The 2026 revision of the European Corporate Sustainability Due Diligence Directive (CSDDD) has removed one of its most contested provisions: Article 29(1) which had required Member States to introduce a civil liability regime for violations of the Directive’s human rights due diligence obligations. The removal appears to signal both an end to Member States’ obligation to provide for civil liability and a shift towards a purely public enforcement system. Yet, a newly introduced Recital 49 calls on Member States to ensure that victims may claim damages in case of violations while provisions in the operative part of the Directive continue to refer to the availability of such claims. Whether the Directive (still) requires Member States to supplement public enforcement with a civil liability regime remains, thus, uncertain.

This uncertainty should not, however, deter Member States from harnessing the advantages of private enforcement. To enhance the effectiveness of the Directive – and to help achieve its settled (political) goal of better protecting human rights in global supply chains – they should provide for civil liability regardless of any legal obligation to do so. In addition, Member States should ensure that victims can effectively pursue damages claims in European courts.

What the Revised Directive Requires (or not)

Whether companies should be held liable for breaches of human rights due diligence obligations has accompanied the discussions about the Corporate Sustainability Due Diligence Directive from the start. With the 2026 removal of Article 29(1) CSDDD the question seemed settled at first. A closer look, however, suggests otherwise: Not only does Recital 49 sentence 2 require Member States to ensure that victims receive full compensation where a company breaches its due diligence obligations under the Directive and thereby cause damage. Recital 49 sentence 1 also justifies the removal of Article 29(1) CSDDD with the need to “better achieve the principle of subsidiarity”. In addition, it only speaks of dispensing with a “specific, Union-wide liability regime”. Many scholars, therefore, argue that the European legislature merely intended to leave the details of the civil liability regime to the Member States – but not the decision whether to introduce such a regime in the first place (see Brunk with further references).

This interpretation is supported by the fact that the Directive still contains numerous provisions that seem to presuppose the existence of a civil liability regime. Article 29(2) CSDDD, for example, requires that victims receive full compensation where a company is held liable for damage under national law. Article 29(3)(a) CSDDD, in turn, provides that national rules on the commencement, duration, suspension or interruption of limitation periods must not unduly hamper the bringing of actions for damages and lays down detailed requirements concerning the design of these rules. Finally, Article 29(3)(b) to (e) CSDDD contain a number of provisions aimed at facilitating the enforcement of claims for damages in civil proceedings.

One may, however, wonder why the European legislature deleted Article 29(1) CSDDD in its entirety if it merely intended to leave the design of the civil liability regime to the Member States? It would have been easy to provide that Member States must ensure that victims have a right to claim damages in accordance with national law. The inclusion of a corresponding recital is no substitute. According to the settled case law of the CJEU, recitals do not have binding legal force (CJEU, C-136-04, Deutsches Milch-Kontor, EU:C:2005:716, para. 32; CJEU, C-418/18 Puppinck, ECLI:EU:C:2019:1113, para 75). They may be used to interpret the operative provisions of EU legislation, but they cannot establish obligations that have no basis in those provisions. And they cannot establish obligations that were deliberately deleted from the operative part of a legislative act (cf. CJEU, C-397/16 and C-435/16, Acacia and D’Amato, ECLI:EU:C:2017:992, paras 33 ff.). Nor do the remaining references to damages claims in the operative part of the Directive suggest that Member States have to introduce a civil liability regime. These provisions can equally be understood as regulating the conditions and modalities of civil liability where liability already exists under national law or is voluntarily introduced by Member States when implementing the Directive.

Why Member States Should Introduce Civil Liability Either Way

In the light of the above, it remains unclear whether the revised Directive requires Member States to establish a civil liability regime for violations of the Directive’s obligations. This uncertainty, however, should not obscure the policy case for private enforcement. Indeed, there is something counterintuitive about imposing obligations on companies to protect individuals – and deny the very same individuals the right to enforce these obligations. More importantly, however, private enforcement offers a number of advantages over public enforcement which, in turn, may enhance the effectiveness of the Directive.

The first and arguably most important advantage lies in the incentives of those seeking enforcement: Private enforcement draws on the incentives of victims who have a personal stake in holding companies accountable and in recovering compensation for the harm they have suffered. Public enforcement, by contrast, relies on public officials whose incentives are less immediate, stemming primarily from a sense of professional duty or the prospect of career advancement.

A second advantage concerns access to information and is closely related to the first: Human rights violations usually occur in non-EU countries. Member State authorities will, therefore, have a hard time to gather relevant evidence, identify witnesses, and reconstruct events. Victims, by contrast, are closer to the facts: they know the local conditions, the people involved and the harm suffered. Private enforcement is, therefore, better positioned to tap into the information needed to ensure effective enforcement of the Directive.

