The CSDDD after Omnibus I: what changes for Brazilian suppliers to European companies

In short. The Corporate Sustainability Due Diligence Directive (CSDDD, Directive (EU) 2024/1760) requires in-scope companies to identify and assess adverse human rights and environmental impacts in their own operations and chains of activities, to prevent, mitigate or bring them to an end and, where they have caused them, to provide remediation. This can reach, indirectly, suppliers outside Europe, including Brazilian ones, that are part of those chains.

In February 2026, the Omnibus I package narrowed the CSDDD’s scope and postponed its application to 2029. Many read this as “the CSDDD is dead”. It is not. The directive now focuses on the largest companies: under the main thresholds, EU companies with more than 5,000 employees and € 1.5 billion in worldwide turnover, and non-EU companies with more than € 1.5 billion in EU turnover, plus specific routes for ultimate parent companies of groups and certain franchising or licensing arrangements. These companies may operate extensive global supply chains. And for chains of products covered by the EU Deforestation Regulation (EUDR), there is a much closer milestone: the regulation’s main regime applies from 30 December 2026, subject to the exceptions it provides.

What the CSDDD is

Adopted on 13 June 2024, the CSDDD sets legal due diligence duties aligned in many respects with the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct.¹² In-scope companies must integrate due diligence into their policies and risk management; identify and assess impacts; prevent and mitigate them; maintain a complaints procedure; monitor; and communicate publicly. For suppliers, the key point is that the duty covers the chain of activities, including upstream business partners, both direct and indirect.¹

What Omnibus I changed

Directive (EU) 2026/470 of 24 February 2026 was published in the Official Journal on 26 February and has been in force since 18 March 2026.³

In both versions, Article 2 also provides for ultimate parent companies and franchising or licensing arrangements.¹³

Three changes directly affect suppliers:

1. Two-step mapping. Generalised in-depth assessment gives way to an initial scoping exercise of risk areas, based on reasonably available information, followed by in-depth assessment where impacts are most likely and most severe.³
2. Limits on information requests. In the in-depth assessment, the company may only request information that is necessary and, from partners with fewer than 5,000 employees, only where it “cannot reasonably be obtained by other means”. Where impacts are equally likely or severe across several areas, the company may prioritise assessing the areas involving direct business partners.³
3. Suspension as a last resort. The duty to terminate the business relationship was removed; suspension remains available as a last resort, under the conditions of Articles 10 and 11, where earlier measures are not enough to address the impact.³

Under the reporting directive (CSRD), reporting companies may not, for the purposes of that reporting, require value-chain partners with up to 1,000 employees to provide information beyond the applicable voluntary standard.³

Next in Brussels. The European Commission is preparing the guidelines provided for in the CSDDD, including model contract clauses, and ran a public consultation on them that closed in July 2026. The legal deadline for the model clauses and the main guidelines is 26 July 2027; other guidelines under the same article are due by 26 July 2028.⁵

The date that comes first: the EUDR from 30 December 2026

The EUDR, revised in December 2025 by Regulation (EU) 2025/2650, applies from 30 December 2026 to large and medium operators and to micro and small operators already covered by the former EU Timber Regulation (EUTR), and from 30 June 2027 to other micro and small operators.⁶ The simplification review the Commission presented in May 2026 kept these dates.⁶

• Scope. Cattle (and derived products such as beef), cocoa, coffee, oil palm, rubber, soya and wood; Annex I defines the derived products covered. Bovine leather was removed on 18 September 2026 by Delegated Regulation (EU) 2026/2102, which also sets specific application rules for products it added to the scope.⁷
• Requirements. Products must not come from land deforested after 31 December 2020 and, for wood, must not have been harvested with forest degradation after that date. They must also have been produced in accordance with the “relevant legislation of the country of production”, a concept the EUDR links to the legal status of the area of production and which, in that context, includes labour rights, human rights protected under international law and the principle of free, prior and informed consent.⁷
• Who bears the duty. The legal due diligence duty lies with the operator that first places the product on the EU market (usually the importer); after the 2025 revision, traders and downstream operators have reduced obligations.⁶ A Brazilian supplier does not become subject to the EUDR merely by selling to a European company: its status depends on the role it plays under the regulation’s definitions. For many suppliers operating only upstream, the effect is likely to come mainly through the business relationship and information requests from those subject to the regulation.
• A note on dates. The size distinction refers to the actor holding a regulated position under the EUDR; being a Brazilian supplier does not in itself determine status, and small size does not in itself exclude obligations. A large or medium European trader subject to the regulation must comply from 30 December 2026 and may ask suppliers, before that date, for geolocation data and evidence of legality.

In our view, the human rights dimension of “relevant legislation” may receive less attention than geolocation in some preparation processes, and it may be one of the less mature dimensions in parts of agricultural supply chains.

