Sustainability due diligence should operate continuously: identify human rights and environmental risks against international standards, establish board oversight, implement controls, grievance and remedy mechanisms, and track effectiveness with evidence.
This article uses the OECD six steps to connect CSDDD, CSRD and Taiwan governance requirements. Legal information was checked as of 28 October 2026. Parts of Omnibus I have become law; 2025 parliamentary proposals should no longer be presented as current requirements. Direct applicability, group rules, exemptions and reporting years require individual assessment.
1. Overall architecture and four layers of standards
The management sequence is international standards → risk-based assessment → board oversight → internal control → due diligence and remedy. These four layers support each other, but their documents do not all carry legal force.
| Layer | Main sources | Management role |
|---|---|---|
| A. International soft law and voluntary standards | UNGPs; OECD Guidelines for Multinational Enterprises on Responsible Business Conduct and due diligence guidance | Methods for respecting human rights, identifying adverse impacts and providing remedy. |
| B. Binding EU legislation | CSDDD, CSRD and applicable ESRS | Due diligence and sustainability reporting obligations, subject to scope and national transposition. |
| C. International risk and control frameworks | COSO Internal Control—Integrated Framework; ICSR guidance | Data accountability, controls, monitoring and reliable reporting; these are not accounting standards or universally binding laws. |
| D. Taiwan legislation and rules | Company Act, Securities and Exchange Act, FSC, TWSE and TPEx rules | Director responsibilities, listed-company controls, sustainability information and sector requirements. |
UNGPs and OECD supply principles and methods; CSDDD imposes obligations on in-scope companies; CSRD addresses double-materiality reporting; COSO/ICSR supports control and data quality. Reporting, controls and due diligence support each other without replacing one another. OECD can cover broad business relationships, while CSDDD uses a defined chain of activities. See OECD guidance and COSO guidance.
2. Risk-based due diligence: CSDDD Articles 7–16
This is a process comparison, not a one-to-one legal equivalence with OECD steps. Read the original directive together with Directive (EU) 2026/470.
| Article | Process and qualifications | OECD link |
|---|---|---|
| Art. 7 | Embed due diligence in policies and risk management, covering approach, code of conduct and procedures; consult employees and representatives beforehand as required. Update after significant changes and review policies at least every 24 months. | Step 1 |
| Art. 8 | Scope risks using reasonably available information, then assess high-risk areas in own operations, subsidiaries and business partners within the chain of activities. | Step 2 |
| Art. 9 | Prioritize adverse impacts by severity and likelihood, addressing the most significant first. | Step 2 |
| Art. 10 | Prevent or adequately mitigate potential impacts through plans, schedules, indicators, contractual measures and SME support as appropriate. The 2026 amendment emphasizes conditional suspension and enhanced plans as a last resort, rather than universal mandatory termination. | Step 3 |
| Art. 11 | End actual adverse impacts or minimize their extent where immediate cessation is impossible, using corrective plans. Assess consequences of suspension and keep decisions under review. | Step 3 |
| Art. 12 | Remedy impacts caused or jointly caused by the company; where solely caused by a partner, voluntary remedy and influence to secure improvement apply as provided. | Step 6 |
| Art. 13 | Engage meaningfully with relevant stakeholders, especially rights-holders. Mandatory consultation stages follow the amended text; companies may engage throughout the process. | Cross-step support |
| Art. 14 | Establish notification and complaints mechanisms, with accessibility, fair handling and protection against retaliation. | Supports Steps 2, 6 |
| Art. 15 | Assess effectiveness using suitable qualitative and quantitative indicators. The amended minimum is every 5 years, with timely reassessment after significant changes, ineffective measures or new risk signals. This differs from the 24-month policy review. | Step 4 |
| Art. 16 | Communicate due diligence information publicly as required, checking exemptions and interaction with CSRD rather than assuming duplicate reporting for every company. | Step 5 |
Article 5 requires relevant action records and evidence to be retained for at least 5 years; apply longer periods required by other laws. See the Commission CSDDD page, original directive and 2026 amending directive.
3. OECD six steps: a recurring implementation cycle
- Embed policies and management systems: adopt responsible business conduct (RBC) policies, responsibilities, budgets, purchasing conditions and supplier prequalification.
- Identify and assess adverse impacts: move from broad scoping to high-risk assessment, distinguishing impacts caused, contributed to or directly linked through business relationships.
- Cease, prevent or mitigate: stop harmful conduct, implement action plans and use leverage with partners. Responsible disengagement considers consequences for affected people.
- Track implementation and results: assess effectiveness through internal/external checks and rights-holder feedback, tracking deadlines, coverage and outcomes.
- Communicate responses: disclose policies, risks, measures and performance in understandable, culturally sensitive ways while protecting personal data and safety.
- Provide or cooperate in remedy: address impacts caused or contributed to through appropriate restitution or compensation and credible operational grievance mechanisms.
Update the cycle for new suppliers, operational changes and geopolitical risks. Human rights assessment concerns harm to people, including scale, scope and irremediability. A simple probability-times-impact score must not obscure severe harm merely because its likelihood is low. See the UNGPs.
