The CSDDD After Omnibus: Which Indian Suppliers Still Feel It

The threshold most summaries get wrong

Almost every published account states the CSDDD threshold as "5,000 employees and €1.5 billion turnover". That formulation describes only the EU test, and repeating it to an Indian audience produces a false conclusion.

• Company type: EU company; Test after Omnibus I: More than 5,000 employees and €1.5 billion net worldwide turnover
• Company type: EU franchisor or licensor; Test after Omnibus I: A separate and lower gateway: Union franchising or licensing agreements yielding more than €75 million in royalties and more than €275 million net worldwide turnover
• Company type: Non-EU company; Test after Omnibus I: €1.5 billion net turnover generated in the EU. No employee test

The three routes are alternatives rather than cumulative conditions, so a company that fails the headline employee-and-turnover test can still be caught by the franchising limb in Article 2(1)(c) of the directive as amended. That limb reaches relatively few Indian groups, but it is the reason the headline threshold should never be described as the only way in.

The consequence for India is direct. A large Indian group with substantial European sales can be in scope on turnover alone, regardless of how many people it employs or where they work. It does not need a single European employee.

Most Indian companies are nowhere near €1.5 billion of EU-generated turnover and will answer no. But the largest exporting groups should test the question properly rather than assuming the employee limb protects them, because it does not exist for them.

The dates, corrected

This is the second thing published guidance routinely gets wrong, and the error is a full year.

• Milestone: Omnibus I entered into force; Date: 18 March 2026
• Milestone: Transposition into national law; Date: 26 July 2028
• Milestone: First application by in-scope companies; Date: 26 July 2029
• Milestone: First reporting; Date: Financial years beginning on or after 1 January 2030

Sources citing 26 July 2027 for transposition are quoting the position under the April 2025 stop-the-clock directive, Directive (EU) 2025/794, which Omnibus I superseded. That earlier date circulated widely and remains in a great deal of published material.

The practical effect is that a supplier told in 2025 to prepare for 2027 has roughly two additional years, which is a material planning difference.

What was removed from the substantive duty

Omnibus I did not only move thresholds and dates. It thinned the obligation itself, and each change reduces what flows down to suppliers.

The termination obligation is gone, but suspension is not. The duty to suspend a business relationship was retained, so a buyer is not left without an exit-side duty.

The climate transition plan duty was repealed outright. Article 22 of the original directive required in-scope companies to adopt and put into effect a transition plan for climate change mitigation aligned with the Paris Agreement. Omnibus I deleted it. An intermediate negotiating position would have softened it from "put into effect" to "adopt"; that is not what survived. There is now no substantive due diligence duty to adopt or implement a transition plan, only reporting on the sustainability reporting side about a plan a company has voluntarily adopted. It is arguably the gravest of the deletions.

The penalty basis changed direction. The original Article 27 set a floor on the maximum, requiring pecuniary penalties to be capped at not less than 5 per cent of net worldwide turnover. Omnibus I replaced that with a genuine EU-wide ceiling of 3 per cent, and dropped turnover as the mandatory calculation basis.

The original directive required an in-scope company, where an adverse impact could not be prevented or adequately mitigated, ultimately to terminate the business relationship. That requirement was removed. A European buyer is no longer under a legal duty to drop a supplier it cannot remediate.

EU-harmonised civil liability was deleted. The directive no longer establishes an EU-level civil liability regime. Liability is left to member state law, which means it will vary across the Union and will be determined during transposition.

Due diligence is explicitly risk-based, prioritising direct business partners. The original drafting implied cascading obligations through the full chain of activity. The revised position focuses effort on direct partners and on risk, which substantially reduces the depth of the enquiry reaching lower-tier suppliers.

A value chain information-request cap was introduced. Requests to smaller business partners must be targeted, reasonable and proportionate, and used only where the information cannot reasonably be obtained otherwise. Two figures circulate because the directive uses both. The protection runs to undertakings with fewer than 1,000 employees, which may decline requests going beyond the voluntary SME standard; the SME and small mid-cap definition itself runs to 500 employees. A source quoting 500 is citing the definition, one quoting 1,000 is citing the protection.

Full harmonisation was extended to core due diligence mechanics, constraining member states from imposing stricter national variants in those areas. This matters because it limits the "gold-plating" that would otherwise have produced twenty-seven different supplier questionnaires.

