Our input to the EU commission CSDDD questionnaire

In August 2026, Sustainability Scorex (SCX) submitted its input to the European Commission’s public consultation on the Guidelines to the Corporate Sustainability Due Diligence Directive (CSDDD) – bringing Ukraine’s wartime due diligence experience directly into the EU regulatory conversation.

Safety isn’t a geographical criterion. True resilience is the capability to operate consistently – not just to keep firefighting. This is the main message Sustainability Scorex submitted to the European Commission’s public consultation on the CSDDD.

We are grateful for this open window to contribute – not only because Ukraine is a Conflict-Affected and High-Risk Area (CAHRA), but also because we are in the middle of a systemic transformation, while sustainability and due diligence  frameworks have not yet evolved enough to reflect this new reality.

1. ‍EU businesses already face a heightened operating context and safety risks even if they are not formally located in a CAHRA. Heightened Human Rights Due Diligence – referenced in Recital 42 of the CSDDD through the UNDP Guide – is called for wherever businesses operate in “… other forms of instability”, including “serious levels of volatility”. Romanian businesses have faced repeated drone incursions, Spain experienced blackouts in 2025, and the Baltic States operate under heightened geopolitical risks.
2. ‍Safety reflects resilience, which in CAHRAs is a vital: mobile refuelling points, the dispersal of warehouses to avoid losing everything at once, and time to recovery, ability to recover and frequency of recovery. McDonald’s has restored operations at its Lukianivska restaurant in Kyiv seven times, with an average recovery time is about 3–5 days after missile attacks. Resilience becomes a measurable determinant of impact severity in CAHRAs.
3. In CAHRAs, harm is externally caused, so remediation cannot rely on fault. A company cannot control the hazard, but it controls the exposure and protection of those present. Statutory support is slow and insufficient, so business resilience becomes an effective line of protection for people. Ukrainian employers pay the families of employees killed on the battlefield (EUR 5,000 on average), including where the mobilisation notice was served through the employer – placing the company in the chain of events without making it the cause. Business practice therefore already goes beyond the current definition of remediation in the СSDDD.‍
4. The understanding of vulnerability also needs to evolve. A veteran living with PTSD experiences an air raid differently from someone without combat experience. An employee with a prosthetic limb has a completely different evacuation profile, even without officially recognised disability status. Certain groups – such as employees who are former prisoners of war, and their families – remain unaddressed.
5. Implementing Human Rights Due Diligence in a company with more than 50,000 employees across 24 countries and nine businesses has shown that the greatest challenge is often not prioritising risks, but identifying the hidden ones. In Ukraine, hundreds of thousands of people are outside the visible labour market because of mobilisation – a shift that is invisible to standard audits. This is not Ukraine-specific. The same dynamic appears wherever labour markets are reshaped by displacement, demographic pressure or rapid sectoral shifts.

• Also, prioritisation is a loop, not a sequence. After a disruption a company must be able to step back from prevention to identification and re-assess in the moment: a company whose warehouse is destroyed begins again, with a new assessment and new risks. As amended by Directive (EU) 2026/470, Article 15 CSDDD requires periodic assessments at least every five years. Conditions change faster than the next scheduled assessment falls due. The Guidelines should clarify that an external disruption event constitutes a significant change triggering reassessment under Article 15.

6. Defence tech is already in the EU value chain and is no longer state procurement policy. It is one of Europe's fastest-growing private sectors. European defence tech funding grew by 55% year-on-year to $8.7 billion. Ignoring this industry in due diligence guidance will leave its impacts unmanaged.
   ‍
7. The absence of communication is itself a form of communication. In CAHRAs, non-disclosure is often a deliberate risk mitigation decision rather than a failure to report. Article 5(3) provides that a business partner is not obliged to disclose to a company information that is a trade secret, and shall never be obliged to disclose classified information or information whose disclosure would cause a risk to the essential interests of a state's security. The provision governs what a business partner owes a company; it gives a company no right to omit from its own Article 16 statement information whose disclosure would endanger its workforce.

More in our presentation sent within the CSDDD questionnaire to the EU Commission.

‍