EU CSDDD after the 2026 changes: what it means for clothing brands and their Bangladesh suppliers

The EU Corporate Sustainability Due Diligence Directive (CSDDD) is narrower and later than many pages about it still say. Directive (EU) 2024/1760 entered into force on 25 July 2024. Directive (EU) 2026/470, in force since 18 March 2026, limits it to companies with more than 5,000 employees and more than €1.5 billion net worldwide turnover, and to non-EU companies with more than €1.5 billion net turnover in the EU. National laws are due by 26 July 2028 and apply to every company in scope from 26 July 2029. This guide is written from the Official Journal texts as they stand on 23 September 2026. It explains the law and is not legal advice: national laws will add detail, so confirm your own position with a lawyer.

The CSDDD then and now

The directive has been amended twice since June 2024. Directive (EU) 2025/794, published on 16 April 2025, postponed the transposition deadline and the first application date by a year. Directive (EU) 2026/470, published on 26 February 2026, changed the substance.

Who is in scope after the 2026 amendment

• EU companies: more than 5,000 employees on average and more than €1.5 billion net worldwide turnover in the last financial year for which accounts were, or should have been, adopted. A parent is also covered when its group reaches those figures on a consolidated basis.
• Non-EU companies, such as a US, UK or Australian brand selling into the EU: more than €1.5 billion net turnover generated in the EU in the financial year before the last one, alone or as the ultimate parent of a group. There is no employee test, and sales outside the EU do not count.
• Franchising and licensing: royalties from agreements in the EU above €75 million and net turnover above €275 million.

Part-time staff count as full-time equivalents and temporary agency workers are included, and the thresholds must be met in two consecutive financial years. The European Commission's summary states that micro companies and SMEs are not covered.

So most clothing brands will not be in scope themselves. The largest groups that sell clothing in the EU will be, and their due diligence reaches back to the factory floor. A Bangladesh exporter is in scope only with more than €1.5 billion of net turnover in the EU. For everyone else the directive arrives through customers' contracts, codes of conduct and questionnaires.

The timetable, date by date

Until a Member State's law applies, the directive places no duty on any company. It sets no date for sector-specific guidance, so it schedules nothing for clothing in particular. The 2031 review could widen the scope again, but that would need new legislation.

What the 2026 amendment changed, and what it kept

Beyond the rows in the table above, Directive (EU) 2026/470 changed how due diligence is done:

• Scoping first. Article 8 now asks for a scoping exercise, based solely on reasonably available information, to find the general areas where harm is most likely and most severe, then an in-depth assessment only in those areas. The recitals say the scoping stage, as a general rule, rules out requesting information from business partners.
• Suspension, not termination. As a last resort a company must refrain from new or extended business with the partner and, where the law governing the relationship allows, suspend it while an enhanced action plan runs. Continuing to work with the partner does not in itself expose the company to penalties or liability while that plan has a reasonable expectation of success.
• Liability. Where a company is held liable under national law, the people harmed must still have a right to full compensation. The rule letting victims authorise a trade union or NGO to sue for them is deleted from the directive.
• Stakeholders. Engagement is limited to workers, their unions and representatives, and people directly affected, at three stages: identifying impacts, drawing up action plans and deciding remediation.

What stayed matters more to a supplier. In-scope companies still need a due diligence policy with a code of conduct, reviewed at least every 24 months, and must still, where relevant, seek contractual assurances from direct business partners, verify them, run a complaints procedure and publish an annual statement. The Annex still lists the rights that count, including a fair wage and an adequate living wage, safe and healthy working conditions with reasonable working hours, freedom of association and collective bargaining, and the bans on child labour, forced labour and unequal treatment. It also covers environmental harm, such as measurable water or air pollution that damages people's health or access to safe drinking water.

What an in-scope customer will still ask a Bangladesh supplier

Audit reports sit at the centre because the directive expressly allows verification through independent third parties and industry initiatives. Our comparison of BSCI, WRAP, SMETA and SA8000 audits explains each scheme, amfori BSCI audit ratings explained sets out what each grade means, and how to verify a factory certificate in Bangladesh shows how to check a report is genuine. Material origin is the part most often missing; the forced labour and cotton traceability guide sets out the document chain from bale to garment.

