HREDD: What Human Rights Due Diligence Means for Your Supply Chain Compliance

Your supply chain is now a compliance surface. Under the EU's Corporate Sustainability Due Diligence Directive (CSDDD), the way your company treats human rights and the environment across its business partners is becoming a legal obligation, not a voluntary ESG pledge.

At the centre of that obligation sits a single practice: Human Rights and Environmental Due Diligence, or HREDD. This is the operational engine of the CSDDD, and it is the thing regulators and business partners will actually ask you to evidence.

The rules changed materially in 2026. The scope shrank, the timeline moved, and the EU-wide liability regime was stripped out. If your understanding of HREDD is based on the 2024 version of the directive, it is now out of date.

This post sets out what HREDD means today, what the 2026 Omnibus changed, who is in scope, and how to build the due diligence process before your buyers and your regulator start asking for proof.

What HREDD Actually Requires

HREDD is not a questionnaire you send once a year. It is a continuous, risk-based process that the CSDDD builds directly on the internationally recognised OECD and UN frameworks for responsible business conduct.

In practice, an in-scope company has to run a repeating cycle across six duties:

1. Embed due diligence into company policies and risk management systems.
2. Identify and assess actual and potential adverse human rights and environmental impacts in your operations and your chain of activities.
3. Prevent, mitigate, or bring to an end those impacts, with a prevention or corrective action plan where needed.
4. Monitor the effectiveness of your due diligence measures on an ongoing basis.
5. Communicate publicly on your due diligence.
6. Provide remediation, and operate a notification mechanism and complaints procedure for affected people.

The word that matters most here is "process." The CSDDD does not require you to guarantee a perfect supply chain. It requires you to show a genuine, documented, and evidenced effort to find harm and act on it.

That distinction is where most compliance programmes will succeed or fail. A regulator or a large customer conducting supplier assurance is not looking for a clean bill of health. They are looking for a defensible trail: what you assessed, what you found, what you did, and when.

What the 2026 Omnibus Changed

In February 2026 the picture shifted. Directive (EU) 2026/470, part of the Commission's Omnibus simplification package, was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026.

The amendments narrowed the directive in several important ways. Here is what changed, and why each change matters to your programme.

• Narrower scope. The obligations now apply to EU companies with more than 5,000 employees and more than €1.5 billion in net worldwide turnover, and to non-EU companies generating more than €1.5 billion in net turnover inside the EU. That is a much smaller group of directly obligated companies than the original 2024 thresholds.
• A later timeline. Following the earlier "Stop the Clock" directive and the Omnibus, Member States must transpose the rules into national law by 26 July 2028. First application of the obligations for the largest companies begins on 26 July 2029. Certain reporting measures apply for financial years starting on or after 1 January 2030.
• Due diligence refocused on tier-1. The assessment obligation now centres on your direct business partners. You are expected to look deeper into indirect partners only where you have plausible, objective, and verifiable information pointing to a concrete adverse impact. This is a shift away from blanket, full value chain mapping toward a genuinely risk-based approach.
• The EU-wide civil liability regime was removed. The original CSDDD created a harmonised right for victims to claim damages. The Omnibus deleted that harmonised regime, so civil liability now falls back on each Member State's existing national law.
• Guidelines arrive sooner. The deadline for the Commission to publish practical guidelines was brought forward to 26 July 2026, ahead of transposition, to help companies prepare.

Read together, these changes lower the number of directly regulated companies and soften some of the sharpest edges. They do not remove the underlying duty.

Why Smaller Companies Are Still Affected

Here is the trap. If you read "more than 5,000 employees and €1.5 billion turnover" and conclude that HREDD is somebody else's problem, you are looking at the wrong risk.

Large in-scope companies cannot meet their own due diligence duty without pushing requirements down to their suppliers. When a €1.5 billion buyer has to evidence prevention and monitoring across its direct business partners, its direct business partners are you.

That pressure travels through commercial channels rather than legal ones:

• Contractual clauses requiring you to adopt a code of conduct and cooperate with the buyer's due diligence.
• Supplier assurance questionnaires asking for your human rights policy, grievance mechanism, and risk assessments.
• Onboarding and re-qualification gates where missing evidence delays or blocks the contract.

So the operative question for a mid-sized supplier is not "am I directly in scope." It is "can I produce, on demand, the evidence my largest customers now need." Firms that can answer quickly win procurement cycles. Firms that scramble lose them.

