I. Introduction
Risk, and its management, are considered ‘central organising principles’ of the modern regulatory state.Footnote 1 Regulatory objectives are often framed in terms of managing ‘risks’ to everything from financial stability to public health.Footnote 2 To achieve these aims, regulators often create obligations for corporations to manage risks to the public, thereby delegating regulatory implementation to the private sector and conscripting corporations’ resources and expertise to help achieve public policy goals.Footnote 3 Already in 2006, the British accounting and regulation scholar Michael Power published a report critiquing what he called the “risk management of everything.”Footnote 4 Following the spectacular failure in 2008 of established approaches to financial risk management, he later adapted this to the “risk management of nothing.”Footnote 5 Almost two decades later, however, there still seem to be few issues that EU legislators cannot frame as risks for companies to manage. This notably includes two domains that have risen on the EU’s policy agenda in recent years: the regulation of global businesses’ environmental and human rights impacts, and the regulation of large digital platforms.
In the former area, the 2024 Corporate Sustainability Due Diligence Directive (CSDDD) prescribed wide-ranging obligations for companies to identify and address risks to human rights, labour rights and sustainabilityFootnote 6 associated with their activities and those of other businesses in their value chains.Footnote 7 In the latter area, the 2022 Digital Services Act requires companies operating online platforms and search engines to regularly assess “systemic risks” related to various broadly-defined policy areas: dissemination of illegal content, fundamental rights, civic discourse, electoral processes, public health and security, gender-based violence, minor safety, and people’s physical and mental wellbeing.Footnote 8 Companies must document their implementation of “reasonable, proportionate and effective” risk mitigation measures,Footnote 9 and have their risk assessments and mitigation measures independently audited.Footnote 10 In both laws, these obligations are reserved for the largest corporations:Footnote 11 in the DSA, those with over 45 million EU users, which can be designated as “very large online platforms” (VLOPs),Footnote 12 and in the CSDDD, those with over 1,000 employees and net worldwide turnover over €450 million.Footnote 13 The DSA’s risk management obligations are overseen and enforced exclusively by the European CommissionFootnote 14 (with advisory input from national regulatorsFootnote 15 ), whereas the CSDDD’s due diligence obligations will be overseen by national regulatory authorities, but can also be enforced through private litigation.Footnote 16
Overall, despite these differences, the parallels are striking. In two domains which are highly politically salient and characterised by rapid and disruptive change,Footnote 17 EU legislators chose to frame potential harms to the public as “risks” and to delegate the management of these “risks” to large corporations, who are considered best placed to evaluate and address them. This is in a sense unsurprising. As mentioned above, this regulatory approach has become increasingly ubiquitous in recent decades. Moreover, both the DSA and CSDDD can be characterised as codifying and institutionalising existing norms and practices in their respective fields, rather than introducing particular innovations. The CSDDD was inspired by proliferating soft law codes and national-level laws mandating human rights and environmental “due diligence,”Footnote 18 while the DSA blends human rights impact assessment practices that were already widespread within “big tech” companies with more formalised risk assessment techniques inspired by financial and data protection regulation.Footnote 19
In this article, we develop a critical analysis of the CSDDD and DSA’s shared regulatory approach, informed by scholarship in regulatory theory, sociology and political economy, as well as law. Space does not permit an in-depth comparative analysis or comprehensive critique of both regulations. However, through this brief analysis, we make two contributions. First, we connect two bodies of literature that have rarely been put into conversation, on two laws that are both seen as central to the EU’s green and digital “twin transitions.” The DSA and CSDDD were early and prominent steps in “Green New Deal” and “Digital Single Market” programmes, which dominated the EU’s legislative agenda and policy discourse in the early 2020s. Thus, critically reflecting on the parallels between these laws can illuminate the regulatory philosophies and political constraints that shape contemporary EU law and policy more generally. Second, instead of focusing on particular weaknesses or details of these laws that could be improved, we present a more fundamental critique of their underlying assumptions. In particular, we question the idea that social and economic impacts of platformisation and global value chains can be reduced to quantifiable, tractable “risks,” whose management is most efficiently delegated to corporations. By denaturalising and problematising this framing, we hope to open up space for further comparative and critical analysis of the DSA, the CSDDD and other regulations that take a similar risk-based approach.