Where a partner is an SME as the directive defines it, by reference to the EU accounting directive's size categories, contract terms must be fair, reasonable and non-discriminatory, and the in-scope company bears the cost of independent third-party verification relating to that SME. Whether a given factory qualifies is a question for the buyer's lawyer. And if your contract is with a buying house rather than the factory, the directive's definitions make the buying house your direct business partner and the factory an indirect one. Article 10(4) allows contractual assurances from an indirect partner too, and the amended Article 8 asks companies to request information, where reasonable, from the partner where harm is most likely. Both need the factory's name.

The 5,000-employee limit on information requests

Under the amended Article 8, once national law applies:

• an in-scope company may request information from a business partner only where it is necessary for the in-depth assessment;
• from a partner with fewer than 5,000 employees, only when the information cannot reasonably be obtained by other means, such as information it already holds;
• it may rely on independent reports, digital solutions and industry or multi-stakeholder initiatives, which the recitals say should help avoid duplicate requests.

The recitals add that requests should be targeted, reasonable and proportionate. A factory that keeps one current evidence pack (audit report, corrective actions, grievance records and material origin) gives customers less reason to send another questionnaire. The limit does not remove contractual assurances or verification, and it does not apply before 26 July 2029. Until then a questionnaire is a commercial request, backed by the customer's contract and any national law already in force.

A separate limit for sustainability reporting questionnaires

Some questionnaires come from sustainability reporting under the Corporate Sustainability Reporting Directive (CSRD), which the same 2026 directive narrowed to undertakings with more than 1,000 employees and more than €450 million net turnover. It also created "protected undertakings": value-chain companies with no more than 1,000 employees on average.

The reporting protection expressly does not cover requests made to comply with EU due diligence duties, so a CSDDD request falls under the 5,000-employee rule instead. A reporting company may rely on a supplier's self-declaration that it is protected, unless it knows, or can reasonably be expected to know, that the declaration is manifestly wrong. The voluntary standard itself now exists: the Commission adopted it on 3 July 2026 as Delegated Regulation (EU) 2026/1560, published in the Official Journal on 21 September 2026. It enters into force on 24 September 2026, when Commission Recommendation (EU) 2025/1710, the earlier voluntary standard for SMEs on which it is based, stops having legal effect. Its value-chain cap, the list of datapoints a reporting company may ask a protected supplier for, applies from financial years beginning on or after 1 January 2027.

Myths still repeated on sourcing sites

How the CSDDD fits with other rules

• EU Forced Labour Regulation. From 14 December 2027 it prohibits products made with forced labour from being placed on, made available on or exported from the EU market. The Commission says it applies to all companies and adds no audit or reporting obligations. It reaches small brands that the CSDDD does not.
• National laws. The amended directive lets Member States adjust their existing due diligence laws, in particular their scope, to align with it. Buyers in Germany should read our page for German brands, which covers the German supply chain act.
• Product rules. The planned digital product passport is separate; see the EU digital product passport guide. Much of the data overlaps, so collect it once.

For duty and proof of origin on clothing made in Bangladesh, see our page for EU brands.

A checklist before July 2029

1. Check whether your company, or your largest customers, pass the thresholds in two consecutive years; non-EU companies count EU turnover only.
2. Record the factory, its address, its audit status and any subcontractor for every style.
3. Keep one evidence pack per factory: audit report, dated corrective actions, grievance channel and records.
4. Record the fabric mill, dye house, yarn and cotton origin for each order.
5. Review codes of conduct and supplier contracts against the amended text, including the move from termination to suspension.
6. Watch for the Commission guidelines due by 26 July 2027 and your Member State's law due by 26 July 2028, and confirm your position with a lawyer.

What to do next

If a customer in scope is already asking questions, the useful answer is evidence rather than assurances. CMB Sourcing Ltd. is a buying house in Narayanganj, Dhaka. We do not own sewing lines; orders are made in audited partner factories. We name the factory making your order in writing before production, with its address, certificates and audit reports, check quality on the line and run an AQL final inspection. Our compliance and factory audits page explains how orders are matched to factories holding the audits your customers require. Send us your styles and quantities, with your customer's questionnaire if you have one, and a founder will reply within one working day.