A third advantage relates to the costs of enforcement: Public enforcement requires a state-funded system of supervision and control, including sufficient personnel and financial resources to investigate violations and impose sanctions. Private enforcement, by contrast, shifts a substantial part of the costs of enforcement to the litigating parties, thereby reducing the resources Member States must devote to ensuring compliance with the Directive.

A final advantage lies in the greater independence of private enforcement from political influence. Since it places the initiative in the hands of individuals, private enforcement is not susceptible to shifts in political priorities. Public enforcement, by contrast, depends on the willingness of the state to investigate violations and take actions. Germany provides a telling example of how politics may undermine public enforcement: Under Federal Minister for Economic Affairs and Energy, Katherina Reiche, member of the governing Christian Democratic Party (CDU), staff resources devoted to enforcing the German Act on Corporate Due Obligations in Supply Chains (Lieferkettensorgfaltspflichtengesetz – LkSG) were substantially reduced. According to government information released in July 2026, only 40 of the 101 positions allocated to the relevant division of the Federal Office for Economic Affairs and Export Control (BAFA) were actually being used for the enforcement of the Act (cf. Deutscher Bundestag, Drucksache 21/7228, 21 July 2026). The Ministry also instructed BAFA to discontinue the examination of corporate reports and to restrict the imposition of fines to particularly serious allegations (Federal Ministry of Economics and Energy, Press release of 26 September 2025). Whatever one thinks of these policy choices, they illustrate how dependent public enforcement is on administrative resources and political will.

Against this background, civil liability can compensate for some of the structural weaknesses of public enforcement. And while it is certainly no panacea, it can provide companies with additional incentives to comply with their obligations. Member States should, therefore, establish a civil liability regime, irrespective of whether the Directive requires them to do so. In addition, they should address three challenges to ensure that private enforcement of the Directive is effective in practice.

Challenge 1: The Place of Injury Principle

The first challenge relates to the applicable law: Under Article 4(1) Rome II Regulation, non-contractual obligations are, as a general rule, governed by the law of the country where the damage occurs. Supply chain cases are, therefore, typically subject to law of the country where the human rights violation actually took place. If, for example, the employees of a Pakistani supplier suffer harm in Pakistan, their claims for damages will be governed by Pakistani law – even if the employees initiate proceedings against a European buyer company in Europe (cf. OLG Hamm, Case 9 U 44/19, ECLI:DE:OLGHAM:2019:0521.9U44.19.00). Without further action, liability provisions enacted to enforce the Directive will, therefore, remain largely ineffective.

Fortunately, the Rome II Regulation offers a way out. Under its Article 16 provisions of national law may apply irrespective of the otherwise applicable law, if they are overriding mandatory in nature. If Member States decided to introduce a civil liability regime into their legal systems when implementing the Directive, they should take the occasion and classify these provisions as overriding mandatory provisions.

There would also be no substantial obstacles to this path. According to the case law of the CJEU, Member States have broad discretion to decide that provisions of national law are overriding mandatory in nature. In fact, Member States must only make sure that they are not violating their obligations under primary or secondary EU law (CJEU, Case C-184/12 Unamar, ECLI:EU:C:2013:663, para 46). Clearly, this would not be the case with regards to civil liability provisions that aim to effectuate the human rights due diligence obligations of the Directive.

Nor would the CJEU’s recent judgment in HUK-COBURG preclude classifying the relevant provisions as overriding mandatory in nature. Admittedly, the Court emphasised that the concept of overriding mandatory provisions must be interpreted strictly and that national provisions may only qualify as overriding mandatory when they (also) pursue public – as opposed to purely private – interests (CJEU, Case C-86/23, HUK-COBURG, ECLI:EU:C:2024:689, paras 30 ff., 57). Civil liability provisions designed to enforce the Directive, however, would have little difficulty clearing this hurdle as they would serve to protect human rights and to promote responsible corporate behaviour in global supply chains. Indeed, in March 2026, a French court applied precisely this reasoning, holding that the civil liability provisions of the French Duty of Vigilance Law qualify as overriding mandatory provisions under Article 16 Rome II Regulation (Tribunal judiciaire de Paris, 12 March 2026, Yves Rocher, paras 48 ff.).

Against this background, there is a persuasive case that Member States could go ahead and declare liability provisions enforcing the Directive as overriding mandatory provisions. This view is also supported by the Directive itself: While it is true that Article 29(7) of the original Directive – which required Member States to ensure that the civil liability regime established by Article 29 is overriding mandatory in nature – was deleted when the Directive was revised in 2026, Recital 49 of the revised Directive explicitly states that the deletion does not “restrict the possibility for Member States to provide that the provisions of national law transposing [the Directive] are overriding mandatory provisions”.

