I. Introduction
After two unsuccessful attempts, the EU’s Corporate Sustainability Due Diligence Directive (CSDDD)Footnote 1 passed the Council of the EU on 15 March 2024 and the European Parliament on 24 April 2024. This article analyses the CSDDD against the background of existing EU sustainability-oriented law and regulation, as well as supply chain regulation in two large EU Member States, namely FranceFootnote 2 and Germany.Footnote 3
We find that the CSDDD fundamentally changes the perspective of EU sustainability legislation, as it obliges in-scope entities not only to disclose adverse sustainability impacts, but to prevent these impacts. It does so by combining principles of the OECD Guidelines for Multinational Enterprises on Responsible Business with those of the UN Guiding Principles on Business and Human Rights, while relying on the private enforcement model of the French law with the public enforcement model of the German supply chain law from 2021. We show that the resulting legal text prompts questions about consistency and raises doubts as to whether combining all of the components of a private and a public enforcement model is adequate to counter violations of human rights and environmental standards in global supply chains effectively.
Part II. places the CSDDD in the context of existing approaches to sustainability-oriented law and regulation; Part III. discusses the CSDDD’s scope, Part IV. the due diligence duties, Part V. the duty to disclose a transition plan for climate change mitigation, and Part VI. the CSDDD’s enforcement and liability provisions. Part VII. concludes.
II. Supply chain regulation in the context of sustainability law
Simply put, sustainability is the logical consequence of considering environmental, social and governance aspects in business decisions.
1. “Double materiality”
Legal doctrines differ with respect to sustainability risks and adverse impacts on sustainability factors.Footnote 4
Sustainability risks relate to the internal dimensions of an enterprise, and how changes in environmental and social conditions impact on the given enterprise’s business activity, profitability, and risk exposures.Footnote 5 For instance, if the sea level rises due to climate change, production facilities close to the sea would require additional safeguards (eg, dams) and/or hedges (ie, bespoke insurance), or may need to be relocated altogether. All such measures come with costs and reduce an enterprise’s profitability. Under traditional corporate law, the board and management of a company must consider these sustainability risks as part of their shareholder-oriented fiduciary duties given that these steps would be indispensable to retaining the firm’s profitability and preventing it from damages.Footnote 6
By contrast, adverse sustainability impacts concern negative externalities and how the firm’s activities affect environmental and social conditions. Some examples of the questions that might be considered here are: (1) How do emissions of gas and liquids from a production site close to the sea impact on fish and maritime biodiversity? (2) Are the work and social conditions at a production site consistent with human rights law? (3) Do the firm’s activities advance or hinder the suppliers’ adherence to environmental and social standards including human rights?
The EU acquis distinguishes between sustainability risks and adverse sustainability impacts, yet abides by the concept of “double materiality”. Notably, both sustainability risks and adverse sustainability impacts are material to the sustainability-oriented transformation of the EU economy. However, the tools applied differ. As sustainability risks relate, eventually, to the firm’s profitability and risk resilience, and are thus a concern for shareholders and other investors, the primary tool of the EU acquis is disclosure (see, eg, the SFDRFootnote 7 and CSRDFootnote 8 ).
Externalities are regulated traditionally by public environmental and labour laws, and usually come with sanctions in the event of breaches. Besides, under some corporate laws, management has to consider the degree to which externalities relate directly to the firm’s business activity.Footnote 9 Such considerations may for instance include where environmental and social factors could impact on the firm’s reputation as a “good corporate citizen” or where they could affect demand for the firm’s goods and services (and thus the firm’s profitability). In these cases, management has to take externalities into account. Beyond these firm-internal effects, most corporate laws refrain from imposing any further obligation to consider externalities. In particular, management is not obliged to take into account whether the firm’s activity harms any third party. By contrary, in market-based competition, one firm’s upside is another’s downside. Accordingly, in this context, the firm’s management has not only the right but also a kind of duty to accept harm caused to third parties.
Hence, supply chain regulation sets sustainability-related limits of the firm’s freedom to compete.
2. Tools of sustainability regulation
Regulators can influence the use of public goods through a number of tools, ranging from doing nothing to the sanctioned prohibition of such use (cf. Figure 2).
Double materiality.
Regulatory options to impact on the use of public goods.
