Omnibus I is now law: what actually changed for the CSDDD

If you read up on the EU Corporate Sustainability Due Diligence Directive (CSDDD, or CS3D) back in 2024, almost every number you memorised has changed. The "Omnibus I" simplification package is now law as Directive (EU) 2026/470, in force since 18 March 2026, and it has reshaped who is covered, when they must comply, and how much they have to do.

Here is the short version, in plain English.

The headline changes

• Far fewer companies are directly in scope. The thresholds jumped to more than 5,000 employees and more than €1.5 billion in worldwide net turnover for EU companies (non-EU companies are caught at €1.5 billion of EU turnover, with no employee test).
• One deadline, later. The phased waves are gone. A single application date of 26 July 2029 now applies to every in-scope company.
• Lighter ongoing duties, lower fines, and no EU-wide civil liability.

Scope: only the very largest companies

The original 2024 directive caught companies with 1,000+ employees and €450m turnover, phased in by size, with an even lower threshold for "high-impact sectors". Omnibus I removed the phasing and the high-impact-sector tier and raised the thresholds sharply. In practice, only a few thousand of Europe's largest companies are now directly in scope.

The catch: if you are a smaller company, you are still affected indirectly, because in-scope companies have to run due diligence on their suppliers and business partners. Check whether the directive reaches you, directly or through your customers.

Dates: one deadline instead of three

• 26 July 2028 - Member States must transpose the directive into national law.
• 26 July 2029 - the single application date for all in-scope companies.
• Financial years starting on or after 1 January 2030 - first public reporting.
• 26 July 2027 - the Commission must publish general guidelines.

The full picture lives on our CSDDD timeline.

The chain you must look at got narrower

The directive covers your "chain of activities" - upstream business partners plus limited downstream (distribution, transport, storage), but not how customers use or dispose of the product. Omnibus I kept the focus on your direct, tier-1 business partners; you only go deeper when you have plausible information of a real impact. It also added a value-chain cap: you generally cannot demand information beyond a standardised set from partners with fewer than 5,000 employees. See value chain mapping.

Lighter ongoing obligations

• Monitoring moved from every 12 months to at least every five years (plus on significant change).
• Fines are capped at no more than 3% of net worldwide turnover - the original "not less than 5%" floor was removed.
• The EU-wide harmonised civil-liability regime was removed; liability is now left to national law.
• The standalone climate transition plan duty (Art. 22) was significantly scaled back.

What did not change

The core of the directive survived intact: a risk-based, six-step due diligence process on human rights and the environment, built on the OECD Due Diligence Guidance and the UN Guiding Principles. If you want the cycle in detail, see the due diligence process.

What this means for you

• Directly in scope? Keep building your programme toward the 2029 date - the destination didn't move, only the timing and some of the detail.
• A supplier to a big customer? You'll still receive questionnaires, codes of conduct and audit requests. The best preparation is a clean, proportionate response. Get our free CSDDD due diligence questionnaire to see exactly what large customers ask for.

We track these changes as they land. Subscribe to The CSDDD Brief and we'll watch Brussels so you don't have to.

Sources: Directive (EU) 2024/1760 on EUR-Lex; the European Commission's corporate sustainability due diligence pages. This is general guidance, not legal advice.