article 16 are deferred a year beyond the application date itself, giving companies a short runway between having to comply with due diligence duties and having to formally report on them.
• 26 July 2031: First review report. The Commission must submit its first report assessing the implementation and effectiveness of the Directive, including whether the Article 2 scope thresholds should be revised, and whether a sector-specific approach should apply to high-risk sectors, which potentially pulls smaller companies or specific industries back into scope.

‍

How Sami supports your CS3D compliance strategy

CS3D preparation shouldn’t start at the last minute, much of the groundwork can be built now, well ahead of the 2029 compliance deadline.

‍

In partnership with SGS, Sami supports you in your global mapping process, identifies the areas of highest risk, and guides you in the creation of mitigation strategies. Sami’s data collection approach is built for supplier engagement, and facilitates collecting the necessary data across your chains of operations. A dedicated UK team also keeps pace with the evolving domestic regulatory picture so your approach stays aligned with both EU requirements and what's coming at UK level.

‍

{{newsletter-blog-3}}

‍

FAQ

‍

Does the CS3D still apply to UK companies after Brexit?

‍

Yes, although the UK is no longer a member of the European Union, UK companies can fall into scope for CS3D compliance through large scale EU operations, membership of an in-scope EU parent group, or a position in an in-scope company's chain of activities.

‍

What is the new minimum threshold to be in scope of the CS3D?

‍

The new minimum threshold to be in scope of the CS3D is over both 5000 employees and €1.5 billion global net turnover for EU companies. Non-EU companies exceeding €1.5 billion net turnover generated in the EU are also in scope.

‍

When do the amended CS3D rules actually apply to my company?

‍

All in-scope companies must comply by 26 July 2029. Reporting of CS3D compliance must be published autonomously from fiscal years beginning 1 January 2030.

‍

Is civil liability under the CS3D still harmonised across the EU?

‍

Civil liability is no longer harmonised across the EU under the updated CS3D. It is instead left to national law, with Member States free to determine their own liability rules, provided injured parties retain a right to full compensation where liability exists.

‍

‍