So far, the EU has used four tools to tackle supply chain issues. The first of these, international treaties and accords, protect, for instance, endangered species.Footnote 10 The downside of such tools include the reliance on enforcement in third countries. Essentially, some countries take international obligations more seriously than others, while different interpretations and enforcement entities enable regulatory arbitrage. In short, the success of international treaties is mixed.
Secondly, the EU has experimented for years with regulatory definition, reduction, and related market-based pricing of public goods, with emissions trading and emissions pricing being notable examples.Footnote 11 One of the main challenges consists of the effective management of relations with third countries to ensure a comprehensive emissions trading system. For instance, is it realistic to ask US producers for greenhouse gas (GHG) compensation when politicians at the same time ask for protection of the EU’s Eastern borders?
Third, the EU impacts on supply conditions indirectly through disclosure duties imposed by the CSRDFootnote 12 and Article 8 of the Taxonomy RegulationFootnote 13 and, when it comes to sustainability-labelled financial products, the SFDR as well.Footnote 14 One of the main difficulties here is that supply chain matters often prove immaterial in the overall context of the firm’s products and services. In turn, chances are that investors will focus on the most prominent production issues to a greater extent than on supply chain matters. However, given the respective disclosure obligations only recently entered into force, we lack sufficient data at this point to allow for a well-founded conclusion.Footnote 15
Finally, the EU can prohibit all enterprises within its jurisdiction to purchase or sell goods that do not meet certain environmental or social preconditions. Such prohibitions may relate, for instance, to weapon export controls, import and export bans concerning Iran, Russia and North Korea,Footnote 16 or the ban of goods and services created using forced labor.Footnote 17 Furthermore, EU Member States have adopted measures addressing human rights violations in certain countries,Footnote 18 including the French supply chain regulation (2017) and the German supply chain law (2021). These both function as role models for the CSDDD.
3. The tragedy of the time horizon
Externalities and the use of public goods rarely have an immediate impact on individuals in distant places, like consumers in the Global North. The pollution of water and air at production sites will be felt much later through an increase in the prevalence of disease, lower life expectancy, and reduced social productivity in countries closer to the sites (rather the Global South). Human rights violations may prompt feelings of unease when consumers in Europe and the US are confronted with certain reports, but the true costs and harm are seldomly internalised. The relative distance in terms of regional and time impact undermines the motivation to accept higher costs for goods and services today. Silently referencing Gerrit Hardin’s famous article on public goods (“the tragedy of the commons” Footnote 19 ), this feature of sustainability as a policy paradigm has been described aptly as the “tragedy of the time horizon”.Footnote 20
In turn, sustainability regulation aims to achieve congruence of time and place: consumers should feel the related negative sustainability impacts promptly at the place of consumption, so that they reduce, if not avoid, consumption immediately.
Whether the disclosure of negative sustainability impacts eventually results in the desirable time and regional congruence is the subject of intense debate among experts.Footnote 21 We can assume that disclosure is an effective tool where almost all institutional investors and financial institutions consider the most important negative externalities in their financing decisions. Moreover, we could also assume that some good progress has already been made towards this goal in light of the immense growthFootnote 22 of sustainable investments, related self-imposed commitments, and mandatory disclosures in prospectuses.
In this context, EU supply chain regulation takes the counter position. In particular, the CSDDD assumes actors are rational, self-interested, and focused on profit maximising with a limited time horizon. Relying on this premise, the overwhelming majority of investors would not consider distant negative environmental and social impacts in their investment decisions, as long as these impacts do not threaten the firm’s profitability.
III. Scope of the CSDDD
1. In-scope enterprises
The CSDDD’s scope relies on the EU Accounting Directive,Footnote 23 particularly regarding legal form, size criteria, and local nexus, with some differences in the details.
