Skip to main content
Glossary termPublished inCSDDD

Risk factors

What does "Risk factors" mean under the CSDDD?

Facts, situations or circumstances that relate to the severity and likelihood of an adverse impact, including facts, situations or circumstances at the level of the business partner, such as whether the business partner is not a company covered by this Directive or other comparable mandatory sustainability due diligence legal acts; at the level of geography and context, such as the level of law enforcement with respect to the type of adverse impact; and at the level of sectors, of business operations, and of products and services

Defined in / by

  • CSDDD (32024L1760), Article 3(1), point (u), as replaced by Article 4, point (3)(b), of Directive (EU) 2026/470

Last updated: 13 October 2026.

How the factors are used

Risk factors are inputs to a company's judgement, not impacts. Article 8(2), as replaced by Directive (EU) 2026/470, makes the identification step an appropriate-measures duty: companies take appropriate measures, taking into account relevant risk factors, including facts, situations or circumstances at the level of the business partner. The definition of appropriate measures refers to relevant risk factors as well, so the term works in two places at once.

The definition lists the levels at which the facts can sit: the business partner, geography and context, sectors, business operations, and products and services. Two of the levels carry an example in the text. At the level of the business partner, the example is whether the partner is not a company covered by this Directive or by other comparable mandatory sustainability due diligence legal acts. At the level of geography and context, it is the level of law enforcement with respect to the type of adverse impact.

The facts must relate to the severity and likelihood of an adverse impact. A fact that touches neither does not qualify.

We compared the 2024 definition with the one Directive (EU) 2026/470 substituted. The 2024 text listed company-level, business operations, geographic and contextual, product and service, and sectoral facts. The new text drops the company-level category and adds a business-partner level, with the example that a partner may fall outside the Directive and comparable acts. The geographic level gained its enforcement example. Read together, the change moves attention from the company to its partners and to the setting in which they operate.

Questions and answers

Is a partner outside the Directive a risk factor?

Under the text as replaced, being outside the Directive or comparable mandatory acts is an example of a fact at the level of the business partner.

Are risk factors the same as risks?

No. The Directive defines risk factors as facts, situations or circumstances that relate to the severity and likelihood of an adverse impact.

Glossary

  • Appropriate measures

    Measures that are capable of achieving the objectives of due diligence by effectively addressing adverse impacts in a manner commensurate to the degree of severity and the likelihood of the adverse impact, and reasonably available to the company, taking into account the circumstances of the specific case, including the nature and extent of the adverse impact and relevant risk factors.

  • Severity of an adverse impact

    The scale, scope or irremediable character of the adverse impact, taking into account the gravity of an adverse impact, including the number of individuals that are or may be affected, the extent to which the environment is or may be damaged or otherwise affected, its irreversibility and the limits on the ability to restore affected individuals or the environment to a situation equivalent to their situation prior to the impact within a reasonable period of time.

  • Business partner

    An entity (i) with which the company has a commercial agreement related to the operations, products or services of the company or to which the company provides services pursuant to point (g) (‘direct business partner’); or (ii) which is not a direct business partner but which performs business operations related to the operations, products or services of the company (‘indirect business partner’).

Regulations

  • Corporate Sustainability Due Diligence Directive (CSDDD)

    The Corporate Sustainability Due Diligence Directive is Directive (EU) 2024/1760. After Omnibus I, Member States must transpose it by 26 July 2028 and apply it from 26 July 2029, to companies with more than 5,000 employees and EUR 1.5 billion in net worldwide turnover. The Netherlands has a draft bill, the Wivo, which names the ACM as supervisor.

    Next
    Commission adopts guidelines under Article 19(2), points (a), (d) and (e), and guidance on model contractual clauses (Article 18)