IBP Signal Issue #5 CSDDD value-chain audit readiness hero image
FULL PUBLIC ISSUE

Lead Signal

On 18 March 2026, the EU Corporate Sustainability Due Diligence Directive, amended by Omnibus I, entered into force. The headline numbers are fixed: companies with 5,000 or more employees and turnover of at least EUR 1.5 billion fall directly in scope. They have until 26 July 2029 to comply. Penalties are capped uniformly at up to 3% of net worldwide turnover. The climate-transition-plan requirement has been removed.

If you stopped reading there, you would miss the signal that matters for Integrated Business Planning.

Omnibus I narrowed the direct obligation, but it amplified the indirect pressure. DLA Piper's legal analysis is explicit: "Even smaller entities must be prepared to deliver the information requested by their business partners." If you supply, or are supplied by, an in-scope company, your data, governance records, and traceability documentation are now audit-ready or commercially exposed, whether your headcount is 50 or 5,000.

The mechanism is familiar to procurement leaders who lived through REACH, conflict-minerals reporting, or modern-slavery supply-chain audits. Based on prior regulatory cycles, tier-1 customers typically begin baking compliance requirements into RFPs, contract renewals, and supplier scorecards roughly two years before the statutory deadline. For CSDDD, that means 2027, not 2029, is when procurement contracts will likely start reflecting audit pressure. The 3% turnover fine is the headline risk for direct-scope companies. For everyone else, the risk is simpler: lose the customer relationship to a competitor who can pass a value-chain audit today.

IBP Implication

This is where the TIACA e-commerce white paper becomes relevant. Air cargo e-commerce now accounts for roughly 20% of global air cargo volumes, and the paper frames the sector's challenge as a "paradigm shift" driven by data harmonization, customs accountability, and process simplification. The same shift is coming to every tier of the value chain: the era of low data and low accountability is ending. Supplier master data must now include governance fields, traceability indicators, and scenario-ready documentation, not as a sustainability initiative, but as a commercial survival requirement.

The DHL Global Connectedness Report 2026 adds the counter-narrative IBP leaders should note. Globalization held at a record 25% of global output in 2025. Trade distances are the longest on record, at 5,010 km on average. Supply networks are more stretched, more multi-tier, and more opaque than ever. Regulatory pressure is not a retreat signal; it is a filter. Companies that build audit-ready networks will operate in those stretched corridors with less friction. Companies that wait will find their value-chain data too shallow, their supplier governance too fragmented, and their scenario planning too slow to catch up.

The cascade is practical, not theoretical. An in-scope company must conduct due diligence on its value chain. That obligation is pushed to tier-1 suppliers through contract clauses, supplier questionnaires, and third-party audits. Tier-1 suppliers then push the same requirements to tier-2 subcontractors because the audit trail must be complete. The failure point is rarely intent; it is data architecture. Most supplier master data systems capture tier-1 contact details, pricing, lead times, and quality certifications. They do not capture tier-2 names, locations, governance certifications, or remediation status.

That makes the translation to IBP direct. In your next S&OP cycle, demand-review assumptions should include compliance-readiness overlays: will customers de-risk by shifting volume to suppliers who can prove audit readiness? Supply-review discussions should treat governance and traceability as core supplier-master-data fields, not sustainability add-ons. Reconciliation should ask a new question: do we have a Plan B if a key supplier fails a value-chain audit mid-cycle? That failure is now a supply-disruption scenario with revenue and margin implications, not a post-facto legal report.

Leadership Takeaway

Most IBP leaders still treat compliance as a legal checkbox owned by risk or legal teams. That mental model is the planning gap.

CSDDD Omnibus I moves audit accountability from the boardroom to the supplier master data. ERP and S&OP tools were built for lead times, capacities, and costs, not for signed supplier codes of conduct, human-rights due-diligence trails, environmental-impact documentation, tier-2 production locations, grievance mechanisms, or certificate expiry dates. Retrofitting those fields under a 2027 contract deadline is a planning exercise that will land on IT's backlog if not framed correctly.

The retrofit challenge is not just adding fields. It is populating them with verifiable data, maintaining them through supplier changes, and integrating them into S&OP workflow so that a compliance gap surfaces as a supply-risk flag. Companies that start in 2028 will discover that tier-2 suppliers have no documentation, tier-1 contacts have changed, and IT priorities are already committed. Companies that start now can build the fields, run the first questionnaire cycle, and use the gaps as procurement negotiation leverage before audit pressure arrives.

The 2029 deadline is not the date to watch. 2027 is. That is when procurement contracts and supplier audits will start reflecting CSDDD pressure, and when tier-1 customers will begin routing orders toward compliant networks.

The question to ask in your next Executive IBP meeting:

Do our current S&OP scenario plans include a supplier-compliance failure as a standard supply-disruption trigger, or are we still treating it as a legal risk to be reviewed after the fact?

The immediate action: assign one S&OP cycle to supplier-compliance readiness. Identify the top five suppliers by revenue exposure, then ask each for: (1) a signed supplier code of conduct covering human rights and environmental standards, (2) third-party audit certification or a completed self-assessment questionnaire, and (3) supply-chain mapping to tier-2 where available. Then schedule a thirty-minute meeting with your ERP/system owner and supply-planning lead. Ask which compliance-related fields can be added to supplier master data without custom development, and what the realistic timeline is to populate those fields for the top twenty suppliers. You are not looking for perfection. You are looking for gaps, and the time to close them before your customer asks first.

Sources