On 17 September 2026, the Dutch Authority for Consumers and Markets (Dutch acronym: ACM) issued its feasibility and enforceability assessment of the draft bill on International Responsible Business Conduct (Dutch acronym: WIVO), which implements the Corporate Sustainability Due Diligence Directive (CSDDD) into Dutch law. This assessment was recently published. The Dutch implementation of the CSDDD designates the ACM as the supervisory authority responsible for monitoring compliance with the CSDDD.

The ACM concludes that the Dutch implementation of the CSDDD is feasible and enforceable, provided that four conditions are met.

The four conditions set by the ACM:

  • Clarity regarding non-EU companies: the Dutch implementation of the CSDDD must make clear which third-country companies fall under the ACM's supervision.
  • Timely and sufficiently specific EU guidance: the European Commission must issue clear and sufficiently detailed guidance on the CSDDD's open-ended standards, available at least one year before companies must comply with the relevant obligations (by the end of July 2028).
  • Flexibility to prioritise substantiated concerns: the ACM must retain sufficient discretion to prioritise cases involving the most serious harm to society. If the mandatory handling of substantiated concerns places excessive pressure on its capacity, the ACM considers it necessary that additional funding can be made available swiftly through its multi-year budget.
  • Timely establishment of the European network of supervisory authorities: the cooperation network of national supervisory authorities must become operational no later than six months before the relevant provisions take effect (January 2028), to coordinate supervision and test the required systems.

The ACM provides for some useful insight into where enforcement of the CSDDD will be heading in practice

Beyond the four formal conditions, the ACM's assessment offers a useful preview of how enforcement of the Dutch implementation of the CSDDD will actually play out, and what that means for companies trying to get compliance right.

The scope has narrowed, but the substance remains largely intact

According to the ACM, the Omnibus has narrowed the scope of the CSDDD, but not its substance. The core due diligence framework remains largely intact, and the legislation continues to focus on the effectiveness of an in-scope company's due diligence process rather than on reporting and documentation for its own sake.

For enforcement, this is the ACM's clearest signal yet: it intends to assess whether in-scope companies are making meaningful progress in addressing adverse impacts throughout their chains of activities, and it accepts that this progress takes time and effort. For in-scope companies, the practical lesson is that a well-documented policy will not, on its own, satisfy the ACM. What will be tested is whether the due diligence system in place is actually producing results on the ground, which means the evidence base for compliance needs to go well beyond paperwork: demonstrable follow-up, measurable steps, and a track record of acting on identified adverse risks to human rights and/or the environment.

Risk-based and complaint-driven enforcement by the ACM

The ACM positions itself as a responsive regulator: it will focus on the most significant potential harms and runs a prioritisation policy because it expects more reports than it can investigate. At the same time, the Dutch implementation of the CSDDD allows anyone with an objective basis to believe a company is non-compliant to submit a substantiated report to the ACM.

That gives NGOs, trade unions and affected stakeholders a direct avenue to trigger regulatory scrutiny and shape enforcement priorities, and such concerns may also be used strategically as a steppingstone to obtain findings that support civil litigation proceedings.

The ACM underscores that the possibility of issuing such non-compliant reports could create a tension: the ACM cannot predict report volumes, and a surge of complex reports could crowd out its own priorities and thus complicate its own supervision. It therefore insists on retaining enough flexibility to prioritise the most serious adverse impact and harm, and on swift access to additional resources if dialogue with stakeholders is not enough to do so.  

Non-EU companies and cross-border enforcement

Uncertainty remains as to which non-EU companies will fall within the scope of the CSDDD, prompting the ACM to call for greater transparency at EU level. In this regard, Article 28(10)(b) of the CSDDD requires the European Commission to publish an indicative list of in-scope non-EU companies. The ACM however expects investigations into substantiated concerns involving third-country human rights or environmental adverse impacts to be particularly complex and resource-intensive: it has no investigative powers abroad.

Effective supervision of both EU and non-EU in-scope companies is nevertheless essential to maintaining a level playing field. The ACM therefore emphasises that effective cross-border enforcement will require stronger international cooperation with foreign authorities, embassies and NGOs. Such cooperation will be particularly important where evidence must be gathered in third countries or enforcement measures must be taken against companies without an EU establishment.

Overlapping obligations and regulatory coordination

The ACM further notes that in-scope companies may already face overlapping due diligence obligations under other EU legislation, such as the Deforestation Regulation, the Forced Labour Regulation, the Conflict Minerals Regulation and the Batteries Regulation.

The CSDDD operates as a horizontal framework, a lex generalis, so preventing fragmented supervision will take extensive coordination between national and EU authorities on aforementioned overlapping European due diligence obligations. The ACM acknowledges that this may be difficult in practice if authorities adopt different priorities or approaches to enforcement. That is why the timely establishment of the European network of supervisory authorities matters: it should facilitate cooperation, promote consistent interpretation of the CSDDD, and coordinate cross-border enforcement.

Commission guidance will be critical, but will not remove all uncertainty

ACM repeatedly stresses that effective supervision depends on detailed EU Commission guidance, pointing to concepts such as "potential adverse impacts," stakeholder engagement, and what companies may request from business partners in their chain of activities.

Without further guidance, these open-ended standards leave considerable room for interpretation, making both compliance and enforcement more difficult. Clear and timely guidance should provide greater legal certainty and support a more consistent supervisory approach across Member States.

We agree the guidance will be critical, though expectations should be tempered. The CSDDD rests on risk-based, context-specific due diligence obligations that inherently require open-ended standards. Guidance may reduce uncertainty and support a more consistent approach, but it is unlikely to eliminate the room for interpretation and thus flexibility for in-scope companies contemplated by the framework.  

Conclusion

The ACM considers the Dutch implementation of the CSDDD feasible and enforceable, but conditional on four requirements: clarity on which non-EU companies fall within scope, timely and sufficiently detailed EU guidance, enough flexibility to prioritise the most serious cases over the volume of substantiated concerns it may receive, and a timely European supervisory network.

Several pieces have yet to fall into place: the scope of non-EU companies, the quality and timing of EU Commission guidance, and the degree of coordination the ACM can achieve with other European supervisory authorities. What in-scope companies can expect regardless is a responsive, risk-based style of supervision, one that focuses on genuine progress in managing (potential) adverse impacts rather than compliance against a fixed set of rules. To be continued.

Get in touch

As ESG legislation and litigation continue to evolve rapidly, our firm is monitoring these developments and the potential liability risks for companies. For tailored advice or further information about the implications of the CSDDD or other relevant ESG risk management aspects for your organisation, please feel free to contact one of our advisers below.