Use case: Prepare evidence for an EU customer, group due-diligence process or supplier questionnaire concerning human-rights and environmental risks in operations, subsidiaries and business-partner chains.
Scope first: The CSDDD is an EU directive on corporate sustainability due diligence. It is not a universal certificate or a fixed supplier questionnaire. Its logic is risk-based: policy, identification, prevention, mitigation, remediation, complaints and public communication. A Chinese supplier is not automatically a directly regulated company merely because it serves an EU customer, but a customer may request evidence relevant to the relationship and identified risks.
Separate direct legal duties, customer or contract requirements, and voluntary management practices. For every record, state the entity, site, period, version, source and scope. An audit or certification may support a conclusion, but it does not replace the company’s own risk assessment or prove that no adverse impact exists.
1. Check the current legal version and the covered company
The base text is Directive (EU) 2024/1760. It was amended by Directive (EU) 2025/794 and Directive (EU) 2026/470. As of this review, do not reuse the earlier “2026 transposition, three groups from 2027, and an early high-risk-sector phase” narrative. Directive 2026/470 moves the Member State transposition deadline to 26 July 2028 and provides for national measures to apply from 26 July 2029; measures implementing Article 16 follow the financial-year rule. National transposition must still be checked separately.
Article 2 now focuses the general scope on very large companies. In broad terms, EU-established companies are assessed against more than 1,000 average employees and more than EUR 450 million worldwide net turnover; third-country companies are assessed against more than EUR 450 million net turnover generated in the Union. Group, ultimate-parent, franchising and licensing rules also require review. A company is not classified by nationality, product category or the mere existence of an EU customer.
For a supplier, use this sequence: (1) confirm the customer or group’s status and the relevant national law; (2) map the relationship, product or service, sites and value-chain position; (3) prepare evidence for identified actual or potential risks; and (4) label extra customer requests as contractual or questionnaire requirements rather than as uniform CSDDD fields.
2. Turn due diligence into a traceable evidence chain
| Stage | Record the facts | Possible supporting records |
|---|---|---|
| Policy and governance | Owners, approval, code of conduct, and consultation with workers and representatives. | Policy versions, training, responsibilities, supplier terms and change history. |
| Risk identification and prioritisation | Sites, processes, materials, labour and environmental risks, severity, likelihood and rationale. | Supplier map, process flow, permits, incident and complaint records, assessment and prioritisation notes. |
| Prevention, mitigation and termination | Owner, target, timing, communication and escalation where an issue is not resolved. | Corrective plan, training, engineering or purchasing changes, review results and communications. |
| Remediation and complaints | Accessibility, case number, confidentiality, investigation, remedy and closure basis. | Channel rules, case log, interviews, remedy records and communication with affected persons. |
| Review and communication | Significant changes, periodic review, public statement and national reporting scope. | Review minutes, annual statement or report, web version, publication date and corrections. |
3. Supplier file map: prepare proportionately
There is no official universal “five-level audit checklist”, and no rule says that one SA8000, SMETA, ISO 14001, payroll file or chemical log automatically satisfies every requirement. Build folders around the actual project and mark whether each record applies to the product, site, legal entity and period:
- Entity and relationship: legal entity, sites, subsidiaries or subcontractors, product or service scope, contract and order links.
- Labour and human rights: age checks, recruitment and exit, wages and hours, occupational health and safety, forced-labour risks, worker representation and complaints. Protect personal data and share only what is necessary.
- Environment: permits, emissions and waste records, chemicals and incidents, energy or greenhouse-gas data, and land or biodiversity risks. Separate measured data, estimates and voluntary customer metrics.
- Corrective action and remedy: finding, root cause, owner, target date, review result, affected person and open item.
- Source and version: legal or national-law link, internal document number, data period, preparer, approver, translation and limitations.
For smaller value-chain partners: Directive (EU) 2026/470 requires reporting undertakings to respect the right of value-chain undertakings averaging no more than 1,000 employees to decline information exceeding the voluntary standards, in the context covered by that rule. This cannot be generalised into a right to refuse every due-diligence request. Customers should state the purpose, scope and basis of a request and avoid default demands for unrelated personal files or unlimited historical data.
4. Boundaries for website and customer claims
- Say that a defined site, period and business scope has a documented risk review and evidence set available for review within the agreed scope.
- Do not say that one file “passes CSDDD”, that every supplier must obtain a fixed certification level, or that submission by a date guarantees avoidance of enforcement.
- Do not merge customer questionnaires, third-party opinions, self-assessment, national transposition laws and the directive into one legal conclusion.
- Do not present fines, market restrictions, recalls, delisting, orders or customer outcomes as automatic results; consequences depend on law, facts, procedure and competent authorities.
- When the company is named, use “Greenark Certification (Shenzhen) Co., Ltd.” as the English rendering of 绿色方舟（深圳）认证有限公司. This reference page is not legal advice.
5. Five checks before publication
- Verify company identity, EU turnover or employee data, group links and the applicable national law; do not use the old phase-in table.
- Check that each risk has a business scope, site, period and source; remove unsupported numbers and scores.
- Cross-check risk assessment, corrective action, complaints and remedy records, including open items.
- Apply necessity and access controls to supplier requests and remove unnecessary personal data.
- Review title, summary, H1, English localisation and cover text for certification seals, pass rates, fine percentages, fixed deadlines or outcome cues.
Sources (review date):
Directive (EU) 2024/1760 consolidated text; Directive (EU) 2025/794; Directive (EU) 2026/470; European Commission: Corporate Sustainability Due Diligence. Application, national transposition and contract-specific duties must be checked against the current official texts and facts.
