CSDDD Value Chain Mapping
Value chain mapping is the foundation of CSDDD compliance — you cannot identify, prevent, or remediate adverse impacts across your value chain without first understanding what that chain looks like. CSDDD requires mapping both upstream suppliers and downstream business customers. Here is how to do it.
Value chain mapping is the foundation of CSDDD compliance — you cannot identify, prevent, or remediate adverse impacts across your value chain without first understanding what that chain looks like. CSDDD defines the value chain as all activities, operations, business relationships, and investment chains of a company and its subsidiaries — including both upstream and downstream.
What CSDDD means by value chain
CSDDD defines the value chain as all activities, operations, business relationships, and investment chains of a company and its subsidiaries — including both upstream and downstream.
Upstream value chain: suppliers of raw materials, components, and services; their sub-suppliers (tier 2 and beyond) where relevant; logistics and transportation providers; energy suppliers.
Downstream value chain: business customers who use your products or services in their own production; distributors and wholesalers; retailers (where they are business customers purchasing for resale). Consumer-facing retail and end users are generally outside CSDDD's downstream scope — CSDDD focuses on business-to-business relationships.
Key distinction from CSRD: CSRD value chain reporting focuses on sustainability data disclosure. CSDDD value chain scope determines where you must conduct active due diligence and potentially intervene to prevent adverse impacts. The CSDDD value chain scope is potentially narrower — focused on 'established business relationships' where you have leverage — rather than the full theoretical value chain.
The tiered mapping approach
Full tier-by-tier mapping of all suppliers to raw material source is impractical for most companies. CSDDD acknowledges this through the concept of 'appropriate measures' — what is proportionate depends on your industry, the severity of potential impacts, and your leverage over suppliers.
Tier 1 — Direct suppliers: Map all tier 1 suppliers (those you have direct contracts with). For each, identify the goods or services supplied, the country of origin, the sector, and the estimated exposure to human rights and environmental risks. This is achievable from procurement system data.
Tier 2+ — Indirect suppliers: Go beyond tier 1 where: (a) there are plausible signals of adverse impacts at tier 2 or beyond; (b) the commodity or product is inherently high-risk (agricultural commodities, minerals, garments); or (c) the supplier country presents high systemic risk. Use commodity traceability tools, sector-specific risk databases, and supplier declarations to identify material tier 2+ exposure.
Downstream mapping: Identify business customers who use your products as inputs to their own production. Assess whether your products could contribute to adverse impacts in their operations — chemical products used in dangerous processes, components incorporated into products with safety risks.
Prioritisation output: From the mapping, produce a risk-prioritised supplier list — identifying which relationships carry the highest actual or potential adverse impact risk and therefore require the most intensive due diligence.
Tools and data sources for value chain mapping
Procurement systems: Your ERP or procurement platform is the starting point — extract all tier 1 supplier relationships with spend, commodity category, and country of supply. This gives you the universe for risk screening.
Country risk indices: For geographic risk overlay, use: US Department of Labor List of Goods Produced by Child Labor or Forced Labor; Transparency International Corruption Perceptions Index; US Department of State Trafficking in Persons Report; Maplecroft Human Rights Risk Atlas.
Sector risk data: For sector-specific risk identification, use: ILO sectoral research on labour rights violations; Know The Chain benchmark reports (technology, food and beverage, apparel); Responsible Business Alliance sector assessments.
Commodity traceability tools: For agricultural and mineral commodities, use: Sourcemap for supply chain visualisation; Spectrally for satellite-based deforestation monitoring; Responsible Minerals Initiative conflict minerals data; Trase for agricultural commodity supply chain mapping.
ESG data providers: MSCI, Sustainalytics, EcoVadis, and Sedex all provide supplier risk assessment services that can accelerate the risk prioritisation phase of value chain mapping.
Frequently asked questions
How many tiers deep must our value chain mapping go?
CSDDD requires mapping to the depth necessary to identify plausible adverse impacts. For most manufactured goods, tier 1 plus a risk-based tier 2 assessment for high-risk commodities satisfies the requirement. For raw materials with known systemic risks (cobalt, cotton, palm oil, timber), mapping to source is increasingly expected and may be required to demonstrate effective due diligence.
What is an established business relationship under CSDDD?
CSDDD focuses due diligence obligations on 'established business relationships' — those that are or are expected to be lasting, in light of their intensity or duration, and which do not represent a negligible or ancillary part of the value chain. One-off spot purchases from a new supplier are less likely to qualify than long-term contracted supply relationships. The established relationship test limits the practical scope of CSDDD's value chain reach.
Do we need to map our downstream value chain even if we sell B2B?
Yes — CSDDD's downstream scope covers business customers using your products in their own operations. If your products could contribute to adverse impacts in customer operations (toxic chemicals used in manufacturing, components incorporated into products with safety risks), downstream mapping is required. Pure service businesses with no physical product may have limited downstream due diligence obligations.