Corporate Sustainability Due Diligence Directive
CS3D requires large companies to conduct due diligence on actual and potential adverse impacts on human rights and the environment in their operations and supply chains.
What does CS3D require and when does it apply?
CS3D applies to Large Companies (1000+ employees; €450M+ turnover) and Financial Services organisations across all EU member states. The key deadline is 2027-2029 (phased by company size). Non-compliance carries a maximum penalty of At least 5% of net worldwide turnover. Core obligations include map and assess supply chain risks and implement due diligence policies.
- Map and assess supply chain risks
- Implement due diligence policies
- Establish grievance mechanisms
- Monitor and remedy adverse impacts
- Report annually on due diligence
| Deadline | 2027-2029 (phased by company size) |
| Max fine | At least 5% of net worldwide turnover |
| Primary sectors | Large Companies (1000+ employees; €450M+ turnover), Financial Services, Manufacturing |
CS3D: At least 5% of net worldwide turnover max fine
CS3D applies to Large Companies (1000+ employees; €450M+ turnover) and Financial Services organisations in all EU member states. Key deadline: 2027-2029 (phased by company size).
Source: Official Journal of the European Union — Corporate Sustainability Due Diligence Directive
2027-2029 (phased by company size)
At least 5% of net worldwide turnover
Large Companies (1000+ employees; €450M+ turnover), Financial Services, Manufacturing
The highest penalty for non-compliance with CS3D in the EU.
EU Official Journal
How do I comply with CS3D?
- Map and assess supply chain risks
- Implement due diligence policies
- Establish grievance mechanisms
- Monitor and remedy adverse impacts
- Report annually on due diligence
Does CS3D apply to your business?
Find out in 2 minutes with our free regulation checker.
Check now — freeCS3D by Country
Related Regulations
AI Act
The EU AI Act classifies AI systems by risk level and imposes obligations on providers and deployers. High-risk systems face mandatory conformity assessments, documentation, and human oversight requirements.
GDPR
GDPR governs the processing of personal data of EU residents. It requires lawful basis for processing, data subject rights, breach notification, and accountability measures.
NIS2
NIS2 expands cybersecurity obligations to essential and important entities across critical sectors. It mandates risk management, incident reporting, and supply chain security.
Next step — classify
Classify your AI systems
Use the free regulation checker to find out exactly which CS3D obligations apply to your business in 2 minutes.
For informational purposes only. This is not legal advice — consult qualified legal counsel.
Last updated: · Editorial policy