EU CSDDD After Omnibus I (2026): What Dubai Exporters Must Answer and What They Can Refuse

UAE companies are not directly bound by the EU's Corporate Sustainability Due Diligence Directive unless they generate EUR 1.5 billion of net turnover inside the EU. After Omnibus I — Directive (EU) 2026/470, published in the Official Journal on 26 February 2026 — fewer than a thousand companies worldwide sit in direct scope. Your Dubai factory, trading house or contract manufacturer will still be asked to answer for human rights, labour and environmental performance, because in-scope EU buyers must run risk-based due diligence across their whole chain of activities from 26 July 2029. The new rules also hand you something you did not have before: a legal ceiling on what those buyers may demand from you.

Three numbers that set the stakes for Dubai exporters

Most CSDDD commentary is written for European head offices. The version that matters here starts with how much UAE trade actually touches Europe.

AED 211 billion — UAE non-oil trade with the EU in the first nine months of 2025, split into AED 160.5 billion of non-oil imports, AED 16.5 billion of non-oil exports and AED 33.4 billion of re-exports. The EU accounted for roughly 7.8% of total UAE non-oil trade over that period, with Italy (AED 43.5 billion), Germany (AED 42.1 billion) and France (AED 41 billion) leading.
AED 3.8 trillion — UAE non-oil foreign trade, a record high. The re-export share is the detail that matters for due diligence: goods passing through Jebel Ali on the way to Hamburg or Genoa pull a UAE entity into a European buyer's chain of activities.
EUR 1.5 billion — the only CSDDD test that applies to a company incorporated outside the EU. It is measured on net turnover generated in the EU, consolidated for a non-EU ultimate parent, and it carries no employee threshold at all.

Add the UAE–EU free trade talks on top. Negotiations have run through a seventh round, with the fifth round held in Dubai covering goods, customs, digital trade and government procurement, and both sides still aiming to conclude during 2026 — though UAE Minister of Foreign Trade Thani bin Ahmed Al Zeyoudi has publicly blamed "non-trade matters" for the slow pace. Sustainability conditions are exactly the kind of non-trade matter under argument.

The myth: "the EU gutted CSDDD, so we can ignore the questionnaire"

This is the most expensive misreading circulating in Dubai boardrooms right now. Omnibus I genuinely cut the directive down. It did not cut the questionnaire.

What was actually removed or reduced:

Scope. EU companies are in scope only above 5,000 employees and EUR 1.5 billion net worldwide turnover. The earlier 1,000-employee / EUR 450 million test is gone.
The EU-harmonised civil liability regime is removed. Liability now runs mainly through national law, with a review clause pointing at July 2031.
The penalty ceiling fell to 3% of net worldwide turnover, down from the 5% figure in earlier drafts.
The obligation to adopt and put into effect a climate transition plan is deleted from CSDDD. CSRD disclosure of a plan still applies where a plan exists.

What survived — and this is the part aimed at you — is that the in-scope buyer must still identify and address adverse human rights and environmental impacts using a risk-based approach across business partners in its chain of activities. Proposals to confine due diligence to tier-one, direct partners were rejected. A buyer may prioritise direct business partners where impacts are equally likely and equally severe; it cannot stop there by default. A Dubai supplier two steps down a European chain is still inside the assessment perimeter.

Scope narrowed at the top of the chain. The obligation to look down the chain did not.

Who is in scope, and where a UAE entity actually sits

Two directives drive the paperwork you receive, and they apply different tests. Knowing which one your customer is answering tells you what they are entitled to ask.