Other rules reaching suppliers

• Forced Labour Regulation (EU) 2024/3015. From 14 December 2027, it prohibits placing and making available on the EU market, and exporting, products made with forced labour, whatever their origin or sector. On 26 June 2026, the Commission adopted guidelines on its application.⁸ In Brazil, Article 149 of the Criminal Code makes it a crime to reduce a person to a condition analogous to slavery.⁹ The definition in ILO Convention No. 29 (work exacted under the menace of a penalty and not offered voluntarily)¹⁰ and Article 149 are not identical: the Brazilian provision lists, in addition to forced labour, exhausting working hours, degrading conditions and restriction of movement because of a debt owed to the employer or its agent.
• National laws already in force, such as the French duty of vigilance law (2017) and the German Supply Chain Due Diligence Act (LkSG, in force since 2023). On 3 September 2025, the German cabinet approved a bill that proposes to abolish the LkSG reporting obligation and restrict fines to serious violations.¹¹
• Brazilian banks. National Monetary Council (CMN) Resolutions 4,943 and 4,944 of 2021 set requirements for managing social, environmental and climate risks across the prudential segments of financial institutions, and CMN Resolution 4,945 governs the Social, Environmental and Climate Responsibility Policy (PRSAC).¹² Under the self-regulation of the Brazilian Federation of Banks (Febraban), signatory institutions commit to social, environmental and climate due diligence and, in the cases set out in the rule, to contract clauses on labour law and on the prohibition of slave-like and child labour.¹³

What to expect in questionnaires and contracts

1. More focused questionnaires. In our view, they may concentrate on the risks the customer has prioritised for a given sector, region or business relationship.
2. More weight on evidence, such as audits, action plans, complaint data and monitoring records, without excluding other sources of information.
3. Due diligence clauses. These may include commitments on codes of conduct, verification, incident reporting, sub-suppliers and corrective plans, depending on the contract. The CSDDD provides for Commission guidance on voluntary model contract clauses.¹
4. Questions about your grievance mechanism, because in-scope companies must maintain a complaints procedure accessible to affected people in the chain.¹

Two CSDDD provisions matter for smaller suppliers: where relevant, the company must provide targeted and proportionate support to SME business partners; and when it seeks contractual assurances from them, it must offer fair, reasonable and non-discriminatory terms and, as a rule, bear the cost of independent verification.¹ The consolidated CSDDD text in force since 18 March 2026 keeps these provisions.³

Five-step roadmap

1. Map who will ask. List European customers, lenders and investors. Map which of them report being subject to the CSDDD, the EUDR, the LkSG or the French law and, where legal status matters, validate it with the responsible legal function.

2. Run your own human rights risk assessment. Prioritise by severity (scale, scope and irremediable character) and by the risk that a delayed response would make the impact irremediable (UNGPs 14 and 24). OECD guidance adds likelihood as a criterion.²

3. Build a single evidence file. Policies, risk matrix, action plans, audits, grievance data, health and safety indicators and records of community engagement.

4. Take clauses to the responsible functions before signing. Submit relevant clauses for review by the responsible functions and assess their operational impact: are they proportionate to size and risk? Do they provide for support and reasonable time for corrective action? Do they address obligations applicable to sub-suppliers without implying a transfer of responsibilities that belong to the company subject to the CSDDD?

5. Publish and maintain. As a transparency practice, consider publishing your policy, salient risks (the most severe impacts on people), main measures and how your grievance channel works, updating them whenever there are significant changes. In our view, reliable public information can be one of the “other means” a customer uses before requesting data directly.

FAQ

### Does the CSDDD apply directly to my Brazilian company? It depends on the routes in Article 2. For non-EU companies, the main one is net EU turnover above € 1.5 billion, but the directive also covers certain ultimate parent companies and franchising or licensing arrangements.³ For companies not directly in scope, the effect may arrive indirectly, through customers and other business relationships.

### When do the obligations apply? Member States have until 26 July 2028 to transpose the directive, and application begins on 26 July 2029.³ The main EUDR regime (30 December 2026, with the exceptions provided) and the forced labour regulation (14 December 2027) come first.

### Can a customer ask me for information if I have fewer than 5,000 employees? In the in-depth assessment, it may request necessary information and, if the partner has fewer than 5,000 employees, only where that information cannot reasonably be obtained by other means. The directive mentions various resources and sources, such as independent reports, digital solutions and industry or multi-stakeholder initiatives, without framing them as a closed list. In our view, what the supplier itself publishes can also be one of those sources.³

### Does removing the EU civil liability regime reduce risk? It reduces harmonisation: exposure to civil liability depends more directly on the applicable national law, which must ensure access to justice and full compensation where liability arises.³

### Do I need certification? The CSDDD provides for independent verification and industry or multi-stakeholder initiatives as support for due diligence. These can help, but they do not replace the obligations the directive places on in-scope companies.¹

### Where to start on a small budget? In our view, an organisation with limited resources can start with an assessment of its most salient risks and with appropriate listening and grievance mechanisms. These topics may appear in due diligence questionnaires from customers and lenders.

Related content

Jornadas tracks these rules in its Thematic Executive Radars and structures due diligence processes through its Human Rights Due Diligence Framework. This article is for information only and does not constitute legal advice.