At the time of writing, the future of both laws – especially the CSDDD – appears uncertain. Under increasing pressure from business lobbiesFootnote 20 and concerned about Europe’s “competitiveness” at a time of economic and (geo)political upheavals,Footnote 21 EU policymakers are negotiating a so-called “Omnibus law” aimed at reducing the burden on businesses of Europe’s “Green Deal” environmental regulations.Footnote 22 The CSDDD is likely to be amended in ways that significantly dilute or even completely negate its key obligations,Footnote 23 but this has proved politically controversial and a final agreement on the Omnibus proposal is (at the time of writing) yet to be reached.Footnote 24 DSA enforcement also appears caught between conflicting imperatives. US-based “big tech” firms which own several leading platforms have intensified lobbying efforts aimed at weakening EU tech regulation, notably giving their explicit support to the second Trump administration’s reactionary ethnonationalist agendaFootnote 25 in exchange for its support in opposing EU digital regulation.Footnote 26 EU policymakers are already rolling back certain digital regulations,Footnote 27 but have so far resisted US pressure to reform the DSA (even prioritising this over other important issues, like energy, in tense EU–US trade negotiationsFootnote 28 ). Given widespread public and media concern about platforms and AI, EU institutions may see robust DSA enforcement as an important way to maintain public legitimacy, but also as strategically useful, since it can serve as a bargaining chip in transatlantic trade negotiationsFootnote 29 and as a way to boost Europe’s tech sector by reining in dominant US firms.Footnote 30
In the face of these political pressures and conflicts, whose outcomes remain uncertain, we suggest that opposing the backlash against the DSA and CSDDD should not mean adopting a defensive posture in which these laws are idealised as progressive victories, or seen as the most we can reasonably hope for. Progressive opposition to the deregulatory agenda of business lobbies and far-right political actors should recognise the inherent limits of risk-based regulatory approaches that accommodate powerful corporate interests, and instead mobilise for more structural economic reforms.
II. Risk management and corporate power
Both the CSDDD and DSA were drafted against the backdrop of increasingly widespread criticism of transnational corporations.Footnote 31 The adoption of the 2017 French law on the duty of vigilance, which served as a key precedent for the CSDDD, was proposed following the death of over a thousand Bangladeshi garment workers in the notorious 2013 Rana Plaza factory disaster, while the DSA followed a wave of public concern and policy and media debates about the growing power of “big tech,” sometimes known as the “techlash.”Footnote 32 As such, both laws aimed to impose stricter regulatory obligations on today’s most powerful corporations, in order to subject them to more external oversight and to force them to internalise public policy goals and concerns.
However, we argue that as these aspirational policy goals were translated into concrete legislative projects, they took a form that neutered their more ambitious aspects and limited their capacity to tackle the negative social impacts of multinational businesses. We suggest that framing multinational businesses’ social and environmental impacts as “risks” to be managed ultimately shields corporate freedom in three ways. First, risk regulation is inherently deferential towards corporate freedom and profitability, and it excludes any possibility of structural reforms that would more substantially challenge corporate power. Second, the discourse and techniques of risk management are also highly technocratic: by evoking evidence-based management of technical problems, they depoliticise contested ideological questions about the governance of the global economy. Finally, corporate risk management systems function as a means of externalisation, reframing companies’ social impacts as problems they face, rather than consequences they impose on others.
1. Deference
Regulatory frameworks based on corporate risk management can be more or less onerous for regulated companies, and can involve more or less strict regulatory oversight and potential penalties. However, despite this variation, we argue that the basic structure of risk management obligations creates a bias towards deference to corporate preferences and interests. Established approaches to risk management are founded on principles of economic efficiency, aiming to minimise the costs of regulatory enforcement for both the public and private sectors.Footnote 33 This will inherently tend to bias regulatory principles, enforcement strategies and outcomes towards those that minimise disruption to corporate power and profits.
To understand how this happens, it is important to appreciate how both the CSDDD and DSA build on established corporate risk management practices and techniques. The idea that companies should establish structured, carefully-documented “internal controls” to identify and manage risks originates in “enterprise risk management” (ERM): that is, systems and processes developed to address risks to a company’s own commercial interests.Footnote 34 Innumerable regulations now require companies to implement similar processes to manage risks in areas such as financial sustainability, environmental damage, and – increasingly – human rights and social impacts.Footnote 35 In regulations like the CSDDD and DSA, legislators have sought to build on existing ERM resources, techniques and procedures and redirect them to serve public-interest goals. However, the core concepts and procedures of corporate risk management still reflect the purposes for which they were originally developed.