4. Board implementation: five steps and outputs
These are governance recommendations. Authority and legal responsibility depend on applicable law and company constitutional documents; CSDDD does not automatically impose identical director duties on all Taiwan companies.
| Step | Actions | Outputs |
|---|---|---|
| 1. Policy and mandate | Approve or oversee policy, scope, responsibilities, resources and reporting frequency; designate a committee or owner. Risk appetite cannot justify illegality or human rights abuse. | Policy, mandate and accountability matrix |
| 2. Identification and assessment | Map activities and risks across functions, collect information, hear rights-holders and obtain independent expertise where needed. | Risk map and priorities |
| 3. Investigation | Use risk-based interviews, questionnaires, record reviews and site verification; document sources and limitations. | Findings and evidence index |
| 4. Review and decision | Evaluate improvement, remedy or relationship changes; document reasons, owners, deadlines and consequences for affected people. | Decisions and action plans |
| 5. Monitoring and reporting | Track KPIs, open cases and remedy outcomes; publish applicable information suitable for disclosure. | Dashboards, reports and follow-up records |
Director/executive background checks, insolvency searches and adverse-media screening may support transaction or integrity reviews, but cannot replace human rights and environmental assessment. Personal-data collection must be lawful, necessary and confidential.
5. Connecting ESG risk assessment to controls
- Objectives and boundaries: establish applicable law, operations and value-chain scope; distinguish impacts on people/environment from financial risks to the company.
- Information and identification: combine external/internal data, supplier records, grievances, interviews and risk databases. SWOT supports discussion without replacing impact assessment.
- Assessment and priorities: combine matrices with severity analysis. Double materiality informs CSRD/ESRS disclosure, rather than substituting for due diligence prioritization. Select scenarios such as 1.5°C or 4°C according to purpose and applicable requirements; they are not a universal mandatory pair.
- Controls and improvement: connect measures to purchasing, contractors, workforce and environmental controls. Transferring or accepting financial risk does not remove prevention or remedy responsibilities.
- Reporting and communication: report to management and the board, disclose under applicable GRI/ESRS frameworks, and arrange independent assurance according to law, contracts and risk.
6. Internal verification and audit: PDCA and Three Lines
| Stage | Focus |
|---|---|
| Plan | Set annual audit scope, methods and sampling based on high-risk areas and legal requirements. |
| Do | Test control design and operation through samples, walkthroughs and interviews. |
| Check/Act | Report findings to the audit committee or board, assigning owners, deadlines and verification methods. |
| Continuous improvement | Review periodically according to risk and applicable rules, incorporating new suppliers, laws and failure signals. |
The Three Lines model can allocate responsibilities as follows:
- Operations: daily ESG controls, records and improvement.
- Risk/compliance: methods, oversight and challenge to support risk assessment.
- Internal audit: independent assessment of governance, risk management and the first two functions, without taking over their controls.
External assurance adds confidence without replacing internal audit. See the IIA Three Lines Model.
7. Thresholds and dates: legislation adopted in 2026
Directive (EU) 2026/470 was published in February 2026 and entered into force on 18 March. This summary excludes detailed group, franchise, transitional and exemption rules.
| Item | Amended position | Implications |
|---|---|---|
| General CSDDD thresholds | EU companies: over 5,000 employees and over €1.5 billion worldwide net turnover. Non-EU companies: over €1.5 billion EU net turnover, without the same employee test. | Check statutory years, group and other conditions. Receiving a supplier questionnaire does not establish direct applicability. |
| CSDDD timetable | Transposition by 26 July 2028; company obligations apply from 26 July 2029. Article 16 reporting applies to financial years starting on or after 1 January 2030. | Discard the old “2026 transposition, full application in 2028” statement. |
| General CSRD thresholds | EU companies generally exceed 1,000 employees and €450 million net turnover. Non-EU groups have separate EU-turnover and subsidiary/branch conditions. | The employee threshold is not 1,750. Check reporting years, transposition, consolidation and exemptions. |
| Civil liability and penalties | Harmonized conditions for civil liability were removed in favor of national law; administrative pecuniary penalties have a maximum set at 3% of worldwide net turnover. | This is neither immunity nor a fixed 3% fine for every infringement; national law and individual assessment matter. |
| Climate transition plans | Former CSDDD Article 22 was deleted. | Other climate, reporting and contractual duties do not all become voluntary. |
| Taiwan sustainability-information controls | Since 2025, TWSE/TPEx-listed companies must include sustainability-information management in internal control and as a necessary annual audit-plan item. | Determine scope and detail under FSC, TWSE and TPEx rules. |
See the Council adoption announcement and TWSE reproduction of the FSC announcement.
Taiwan has no blanket rule requiring independent assurance of an entire sustainability report solely because paid-in capital is at least NT$5 billion. Assess sector-indicator assurance, GHG inventory/assurance phases and other sustainability-information rules separately. The TWSE report preparation rules amended on 18 May 2026 distinguish these requirements; assurance of specified information is not assurance of the entire report. Changes to the 2026 evaluation system also need to be distinguished from statutory director duties.
Taiwan suppliers outside direct CSDDD/CSRD scope may still receive EU customer requests. Check request scope, confidentiality, proportionality and applicable value-chain information safeguards.
8. What evidence should the process produce?
Connect six work packages into a cycle: policy and authority; risk mapping and prioritization; prevention and remedy plans; stakeholder and grievance records; monitoring and disclosure; control and audit follow-up. Each should identify owners, update triggers, objective evidence and improvement results.
OECD supplies the implementation backbone, CSDDD governs in-scope companies, CSRD addresses applicable disclosures, and COSO/ICSR supports controls. Board oversight and assessment of actual impacts turn commitments into traceable action and reduce unmanaged risks and greenwashing.
This is general governance and process guidance. Applicability depends on current official legislation, national transposition, Taiwan regulatory rules and individual company facts.