Can due diligence guidance arrive early enough to matter? Companies preparing for the Corporate Sustainability Due Diligence Directive have spent the summer answering a Commission questionnaire that closed on 14 August, and the answer they received is uncomfortable. The guidelines those responses will shape are not due until July 2027, and a second tranche follows a year after that.
The consultation opened on 12 June and asked firms, trade associations, unions and civil society groups how the Commission should explain a law that member states are already transposing. It covers the mechanics that determine whether the directive functions: how a company maps its chain of activities, which data sources count as reliable, how it engages stakeholders in practice, and what digital tools can substitute for the site visits nobody can perform across thousands of suppliers.
The sequencing problem is not an accident of drafting. The Omnibus I package, agreed early this year, cut the directive’s scope, removed the obligation to adopt climate transition plans and pushed back application dates. It also preserved the guideline deadlines set in the original text, which means the Commission must publish process guidance by 26 July 2027 and resource-sharing guidance by 26 July 2028. Firms in the first application wave will design compliance systems before either document exists, and they will redesign them afterwards if the guidance contradicts their choices.
Large companies can absorb that. A group with a dedicated sustainability function will build a defensible process, document its reasoning and adjust later. The cost falls on suppliers, and specifically on the small and medium firms the directive never covered directly. Those companies receive questionnaires from every customer in scope, each formatted differently, each demanding data the supplier collects for no other purpose. The Omnibus tried to address this by limiting the information large firms may request from smaller partners, but the limit binds the buyer, not the buyer’s auditor.
Business groups used the consultation to push for a single European template, arguing that guidance without standardisation multiplies paperwork rather than reducing it. Civil society organisations pushed the other way, warning that a template invites box-ticking and lets companies substitute a completed form for the risk-based analysis the directive requires. Both criticisms describe a real failure mode, and the Commission cannot avoid one without inviting the other.
National transposition adds a third pressure. Member states must write the directive into domestic law, and several have signalled they will do so without waiting for guidance that arrives in 2027. Divergent national interpretations of the same obligation would recreate the fragmentation the directive was meant to prevent, and companies operating in a dozen jurisdictions would face a dozen readings of what a reasonable risk assessment looks like. Officials know this. They have limited tools to stop it, because a directive leaves implementation choices to capitals by design.
The deeper question the consultation cannot resolve is what the guidelines are for. Guidance that merely restates the legal text helps nobody. Guidance detailed enough to be useful starts to look like law made without a legislature, and companies that follow it will expect a safe harbour the directive does not grant. The Commission has not said whether compliance with its guidelines will protect a firm from liability, and that silence explains much of the caution in the responses it received.
What arrives in July 2027 will therefore be judged on a narrow test. Firms want to know whether following the Commission’s method protects them when a national supervisor disagrees. Suppliers want to know whether one questionnaire can replace forty. Neither group will get certainty from a document that carries no legal force, and both will keep building systems on assumptions that Brussels has another eleven months to confirm or overturn.