One basic premise is that risks should be managed with as little disruption as possible to profitability. Entrepreneurial activity is fundamentally about taking risks in order to pursue potential profits.Footnote 36 Consequently, ERM processes almost never seek to reduce risk to zero, but rather aim to find the most profitable balance between the costs of potential harms and the costs of their prevention.Footnote 37 Similar principles have guided risk-based regulatory approaches in the public sector. While approaches to risk(-based) regulation vary widely and can be more or less interventionist and onerous for regulated companies,Footnote 38 at a general level, they share the principle that both the costs of running public regulatory agenciesFootnote 39 and the regulatory burden on businessesFootnote 40 should be calibrated to the minimum necessary to protect the public.Footnote 41 In practice, risk regulation is often guided by principles of efficiency and cost-benefit analysis that assume businesses should by default be free to do what they want, with regulators intervening only where clearly justified.Footnote 42
Moreover, regulatory approaches which delegate risk management to companies, like the DSA and CSDDD, are (more or less explicitly) premised on the assumed superiority of private-sector expertise over public-sector capacities.Footnote 43 Traditionally, an important justification for such delegation has been that companies have more expertise about their own industries and operations than regulators; consequently, allowing them to decide how to implement regulations in the context of their own businesses will be more efficient and effective than imposing uniform, top-down legal standards.Footnote 44
Importantly, laws like the DSA and CSDDD do not give companies absolute discretion over how to manage risks, but also aim to force them to consider external perspectives – for example, by consulting affected stakeholders.Footnote 45 However, these perspectives can only influence decisions once they are filtered through corporate risk management processes designed to focus on business risks. This creates distortions and biases. For example, companies are more likely to listen to criticism from stakeholder groups who can credibly threaten their commercial interests, e.g., because they represent wealthy consumer groups or have influential political and media connections, than to groups lacking economic and social capital.Footnote 46
Finally, the adequacy of corporate risk management is also subject to external oversight by public authorities. However, as we will show in more detail in Section 3, delegating risk management to corporations also limits the scope and impacts of such public oversight. In translating broad concepts like “human rights,” “sustainability” or “civic discourse” into operationalisable metrics and policies, companies necessarily have extensive discretion as to how risks should be defined, evaluated and managed.Footnote 47 The task of regulators is to determine whether companies’ risk management approaches are within the range of defensible interpretations of the law, not whether they optimally serve the public interest. As Antoine Duval has noted, human rights due diligence should be seen as “supporting the privatisation of the governance of human rights along transnational supply chains” through the empowerment of transnational corporations.Footnote 48
As such, this deference to corporate power can partly be understood as a consequence of delegating the interpretation of vague regulatory standards to companies; however, in a sense, it is also a natural consequence of framing policy problems as “risks.” The claim that the risks associated with an activity must be managed only makes sense if that activity is worth doing in the first place, or will continue to happen regardless. These assumptions are reinforced by the DSA and CSDDD’s integration of sustainability, human rights and other sociopolitical issues into existing ERM procedures, which aim to manage risks to companies’ business objectives.Footnote 49 They are thus premised on the assumption that regulated companies’ objectives are in themselves acceptable. Companies may need to manage unexpected problems that might arise in pursuing their commercial goals, but not to fundamentally reorient what they are trying to achieve.Footnote 50
2. Technocracy
In both the corporate world and the public sector, risk management has traditionally relied heavily on technical and scientific knowledge to investigate and evaluate potential risks and mitigation measures.Footnote 51 Consequently, risk management obligations lend themselves to technocratic modes of governance, where specialised professional and/or scientific experts manage risks on the public’s behalf, Footnote 52 and to discussing policy issues in technical and depoliticised terms.Footnote 53 This technocratic register obscures and subdues political conflicts around multinational business operations.
The DSA and CSDDD take inspiration from fields like environmental and financial regulation, where actors may disagree on the details of potential risks and preferred responses, but there is at least a basic level of consensus about what kinds of events constitute risks (nuclear accidents, financial market crashes, etc.) and why they should be avoided. In a similar vein, the DSA and CSDDD seem to assume that the objectives of risk management are self-evident or widely agreed. They mandate companies to address risk areas defined in broad and abstract terms, often framed as universally shared values (“fundamental rights”) or risks to a unitary “public” with shared interests (“public health” or “public security”). This obscures the need to resolve conflicts about the underlying objectives or values of the regulatory framework. According to this logic, everyone understands what the problems are, and all that remains is for professional experts to assess the evidence and choose the optimum mitigation measures.
Yet when we consider the policy areas in which these regulations seek to intervene, it is immediately apparent that not only is there no objectively correct way of defining or measuring risks; there is deep political conflict over the logically prior questions of what objectives are at risk and what risk management processes should be trying to achieve. For example, to what extent should consumers in the Global North pay more for products so that workers in the Global South can have higher wages? What constitutes good or bad “civic discourse,” and at what point do efforts to prevent “negative” civic discourse represent unacceptable incursions into media pluralism or political freedoms? Evidently, these questions demand more than evidence-based expert assessments: they implicate conflicts of interest and ideology.
