If you sell parts, fabric or semi-finished goods to a large European customer, a form like this may have landed on your desk in the past two years: working conditions, waste handling, sub-suppliers, emissions. The rule behind it is often the CSDDD, the EU’s Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760). It expects companies to identify and prevent human rights and environmental risks in their own operations and across their supply chains.
In 2026 the directive was cut back sharply. That does not mean the forms stop arriving. Here is what changed, what stayed the same, and what a Turkish manufacturer should prepare today.
What did Omnibus change in the CSDDD?
The “Omnibus I” simplification package (Directive (EU) 2026/470) was published in the Official Journal of the EU on 26 February 2026 and entered into force on 18 March 2026. We covered the reporting side in a separate article. On the CSDDD, the main points are:
- Scope shrank a lot. For EU companies, both more than 5,000 employees and more than EUR 1.5 billion in worldwide net turnover are required. For non-EU companies, the test is more than EUR 1.5 billion in net turnover in the EU.
- The timeline slipped. Member States now have until 26 July 2028 to transpose the directive. In-scope companies are expected to comply from 26 July 2029.
- The climate transition plan duty is gone. The obligation to adopt and implement a plan aligned with Paris goals was removed from the directive. The CSRD still asks companies to disclose a plan if they have one.
- Fines are capped. Administrative penalties are limited to 3% of net worldwide turnover.
- The EU-wide civil liability regime was deleted. Member States can still regulate liability under their own national law.
- A risk-based approach. Companies prioritise the areas where risk is highest and the information they can reasonably obtain, rather than examining every link in the chain equally.
Sources: the Omnibus I text in the Official Journal of the EU and post-publication summaries by law firms (Linklaters, CMS). Check the current text on EUR-Lex before making decisions for your own case.
The real question for a Turkish supplier: am I safe if I’m out of scope?
Most likely you are not directly in scope. Thresholds of 5,000 employees and EUR 1.5 billion are far above where the large majority of manufacturers in Türkiye sit. But even if the directive puts no direct obligation on you, the questions reach you when your customer is in scope. Due diligence covers the “chain of activities”: your customer’s suppliers, their suppliers and production partners.
The good news is that Omnibus put a frame around information requests. What companies ask of business partners, especially those with fewer than 5,000 employees, must be necessary and proportionate. Industry initiatives, multi-stakeholder schemes and digital tools are recognised as legitimate ways to do the work. In practice, expect a move toward shared formats instead of a different long questionnaire from each customer every year.
On the other hand, a risk-based approach can mean sharper questions in high-risk sectors. Textiles, leather, metalworking, chemicals, plastics and electronics may keep seeing detailed requests.
Which questions will keep coming?
In practice, an EU buyer’s questions to suppliers fall into three groups:
| Area | Typical question | Evidence to keep ready |
|---|---|---|
| Working conditions | Minimum age, working hours, health and safety records | HR records, safety training and incident logs, internal procedures |
| Environment | Energy, water, waste, emissions data; hazardous substances | Meter and invoice data, waste declarations, ISO 14001 or similar certificates |
| Sub-suppliers | Where raw materials come from, which subcontractors are used | Supplier list, origin documents, subcontractor agreements |
This table is not a legal provision, just a summary of typical practice. Requests vary by sector and product, so the safest move is to ask your customer in writing what exactly they need.
Three new pressure points: contracts, audits and data
The scope shrank, but the pressure did not disappear. It changed shape.
Clauses in the contract
Large buyers still attach codes of conduct and compliance expectations to their contracts. These clauses typically cover duties to provide information, allow audits and pass requirements down to sub-suppliers. Review them with your purchasing or legal team before signing, and do not accept a commitment you cannot keep.
On-site and remote audits
The customer or an independent auditor may visit your plant. What wastes the most time in an audit is rarely a missing document. It is the same document sitting in three folders with three different people. Records kept in one place, dated and searchable, can cut audit time in half.
One dataset for many requests
CBAM, supplier requests under the CSRD, Türkiye’s TSRS and the CSDDD are different laws, but the raw data is mostly shared: energy use, production volume, emissions, waste, headcount. Building a separate spreadsheet for each request raises cost and error rates. One data backbone is cheaper and safer. In our carbon footprint guide we explain the emissions side of that backbone.
Six steps you can take today
- List your customers. Identify which EU customers are near or above 5,000 employees and EUR 1.5 billion. They are the source of the questions.
- Collect incoming requests. Put the questionnaires and audit requests of the last two years side by side. Which questions repeat, and which are one-offs?
- Define a common dataset. Set up one template for energy, water, waste, emissions, headcount and occupational safety indicators.
- Map your sub-suppliers. At minimum, record direct suppliers, their countries and critical raw materials.
- Name an owner. If nobody is responsible for replying, the same question gets different answers.
- Check document freshness. An expired certificate is a risk signal on its own.
From data order to compliance: what İkiz Eksen does
The weak spot in all of these is the same: data produced on the shop floor and lost in the office. İkiz Eksen works through a measure, software and compliance chain. Production and energy data is captured at source, consolidated in one system using the enterprise software experience of Qera (550+ customers across 15+ sectors and 100+ ERP implementations), then turned into the output your customer and the regulation expect. The infrastructure runs on Microsoft Azure. We deliver nationwide as turnkey projects. Steps that need specialist expertise, such as accredited verification, are carried out with solution partners, and our solutions page states openly who provides what.
If you want to talk through which customer request will meet which data, get in touch. You can read how we work on the methodology page.
Frequently Asked Questions
Am I directly subject to the CSDDD?
For a Turkish manufacturer that is unlikely. The directive looks for more than 5,000 employees and more than EUR 1.5 billion in net turnover for EU companies, and more than EUR 1.5 billion in EU net turnover for non-EU companies. If your customer is in scope, though, supply chain questions can reach you.
Can my customer still ask me for data after Omnibus?
Yes. What changed is that requests must be necessary and proportionate, and companies are steered toward shared industry initiatives and digital tools. The data demand did not disappear, its frame became clearer. It is reasonable to ask your customer for the purpose and format of the request in writing.
When does it apply?
Member States must transpose the directive by 26 July 2028. In-scope companies are expected to comply from 26 July 2029. Customers can question suppliers before that date under their own policies.
Does the penalty or liability risk pass to me?
Penalties apply to in-scope companies and are capped at 3% of net worldwide turnover. As a supplier you are not the addressee of a fine. Still, obligations in your customer contract can have commercial consequences, such as termination or lost orders. Read contract clauses with that in mind.
Do CBAM and the CSDDD ask for the same data?
Largely yes, though not at the same level of detail. CBAM asks for embedded emissions per product and requires verification. The CSDDD looks more broadly at environmental and human rights risk. Keeping energy, production and emissions data in one place serves both. For a starting point, see our twin transition page.