Taken together, these changes convert the CSDDD from an instrument that would have reached deep into Indian supply chains into one that concentrates on large buyers and their immediate partners.

Which Indian suppliers still feel it, and how

Four categories, and the distinction between them is what a supplier needs to establish.

Directly in scope

An Indian group generating more than €1.5 billion in net turnover within the European Union. Small in number, but for those companies the directive applies to them as duty-holders, not merely as suppliers, with obligations to conduct their own due diligence across their chains of activity.

Supplying an in-scope buyer as a direct partner

The category that matters most in practice. Where your customer is an in-scope European company and you are a direct business partner, the revised risk-based approach puts you squarely in the priority zone. Expect substantive due diligence enquiry, audit rights and remediation expectations.

Supplying an in-scope buyer at a lower tier

Materially better off than before. The removal of full-chain cascading and the introduction of the information-request cap mean that a tier-two or tier-three supplier should face proportionate requests rather than the same questionnaire as a tier-one partner.

Supplying a buyer no longer in scope

The largest group by number. A mid-sized European buyer that fell out of scope has no CSDDD duty to transmit. But see the next section, because that does not necessarily mean the requests stop.

Why the requests may keep coming anyway

Three reasons a supplier should not assume the questionnaires disappear.

Programmes already exist. European companies built supplier due diligence functions between 2022 and 2025 against the original timetable. Staff were hired, systems bought, processes embedded. Those do not get dismantled because a deadline moved, particularly where the company also reports under other frameworks.

Other instruments still bite. The EU Forced Labour Regulation, Regulation (EU) 2024/3015, applies from 14 December 2027 with no size threshold whatever, and prohibits products made with forced labour from the Union market outright. That is two years before CSDDD application and reaches every supplier regardless of size. The Deforestation Regulation applies from 30 December 2026 for covered commodities.

Contracts bind on their own terms. A supplier code of conduct signed in 2023 with audit rights and information covenants remains enforceable according to its drafting. It does not lapse because the directive that inspired it was narrowed. For most Indian suppliers, the contract is the operative obligation.

What to do about it

Establish which of the four categories you fall into. Ask your major European customers directly whether they expect to be in scope. Most will know.

If you are directly in scope, start now. July 2029 sounds distant, but building a due diligence function across a chain of activity is multi-year work, and first reporting attaches to financial years beginning January 2030.

Read the supplier contracts you have already signed. This is where most Indian suppliers' actual obligations sit, and it is a cheaper exercise than any compliance programme.

Do not let the CSDDD reprieve create a forced labour blind spot. The instrument arriving soonest and reaching furthest is the Forced Labour Regulation, and nothing about Omnibus I touched it.

Watch transposition. Because civil liability returned to member state law, the position will differ across the Union. A supplier selling into Germany, France and the Netherlands may face three different liability environments from 2028.

Frequently asked questions

What is the CSDDD threshold after Omnibus I? For EU companies, more than 5,000 employees and €1.5 billion net worldwide turnover. For non-EU companies, including Indian-parented groups, €1.5 billion net turnover generated within the European Union, with no employee test.

Can an Indian company be directly subject to the CSDDD? Yes, if it generates more than €1.5 billion in net turnover within the European Union. There is no employee requirement for non-EU companies.

When does the CSDDD apply? Transposition into national law is due by 26 July 2028 and first application by in-scope companies is 26 July 2029, with first reporting for financial years beginning on or after 1 January 2030.

Is 26 July 2027 the transposition deadline? No. That is the superseded date under the April 2025 stop-the-clock directive. Omnibus I moved transposition to 26 July 2028.

Must a European buyer terminate a supplier relationship it cannot remediate? No. The termination obligation was removed by Omnibus I, though the duty to suspend a business relationship was retained.

Is there EU-level civil liability under the CSDDD? No. The harmonised civil liability regime was deleted and liability is left to member state law, so it will vary across the Union.

Does the CSDDD cascade through the whole supply chain? No longer in the way originally drafted. Due diligence is explicitly risk-based with priority to direct business partners, and a value chain information-request cap limits what may be demanded from smaller partners.

Will the due diligence questionnaires stop? Not necessarily. European buyers have existing programmes, contracts signed earlier remain enforceable on their terms, and other instruments including the Forced Labour Regulation and the Deforestation Regulation still apply.

Which European instrument should a small Indian supplier worry about most? The EU Forced Labour Regulation, which applies from 14 December 2027 with no employee or turnover threshold at all.