By framing these questions as technical problems that can be managed by experts in the common interest, the EU’s regulatory approach not only obscures these conflicts, but also makes it more likely that they will in practice be resolved in favour of already-powerful interest groups – most obviously including regulated companies. Actors with the material resources to produce technical and scientific knowledge, employ credentialled experts, and thereby achieve expert “authorization”Footnote 54 of their preferred understandings of risk are best placed to present their political preferences as technically efficient solutions. Footnote 55 Both the CSDDD and DSA also envisage independent stakeholders (such as NGOs, academic researchers, and associations representing affected communities) informing, influencing and contesting how regulated companies manage risks.Footnote 56 However, these provisions generally limit the scope of public participation and contestation by framing stakeholder engagement as a technocratic and consensual exercise, in which everyone already agrees on the objectives being pursued, and the aim is simply to gather more evidence.Footnote 57
External actors will typically find it easier to gain access and influence risk management processes if they present themselves as contributing scientific evidence and expertise that can inform companies’ decisions, rather than fundamental political disagreement.Footnote 58 External contestation of companies’ decisions thus becomes generally more difficult, but also more unequal. We have already noted above in Section 2(a) that corporations determining which stakeholder perspectives to prioritise in due diligence processes will be incentivised to disproportionately listen to wealthier and better-connected groups who can credibly threaten their commercial interests. In addition, stakeholder groups with more economic and symbolic capital will typically find it easier to deploy the kinds of technical arguments that companies and other experts deem authoritative.Footnote 59 For example, not all NGOs have the resources to commission scientific studies or hire human rights lawyers. Affected communities in the Global South will likely find it particularly hard to participate in these processes and to have an autonomous voice that is not mediated via authorised Global North actors.Footnote 60
3. Externalisation
As discussed above, the DSA and CSDDD work within the logic of existing ERM systems, mandating companies to use similar risk management procedures to address public policy issues. This means that social problems are framed in a similar way to business risks – as problems that companies are faced with while attempting to pursue their business objectives.Footnote 61 This obscures the possibility that these social harms might be inherent results of these objectives, or that they could be beneficial for the company at the same time as they impose harmful consequences on other actors.
For example, the CSDDD requires regulated companies to identify and endeavour to preventFootnote 62 existing or potential adverse impacts of their own activities and those of their subsidiaries, suppliers and commercial partners.Footnote 63 Historically, transnational companies have outsourced low-wage labour and environmentally damaging activities to smaller companies through global value chains not only to boost their profitability, but also to avoid legal and social responsibility.Footnote 64 Thus, extending due diligence obligations beyond the boundaries of the individual corporation is one of the CSDDD’s key innovations (that would, however, be drastically limited should the Omnibus proposal be passed).Footnote 65 The legislation can be understood as an attempt to force powerful corporations to “internalise" and take responsibility for problems which they historically “externalised" to other actors in their value chains.Footnote 66
Yet seeking to achieve this goal through risk management obligations actually aligns, in another sense, with the externalisation of risk described above. If the primary source of risk is misbehaviour by third parties, which regulated companies are responsible for preventing, then social and environmental impacts are implicitly framed as external problems which they have to deal with, rather than direct consequences of their own actions.Footnote 67 Research on global value chains calls into question whether this framing is helpful.Footnote 68 “Lead firms” carefully plan everything from the choice of suppliers to the price of different inputs and the management and disposal of waste.Footnote 69 To comply with voluntary due diligence commitments – and now, legal obligations – lead firms may prescribe sustainability, working conditions and human rights standards in their contracts or codes of conduct. Yet they often simultaneously impose contractual terms, such as tight deadlines or low prices, which make it impossible for suppliers to respect these standards.Footnote 70 These codes and standards could therefore be understood as a typical example of “cosmetic compliance,” which signal respect for human rights and sustainability without substantively changing harmful business practices and relationships.Footnote 71 They may also increase lead firms’ control over their value chains, for example by justifying more stringent surveillance and monitoring of smaller partners.Footnote 72
Recognising the importance of prices and deadlines shows that environmental harms and human rights violations are closely connected to the core objective of a multinational corporation: minimising costs and maximising profits. Evidently, this objective is unlikely to be problematised or questioned by companies’ own internal risk management systems. Importantly, while the CSDDD can be read as aspiring to incorporate considerations of pricing and economic distribution in global value chains into due diligence processes, it creates little concrete legal pressure for companies to take these factors into account. Some recitals mention the relevance of procurement and pricing practices in assessing labour rights, human rights and environmental risks.Footnote 73 However, no articles establish concrete obligations to reform these practices, or to ensure suppliers are paid enough to implement effective risk mitigation measures. Given the extensive discretion companies enjoy over how to interpret and prioritise risks, it seems unlikely these vague references to pricing practices will lead them to voluntarily redistribute value from themselves to their suppliers.Footnote 74
In contrast, Article 34(1) DSA provides that designated “very large online platforms” (VLOPs) must assess and mitigate “any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services” (emphasis added). This seems to make it explicit that companies must consider harms directly caused by their commercial operations, not only problems they encounter in the course of those operations. However, considering the context in which these broadly defined obligations will be translated into concrete corporate practices, standards and procedures, this interpretation seems less likely.