Rule	EU company test	Non-EU company test	Key dates
CSDDD (due diligence)	More than 5,000 employees and net worldwide turnover above EUR 1.5 billion	EUR 1.5 billion net turnover generated in the EU, consolidated, no employee threshold	Transposition 26 Jul 2028; compliance from 26 Jul 2029; annual statements for financial years starting on or after 1 Jan 2030
CSRD (reporting)	More than 1,000 employees and net annual turnover above EUR 450 million	EUR 450 million net EU turnover for two consecutive years, plus an EU subsidiary or branch above EUR 200 million	Reporting waves continue under the amended directive
Your UAE company	Not applicable	Almost certainly below EUR 1.5 billion of EU turnover — so not directly in scope	You are asked as a business partner, under contract, not under EU law

That last row is the strategic point. Your obligation is contractual, not statutory. It arrives as a supplier code of conduct, a due diligence questionnaire, a self-assessment questionnaire, an audit clause or a warranty buried in a renewal. It is enforced by purchase orders, not by regulators in Brussels — which makes it negotiable in a way a UAE federal law is not.

What the 2026 due diligence questionnaire actually asks

Supplier questionnaires built for CSDDD have converged on a predictable shape. Expect eight blocks:

Company and ownership — legal entity, trade licence, ultimate beneficial owners, sites, headcount by site.
Governance and policies — a human rights and due diligence policy, a supplier code of conduct, and who owns it at board level.
Human rights and labour — forced and child labour, freedom of association, working hours, wage payment, recruitment-fee practices, passport retention.
Health and safety — safety management system, incident and accident reporting, worker accommodation.
Environment — emissions, waste, water, hazardous substances, permits.
Grievance mechanism — how a worker in your Al Quoz warehouse raises a complaint, and how retaliation is prevented.
Your own supply chain — your tier-one suppliers, country-of-origin data, sub-contracted labour.
Evidence — certificates, audit reports, policy PDFs, training records, all dated.

Supply-chain ESG software vendors report that a mid-sized supplier can field anywhere from 50 to 250 ESG-related requests a year once several large buyers are in the mix, each in a different format and on a different deadline. That is the real cost: not the answers, but re-typing the same answers into a new spreadsheet every few weeks.

The lever nobody is using: the information cap

Omnibus I added explicit ceilings on what large companies may extract from smaller partners. Use them.

Under CSDDD: an in-scope company may seek information from business partners only where necessary, and from partners with fewer than 5,000 employees only when the information cannot reasonably be obtained by other means. Nearly every UAE SME sits under that line.
Under CSRD: a reporting company may not request information from an undertaking averaging fewer than 1,000 employees beyond what the voluntary standard for non-listed SMEs (VSME) requires.

Practical translation for a Dubai supplier: when a 300-question bespoke workbook lands, you are entitled to ask which directive drives it, why the data cannot be obtained from existing or public sources, and to offer a VSME-shaped answer set instead. Buyers who have read their own obligations accept this. The ones who have not are usually running a 2024-vintage template that the February 2026 amendments already superseded.

The counterpart to that right is a duty to be credible. A supplier who cannot produce a dated policy, a headcount by site or a grievance log loses the argument immediately — and loses the order to a competitor in Türkiye or Vietnam who can. Preparation, not resistance, is the defensible position.

Answer once, reuse forever: the supplier-data system

The engineering problem is boring, which is exactly why it pays. You need one authoritative store of entity data, policies, certificates with expiry dates, site headcounts, incident logs and supplier lists — then an export layer that renders it into whatever format each buyer demands. Build the record once; let the software do the typing.

Indicative AED ranges for what we build in Dubai, for scale rather than as a quote — see pricing for how we structure projects:

Build	What it does	Typical AED	Timeline
Answer bank + evidence vault	Single source of truth for policies, certificates, expiry alerts and site headcounts; exports to PDF/XLSX	18,000 – 35,000	2 – 3 weeks
Questionnaire mapping engine	Buyer template in, mapped answers out; VSME baseline; gap report per buyer	35,000 – 70,000	4 – 6 weeks
Supplier data portal	Your own tier-one suppliers self-serve their data to you; country-of-origin capture; completeness scoring	45,000 – 90,000	5 – 8 weeks
ERP / HRMS integration	Headcount, payroll-run, WPS and incident data pulled automatically instead of re-keyed	60,000 – 140,000	6 – 12 weeks

Set against the alternative, the arithmetic is not close. One operations manager spending two days a month on questionnaires is roughly 24 working days a year of fully-loaded salary — and that is the cost when nothing goes wrong. The cost when it does go wrong is the contract.

