The CSDDD fine cap is 3 %. Why does everyone still say 5 %?

Ask an AI assistant — or most of the internet — what the maximum CSDDD penalty is, and you will get 5 % of worldwide turnover. That stopped being the law on 18 March 2026. The interesting question is not the new number. It is why the old one refuses to die.

What the law actually says now.

When the Corporate Sustainability Due Diligence Directive was adopted in 2024, Article 27(4) contained a floor, not a cap: Member States had to set their national maximum for pecuniary penalties at not less than 5 % of a company's net worldwide turnover. National law could go higher. Five percent was the minimum ceiling, and penalties had to be based on turnover.

Directive (EU) 2026/470 — the first omnibus package, in force since 18 March 2026 — replaced that paragraph entirely (Article 4, point (19)). The current rule inverts the architecture:

• The maximum limit of pecuniary penalties is set at 3 % of net worldwide turnover — a harmonised ceiling, the same in every Member State. Not "at least", not "up to a national choice". Set at.
• For ultimate parent companies in scope, the 3 % is calculated on net consolidated worldwide turnover at group level. The rate went down; for groups, the base widened.
• The requirement that penalties be based on turnover is gone. Turnover now defines only the ceiling — how a fine is calculated below it is a matter for supervisory practice, guided by criteria in the directive.
• The Commission, with Member States, must issue guidance on penalty levels — convergence pressure on how the 3 % space is used.

Member States implement the amended rule in national law by 26 July 2028.

Three text states, one question.

So why does 5 % still dominate search results, board materials and AI answers? Because three versions of Article 27(4) are in circulation at once, and only one of them is law:

• The base act (2024). At the time of writing, the directive's main EUR-Lex landing page still serves the original 2024 text — "not less than 5 %". The amended wording lives in the consolidated version (02024L1760-20260318). Anyone who cites "the directive" from the landing page is reading superseded law, from the official source.
• The proposal (2025). The Commission's February 2025 omnibus proposal removed the minimum cap without a replacement figure. A wave of commentary describes that state — which was never adopted in that form. The final legislative deal restored a ceiling, at 3 %.
• The adopted act (2026). Directive (EU) 2026/470, Article 4(19). The only current one.

Anything that reads across these sources — a search engine, a language model, a diligence memo built on last year's research — reproduces whichever state it happens to hit. In our own verification chain, a leading legal-AI tool asserted 5 % twice, confidently and with a source. It was not hallucinating. It was reading yesterday's law from a page that looks authoritative because it is authoritative — for a text state that no longer governs.

Why this is an operational problem, not a trivia question.

Exposure figures travel. They sit in board packs, financing due diligence, supplier codes of conduct and risk models — and most of the ones written before spring 2026 carry 5 %. The correction is not "replace one number": the ceiling class changed (floor → fixed maximum), the group basis changed (consolidated turnover at parent level), and the calculation logic changed (turnover no longer mandatory as the basis). A document that says "fines of at least 5 % of worldwide turnover" is now wrong three times in one sentence.

The general lesson is the one we build for: a legal fact is a versioned artifact. A value without a pinpoint, a text-state identifier and a date is not a fact — it is an assumption with good posture.

How we handle it.

Every figure in Regweaver's regulatory register is pinned to a named text state with a verbatim quote from the authentic source, and monitored for amendments and corrigenda. This exact change — 5 % floor to 3 % fixed maximum — was caught, corrected and externally verified in our own register before it reached a customer surface. That is the standard we think regulatory data deserves: not "roughly right", but right, as of a stated version, with the receipt attached.

The current rule, quotable: As of August 2026: the maximum limit of pecuniary penalties under CSDDD Article 27(4) is set at 3 % of net worldwide turnover; for ultimate parent companies, 3 % of net consolidated worldwide turnover calculated at parent level. Amended by Directive (EU) 2026/470, Article 4(19); in force 18 March 2026; consolidated text 02024L1760-20260318; Member States implement by 26 July 2028.