Importantly, even where there is broad consensus that a certain issue constitutes a systemic risk, it can typically be framed in multiple ways. For example, risks like “dissemination of illegal content” or “gender-based violence” are often understood as problems involving misbehaviour by individual users, which platforms must prevent.Footnote 75 On the other hand, these widespread problems could also be understood as the predictable consequence of creating online spaces that enable large-scale interpersonal communication (and which in many cases actively incentivise or facilitate abusive behaviour)Footnote 76 without investing sufficient resources in safety measures.Footnote 77 From this perspective, then, “risks” of interpersonal abuse or illegal content appear less like external threats to the public that platform companies must fend off, and more – once again – the direct consequence of their efforts to maximise profits and share values.
When we consider which framings might be favoured in practice, it is obviously relevant to recall that VLOPs enjoy substantial discretion over how risks are defined, measured and addressed. From their perspective, “externalising" framings – in which their business practices are per se acceptable, but must respond to external impediments – are obviously preferable to “internalising" framings which identify those practices themselves as the source of harm. This can already be seen from the first DSA risk assessment reports published by leading companies like Google and Meta, which heavily frame risks in terms of “bad actors” whose malicious behaviour requires constant vigilance from companies.Footnote 78 In practice, then, much like the CSDDD, the DSA’s delegation of the definition of systemic risks to companies effectively facilitates the externalisation of negative impacts and the legitimisation of existing business practices.Footnote 79
III. Risk management and legal remedies
We have argued that framing social issues related to sustainability, human rights and platform governance as “risks” to be managed through internal corporate bureaucracies has important discursive effects: it frames these issues in technocratic, depoliticised market-friendly terms that minimise regulatory disruptions to business as usual. This already has legal implications, as such shared understandings influence how political actors draft and interpret regulations.Footnote 80 However, the DSA and CSDDD’s reliance on corporate risk management obligations also has direct legal consequences. First, this regulatory approach entails a focus on procedure rather than outcomes, which reinforces the bias towards deference to companies. Second, relatedly, it poses practical hurdles to private and public enforcement which might seek to hold these companies accountable for their risk management decisions.
1. Proceduralisation
The CSDDD and DSA’s regulatory approach is sometimes called “meta-regulation” – referring to regulatory regimes where public authorities do not establish substantive rules on how companies should respect human rights, sustainability etc., but instead require them to define their own standards and establish effective internal controls to enforce these standards. Regulators then oversee the adequacy of these internal systems.Footnote 81
In line with this approach, the clearest and most straightforward obligations in the CSDDD and DSA focus on procedures (conducting risk assessments,Footnote 82 considering how different factors affect risks,Footnote 83 monitoring and reporting on mitigation measures,Footnote 84 etc.), rather than on the substantive results they should achieve. Conversely, legal standards and criteria that do address substantive results are comparatively vague and open to interpretation (e.g., “reasonable” risk mitigation measures).Footnote 85
This reinforces the deregulatory tendency of risk regulation, by maximising companies’ discretion over regulatory interpretation.Footnote 86 Importantly, it also encourages public authorities overseeing compliance to focus on procedure over substance. Because substantive criteria like “reasonableness” intentionally accord extensive discretion to regulated companies, challenging the substantive merits of their decisions is difficult: it would require a demonstration that companies’ decisions were not just suboptimal but clearly “unreasonable.” In contrast, procedural obligations are clearer and thus easier to enforce. Illustrating this, the first enforcement decision under the DSA risk assessment involved TikTok’s failure to produce a risk assessment before launching its new “TikTok Lite” service in the EU – that is, a failure to follow correct procedures, rather than a substantively unacceptable decision.Footnote 87 Similarly, early court decisions under the French duty of vigilance law – which could provide an indication of how national authorities might enforce similar CSDDD provisions – focused heavily on the procedural obligation to establish a “vigilance plan,” while according substantial deference to companies over such plans’ substantive contents.Footnote 88
Meta-regulatory regimes also incentivise companies to focus on procedure and formalities over substantive outcomes, as formalised internal procedures are useful to demonstrate compliance to regulators.Footnote 89 This dynamic – often called “cosmetic”Footnote 90 or “ceremonial” complianceFootnote 91 – has been empirically documented by sociolegal scholars in diverse contexts, including business and human rights, sustainability and technology regulation.Footnote 92 Companies may rationally spend limited time and resources documenting that relevant fundamental rights issues were considered in their decision-making processes, rather than adapting the outcomes of those decisions to better reflect fundamental rights standards (which are in any case generally highly ambiguous, and could thus almost always be interpreted to justify the company’s preferred course of action).Footnote 93 Staff responsible for legal compliance might find it easier to write a new internal policy, or introduce new forms and checklists, than to convince senior executives or other internal teams to compromise other business objectives in order to make more fundamental changes.Footnote 94
