October 16, 2026
CSDDD Compliance for Businesses Sourcing from Malaysia
Overview
The Corporate Sustainability Due Diligence Directive (CSDDD) was significantly narrowed by the EU’s Omnibus I simplification, in force since 18 March 2026. It now applies directly only to EU companies with 5,000 or more employees and over €1.5 billion in worldwide turnover, or non‑EU companies with over €1.5 billion in EU‑generated turnover, with compliance required from 26 July 2029.
If your business meets those thresholds, CSDDD requires risk‑based human rights and environmental due diligence across your value chain, including your Malaysian suppliers. If you don’t meet those thresholds, you are still very likely to feel this – your own large customers, who do meet them, are already pushing due diligence questionnaires and codes of conduct down their supply chains, and that includes you.
What due diligence actually requires, for in-scope companies
- 01
a risk‑based assessment of adverse human rights and environmental impacts across your own operations, subsidiaries, and established business relationships in the value chain
- 02
a due diligence policy and a complaints or grievance mechanism
- 03
a preference for engagement and remediation with a supplier over ending the relationship – CSDDD explicitly disfavours disengagement as a first response
Civil liability for breaches is now determined by each Member State’s own law rather than a single EU standard, and national transposition is due by 26 July 2028 – a year before the compliance date itself.
Why you may feel this even if you’re not directly in scope
If you sell into a corporate group or supply a large EU company that does meet the CSDDD thresholds, that company’s own compliance depends on being able to show due diligence across its value chain – which includes you, and in turn, your own Malaysian suppliers. In practice, due diligence expectations cascade down several tiers, not just from the largest company to its first supplier. It’s worth building the same due diligence discipline into your own Malaysian sourcing now, even without a direct legal obligation of your own – both to satisfy your larger customers, and because investors, banks and insurers increasingly expect it as standard practice regardless of formal scope.
Where CSDDD compliance fails without the right contract
- A warranty of compliance with the buyer’s due diligence code of conduct
- An obligation to cooperate with audits and assessments
- Remediation‑before‑termination commitments, consistent with the Directive’s own preference
- A clear allocation of liability if a breach is found
- Without an arbitration clause, none of it is practically enforceable against a Malaysian counterparty – a judgment from most EU courts is not straightforwardly recognised or enforced in Malaysia (if at all!), and litigating locally without pre‑agreed dispute resolution is slow and uncertain
Full treatment of supply chain contract terms
See our full treatment of supply chain contract terms for the broader drafting approach; the points above are the ones CSDDD specifically puts under pressure.
Why work with us on this
We extend the same supply chain due diligence work we do for EUDR and CBAM to CSDDD – and to the value‑chain pressure your business faces even where you’re not directly in scope – drawing on our broader EU regulatory compliance work.
Get your CSDDD exposure assessed
Contact us
Related Insights
Featured ebook
June 8, 2026
A Plain-English Guide to Mareva Injunctions in Malaysia
Winning a court case is one thing. Actually recovering the money you are owed is another. One of the more frustrating situations a business can face […]
Featured ebook
December 28, 2025
AIAC Arbitration Rules 2026: A Guide For Foreign Companies
Introduction – why this matters to international users of Malaysian arbitration The new AIAC Arbitration Rules 2026 will enter into force on 1 January 2026 and […]
