Due Diligence Directive finally adopted
On 24 May, the Council of the European Union approved the final text of the Corporate Sustainability Due Diligence Directive (also known as CS3D), which requires large companies operating in the EU to follow a new standard of conduct in relation to social and environmental sustainability obligations.
1. What is the aim of the CS3D Directive?
The CS3D Directive aims to set the standard of care for large companies operating in the EU to contribute to economic, social and environmental sustainability. It seeks to promote fair working conditions in global value chains and to protect and improve the quality of the environment. The measures put in place are expected to benefit business, given the growing interest of consumers and investors in these issues.
To this end, the CS3D Directive sets out a number of specific actions that companies must take in relation to their own operations, those of their subsidiaries and those of their direct and indirect business partners throughout their supply chains, as well as ways in which non-compliant companies can be sanctioned and held liable for damage caused.
In addition, companies will have to adopt a transition plan with the aim to make their business model and strategy compatible with limiting global warming to 1.5°C, in line with the Paris Agreement, and with the climate neutrality objective set out in EU Regulation 2021/1119.
Other particularly controversial aspects, such as those relating to directors' due diligence or the regulation of variable remuneration linked to sustainability objectives, have disappeared in the final version adopted.
2. What legal interests does it protect?
The CS3D Directive seeks to avoid adverse impacts on human rights and the environment, as listed in Annex I and interpreted in accordance with the principles of international and European Union law.
Adverse human rights impacts are considered from a business and labour perspective. For example:
(a) The right to life or the prohibition of torture and cruel, inhuman or degrading treatment includes violations by private and public security guards protecting company resources, facilities or personnel.
(b) The right to fair and just conditions of work includes the obligation of companies to contribute to decent wages and incomes for their suppliers, especially for small farmers, and to contribute to safe and healthy working conditions and reasonable limitation of working hours. It also includes the prohibition of unequal treatment in employment and discrimination.
(c) It includes a prohibition on restricting workers' access to adequate housing, where workers are housed in company-provided accommodation, and on restricting workers' access to adequate food, clothing, water and sanitation at the workplace.
(d) It includes the right to freedom of association and assembly and the rights to join trade unions and bargain collectively.
(e) It includes the prohibition of the worst forms of child labour, forced labour and all forms of slavery and trafficking in human beings.
Adverse environmental impacts include, inter alia in addition to pollution, harmful emissions, the cause of epidemies, excessive water consumption, land degradation, deforestation and impacts that prevent a person's access to clean, safe and potable water or make access to sanitation facilities difficult, among others. Similarly, the obligations set out in the CS3D Directive seek to contribute to the conservation and restoration of biodiversity, avoid the import or export of dangerous chemicals and pesticides, the use of mercury or polluting discharges from ships.
3. To which companies does it apply?
The CS3D Directive applies to both EU and non-EU companies if a number of conditions are met in two consecutive financial years.
In particular, it applies to:
(a) Companies incorporated in an EU Member State with more than 1,000 employees and a worldwide net turnover exceeding EUR 450 million in the last financial year for which the annual accounts have been or should have been approved or which are the ultimate parent companies of groups that have reached these thresholds on a consolidated basis.
(b) To companies incorporated outside the EU which have a net turnover in the EU of more than EUR 450 million in the financial year preceding the last financial year, or which are ultimate parent companies of groups having reached this threshold.
(c) To companies incorporated inside or outside the EU which have concluded franchise or licence agreements in the EU in return for royalties (or to their ultimate parent companies) provided that the following conditions are cumulatively met:
(i) that the agreements are concluded with independent third party companies;
(ii) such arrangements involve a common identity, a common business concept and the application of homogeneous business methods;
(iii) the relevant royalties amounted to more than EUR 22.5 million in the last financial year for which annual accounts have been or should have been approved (in the case of companies incorporated within the EU) or in the financial year preceding the last financial year (in the case of companies incorporated outside the EU); and
(iv) the company has a worldwide net turnover exceeding EUR 80 million in the last financial year for which annual accounts have been or should have been approved (in the case of companies incorporated within the EU) or an EU net turnover in excess of EUR 80 million in the financial year preceding the last financial year (in the case of companies incorporated outside the EU).
4. Are there any exclusions?
The CS3D Directive does not apply to alternative investment funds (AIFs), undertakings for collective investment in transferable securities (UCITS), pension institutions operating social security schemes under European Union law, and institutions for occupational retirement provision, where a Member State has opted not to apply Directive (EU) 2016/2341 to them.
Parent companies whose main activity is to hold shares in operating subsidiaries and are not involved in the management, operational or financial decision-making of the group or one or more of its subsidiaries may be exempted if they designate one of their EU-based subsidiaries to comply with the obligations of the CS3D Directive.
5. What is meant by the term "activity chain"?
The CS3D Directive considers that for due diligence to have a significant impact, it must apply to most of the life cycle of a product or service provision.
In particular, the activity chain to which the new regulation applies includes the activities of a company's business partners upstream in the chain related to the production of goods or the provision of services by the company, such as the design, extraction, sourcing, manufacturing, transport, storage and supply of raw materials, products or parts of products and product or service development, and the activities of a company's business partners downstream in the chain related to distribution, storage and supply of raw materials, products or parts of products and the development of product or services, and the activities of a company's business partners downstream in the chain related to the distribution, transport and storage of the product, where the business partners carry out such activities for or on behalf of the company.
In contrast, the CS3D Directive does not apply:
(a) to activities consisting of the disposal activities of the product;
(b) the distribution, transport, storage and disposal of items subject to: (i) export controls under Regulation (EU) 2021/821, such as software and cyber-surveillance technologies, semiconductor materials, navigation systems or aeronautics; or (ii) export controls related to arms, munitions or war material;
(c) downstream links in the chain related to the provision of services;
(d) in the case of financial institutions, to downstream business partners who receive their services and products.