Finally, reliance on auditors and other external experts to monitor and validate risk management processes – which is explicitly required by Article 37 DSA, and which has also historically played an important role in human rights and environmental due diligenceFootnote 95 – also tends to incentivise an emphasis on process over outcomes. Auditors typically do not want responsibility for making contestable choices about how ambiguous legal terms should be interpreted.Footnote 96 Consequently, auditing tends to focus on whether companies have correctly followed procedural requirements and reliably implemented their own policies, rather than on these policies’ substantive merit.Footnote 97
Overall, then, the various actors involved in translating vague regulatory obligations into practice – regulators, companies and third-party services like auditors – each have their own incentives to focus on procedural rather than substantive questions. As can already be seen from some early signs in the implementation of the DSA and the French duty of vigilance, this is generally likely to lead to a stronger emphasis on “ceremonial” and “auditable” procedures that signal attention to environmental and social issues, rather than meaningful changes to business practices that actually reduce these negative impacts. As long as companies demonstrate that they have followed appropriate procedures, they are largely free to run their businesses as they want. This suggests the DSA and CSDDD may ultimately have little impact on the social and environmental impacts with which they are concerned.
2. Enforcement
Finally, the meta-regulatory approach constrains private and public enforcement. As we described above, companies have extensive discretion over how to define vague regulatory terms and how to prioritise and balance the benefits and costs of different risks and mitigation measures. This immediately makes contestation of their decisions more difficult, as regulatory agencies or individual claimants alleging non-compliance must demonstrate not only that the company’s risk management practices leave something to be desired, but that they fall outside the bounds of possible interpretations of the relevant provisions. Importantly, however, even where claimants can make a convincing case for non-compliance, we argue that the meta-regulatory and procedurally focused approach to risk management will further limit legal enforcement and available remedies in practice. This plays out differently in the CSDDD and DSA, given their different enforcement structures, but some parallels can be observed.
In the DSA, risk management is primarily overseen by the European CommissionFootnote 98 (which has a dedicated team in its directorate-general for communications and network technologies, DG ConnectFootnote 99 ). The Commission has extensive supervisory powers: it can inspect platform companies’ premises, request internal documents and data,Footnote 100 and issue preliminary findings of non-complianceFootnote 101 (to which companies can respond by making “voluntary” commitments to rectify the alleged non-compliance)Footnote 102 before proceeding to an eventual final enforcement decision, which could involve fines of up to 6% of worldwide annual turnover.Footnote 103 National regulators, represented collectively by the European Board for Digital Services,Footnote 104 can advise and support the Commission as well as issuing their own guidance on relevant systemic risks and best practices.Footnote 105
Given the Commission’s extensive discretion over how to interpret Articles 34–35 – including through more informal communications with platform companies, as well as formal regulatory guidance – and its authority to threaten significant fines, experts have expressed concern about regulatory overreach and politically motivated restrictions of online speech.Footnote 106 These concerns should not be discounted. However, while the Commission’s discretion over DSA interpretation and enforcement is theoretically very large, it is also subject to judicial review. Notably, any eventual enforcement decisions can be legally challenged by platform companies.Footnote 107 These are large and extremely well-resourced corporations, who enjoy significant structural advantages in any litigation. The meta-regulatory structure of the DSA reinforces this advantage. To prove non-compliance, the Commission would have to show that a VLOP’s compliance measures were outside the bounds of reasonable interpretations; meanwhile, the VLOP would only have to show that they have put forward one among many defensible interpretations. Given the vague, abstract and contestable nature of the risk areas defined in Article 34, this will generally not be difficult.
Crucially, this legal contestation does not only have an impact in particular cases where enforcement decisions are successfully challenged – it can also more generally influence how regulatory authorities approach their work. Quite rationally, DG Connect is likely to focus on cases and regulatory interpretations deemed less likely to be legally challenged or more likely to hold up in court,Footnote 108 which will typically be those that are more conservative and less disruptive to widely accepted industry practices.