The UAE rules already asking for the same data

This is the part that converts a compliance chore into an asset. Federal Decree-Law No. 11 of 2024 on the reduction of climate change effects came into force on 30 May 2025, with the first reporting deadline falling on 30 May 2026. It applies to public and private entities across the UAE, including free zones, covering Scope 1 and Scope 2 greenhouse gas emissions in this phase, with Scope 3 widely expected to follow from 2027. Non-compliance carries administrative fines from AED 50,000 to AED 2 million, rising towards AED 4 million for repeat violations.

In other words: you are already required to measure and report the emissions data that sits in section five of every European questionnaire. Build it once, properly, and it serves both. We cover the systems side of that in ESG and carbon reporting software in Dubai.

The same holds across the rest of the European compliance wave hitting UAE exporters. The product-level evidence demanded by the EU forced labour regulation and the data model behind the digital product passport overlap heavily with CSDDD questionnaire fields. Four separate spreadsheets is a choice, not a requirement.

Your timeline to 26 July 2029

Date	What happens	What a UAE supplier should have done
26 Feb 2026	Directive (EU) 2026/470 published in the Official Journal; in force 18 Mar 2026	Confirm whether any customer is in scope; stop answering 2024-vintage templates unchallenged
By 26 Jul 2027	Commission guidelines due on due diligence, stakeholder engagement and risk-based assessment	Answer bank and evidence vault live; policies dated and signed
26 Jul 2028	Member State transposition deadline; further guidelines due on resource sharing and protection from retaliation	Tier-one supplier data collected; grievance mechanism operating with a log
By 31 Mar 2029	Delegated acts due on the content of the public due diligence statement	Integrations done; questionnaire turnaround measured in hours
26 Jul 2029	In-scope companies must comply; annual statements for financial years starting on or after 1 Jan 2030	You are the easy supplier to keep, not the risk to replace

How Aquarius builds this

We are a Dubai software studio, not an ESG consultancy — we will not write your human rights policy, and we will tell you to get that from counsel. What we build is the system underneath it: the evidence vault with expiry alerts, the supplier portal your own vendors fill in, the mapping layer that turns one dataset into any buyer's template, and the integrations that stop your team re-keying headcount out of the HR system. AED-first quotes, fixed scope, your code and your data on handover.

If a European customer has already sent you a questionnaire, send us the questionnaire. We will scope the build against the real fields you have to answer rather than a generic module. Talk to us — and if the faster path for you is a lighter internal tool rather than a platform, we will say so.

FAQ

Is my Dubai company legally bound by CSDDD?

Only if your group generates EUR 1.5 billion or more of net turnover inside the EU, measured on a consolidated basis. There is no employee threshold in the non-EU test. Below that figure you are affected contractually, through your in-scope customers, not directly by EU law.

Did Omnibus I cancel CSDDD?

No. Directive (EU) 2026/470 narrowed scope to companies above 5,000 employees and EUR 1.5 billion turnover, removed the EU-harmonised civil liability regime, cut the penalty cap to 3% of net worldwide turnover and deleted the climate transition plan obligation. The core risk-based due diligence duty across the chain of activities remains, applying from 26 July 2029.

Can my EU customer demand any data it wants?

No. Under CSDDD, information may be sought from a business partner only where necessary, and from partners with fewer than 5,000 employees only where it cannot reasonably be obtained by other means. Under CSRD, a reporting company cannot go beyond the VSME voluntary standard when asking an undertaking that averages fewer than 1,000 employees.

Does due diligence only reach my buyer's tier-one suppliers?

No. Proposals to confine the obligation to direct business partners were rejected. Buyers must apply a risk-based approach across business partners in the chain of activities, and may prioritise direct partners only where impacts are equally likely and equally severe.

What should a UAE exporter do first?

Three things, in order: find out which of your customers are in scope; assemble one dated, signed evidence set covering entity data, policies, headcount by site, safety incidents and certificates; then stop answering each questionnaire from scratch. The third step is a software problem, and it is the one that compounds.