CSDDD Stakeholder Engagement After Omnibus: Narrower on Paper, Still Load-Bearing in Practice

Of all the things Omnibus I changed in the CSDDD, stakeholder engagement is the one most often reported as having been gutted. It was not. It was narrowed in two specific, identifiable places, and the narrowing has been widely over-read into a conclusion that companies no longer need an engagement function at all.

That conclusion is wrong in a way that will be expensive. Engagement remains the mechanism by which a company finds out what is actually happening in its value chain. Remove it and Article 8 risk identification becomes a desk exercise performed on supplier self-declarations, which is precisely the failure mode the directive exists to correct.

This post sets out what the obligation now is, what changed, and how to build an engagement function that will still stand up when the Commission's implementation guidelines arrive.

What Omnibus I actually did

Directive (EU) 2026/470, the CSDDD simplification directive, was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026 (Covington). Two changes bear directly on engagement.

The definition of stakeholder was narrowed. Consumers, for example, are no longer within the definition. This matters less than it sounds for most in-scope companies, whose material human rights and environmental risks sit upstream rather than at the point of sale, but it does remove a category of consultation that some programmes had built in.

Two mandatory consultation trigger points were removed. Most notably, consultation is no longer required when deciding to suspend a business relationship. This sits alongside the removal of termination as a mandatory last resort (Stibbe).

What survived is the part that carries the weight: a cross-cutting obligation to conduct meaningful consultation with stakeholders at different stages of the due diligence process (Accountancy Europe).

Read those together and the picture is clear. The directive removed two specific procedural triggers and one category of stakeholder. It did not remove engagement from the due diligence cycle. Companies that respond by dismantling their engagement capability are reading a trim as a repeal.

Who counts as a stakeholder now

The remaining definition is still broad, and it is worth being precise about it because scoping errors here propagate into everything downstream.

Stakeholders include employees of the company, employees of its subsidiaries and of its business partners, trade unions and workers' representatives, and individuals or communities whose rights or legitimate interests are or could be directly affected by the operations of the company, its subsidiaries or its business partners, including their legitimate representatives (European Commission, EU Due Diligence Navigator).

Three practical points follow.

Affected communities are not the same as suppliers. A supplier is a business partner; the community living next to that supplier's facility is a separate stakeholder with a separate interest. A programme that engages suppliers thoroughly and communities not at all has covered one category and missed another.

Legitimate representatives count. You do not need to reach every individual worker directly. Trade unions and workers' representatives are named in the definition, and in many contexts they are the only practical route to reliable information.

The definition follows the risk, not the contract. It extends to the employees of business partners, which means the boundary of engagement is set by where impacts occur, not by where your contractual privity ends.

Where engagement has to happen in the cycle

The cross-cutting obligation attaches engagement to the due diligence process rather than to a single step. In practice that means four points.

Risk identification and assessment (Article 8). This is where engagement does the most work and where its absence is most visible. Risk mapping built only on supplier questionnaires and country-level indices produces a map of what suppliers are willing to declare, not of what is happening. Worker and community input is how the map gets corrected.

Prioritisation. The directive permits a risk-based approach, which means you will not address everything at once. How you rank severity and likelihood is a judgement call, and a prioritisation made without input from affected people is a judgement made about them without them. It is also the decision most likely to be challenged later.

Prevention, mitigation and cessation. Remedies designed without the people affected are frequently remedies that do not work. This is not a compliance point so much as an effectiveness one, but the two converge.

Remediation. Article 12 remediation and the Article 14 notification and complaints procedure both depend on engagement to function. A grievance mechanism that affected people do not know about, do not trust, or cannot safely use is documentation rather than a mechanism.

Contributors to the Commission's consultation made this argument consistently: meaningful engagement is the core of due diligence, and trusted, ongoing, two-way dialogue with rights-holders is the most reliable way to find and act on harm (Business and Human Rights Resource Centre).

The guidelines are where this gets decided

The Commission ran an open consultation on CSDDD implementation guidelines from 12 June to 14 August 2026, drawing contributions from international organisations, trade unions, civil society organisations and companies. Submissions repeatedly asked for clarity on what meaningful, inclusive and safe engagement looks like at each stage of due diligence, including risk scoping, assessment, prioritisation and remedy (IHRB).

This is the pattern worth internalising: the directive sets the obligation, but the guidelines will set the evidentiary standard. What counts as meaningful, what documentation demonstrates it, and how a company shows engagement was safe for participants are questions the directive does not answer and the guidelines will.

That creates a planning problem and an opportunity. The problem is that you are building before the standard is published. The opportunity is that the substance of good engagement practice is not actually mysterious. It has been documented in the OECD Due Diligence Guidance and the UN Guiding Principles for years, and the guidelines are very unlikely to contradict that body of practice. Building to the OECD standard now is the lowest-regret option available.

What to build, concretely

Six things, in rough order of how much they matter.

1. A stakeholder map that is not a supplier list. For each priority risk area, identify who is affected and who legitimately represents them. Unions, worker representatives, community organisations, local NGOs. Where you have no route to affected people in a high-risk area, record that as a gap rather than leaving it blank.

2. Engagement at risk assessment, not after it. The most common design error is to complete the risk assessment and then consult on the findings. That inverts the purpose. Input has to enter before prioritisation is set.

3. Safety as a designed feature. Engagement that exposes participants to retaliation is worse than none, because it harms the people it was supposed to protect and destroys the trust that makes future engagement possible. Anonymity options, third-party intermediaries, and an explicit non-retaliation commitment that extends to your suppliers' workforces are the baseline.

4. A record that shows judgement, not just activity. Attendance lists do not demonstrate meaningful engagement. What does: what was raised, what you did with it, and where you departed from what stakeholders asked for and why. The reasoning is the evidence.

5. A working link to the grievance mechanism. Article 13 engagement and the Article 14 complaints procedure should feed the same risk register. If a concern raised in a consultation session cannot reach the same place as a formal complaint, you have two systems and one blind spot.

6. A note on the two removed triggers. Consultation before suspending a business relationship is no longer mandatory. Consider doing it anyway where the suspension will affect workers or a community, and document the decision either way. National transposition may go beyond the directive's floor, and a defensible record costs little.

The bottom line

Omnibus I narrowed the perimeter of CSDDD stakeholder engagement. It left the obligation itself intact and cross-cutting.

The companies that will struggle are not the ones that over-invested in engagement. They are the ones that read the simplification as permission to stop asking, and arrive at transposition with a risk map built entirely from documents, no relationships with the people who could have told them what those documents missed, and no evidence of engagement to show a supervisory authority.

The guidelines will tell you what evidence is sufficient. They will not build the relationships for you, and those take longer than a guidance document does to read.