6. What are the obligations imposed on the companies concerned?
The CS3D Directive imposes the following obligations on companies:
(a) Integrate due diligence into the company's corporate policies and risk management systems.
The due diligence policy should be risk-based, developed in consultation with the company's employees and their representatives, and contain a description of the company's approach, including a long-term approach and a code of conduct applicable to the company and its subsidiaries and, where relevant, to direct or indirect business partners. The code of conduct should also apply to recruitment, employment and purchasing decisions.
This policy should be updated whenever there is a significant change or at least every two years.
(b) Detect and assess actual or potential adverse effects on human rights and the environment in its operations, those of its subsidiaries and those of its business partners in the supply chains, prioritising them according to their severity and likelihood.
This assessment must take into account geographical or contextual risk factors (such as the existence of conflict zones or areas at high risk of human rights abuses). Consideration should also be given to the "degree of involvement of the company in an adverse impact" and the company's ability to influence the business partner causing or contributing to the adverse impact or facilitating the cause of the adverse impact.
(c) With respect to potential adverse effects, seek to prevent and mitigate them. This may include the adoption of preventive action plans, requiring direct business partners to provide contractual guarantees, investments in production processes or infrastructure, or redefining the strategy and business plan. Specific support should be provided to SME business partners according to their characteristics.
As a last resort, the company is required to refrain from entering into new relationships or extending them with a business partner whose chain of activities or within whose chain of activities potential adverse impacts have occurred that cannot be sufficiently mitigated or prevented.
(d) Terminate the actual adverse effects (or minimise their extent) through the measures mentioned in the previous paragraph.
(e) Remedy actual adverse effects caused by the company (alone or together with others). Where the adverse effects have been caused solely by a business partner, remediation is voluntary and the company is empowered to use its leverage to get the partner itself to remedy the situation.
Remediation involves restoring the affected people or environment to a situation equivalent or as close as possible to the situation they would have been without the actual adverse effects, including through financial or non-financial compensation and, where appropriate, reimbursement of costs incurred by public authorities in connection with any necessary remedial measures.
In the event of non-compliance, penalties may be imposed and civil liability may be claimed. In addition, the supervisory authority shall have the power to order the undertaking to make good the non-compliance.
(f) Developing constructive engagement with parties involved in relation to the fulfilment of other obligations. These parties include employees of the company and its subsidiaries, employee representatives, consumers and individuals or groups affected by the products, services and operations of the company, its subsidiaries and its business partners, including national institutions and civil society organisations acting in defence of the environment and human rights.
(g) Establish out-of-court reporting and grievance redress mechanisms for persons and entities with legitimate concerns about actual or potential adverse effects of the operations of the company, its subsidiaries or business partners in value chains, whether natural or legal persons, and including representatives of workers in the relevant activity chain and civil society organisations.
The procedure or channel established must be fair, publicly available, accessible, predictable and transparent and ensure confidentiality and avoid retaliation.
(h) Monitor the effectiveness of the policies and the strategy periodically whenever relevant changes or new risks emerge, and in any case every 12 months.
(i) Publish on its website an annual statement on the aspects covered by the CS3D Directive (although exceptions are foreseen to avoid duplication of sustainability reporting under Directive 2013/34/EU).
7. What are the consequences of non-compliance?
Companies will be liable for damages caused to third parties as a result of breaches of their obligations, in accordance with the following parameters:
(a) There must be wilful misconduct or negligence and damage to a natural or legal person protected by the rule.
(b) A company cannot be held liable if the damage is caused solely by its business partners in its chain of activities.
(c) Compensation should not be punitive or involve overcompensation.
Member States should establish mechanisms for victims to file complaints through trade unions or non-governmental organisations, although there is no obligation for such mechanisms to include recourse to collective action.
The CS3D Directive requires the provision of penalties, based on the company's worldwide net turnover, and penalties in the form of public statements identifying the company responsible and the nature of the infringement. The maximum limit for financial penalties shall not be less than 5% of the worldwide net turnover of the undertaking (or the consolidated turnover in the case of a parent company).
In addition, non-compliance with the CS3D Directive may lead to the exclusion of the economic operator in procedures for the award of public contracts and concessions.
8. What powers will national authorities have in implementing the CS3D Directive?
Each Member State will designate an authority or authorities responsible for monitoring compliance with the obligations laid down in the national provisions adopted pursuant to the CS3D Directive, which shall publish an annual report on their activities.
The powers to be exercised by the supervisory authorities shall include the following:
(a) Request information.
(b) Conduct investigations, initiated ex officio or when substantiated concerns have been brought to their attention regarding compliance with the obligations under the CS3D Directive.
(c) Oversee the adoption and design of the transition plan for climate change mitigation.
(d) Order companies to cease their infringements and remedy their consequences.
(e) Impose penalties.
(f) Take precautionary measures in case of imminent risk of serious and irreparable damage.
9. When will the CS3D Directive come into force?
Although the Directive has been definitively adopted, it still has to be signed and published in the Official Journal of the European Union. Once published, it will enter into force 20 days later. This is expected to happen during the last quarter of 2024.
In any case, the obligations for companies will enter into force in a staggered manner well after that:
- In three years for companies with more than 5,000 employees and a worldwide net turnover of more than EUR 1.5 billion.
- In four years for companies with more than 3,000 employees and a worldwide net turnover of more than 900 million euros.
- In five years for the rest.
The staggered application for companies based outside the EU will only take into account the net turnover in the EU.
As an exception to the rules set out above, the obligation to make the annual declaration on its website on the aspects regulated by the Directive will apply for financial years starting on or after 1 January 2028 for the largest companies (those in the first tranche) and from 1 January 2029 for the others.
