What Changes for Italian Companies with the new Sustainability Due Diligence Directive?

Introduction

In recent years, the European Union has stepped up its efforts to make corporate practices more sustainable and respectful of fundamental rights, gradually shifting its focus from a voluntary approach to a binding regulatory framework. In this context, the Corporate Sustainability Due Diligence Directive (CSDDD) introduces legal obligations for large companies to prevent and mitigate negative impacts on human rights, the environment and climate throughout their entire business chain.

The directive, an integral part of the European Green Deal strategy, aims to strengthen regulatory coherence between Member States and ensure a level playing field in the internal market. The approval of Directive (EU) 2025/794, which postponed the application deadlines initially foreseen, confirms the EU’s desire to balance regulatory ambition and implementation realism, offering companies a longer period to comply with the obligations.

Italy, like other Member States, will have to incorporate and implement these provisions into its own legal system, initiating a profound transformation of the rules of corporate conduct.

Obligations and main principles of the Directive

Directive (EU) 2024/1760 introduces a structured system of mandatory corporate due diligence on sustainability, requiring companies to act proactively to identify, prevent, mitigate and, where appropriate, put an end to adverse impacts on human rights and the environment throughout their entire supply chain, both upstream and downstream. The regulatory approach is based on the principle of the risk-based approach, according to which companies must focus their actions on the sectors and business relationships most exposed to serious risks.

The obligations introduced by the Directive include:

• The integration of due diligence into corporate policies, through the adoption of a sustainability policy that includes a risk prevention and mitigation strategy, updated at least every 12 months;
• The identification and regular assessment of current and potential negative impacts, through appropriate tools for mapping the chain of activities, audits and internal and external reporting mechanisms;
• The adoption of corrective measures where negative impacts already underway are identified, with the obligation to cease or minimize such effects and monitor their evolution;
• The active involvement of stakeholders, in particular potentially affected parties, according to the principle of inclusive and transparent participation;
• The preparation of a climate transition plan, mandatory for large companies, which must be in line with the objectives of the Paris Agreement and Regulation (EU) 2021/1119, and which provides for the progressive decarbonization of corporate activities.

In addition, companies will have to set up accessible complaint mechanisms, allowing injured parties or stakeholders to report actual or potential infringements. Competent authorities in Member States will be responsible for verifying compliance with the obligations and will be able to take corrective measures, including fines, cease-and-desist orders and publication of infringements (“naming and shaming”).

The envisaged liability system also includes the possibility of civil actions for damages by individuals or communities affected by violations not prevented by companies, within the limits provided for by national law and in compliance with the principle of proportionality.

Finally, the directive recognizes the need for specific protections for SMEs, requiring large companies to provide technical and financial support to their smaller suppliers, in order to avoid the excessive transfer of burdens along the supply chain.

Area of application and entities affected

Directive (EU) 2024/1760, as amended by Directive (EU) 2025/794, establishes a gradual and selective application of due diligence obligations, based on size, territorial and turnover criteria. The European legislator has adopted a calibrated approach to ensure a balance between the effectiveness of the rule and the sustainability of the burdens for companies, introducing precise thresholds for subjection to the obligations.

The following types of companies are affected:

• EU-based companies with an average of more than 1,000 employees and a worldwide net turnover of more than €450 million in the last financial year;
• Parent companies in the EU that meet, on a consolidated basis, the same criteria of size and turnover;
• Non-EU companies that generated a net turnover of more than €450 million in the Union market during the previous financial year, regardless of their physical presence in the European territory.

The directive provides for a progressive implementation on several levels, which will start from 2028 for larger companies, postponing the original deadline. In particular:

• Companies with more than 5,000 employees and a turnover exceeding 1.5 billion euros (or equivalent groups) will be the first to be involved;
• Companies with more than 3,000 employees and a turnover exceeding 900 million euros will follow from 2028;
• Finally, the application will be extended, in a third phase yet to be defined, to companies that exceed the threshold of 1,000 employees and 450 million euros, as envisaged in the final approved formulation.

SMEs remain excluded from the direct scope of the regulation. However, they could be involved indirectly as suppliers or business partners of companies subject to the directive. Large companies, in fact, will be required to assess risks and manage relationships along the entire value chain, promoting the adoption of minimum standards also by their suppliers and subcontractors, many of which will be SMEs.

It is important to underline that the concept of chain of activities adopted by the directive is broad: it includes not only direct relations between companies and suppliers, but also “upstream” activities (e.g. extraction of raw materials) and “downstream” activities (e.g. distribution and after-sales management), making the scope of responsibility of companies broad and complex.

Timeline

Following the approval of Directive (EU) 2025/794, the entry into force of the provisions of the CSDD has been postponed. Member States will have until 31 December 2025 to transpose the Directive into their national legislation. The first companies will be subject to the obligations starting from 2028, instead of 2027 as initially planned. In parallel, the deadlines for compliance with the obligations under the Corporate Sustainability Reporting Directive (CSRD) have also been postponed, with a two-year deferral for many categories of companies. The postponement is part of a broader European strategy, formalised in the “Omnibus I” Package, aimed at simplifying the implementation of the regulations and promoting economic competitiveness.

Inspections, enforcement and responsibility

In addition to the definition of obligations and progressive application, the directive introduces a complex system of supervision and responsibility, entrusted both to the competent authorities of the Member States and to a European coordination network. Each State will have to designate one or more bodies responsible for supervising compliance with the legislation, with powers of investigation, inspection and sanction. Cooperation between national authorities will be guaranteed by a European supervisory network, coordinated by the EU Commission, to ensure consistent and harmonized application of the provisions throughout the Union.

The sanctioning regime provided for by the directive is divided into two levels:

• Administrative measures, including dissuasive fines, cease-and-desist orders and obligations to publish violations (c.d. naming and shaming);
• Civil liability, which allows those damaged by negative impacts not prevented by the company – when due to a breach of due diligence obligations – to promote compensation actions. This principle strengthens the legal dimension of sustainability, transforming it into a potential source of litigation.

The directive also provides support measures for businesses, in particular for SMEs indirectly involved, through digital tools, guidelines and incentives for the adoption of due diligence practices. The general approach aims to balance the mandatory nature of the rule with forms of operational flexibility, especially in cases where the complexity of the chain of activities makes direct control over all the subjects involved difficult.