🔍 That is the real deadline for most companies. It is not 2029. It is the next time a major customer sends a due diligence pack.

Ready to see what an auto-generated compliance tracker looks like for your organization?

🚀 RegentComply.ai generates audit-ready evidence packs mapped to your specific regulatory framework, in hours rather than weeks. Request a demo →

The Six Failure Points in a HREDD Programme

Across supply chain due diligence work, the same weaknesses show up again and again. Treat this as your pre-audit checklist and fix these before an assessor finds them.

1. Policy without process. A human rights policy sits on the website, but there is no evidence of assessment, action, or monitoring behind it. A statement is not due diligence.
2. A one-time risk assessment. The company assessed risk once, then never revisited it. HREDD is explicitly ongoing, and an eighteen-month-old assessment reads as a lapsed control.
3. No grievance mechanism. There is no working channel for affected workers or communities to raise concerns, so impacts are never surfaced and never remediated.
4. Evidence scattered across inboxes. Policies, supplier attestations, and assessments live in email threads and personal drives. When a buyer or auditor asks, nobody can assemble the pack quickly.
5. No link between finding and action. Risks are identified in one document and corrective actions tracked in another, with no traceable line from impact to mitigation to review.
6. Ownerless tasks. Nobody is assigned to re-run the assessment, chase the supplier attestation, or review the mechanism. Recurring duties quietly fall off the calendar.

Notice that five of these six are operational, not legal. HREDD is won or lost in day-to-day execution, which is exactly where a structured system beats a spreadsheet.

How to Stand Up HREDD Without Boiling the Ocean

You do not need a consultancy army to start. You need a defensible, repeatable structure. Here is a pragmatic sequence.

1. Map your direct business partners first. The 2026 rules put the emphasis on tier-1. Start where the obligation and your leverage are strongest, then extend to indirect partners only where credible information flags a concrete risk.
2. Write the policy, then wire it to controls. Adopt a human rights and environmental policy, then attach specific, owned requirements to it so the policy is evidenced rather than decorative.
3. Run a risk-based assessment and record it. Prioritise by severity and likelihood of impact, not by supplier convenience. Keep the assessment, the reasoning, and the date.
4. Assign remediation and monitoring as recurring tasks. Prevention plans, supplier follow-ups, and re-assessments should regenerate on a schedule with a named owner, so nothing depends on memory.
5. Centralise the evidence. Every policy, attestation, assessment, and corrective action belongs in one catalogue, tagged to the requirement it satisfies, ready to share.
6. Rehearse the buyer request. Assemble a sample evidence pack now, so that when procurement asks, you respond in hours.

This is precisely the workflow RegentComply.ai is built to run. The platform tracks HREDD as an active framework, so you can spin up a project mapped to the directive's duties rather than starting from a blank page.

Inside a project, the tools map directly onto the failure points above:

• Recurring Rules automatically generate the repeat tasks HREDD demands, with a risk rating and an assignee, so monitoring and re-assessment never silently lapse.
• The Document Catalogue acts as a single evidence repository. You tag each document to a project and a requirement reference, then share it, which turns "find the file" into "send the pack." Its AI Document Generation can draft a first-pass compliance document from scratch when you have nothing to start from.
• Task and project views keep every finding tied to an owner and a due date, so the line from identified impact to corrective action stays traceable.

Vendor Management and a Risk Register are on the RegentComply roadmap and will deepen supply chain workflows further. For today, the live combination of framework projects, recurring tasks, and a tagged evidence catalogue already covers the core of what an HREDD programme has to prove.

Best of all, the platform is free to start, with no procurement queue and no IT approval required, so you can begin structuring your due diligence this week rather than next quarter. Learn more on supply chain readiness with #HREDD and #CSDDD before your buyers ask.

The One Thing to Take Away

The CSDDD's 2026 reforms bought most companies time, narrowed who is directly liable, and softened the enforcement edges. What they did not do is make supply chain due diligence optional.

The obligation now flows through commerce as much as through law. Your largest customers are in scope, and they will make their due diligence your problem the moment they send a supplier assurance request.

HREDD rewards the organised, not the perfect. Build the process, evidence it, and keep it running, and the next buyer questionnaire becomes a formality instead of a fire drill.

GRC consultants: stop rebuilding compliance frameworks from scratch.

🟢 consult.regentcomply.ai lets you auto-generate client-ready compliance trackers for any framework, without going through your client's IT or procurement. Sign up directly and deliver faster, more structured engagements from day one.