EU CSDDD: Administrative Penalties (Capped at 3%) and Civil Liability Under National Law
ENFORCEMENT TIMELINE
In force since 25 July 2024 (penalty cap and civil liability regime changed under the 2026 Omnibus reform)
Overview
This card covers how administrative enforcement (penalties) and civil liability operate under the EU Corporate Sustainability Due Diligence Directive (CSDDD).
Under the original Directive (in force from 2024), Member State supervisory authorities could impose penalties of at least 5% of a company's worldwide net turnover, and the Directive established an EU-harmonised civil liability regime under which victims of non-compliance — or their representatives, including NGOs and trade unions — could bring damages claims directly before national courts.
The Omnibus I reform (Directive (EU) 2026/470), in force since 18 March 2026, changed both of these mechanisms significantly. First, the penalty ceiling was changed from a minimum floor of 5% to a maximum cap of 3% of worldwide net turnover. Second, the EU-harmonised civil liability regime was removed altogether: claims for damages arising from due diligence failures are now governed exclusively by the national law of each Member State. There is no unified EU standard, and the EU-level right for NGOs and trade unions to bring representative claims no longer exists.
Enforcement Timeline
25 July 2024: CSDDD enters into force, initially with civil liability provisions and a 5% penalty floor.
26 February 2025: European Commission proposes the Omnibus simplification package, including relaxed penalties and removal of the EU-harmonised civil liability regime.
18 March 2026: Omnibus I enters into force. The 3% penalty cap and the removal of the EU-harmonised civil liability regime are confirmed.
26 July 2028: Deadline for Member States to transpose the Directive, including national penalty calculation rules and civil liability frameworks.
26 July 2029: Full application to all in-scope companies; supervisory authorities begin monitoring and enforcement.
Business Impact
With the penalty ceiling reduced to 3%, the financial exposure is smaller than originally anticipated, though still material. Boards and legal/compliance teams should watch closely how each Member State sets its own penalty methodology and civil liability rules during transposition.
The removal of the EU-harmonised civil liability regime is the more consequential change: the level of damages risk a company faces will now depend on which Member States it operates in, and the risk of representative claims by NGOs or trade unions depends on each country's own legal framework rather than a single EU standard. Building a robust due diligence process and retaining evidence of implementation remains the core defence regardless of which national regime applies.