Moreover, these barriers to legal enforcement do not obviate concerns about politicised enforcement of the DSA – if anything, the opposite. The possibility of legal challenges to formal measures may encourage regulators to favour informal influence, collaborative relationships with platforms and “regulation by raised eyebrow.”Footnote 109 In turn, this makes it harder for external actors to contest enforcement practices that limit freedom of expression or other civil liberties.Footnote 110
As regards private enforcement, claimants who suffer damages caused by violations of the DSA (which is a regulation and thus directly effective in national courts) can sue for damages in accordance with their national lawFootnote 111 (including via associationsFootnote 112 and representative actionsFootnote 113 ). However, Articles 34–35 are not considered sufficiently clear and unconditional to create justiciable individual rights.Footnote 114 Their interpretation could still play a secondary role in litigation related to other aspects of the DSA – most notably the right for researchers to access platform data under Articles 40(4) and 40(12), which requires that the research involves systemic risks. Thus, if data access is refused by VLOPs or by responsible national authorities (who must certify requests for privately held dataFootnote 115 ) on the grounds that the research does not involve systemic risks, this could be contested in court by claimants arguing for a different interpretation of Article 34. This could also provide a route for strategic litigation by claimants who are more interested in influencing risk management than in data access as an end in itself. However, such contestation would be quite narrowly circumscribed: claimants could establish that a given issue constitutes a risk that companies ought to consider, but companies remain free to decide how they evaluate and measure that risk. Overall, then, this seems to reinforce the procedural and technocratic character of DSA risk management: as long as companies go through the procedures of assessing relevant risks, what they do about those risks is up to them.
In contrast, the CSDDD originally provided for oversight by national regulatory agencies,Footnote 116 paired with civil liability.Footnote 117 Public enforcement of due diligence obligations is a relative novelty inspired by Germany’s 2021 supply chain law; given both laws’ recency, it is difficult to predict how this will function in practice. However, it can already be observed that the relevant CSDDD articles are rather vague when it comes to the powers and sanctions of national regulators.Footnote 118 While the DSA is a regulation directly applicable in all member states, the CSDDD is a directive requiring transposition by each member state. Different member state legislatures and regulatory agencies could thus take rather different approaches to enforcement. Given how the CSDDD and other Green Deal regulations have already been politicised in debates around whether Europe’s competitiveness is held back by excessive regulatory “red tape,”Footnote 119 we might expect that Member States’ enforcement strategies might be influenced by their governments’ individual economic and industrial policies.
As it stands, Article 29 CSDDD provides for civil liability (including via representative actionsFootnote 120 ) where claimants suffer damage due to intentional or negligent non-compliance with Articles 10 and 11 (respectively, obligations to prevent and to bring to an end adverse environmental and human rights impacts). However, one of the main modifications by the Omnibus proposal would be the elimination of an harmonised civil liability regime: it would be left to Member States to decide whether to introduce civil liability for violations of due diligence obligations.
In any case, in the current CSDDD text, the emphasis is again on risk management procedures. Articles 10–11 apply to adverse impacts that were or should reasonably have been identified by due diligence procedures. Thus, claimants must demonstrate not only that the defendant company’s actions caused them harm, but that this harm was caused by a failure to correctly carry out due diligence – and in addition, that this failure was intentional or negligent. Given companies’ extensive discretion about how to approach due diligence,Footnote 121 it will be extremely difficult for claimants to conclusively show that if proper due diligence had been conducted, they would not have suffered harm.Footnote 122 The Omnibus proposal would limit the information that companies can require from their suppliers, which would likely further limit which impacts are considered to have been identifiable and preventable via due diligence. These difficulties appear even greater if we keep in mind the imbalances of power and resources between large multinational companies and potential claimants. Even where uncertainties about causation, internal procedures and regulatory interpretation are not fatal to a claim, defendant companies can use them to stall litigation and increase claimants’ costs.
Certain details of the CSDDD could reduce the impacts of civil litigation even further. In the final text passed in 2024, Article 29(1) states that “a company cannot be held liable if the damage was caused only by its business partners in its chain of activities.” As we noted in Section 2(c), expanding due diligence to business partners and suppliers was an important rationale of the CSDDD, aimed at combating the externalisation of liability that is a key feature of global value chains. Since most violations occur without direct participation by the lead firm, excluding them from the scope of civil liability could undermine its whole rationale. Furthermore, even where civil litigation is successful, the remedies envisaged by Article 29 – principally compensatory damages – have little potential to challenge systemic violations or their underlying structural causes. If the EU-wide civil liability regime were to be suppressed, even this (very little and mostly symbolic) potential would be eliminated.
