Following an own-initiative report by the European Parliament in 2021 and lengthy negotiations that began in 2022, the Council of the European Union finally adopted the Corporate Sustainability Due Diligence Directive ("CS3D") on Friday, May 24, 2024^[1].

CS3D is largely inspired by the French law (No. 2017-399 of March 27, 2017, relating to the duty of vigilance of parent companies and contracting companies - the "Duty of Vigilance Law" or the "Law"), but seeks to extend the scope of the latter. Moreover, CS3D clarifies the content of the due diligence obligations imposed on companies.

In order to support companies in the implementation of their due diligence measures, the European Commission is due to publish, within thirty months of the entry into force of the directive, guidelines, including general guidelines and for specific sectors or specific adverse impacts, and guidance on model contractual clauses.

Companies subject to CS3D

CS3D expands the number of companies subject to due diligence obligations compared to the Law^[2] by distinguishing two main categories of subjected companies^[3]:

• Companies incorporated under the laws of a Member State with more than 1,000 employees on average and an aggregate worldwide turnover in the last financial year of more than €450 million, or the ultimate parent company of a group meeting the above thresholds, or companies which have entered into franchising or licensing agreements in the EU in return for royalties (under certain conditions); and
• Companies incorporated under the laws of a non-EU country with an EU turnover in excess of €450 million in the last financial year, or the ultimate parent company of a group meeting the above thresholds, or companies having entered into franchising or licensing agreements in the EU in return for royalties (under certain conditions).

In addition, the directive provides that a parent company may be exempted from the obligations of the directive if the parent company is a pure holding company with no operational activities  and it does not participate in the management, operational or financial decisions affecting the group or of one or more of its subsidiaries.

CS3D scope

CS3D's due diligence obligations extend to the activities of the reporting company, its subsidiaries and its direct and indirect business partners throughout its entire chain of activities.

The term "chain of activities" thus goes far beyond the scope of the Law^[4], since it covers both the upstream activities of a company's business partners and the downstream activities of a company's business partners (distribution, transport, storage), when the business partners carry out these activities for or on behalf of the company.

Regarding regulated financial companies, their chain of activities includes only the upstream business partners in their chain of activities but not the downstream business partners who receive their services and products^[5]. CS3D also requires the European Commission to prepare a report on the need for additional sustainability due diligence requirements tailored to regulated financial companies.

Due diligence obligations for companies subject to CS3D

CS3D introduces several due diligence obligations^[6] that are substantially the same as those set forth in the Law.

However, the directive contains several important clarifications that companies already subject to the Law will need to adapt to (presented in bold below):

• A risk-based due diligence policy, in consultation with stakeholders, that includes (i) a description of the company's approach to due diligence, (ii) a code of conduct, and (iii) a description of processes for the integration and implementation of due diligence^[7];
• A risk mapping to identify, analyze and prioritize risks to human rights and the environment. The directive sets out the methodology for prioritizing risks according to their severity and likelihood. Annexes also list the human rights and environmental protection standards to which companies must refer to in order to proceed with the identification of adverse impacts;
• Appropriate measures to prevent or mitigate potential adverse impacts. CS3D provides several examples of appropriate measures, including obtaining contractual assurances from business partners, adopting codes of conduct, establishing remediation action plans, making investments, providing operational or financial support to SMEs, and suspending or, as a last resort, terminating business relationships;
• Regular assessment procedures for subsidiaries, subcontractors and business partners to regularly evaluate the risks arising from their activities;
• Periodic assessments of the activities and measures implemented by the company, its subsidiaries and business partners in order to evaluate their implementation and ensure the adequacy and effectiveness of these measures;
• Setting up a complaint procedure and notification mechanism.

Companies will also have to adopt and implement a climate change mitigation transition plan to ensure that their business strategy is compatible with limiting global warming to 1.5° C in line with the Paris Agreement. While there is no obligation to achieve specific results, companies must make every effort to meet this goal.

Penalties

CS3D leaves it to Member States to determine appropriate sanctions, including fines, for offending companies. However, the directive specifies that fines must be based on the offender's worldwide turnover (at group level), with a ceiling of at least 5 % of its turnover^[8].

Following the example of the Duty of Vigilance Law, a company may be held liable for damage caused to a natural or legal person if it has intentionally or negligently failed to comply with its due diligence obligations^[9]. On the other hand, Member States will be free to determine the conditions for liability claims, such as the burden of proof, the limitation period, the determination of damage or the causal link.

Supervising authorities

Similar to the German legislation, Member States will have to designate one or more national administrative authorities to monitor compliance with the new rules and impose fines in the event of infringement^[10]. 

Implementation and entry into force of the directive

Member States must transpose CS3D within two years of its entry into force^[11].

CS3D will be phased in (in principle between 2027 and 2029) according to the following employee and turnover thresholds:

• 2027 for companies with more than 5,000 employees and a global turnover of more than €1.5 billion (and non-EU companies with EU a turnover of more than €1.5 billion);
• 2028 for companies with more than 3,000 employees and global turnover of more than €900 million (and non-EU companies with EU turnover of more than €900 million); and
• 2029 for companies with more than 1,000 employees and more than €450 million in worldwide turnover (and non-EU companies with more than €450 million in EU turnover).

The adoption of CS3D does not mean that the regulatory framework has been completely finalized.

The implementation of this Directive has not yet taken place and may lead to divergences between Member States (as this directive does not provide for maximum harmonization). In any case, the directive is likely to change the operational practices and functioning of companies operating in the European Union, particularly those not previously subject to the Law.

The Commission's publication of general guidance, sector-specific guidance, guidance on specific adverse effects and model contract clauses should be a useful addition to the directive's framework, providing companies with practical guidance on how to implement the new obligations.