EUDR vs CSDDD: how the two due diligence laws differ

The EUDR and the Corporate Sustainability Due Diligence Directive (CSDDD, sometimes written CS3D) are two separate laws with different triggers. The EUDR applies to anyone placing seven named commodities on the EU market, whatever their size. The CSDDD applies only to very large companies, and covers human rights and environmental harm generally — deforestation is one risk among many it expects you to assess, not a standalone regime. Most operators that fall under the EUDR are too small to be touched by the CSDDD at all.

What triggers each law

The EUDR is a product regulation. Regulation (EU) 2023/1115 catches cattle, cocoa, coffee, oil palm, rubber, soya and wood, plus listed derivatives, whenever they are placed on or exported from the EU market or made available on it — regardless of the size of the company doing it. A sole trader importing a container of coffee is in scope in exactly the same way as a multinational roaster, though smaller operators get simplified obligations and a later date.

The CSDDD is a company-size regulation. Directive (EU) 2024/1760, as amended by the Omnibus I Directive (EU) 2026/470 (published 26 February 2026, in force from 18 March 2026), only reaches EU companies with more than 5,000 employees and over €1.5 billion in worldwide net turnover, tested at the ultimate parent level. Non-EU groups are caught instead once they generate more than €1.5 billion in EU turnover. Franchising and licensing businesses have their own, lower thresholds: over €75 million in EU royalty income and over €275 million in worldwide turnover (EU businesses) or EU turnover (non-EU businesses). Below those lines, the CSDDD simply does not apply, however much deforestation risk sits in your supply chain.

What each law actually requires

The EUDR requires a product-level due diligence statement for every relevant product, built on three steps: gathering information (including geolocation of the plot of production), assessing risk, and mitigating any risk found before the product is placed on the market. The standard it tests against is narrow and factual — was the commodity produced on land deforested or degraded after 31 December 2020, and was it produced in line with the relevant laws of the country of production.

The CSDDD requires a much broader due diligence process across a company's "chain of activities": identifying actual and potential adverse human rights and environmental impacts, not just deforestation, across upstream suppliers and (for some activities) downstream distribution. It expects a risk-based process, a complaints mechanism, and engagement with affected stakeholders — a governance exercise, not a product check. Two provisions that made the CSDDD distinctive at the drafting stage have since been stripped out by the Omnibus reform: the mandatory climate transition plan (Article 22 has been deleted; companies are no longer required to adopt and implement one) and the EU-harmonised civil liability regime (Article 29's common liability standard has gone, so claims now run under ordinary national liability rules, and member states are no longer required to give NGOs and trade unions standing to sue on a victim's behalf). The maximum administrative penalty has also been capped at 3% of net worldwide turnover, down from a floor of "not less than 5%" in the original text.

Who enforces each law

The EUDR is enforced by a competent authority in each member state, designated under Article 14, with the power to carry out checks, demand corrective action and impose penalties — these authorities already exist and are gearing up for the December 2026 start. The CSDDD leaves enforcement to a supervisory authority each member state must designate, with its own inspection and sanction powers, but because due diligence obligations only bite from 26 July 2029, no CSDDD enforcement activity is happening yet anywhere in the EU. A business dealing with an EUDR inspection today has no CSDDD equivalent to compare it to — the two enforcement regimes are years apart in maturity as well as in scope.

Deadlines: these are not the same calendar

	EUDR	CSDDD
Governing text	Regulation (EU) 2023/1115, as amended by (EU) 2025/2650	Directive (EU) 2024/1760, as amended by (EU) 2026/470
Who is in scope	Any size, by product	Employee and turnover thresholds only
Main threshold	None — product-based	>5,000 employees and >€1.5bn turnover (EU parent); >€1.5bn EU turnover (non-EU parent)
Obligations start	30 December 2026 (large/medium, and micro/small already under the Timber Regulation); 30 June 2027 (other micro/small)	26 July 2029 for in-scope companies
Member state transposition	Not applicable — a regulation applies directly	26 July 2028
What it checks	Deforestation-free status of named commodities since 31 Dec 2020	Broad human rights and environmental adverse impacts

The gap matters in practice. An EUDR operator with December 2026 obligations has nothing in common, date-wise, with the CSDDD's 2029 start — a business can be fully in scope of one and years away from the other even if it eventually meets the CSDDD's size thresholds too.

If you are in scope of both

A handful of very large operators — timber groups, agribusiness majors, big retailers sourcing cocoa or palm oil directly — will eventually sit inside both regimes. Nothing in either text lets compliance with one substitute for the other: an EUDR due diligence statement is not accepted as CSDDD due diligence documentation, and a CSDDD risk assessment does not satisfy Article 9 of the EUDR. They test different things — one a product's origin, the other a company's governance of impacts across its value chain — and each has its own competent authority and its own penalty regime.

What can genuinely be shared is the underlying data. Geolocation coordinates, supplier mapping and risk assessments gathered for EUDR due diligence are relevant inputs to a CSDDD impact assessment, since deforestation and land rights sit inside the broader impacts the CSDDD asks you to consider. Building one data-collection process that feeds both compliance files is sensible; treating either filing as interchangeable with the other is not. This is the same logic that applies to the EUDR's overlap with CSRD reporting — overlapping inputs, separate legal outputs.

The practical sequencing also matters for planning. A group that will eventually meet the CSDDD's thresholds has roughly three years between its EUDR start date and its CSDDD start date — long enough to build the EUDR's product-level supplier and geolocation data first, under a real compliance deadline, and then extend that same supplier mapping outward into the fuller CSDDD process once its 2029 obligations approach, rather than running two separate data-collection exercises from a standing start.

Why this confusion is common

CSDDD, CS3D and CSRD get used almost interchangeably in supply-chain conversations, and all three arrived, were delayed, and were narrowed by the EU's 2025–2026 Omnibus simplification drive within months of each other. The CSRD is a reporting directive — it does not itself impose due diligence duties, though its ESRS E4 standard covers biodiversity and ecosystems. The CSDDD is a due diligence directive with no reporting standard of its own (it uses the company's own website under Article 16 for public disclosure). The EUDR is neither a reporting law nor a general due diligence law — it is a single-purpose market-access rule for seven commodities. Keeping the three apart matters because each has a different trigger, a different regulator, and now, after the Omnibus reforms, a different timetable.

What to do now

If you place any of the seven EUDR commodities on the EU market, your obligations and deadline depend on your size band under the regulation's own test, not your group's consolidated accounts — check how consolidation affects your size band if you are part of a larger group. If you are unsure which EUDR date applies to you, the EUDR deadline guide sets out both dates and the conditions attached to each. Very large operators should also read how the EUDR's own reporting duty interacts with CSRD, since that overlap is live now, while the CSDDD's is still three years off.

For the mechanics of the EUDR filing itself, see the step-by-step guide to the due diligence statement in TRACES, and for what happens if you get it wrong, what EUDR non-compliance actually costs. None of this depends on whether the CSDDD will ever reach you — the EUDR clock is running regardless. Run your business through the checker to get your actual EUDR obligations and deadline in a few minutes.