Supply chain due diligence: CSRD, CSDDD, the OECD framework and what buyers must do
Over the past decade, expectations that companies identify and address human-rights and environmental harms in their supply chains have moved from voluntary guidance into law. For procurement teams, this means supplier questionnaires, contract clauses, audits and data requests that did not exist a few years ago, and suppliers far outside the EU receive them too. This guide explains the main frameworks and what they ask of buyers.
EU sustainability legislation has been amended repeatedly since 2024, including postponements and the "Omnibus" simplification package. Scope thresholds and dates below are given as background; always check the current consolidated text on EUR-Lex before relying on them.
The foundation: UN and OECD frameworks
Most laws in this area build on two international instruments. The UN Guiding Principles on Business and Human Rights (2011) establish that businesses have a responsibility to respect human rights, including through their business relationships. The OECD Guidelines for Multinational Enterprises on Responsible Business Conduct, last updated in 2023, extend this to the environment, labour, anti-corruption and other areas. The OECD's 2018 Due Diligence Guidance for Responsible Business Conduct sets out a six-step process that has become the common reference:
- Embed responsible business conduct into policies and management systems.
- Identify and assess actual and potential adverse impacts in operations, supply chains and business relationships.
- Cease, prevent or mitigate adverse impacts.
- Track implementation and results.
- Communicate how impacts are addressed.
- Provide for or cooperate in remediation when appropriate.
The key idea is that due diligence is risk-based: effort is prioritised where the risk of severe harm to people or the environment is greatest, not spread evenly across all suppliers.
National due diligence laws
Several countries legislated before the EU. France's duty of vigilance law (Law No. 2017-399) requires large companies to establish and publish a vigilance plan covering their subsidiaries, subcontractors and suppliers. Germany's Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, LkSG) has applied since 1 January 2023 to large companies, requiring risk analysis, preventive measures and a complaints procedure covering direct suppliers and, on substantiated knowledge, indirect ones. Norway's Transparency Act and the UK Modern Slavery Act 2015 (section 54, transparency statements) are other examples. A supplier selling to customers in several countries may receive requests driven by each of them.
CSRD: reporting on the value chain
The Corporate Sustainability Reporting Directive (EU) 2022/2464 requires companies in scope to report on sustainability matters using the European Sustainability Reporting Standards (ESRS), based on a "double materiality" assessment: how sustainability issues affect the company, and how the company affects people and the environment. Reporting covers the company's upstream and downstream value chain where material, for instance climate emissions (including scope 3 purchased goods and services), workers in the value chain and resource use.
The first companies, large public-interest entities already subject to the previous non-financial reporting rules, reported on financial year 2024. In April 2025, Directive (EU) 2025/794 (the "stop-the-clock" directive) postponed reporting by two years for the later waves of companies, and the Omnibus package proposed in February 2025 aims to narrow scope and reduce data points substantially. Whatever the final thresholds, the practical effect for procurement is the same: reporting companies need data from suppliers, especially emissions data, and will ask for it.
CSDDD: a legal duty of due diligence
The Corporate Sustainability Due Diligence Directive (EU) 2024/1760 entered into force in July 2024. It requires companies in scope to carry out risk-based human-rights and environmental due diligence across their own operations, their subsidiaries and their "chain of activities", which covers upstream business partners and certain downstream activities. Its obligations follow the OECD steps: integrating due diligence into policies, identifying and prioritising adverse impacts, preventing and bringing them to an end, a complaints procedure, monitoring, and public communication. Companies must also adopt a climate transition plan. Enforcement is through national supervisory authorities and, in its adopted form, a civil liability regime.
As originally adopted, the directive applied in phases to very large companies first. The 2025 stop-the-clock directive delayed the transposition deadline and the first application by one year, and the Omnibus negotiations have proposed further changes to scope, to how deep into the supply chain systematic assessment must go, and to liability. Buyers should follow the final text as it is transposed into the national law that applies to them.
Product-specific rules
Alongside these general duties, product rules require traceability for particular commodities: the EU Conflict Minerals Regulation (EU) 2017/821 for tin, tantalum, tungsten and gold imports; the EU Deforestation Regulation (EU) 2023/1115 for commodities such as cattle, cocoa, coffee, palm oil, rubber, soya and wood, whose application has been postponed; the forced labour product ban (Regulation (EU) 2024/3015), applicable from December 2027; and the Carbon Border Adjustment Mechanism. In the US, the Uyghur Forced Labor Prevention Act affects imports. These are discussed in geopolitics and supply chains.
What buyers should do
- Map and prioritise. Use spend data together with country and sector risk information to find where severe impacts are most likely (for example, raw materials from high-risk regions, labour-intensive manufacturing, construction, cleaning and security services).
- Set expectations in a supplier code of conduct aligned with international standards, and reference it in contracts with proportionate clauses: cooperation with assessments, corrective action, cascading requirements to sub-suppliers.
- Assess proportionately. Self-assessment questionnaires for broad coverage; audits, site visits or industry schemes for high-risk suppliers. Avoid sending every supplier the same long questionnaire.
- Prefer engagement to exit. The frameworks favour working with suppliers to fix problems, with disengagement as a last resort, because abrupt exit can worsen conditions for affected workers.
- Look at your own practices. Last-minute order changes, unrealistic lead times and price pressure can drive excessive overtime or subcontracting. The CSDDD explicitly expects companies to consider their own purchasing practices.
- Organise data. Coordinate requests with sustainability and finance colleagues so suppliers are asked once, in a consistent format.
What suppliers should prepare
Suppliers, including small ones outside the EU, should expect customers to ask for a code-of-conduct commitment, information on their own sub-suppliers, evidence of policies on labour and environment, and emissions figures. Having a basic, documented answer ready (policies, a simple risk assessment, an emissions estimate with its method) saves time and can be a competitive advantage in tenders.
Trade, law & sustainabilityCircular procurement
Specifying durability, repair, take-back and recycled content, and evaluating it.
Suppliers & riskGeopolitics and supply chains
Chokepoints, sanctions, export controls and tariffs, and a method for mapping exposure.
Trade, law & sustainabilityThe UK Procurement Act 2023
New procedures, most advantageous tender, social value and transparency notices.