ESRS and CSDDD: Reporting, Due Diligence and Value Chain Responsibilities Compared

The same impact may appear in an ESRS materiality assessment, a supplier due-diligence file, a grievance review, a CSDDD prevention plan and a board paper. That overlap is useful, but it creates a dangerous shortcut: teams can start to describe the existence of a reporting disclosure as proof that the underlying conduct obligation has been fulfilled. The two instruments answer different legal and reporting questions.

Revised ESRS 1 makes the boundary explicit: ESRS mandate behaviour related to reporting sustainability information, but do not exempt an undertaking from due-diligence obligations under other Union law. CSDDD, by contrast, is directed at the due-diligence conduct of companies within its scope. ESRS explains what material information must be presented to users; CSDDD determines what in-scope companies must do to identify and address specified adverse human-rights and environmental impacts.

Figure 1. A shared operating process can support ESRS and CSDDD, but the obligations and legal claims remain separate.

A well-designed operating model avoids two separate databases for the same underlying facts. It creates a controlled evidence base and then applies separate legal and reporting decision layers. The shared layer can include:

A relationship and value-chain register identifying legal entity, business relationship, activity, geography, product or service, affected stakeholder groups and responsible owner.

An impact register capturing actual and potential adverse impacts, relevant positive impacts for ESRS, severity and likelihood assessments, evidence quality, time horizon and current status.

Stakeholder-engagement records, including who was consulted, why, how accessibility and vulnerability were considered, what was heard, what changed and what could not be disclosed publicly.

A policy and action register connecting commitments, prevention and mitigation measures, leverage, responsible owners, milestones, resources, expected outcomes and monitoring evidence.

Grievance, notification and incident records with privacy classifications, escalation rules, investigation status, corrective action and remedy analysis.

A governance and approval trail showing legal, operational, sustainability, risk and board decisions, together with unresolved limitations and follow-up actions.

The shared records do not themselves decide whether an ESRS datapoint is material or whether a CSDDD duty has been fulfilled. Those decisions sit in separate controlled views of the same evidence.

1. Use due-diligence information as an input to IRO identification. Supplier audits, complaints, incident investigations, worker dialogue, community engagement and litigation signals may reveal impacts that a management-only workshop would miss.

2. Test materiality under ESRS criteria. A severe adverse impact can be material for ESRS even where the company has not concluded that it is within CSDDD scope, and a CSDDD action does not automatically make a separate ESRS disclosure material.

3. Map material IROs to the reporting architecture. Connect each IRO to ESRS 2, the relevant topical standard and the general disclosures on policies, actions, metrics and targets.

4. Translate operational actions into balanced disclosure. Describe the problem addressed, scope, action, resources, status, outcome evidence and limitations; do not convert an activity count into an unsupported effectiveness claim.

5. Preserve sensitive material in the internal file. Public reporting should not disclose personal data, privileged legal advice, confidential grievance details or information that could expose affected people to retaliation.

An ESRS programme can improve CSDDD readiness by creating governance, a business-model and relationship map, a documented DMA, stakeholder evidence, a controlled action register and management reporting. It can also reveal gaps: missing indirect relationships, an action with no outcome measure, a grievance process with no remedy decision, or public language that is inconsistent with the legal file.

The legal team must still test CSDDD scope, the applicable chain of activities, the company’s involvement, the measures required, prioritisation, stakeholder obligations, remediation, monitoring and national enforcement provisions. The ESRS reporting team should receive the approved legal conclusion needed for disclosure, rather than infer it from operational activity.

Shared process. The group records the suppliers, affected worker groups, evidence, severity assessment, corrective actions, responsible buyers, leverage measures, deadlines and remedy questions in one controlled system. Procurement and compliance monitor implementation; sustainability links the material impact to ESRS S2 and ESRS 2 disclosures.

Separate ESRS conclusion. The reporting team assesses whether the impact is material, determines the information needed about the impact, stakeholder engagement, policies, actions, metrics and limitations, and drafts a balanced disclosure. The report does not state that all affected workers have received remedy unless that outcome is supported.

Separate CSDDD conclusion. Legal and compliance determine whether the suppliers and activities fall within the applicable legal perimeter, what measures are required, whether prioritisation is defensible, whether remediation is due and what must be communicated. Their conclusion is approved and retained separately. The shared evidence reduces duplication, but the tests and claims remain distinct.

Using the same word “value chain” without checking whether the ESRS and CSDDD boundaries are legally identical.

Treating the ESRS due-diligence statement as a checklist demonstrating that every CSDDD duty has been met.

Reporting policies and supplier audits but omitting adverse outcomes, failed actions, unresolved remediation or limitations.

Allowing procurement to classify requests and relationships without legal review or reporting-boundary controls.

Publishing confidential grievance or investigation detail that should remain restricted.

Describing stakeholder engagement as approval by stakeholders rather than an evidence and decision input.

Using assurance over selected ESRS information to imply assurance over substantive due-diligence compliance.

Name separate accountable owners for ESRS reporting and CSDDD legal compliance.

Maintain one controlled impact, relationship, action and remedy evidence base where lawful and practical.

Add purpose, legal basis, access class, reporting period, owner, reviewer and retention fields to shared records.

Document separate boundaries, materiality or prioritisation criteria, conclusions and approvals.

Reconcile ESRS statements with CSDDD communications, policies, websites, tenders and supplier messages.

Challenge positive or effectiveness claims against outcome evidence, not activity counts alone.

Review sensitive stakeholder, grievance and remedy evidence for privacy, privilege and retaliation risk.

Ensure assurance wording identifies the subject matter and does not imply legal compliance outside its scope.

1. Can the team identify which conclusion in the file is an ESRS materiality decision and which is a CSDDD legal or operational decision?

2. Does every public statement about prevention, mitigation or remedy have evidence and an approved scope?

3. Could a reader reasonably mistake the sustainability statement or assurance report for a CSDDD compliance opinion?

Source check completed on 2 August 2026. This article is an educational publication draft. It does not provide legal, assurance or organisation-specific advice. Confirm the applicable ESRS edition, the final Official Journal text, national implementation and the undertaking’s facts before public use.

Publication of revised ESRS in the Official Journal or changes to the 2026 transition provisions.

CSDDD national transposition measures, Commission guidance or model contractual clauses.

Changes to CSDDD scope, chain-of-activities, stakeholder engagement, remediation or communication requirements.

New assurance guidance on due-diligence statements, value-chain evidence or claims of compliance.

Do not describe an ESRS statement as evidence that the undertaking complies with CSDDD as a whole.

Check the applicable CSDDD scope and national implementing law before using jurisdiction-specific language.

Keep the ESRS value-chain concept separate from the CSDDD chain-of-activities test.

Review remediation, grievance and stakeholder examples for privacy, privilege and legal sensitivity.