CSRD / ESRS
CSDDD: Supply Chain Due Diligence
What the Corporate Sustainability Due Diligence Directive requires, who it covers, and how to merge supply chain mapping with your DPP programme.
CSDDD requires large companies to identify, prevent and report human rights and environmental risks in their own operations and value chains. It is not the same as a DPP — but it wants the same supply chain map.
What CSDDD requires
- Identify adverse impact risks in the value chain.
- Prevent or mitigate them.
- Remediate impacts.
- Monitor and report on the process.
The first step is mapping your supply chain: who makes what, where?
Overlap with the DPP
| Requirement | CSDDD | DPP |
|---|---|---|
| Supplier identity | Yes | Yes |
| Facility location | Yes | Yes |
| Chain depth | Risk-based | Material-based |
| Material origin | For high-risk commodities | Yes |
| Certificates and audit records | Yes | Yes |
| Product-level breakdown | No | Yes |
See tier-2 and tier-3 transparency and supply chain traceability.
Designing one programme
- Create one supplier master record: identity, facility, country, certificates, risk score.
- Record the product-supplier relationship: which material from which supplier.
- Add a risk layer: country, sector and commodity risk indicators.
- Share the evidence file: audit reports can serve as both CSDDD and passport evidence.
Battery due diligence
The Battery Regulation has its own due diligence regime, delayed two years to 18 August 2027 by Regulation (EU) 2025/1561. The due diligence report appears in the battery passport by August 2028 at the latest. See the battery passport guide.
Frequently asked questions
I am out of CSDDD scope. Why should I care?
Your in-scope customers will ask you for information and commitments. See DPP clauses for supplier contracts.
Do I have to map the entire chain?
CSDDD is risk-based, going deeper where risk is high; the DPP goes by material. Combining the two produces a practical priority order.
Should audit reports be published in the passport?
Not in the public tier. They can be opened to authorised roles in a restricted tier. See restricted data tiers.