Challenge 2: Jurisdiction of European Courts

The second challenge associated with the introduction of a civil liability regime relates to international jurisdiction. In fact, making national civil liability provisions applicable through Article 16 Rome II Regulation will only benefit victims if they also have access to European courts. In typical supply chain cases, where victims form the Global South sue companies domiciled in the Global North, such access is readily available: According to Article 4 Brussels Ia Regulation European companies may be sued in the courts of the Member States of their domicile. Gaps, however, may arise if victims (also) wish to bring claims against non-EU companies.

The first gap concerns joint claims against an EU company and its non-EU subsidiary or supplier. Since the Brussels Ia Regulation only applies to defendants domiciled in an EU Member State, it provides no basis for jurisdiction over subsidiaries and suppliers domiciled in a third country. Jurisdiction, therefore, depends on the applicable national rules of jurisdiction which may or may not be open to joint claims against EU and non-EU companies. German law, for example, is notably strict and rarely allows claims against subsidiaries or suppliers that are domiciled and operate exclusively in the country in which the human rights violation actually occurred. Member States should, therefore, seize the transposition of the Directive as an opportunity to adjust, if necessary, their national rules of international jurisdiction to accommodate joint claims in supply chain cases.

The second gap concerns isolated claims against non-EU companies that generate substantial net turnover in the EU and, therefore, fall within the scope of the Directive (cf. Article 2(2) CSDDD). Here, too, jurisdiction is governed by the national rules of the Member States. And since these rules vary, companies may fall within the scope of European law but be outside the jurisdiction of European courts by virtue of national law. In parallel with the debate on joint claims against EU and non-EU companies, Member States should, therefore, adjust their national laws and allow claims against non-EU companies that pursue their commercial activities in that Member State or target their activities towards that Member State. Such a provision would mirror the jurisdictional rules for consumer contracts (Article 17(1)(c) Brussels I Regulation) which also allow claims against non-EU defendants under the said conditions.

Challenge 3: Practical Barriers to Access to Justice

The last challenge, finally, relates to the conduct of proceedings itself. Since this is where many practical difficulties arise, Article 29(3) CSDDD requires Member States to adjust their national frameworks to ease damage claims by victims. Among others, it requires Member States to ensure that limitation periods are at least five years and do not begin to run before the infringement has ceased and the claimant knows, or can reasonably be expected to know, the relevant circumstances. In addition, litigation costs must not be prohibitively expensive, claimants must be able to seek injunctive relief, including through summary proceedings, and courts must have the power to order the disclosure of evidence held by defendant companies, subject to requirements of necessity, proportionality and confidentiality. Member States will, therefore, have to assess which of these requirements are already met by their national laws and which require legislative change.

Yet, even if Member States faithfully transpose these requirements, chances are that the practical effects remain limited: First, socially and economically marginalized plaintiffs from the Global South will not initiate proceedings based on a vague prohibition of “prohibitive” litigation costs. They require proactive structural support – such as legal aid, third-party funding or contingency fees. Article 29(3) CSDDD, however, fails to require any of that. Second, the mechanism for the disclosure of evidence is heavily bottlenecked. Although courts are given the power to order disclosure, this power is conditioned upon the requirement that claimants first present a “reasoned justification” and establish the “plausibility” of their claim using “reasonably available facts”. This creates a classic catch-22 situation: Victims routinely lack any insight into internal corporate processes or supply-chain oversight. Forcing them to prove the plausibility of a corporate breach just to gain access to the necessary internal documents risks that the evidentiary barrier remains effectively insurmountable. Against this background, Member States should not treat the Directive as a regulatory ceiling. Instead, they should refine their national procedural frameworks to dismantle the structural barriers that may prevent victims from pursuing successful damages claims.

What Member States Should Ignore

Civil liability has become a recurring flashpoint in the European debates about human rights due diligence. On the surface, these debates concern the best way to enforce the Directive’s obligations. In reality, however, they very often revolve around a more fundamental question: Are supply chain laws – and the obligations they impose – desirable in the first place? Those who regard supply chains laws and human rights due diligence obligations as “bureaucratic monsters” that impose unnecessary burdens on companies and undermine their competitiveness in global markets do rarely welcome the idea of making them more effective through civil liability. Conversely, those who see supply chain laws and human rights due diligence obligations as an important step towards a fairer, more sustainable and socially responsible global economy, insist on the importance of civil liability as a means of enforcement.

When implementing the Directive, Member States should move beyond that underlying disagreement. The European legislature decided – with full knowledge of the arguments on both sides – to actively protect human rights in global supply chains by imposing human rights due diligence obligations on European companies. It reaffirmed this commitment when it revised the Directive earlier this year. Member States should, therefore, not reopen the debate about human rights due diligence as such but focus on ensuring the effective implementation and enforcement of the Directive as it now stands. Whether the Directive will yield the hoped-for benefits – or merely generate additional costs and administrative burdens – will ultimately require empirical assessment. Should the evidence suggest that the Directive fails to improve the protection of human rights, the regulatory approach itself – rather than merely its enforcement – should be reconsidered.