On Monday, 8 December, EU Member States and the European Parliament reached a provisional political agreement in trilogue negotiations – together with the European Commission – on the Omnibus I process to revise both the Corporate Sustainability Due Diligence Directive (CSDDD) and the Corporate Sustainability Reporting Directive (CSRD).

The rushed and problematic Omnibus simplification process that was launched in February this year has led to significant losses in these two key Directives measured against their original objectives. The outcome represents a mixed result for companies committed to respecting human rights. Under the leadership of the Danish Presidency, the political agreement importantly preserves the core principle of risk-based due diligence in the CSDDD. Yet significant provisions were cut during the final negotiations or defeated at earlier stages – most notably major reductions in the scope of both Directives, the deletion of a requirement under the CSDDD to adopt climate transition plans, and the removal of a harmonised civil liability regime.

Core risk-based due diligence preserved

The due diligence duty in the CSDDD, as enacted in July 2024, was substantially aligned with the international due diligence standards set out in the UN Guiding Principles on Business and Human Rights (UNGPs) and the OECD Guidelines for Multinational Enterprises. However, the Omnibus threatened to undermine the risk-based approach – the central principle that makes sustainability due diligence meaningful in its outcomes and manageable in practice.

The political agreement preserves the core of the risk-based approach by ensuring that companies focus on the most severe and likely impacts for attention wherever they occur in their own operations, the operations of their subsidiaries or their ‘chains of activities’ (ie, their upstream supply chains and some limited downstream business relationships). They are expected to carry out a scoping exercise, based on reasonably available information, of general risk areas where impacts are most likely to occur and to be most severe, and then to conduct in-depth assessments in those areas based on the same criteria. If they need to prioritize impacts for action, they must do so in line with their severity and likelihood – as set out in the original CSDDD. This is in line with the UNGPs and OECD Guidelines.

Rejecting a Tier-1 approach: Why it matters

This is a significant result given that the initial positions of the Commission, Council and the Parliament’s Rapporteur were all in favour of constraining due diligence to ‘tier 1’ or direct business partners. Such a restriction provides only the illusion of simplification; in fact, companies would need to adopt parallel due diligence systems to meet a range of legal and non-legal demands, including from other EU and non-EU legislation and from their lenders and investors...

The provisional agreement... states that covered companies should (i) ask questions of business partners only where that is “necessary” – meaning that questions should be “aimed at obtaining accurate and reliable information in particular about the nature and extent, causes, severity and likelihood” of the relevant impacts – and (ii) for business partners under 5000 employees, only where the information cannot be reasonably obtained by other means. The most sensible way for companies to implement such a provision is to always consider whether they can obtain information through more efficient means and to only ask reasonable and specific questions of business partners and avoid the use of blanket questionnaires as a normal part of their risk-based due diligence...