Overall, then, despite their different enforcement frameworks, our analysis shows some clear parallels between the CSDDD and DSA: the framing of policy issues as “risks” and the delegation of risk management to regulated companies sharply limits the legal remedies available against these companies. Due to their interpretative discretion, companies have significant leeway to challenge any legal enforcement based on substantive claims about how risks should be mitigated by claiming that they have interpreted relevant provisions in a different but nonetheless acceptable way. In the DSA, civil liability is limited to technical and procedural aspects of risk management. In the CSDDD, while it is theoretically more broadly available, it faces significant barriers in practice, and in any case is again heavily focused on procedure. Due to all of these factors, we would predict that where legal enforcement of the DSA and CSDDD does succeed, it is likely to be in cases based on comparatively conservative and business-friendly interpretations of legal standards – once again serving to legitimise existing industry structures and business practices, and to minimise disruption to corporate freedom and profitability.
IV. Conclusion
We have highlighted some important similarities between the EU’s regulatory approach in two key areas of contemporary economic regulation: the regulation of due diligence in global value chains and the regulation of dominant digital platforms. In both cases, responding to widespread concern among policymakers and the public about social, environmental and political issues, EU legislators followed a well-worn regulatory path: framing these issues as “risks” that needed to be managed, and charging dominant companies in the relevant sectors with defining and managing these “risks” to the public.
We argue that there is nothing inevitable about framing issues as risks to be managed through bureaucratic corporate compliance processes, and that in fact, choosing to approach regulation in this way is ideological and politically consequential. In this regard, we would like to underline three key conclusions of our analysis. First, the DSA and CSDDD align with ideological agendas that maximise corporate freedom and create significant barriers to external accountability, whether from public authorities or from other affected stakeholders. Second, framing multinational businesses’ impacts as “risks” they should manage legitimises not only their extractive business practices, but also their political power – as negative impacts are framed as exogenous to their operations, while they themselves are positioned as responsible participants in a collaborative effort to protect the public.Footnote 123 Finally, both regulations frame these regulatory efforts in technocratic and depoliticised terms. This sidelines political disagreement about what is in the “public interest” and elides the fact that environmentally and socially destructive business practices are not universally understood as harmful, but are the consequences of activities that harm some people while benefiting others. Pursuing a democratic, equitable and sustainable “twin transition” would necessarily involve recognising these conflicts of interest and confronting those who currently benefit from globalised business operations.Footnote 124 The technocratic, consensual and business-friendly understanding of social and environmental issues as “risks” is unlikely to aid such endeavours.
The DSA and CSDDD both attempt to tackle pressing structural problems and disruptions of our time: the social impacts of rapid developments in digital technologies, the concentrated power of large corporations, and the social and environmental impacts of globalised economic production. Yet in both cases, lacking political will or international consensus for ambitious structural reforms, EU legislators instead adopted measures aimed at forcing powerful companies to internalise these concerns, without substantially changing the conditions under which they operate. Risk management obligations can thus be understood as a legal double movement. Regulators acknowledge and attempt to address social concerns linked to companies’ commercial activities – but in a way that is structurally biased towards minimising constraints on business operations and excludes more fundamental questions about these companies’ existence, business models and role in the global economy.
Risk-based regulation can be understood as a way for legislators facing crises and disruption to navigate between conflicting imperatives.Footnote 125 Risk management techniques promise to render complex social problems tractable and achieve a reasonable, universally beneficial balance between competing costs and benefits.Footnote 126 Thus, risk discourse has historically been a powerful way of gaining social acceptance for technological and economic developments.Footnote 127 At the time of their development, the DSA and CSDDD both played a central role in the optimistic rhetoric of the EU’s “twin transitions” to a bright green and digital future.Footnote 128 Our analysis in this article suggests that they allowed EU legislators to seek public legitimacy by demonstrating that they were taking action to address social concerns around digitalisation and the environment, while avoiding the political difficulties that would come with more significantly restricting corporate activities or profits.
The prevailing ideological climate has now shifted. Faced with bleak economic growth projections, transnational businesses are intensifying political mobilisation against legislation aimed at scrutinising or constraining their operations, even if only through relatively minor compliance costs.Footnote 129 EU institutions are increasingly seeking legitimacy based on the rhetoric of great-power competition and security, rather than progressive social and environmental policies. In this context, the symbolic value of Green Deal policies like the CSDDD has diminished, while DSA enforcement may be instrumentalised in transatlantic trade disputes. Despite this fast-evolving situation, the present analysis retains its relevance. Transitional periods, by their nature, amplify the agency of key actorsFootnote 130 and create openings for structural transformation.Footnote 131 This makes it especially crucial to appreciate the limitations of existing regulatory tools in addressing the social, political and environmental impacts of globalised digital platforms and value chains. Our analysis suggests that, rather than defensively mobilising to strengthen the CSDDD and DSA, doubling down on the risk regulation paradigm, there is a need to explore and mobilise – not only legally but also politically – behind alternative approaches.
Competing interests
The authors declare that there are no conflicts of interest.
Open access
