EU CSDDD compliance looked very different in early 2026 than it does now. The Omnibus simplification package was published in the Official Journal in February 2026. It pushed the transposition deadline to July 26, 2028, and application to July 26, 2029 (Covington & Burling, Feb 2026). That is a real delay, not a rumor. Even so, brands that wait until 2029 to start will run out of runway fast.
The revised thresholds also narrowed who needs EU CSDDD compliance in the first place. Only EU companies with 5,000 or more employees fall in scope now. They also need over 1.5 billion euros in net worldwide turnover. Non-EU companies generating that same turnover inside the EU fall in scope too. This guide covers what changed. It also covers who is actually covered, and what a fashion brand’s compliance plan needs to track between now and 2029.
What Does EU CSDDD Compliance Require From Fashion Brands?
EU CSDDD compliance requires a documented, risk-based due diligence process. That process covers a company’s own operations, its subsidiaries, and its direct business partners. In practice, that means identifying where human rights and environmental harm is most likely. In turn, a brand has to act on what the assessment finds. Notably, a fashion brand cannot simply state that it cares about its supply chain.
Specifically, the directive runs on a two-step due diligence process. First, a scoping exercise uses information the company already has to flag likely risk areas. Second, an in-depth assessment covers those flagged areas in detail. Notably, requests for information from a small business partner are capped. A supplier with fewer than 5,000 employees is not buried in paperwork as a result.
Which Fashion Brands Fall Under the Revised CSDDD Thresholds?
Before the Omnibus revision, CSDDD applied to companies with 1,000 or more employees. In turn, the turnover threshold sat at 450 million euros, a much wider net. Under the current rule, EU CSDDD compliance only applies to EU companies at 5,000 employees and 1.5 billion euros in consolidated turnover. Non-EU companies fall in scope too, once they generate that same 1.5 billion euros inside the EU (Covington & Burling, Feb 2026).
Scope shift: The Omnibus revision removed thousands of mid-sized companies from direct CSDDD obligations. That said, a mid-sized supplier to a large brand still feels the effect indirectly. The large brand’s own due diligence obligations still reach into its supply base.
As a result, most independent fashion brands will not carry direct obligations under the directive themselves. Even so, any brand selling into a large retailer’s supply chain should expect a request. That retailer’s compliance team will likely ask for documentation well before 2029.
In fact, the non-EU threshold catches more brands than it first appears to. A US-based fashion company does not need EU headquarters to fall in scope. Notably, generating over 1.5 billion euros in turnover from EU sales alone is enough. That holds regardless of where the parent company is based. A fast-growing brand selling primarily through EU wholesale and e-commerce channels should track its EU revenue against that threshold every year, not just once.
What Are the Key CSDDD Compliance Dates Fashion Brands Need to Track?
Three dates anchor EU CSDDD compliance planning. Member states must transpose the directive into national law by July 26, 2028. The directive then applies to covered companies starting July 26, 2029. In between, the European Commission has to publish its first implementation guidelines. Those guidelines are due by July 26, 2027 (Covington & Burling, Feb 2026).
That 2027 guidance date matters more than it looks. In practice, a brand that waits for final guidance before building any supplier risk mapping will have roughly two years left before application day. Building that supplier documentation earlier, even informally, gives a brand time to fix data gaps. Otherwise, those gaps quietly turn into compliance gaps.
Why Does CSDDD Focus on Tier-1 Suppliers Instead of the Full Supply Chain?
Under the revised directive, detailed due diligence centers on tier-1 business partners. That means the factories and mills a brand contracts with directly. Deeper-tier due diligence, covering raw material suppliers and sub-contractors, works differently. It only kicks in where credible evidence points to risk further down the chain (Carbonfact, 2026).
For a fashion brand, that still means real work. EU CSDDD compliance at the tier-1 level covers water use and wastewater discharge at textile mills. It also covers chemical management practices, energy use, and material sourcing risks such as deforestation-linked fibers. A brand has to map which of its direct factories sit in higher-risk regions or processes. It also has to document why.
What Happened to the Civil Liability Rule in the Omnibus Revision?
The original CSDDD text created a mandatory EU-wide civil liability regime. Specifically, that regime let affected parties sue a company directly under harmonized rules. The Omnibus package removed that mandatory regime entirely. Liability for a breach now falls back to each member state’s own national rules and court procedures (Covington & Burling, Feb 2026).
Consequently, legal exposure under the directive now varies more by country than the original draft intended. A review is scheduled for July 2031. That review will revisit whether an EU-wide liability framework should return. For now, a brand’s legal exposure still depends heavily on where its EU entity is based.
How Does EU CSDDD Compliance Differ From the EU Digital Product Passport and RSL Rules?
Fashion brands already track several overlapping EU compliance regimes. In practice, it helps to separate them clearly. Our EU Digital Product Passport guide covers product-level labeling and material disclosure, not supply chain conduct. Our RSL compliance guide covers chemical limits inside the finished garment itself.
The due diligence directive sits in a different lane again. It instead governs how a company investigates and responds to human rights and environmental risk across its business relationships, not what a product label says or what chemicals a fabric contains. A brand can pass RSL testing and still fail to document its tier-1 due diligence process. Each framework needs its own tracking. In fact, passing one says nothing about the others.
