CSDDD and Fashion: Due Diligence Duties After the Omnibus Changes

On 26 February 2026, the EU published Directive (EU) 2026/470 in the Official Journal, and it rewrote the Corporate Sustainability Due Diligence Directive before a single company had to comply with it. The new text, known as Omnibus I, raises the thresholds, delays the dates and removes several duties altogether. The core duty to identify and address harm in the supply chain survives, and it now sits on a much smaller group of companies.

Which Fashion Companies Are in Scope

The CSDDD now applies to EU companies with more than 5,000 employees and more than €1.5 billion in net worldwide turnover, according to Latham & Watkins’ summary of the final text. Non-EU companies fall in scope at €1.5 billion of net turnover generated in the EU, with no employee threshold. Noerr notes that the previous thresholds stood at 1,000 employees and €450 million.

The timetable has moved as well. Member States must transpose the amendments by 26 July 2028, and in-scope companies must comply from 26 July 2029, a single date that replaces the staggered dates in the original directive. Only the largest fashion groups clear both thresholds, and small and mid-sized brands fall outside them.

What the Duty Now Requires

The amended directive keeps a risk-based approach and spells out how to apply it. Covington explains that a company must first run a scoping exercise, based on reasonably available information, to identify the general areas of its own operations, its subsidiaries’ operations and its business partners’ operations where adverse impacts are most likely and most severe. It must then carry out an in-depth assessment in those areas. Where several areas carry equal risk, the company may prioritise those involving direct business partners.

A fashion brand would run that scoping exercise across fibre production, spinning, fabric mills and garment factories, and then concentrate its assessment on the stages and regions where harm is most likely. The directive lists the risk factors that guide the choice, among them geography and the level of law enforcement in the country concerned. Sector context counts too, and so does whether a business partner falls outside comparable due diligence laws.

Information requests face a cap. A company must seek information from business partners only where necessary, and for partners with fewer than 5,000 employees, only when the information cannot reasonably be obtained by other means. A garment factory with a few hundred workers therefore cannot be asked for data the buyer could gather itself.

What the Omnibus Removed

Several duties disappeared in the final text. The obligation to adopt and put into effect a climate transition plan is deleted, although companies that have plans must still report on them under the sustainability reporting rules. The harmonised EU civil liability regime is gone, and liability now follows each Member State’s national rules, with a review clause in Article 36 that requires the Commission to assess enforcement by July 2031. Companies no longer have to end a business relationship as a last resort after harm has occurred, although suspension rules still apply. Continuing to work with a partner will not expose a company to penalties or liability where there is a reasonable expectation that an enhanced prevention or corrective plan will succeed. The maximum fine is capped at 3 percent of net worldwide turnover, down from 5 percent.

The definition of stakeholders also narrowed, and consumers no longer count as stakeholders under the directive.

What It Means for Suppliers and Mid-Sized Brands

A brand outside the thresholds will still meet the directive through its customers. The Commission must adopt guidelines by 26 July 2027 on due diligence processes, risk identification, responsible disengagement and model contractual clauses. Large buyers are the natural users of those clauses, so a mid-sized brand that sells to a department store group or a marketplace should expect due diligence questionnaires and contract terms before 2029.

National lawmakers keep room to add duties. Covington reports that the revised harmonisation clause still lets a Member State impose additional due diligence obligations for specific products, services or situations, so national transposition laws deserve close reading.

Other rules reach brands of every size. The EU Forced Labour Regulation applies from 14 December 2027 to any company placing goods on the EU market, covers products made in whole or in part with forced labour and offers no safe harbour. National enforcement has not waited either. FLJ’s coverage of the Loro Piana ruling shows a Milan court placing a luxury house under judicial administration over its subcontracting chain, with no due diligence directive in force.

What to Do Before 2029

Brands should map suppliers beyond tier one and record where fibre, fabric and garments come from, because the scoping exercise starts from what a company can reasonably know about its chain. In-scope companies should document how they decide which regions and stages carry the highest risk, since the amended Article 8 makes the scoping exercise the first required step. Smaller brands should prepare supplier information in a form that answers a buyer’s questions quickly, since the cap still lets an in-scope customer ask for data it cannot obtain by other means.

All brands should track the Commission’s 2027 guidelines and their own Member State’s transposition law.

A Narrower Directive With the Same Core Duty

Omnibus I cut the number of companies the CSDDD binds and removed its most contested provisions. The duty at its centre stayed in place: identify where harm is most likely, address it and keep the evidence. A brand that builds that evidence trail for the Forced Labour Regulation will already hold much of the supply chain evidence a CSDDD scoping exercise needs.