What Do Corrective Action and Remediation Look Like in Practice?
When a due diligence assessment turns up an actual adverse impact, a company has to build a corrective action plan. That plan needs clear timelines and measurable milestones. It tracks progress toward fixing the specific issue, not a general improvement pledge. Importantly, remediation steps have to stay risk-based. They also have to stay proportionate to how much influence the company actually has over that supplier (Carbonfact, 2026).
Ending a supplier relationship is a last resort. It only happens after other mitigation steps fail to fix the problem. In practice, that sequencing matters for fashion brands with long-standing factory partnerships. A brand cannot simply drop a supplier at the first flagged issue and call that compliance. Instead, EU CSDDD compliance expects a documented attempt at improvement first. In turn, the factory relationship stays intact wherever that attempt succeeds.
What Should a Fashion Brand’s CSDDD Compliance Plan Track?
Pulling the requirements above together, EU CSDDD compliance planning needs several distinct records. That holds even for a brand outside the directive’s direct scope but selling to one that is inside it. The table below summarizes the core fields.
| Tracked field | What it covers | Review trigger |
|---|---|---|
| Tier-1 supplier risk map | Factories and mills contracted directly, flagged by process and region risk | New supplier, annual review |
| Code of conduct acknowledgment | Human rights and environmental standards embedded in supplier contracts | Contract renewal |
| Deeper-tier evidence log | Documentation triggering an in-depth assessment beyond tier 1 | Credible risk signal identified |
| Corrective action plans | Timelines and milestones for identified adverse impacts | Assessment finding |
| Information request cap tracking | Confirming requests to sub-5,000-employee partners stay within the cap | Every supplier request |
Notably, a brand can hold a clean RSL test result and a compliant Digital Product Passport while its tier-1 risk map sits years out of date. In fact, all three gaps often go unnoticed until a retail customer’s audit team asks for the underlying documentation. Tracking these fields against the same style and supplier records used for sourcing keeps that documentation ready before it gets requested. On the other hand, splitting them into a separate compliance binder does not.
Where Does Wave PLM Fit Into an EU CSDDD Compliance Plan?
Wave PLM ties supplier risk data, code-of-conduct status, and corrective action timelines to the same vendor record used for sourcing and costing. Our vendor onboarding guide covers how a factory or mill gets set up in that record in the first place. Specifically, a tier-1 risk flag stays attached to the exact supplier and factory it applies to. Otherwise, it would live in a separate spreadsheet that goes stale.
Our fabric sourcing workflow guide covers how lead time and supplier data already get tracked at the component level. That same structure extends naturally to due diligence evidence. A brand’s sourcing team and its compliance team end up looking at the same supplier record, instead of two disconnected systems.
This also matters beyond CSDDD alone. The same tier-1 factory data, risk flags, and corrective action history feed other reporting obligations. In turn, a growing brand eventually faces sustainability disclosures under related EU rules too. Building one clean supplier record now saves a brand from rebuilding that same data three separate times for three separate compliance deadlines.
Frequently Asked Questions
What is EU CSDDD compliance and who does it apply to?
The directive requires a documented, risk-based due diligence process. It covers a company’s operations and direct business partners. After the Omnibus revision, it applies to EU companies with 5,000 or more employees and over 1.5 billion euros in turnover. In addition, non-EU companies generating that turnover inside the EU fall in scope too.
When does EU CSDDD compliance actually take effect?
Member states must transpose the directive into national law by July 26, 2028. It then applies to covered companies starting July 26, 2029. The European Commission’s first implementation guidelines are due by July 26, 2027.
Does the directive require checking raw material suppliers, not just factories?
Detailed due diligence under the directive centers on tier-1 business partners. That means the factories and mills a brand contracts with directly. In practice, deeper-tier checks, covering raw material suppliers, only apply where credible evidence points to risk further down the chain.
Can affected parties sue a company directly under the revised rules?
Not under a harmonized EU rule anymore. The Omnibus package removed the mandatory EU-wide civil liability regime. Instead, liability now depends on each member state’s own national rules and court procedures. A review is scheduled for July 2031.
How is EU CSDDD compliance different from RSL or Digital Product Passport rules?
The due diligence directive governs how a company investigates and responds to human rights and environmental risk in its supply chain. RSL compliance governs chemical limits inside the finished garment. Instead, the Digital Product Passport governs product-level labeling and material disclosure. Passing one does not confirm the others.
Should a smaller fashion brand outside the CSDDD thresholds still prepare?
Yes, if it sells into a larger retailer’s supply chain. In turn, that retailer’s own due diligence obligations reach into its supplier base. As a result, a smaller brand should expect documentation requests well before the 2029 application date.
The gap between now and July 2029 feels comfortable, right up until a retail customer’s compliance team sends its first documentation request. Brands that map tier-1 supplier risk into their existing sourcing records now will not be scrambling to build that map from scratch in 2028. Is EU CSDDD compliance starting to show up in your retail partners’ vendor questionnaires? Wave PLM can walk through what supplier data you already have. Often, that conversation tends to be shorter than brands expect.
Leave a Reply