a. Legal form
The personal scope of application of the CSDDD is ambiguous. It extends to “companies”. Article 3(1)(a) CSDDD defines a company as “a legal person constituted as one of the legal forms listed in Annexes I and II” (emphasis added) of the EU Accounting Directive.Footnote 24 Annex I of the EU Accounting Directive lists corporate entities, whereas Annex II lists partnerships. Yet, not all of the entities listed in the two annexes (and especially Annex II) have legal personality under their respective national laws and may therefore be interpreted to be “legal persons”. Thus, the scope of application of the CSDDD is larger than the scope of application of its cross-referenced legal act, the EU Accounting Directive, which is limited to undertakings that are or represent “legal persons”.Footnote 25 We wonder why the CSDDD did not directly copy the (complex) wording of Art. 1(1) of the EU Accounting Directive, but chose a divergent wording and an unclear reference to Annexes I and II of the EU Accounting Directive. It is reasonable to ask whether the scope of the CSDDD is really intended to go beyond what is covered by the EU Accounting Directive, as the referencing to the EU Accounting Directive in other provisions of the CSDDD rather advocates an alignment of the application of the two legal acts.Footnote 26
Hence, it could potentially be argued that “legal person” in Article 3(1)(a) CSDDD shall not be read in its technical sense meaning the attribution of legal personality to the entity. This would put emphasis on the reference to Annexes I and II of the EU Accounting Directive, thereby providing for a broader scope of application of the CSDDD compared to the EU Accounting Directive. Yet, if this was intended, EU law generally uses the term “undertaking” or “enterprise”. None of these terms has been deployed by Article 3(1)(a) CSDDD. Thus, it is reasonable to attribute some relevance to the mention of “legal person” in this provision. Due to a lack of harmonisation of legal forms and their attribution of legal personality throughout Member States, the decision on the personal scope of application of the CSDDD is to be determined by virtue of the Member States’ implementation of the CSDDD.Footnote 27 Such a reading would result in regulatory arbitrage, which is certainly not desirable for a harmonizing EU legal act, also with regard to Article 3(1)(a)(ii) CSDDD providing for the CSDDD’s application to third country “legal person[s] constituted […] in a form comparable to those listed in Annexes I and II to Directive 2013/34/EU”. In that case, the scope of application of the CSDDD to third country companies would be different from one Member State to another.
We plead in favor of an aligned scope of application of the CSDDD and the EU Accounting Directive, as the reference to the disclosure obligations on the climate transition plan pursuant to Article 22 CSDDD (infra, at V.) is also adapted to the EU Accounting Directive. In turn, the CSDDD extends to those companies only that are obliged to publish, or make available respectively,Footnote 28 the annual financial statements and the management report subject to Article 30 of the EU Accounting Directive, including partnership types where not at least one partner with unlimited liability is a natural person. With regard to third-country firms these provisions apply mutatis mutandis. For instance, the CSDDD applies to the Delaware Stock Corporations or English limited companiesFootnote 29 active in the EU. In a similar vein, the CSDDD applies to groups of entities obliged to publish consolidated financial accounts under EU accounting law.Footnote 30
In contrast to the CSDDD, the German Supply Chain Law applies to all enterprises irrespective of their corporate form (s. 1(1) German Supply Chain Law); while the French supply chain legislation applies only to stock corporations (sociétés anonymes)Footnote 31 . Here, we question whether the CSDDD’s mirroring of EU accounting law is wise. EU accounting law refrains, for instance, from requiring disclosure of financial statements by simple partnerships and sole traders; the prevailing view in the literature is that the partners and sole trader’s personal and unlimited liability substitutes for the disclosure of financial statements.Footnote 32 We cannot fathom, however, why violations of human rights and fundamental environmental standards should prompt liability and penalties in the case of legal persons, while the same conduct does not prompt the same consequences for simple partnerships and sole traders. This becomes particularly stark where the CSDDD refrains from requiring the disclosure of financial statements for very large partnerships and sole traders (which is required, for instance, by German accounting lawFootnote 33 ).
b. Size criteria
The CSDDD’s size criteria for in-scope companies has also been keenly debated.Footnote 34 Of note, the CSDDD applies to all companies and groups of companies with at least 1,000 employees (on an FTE basis)Footnote 35 and a worldwide turnover of at least EUR 450 million. In addition, the CSDDD introduces a bespoke threshold for licensing income and franchise models (for example, McDonalds) of EUR 22.5 million in conjunction with a minimum turnover of EUR 85 million.Footnote 36 Both employee and turnover thresholds apply cumulatively: if only one of the thresholds is surpassed, the CSDDD does not apply.
For groups of companies, the CSDDD requires that the thresholds are surpassed by all companies in the group on a consolidated basis.Footnote 37 The figures of all group subsidiaries are attributed to the ultimate parent company (UPC) at the helm of the corporate group.
These thresholds were fervently debated within the Council of the EU. Generally, the European Commission and France pressed for alignment with the thresholds of the EU Accounting Directive, requiring issuance and disclosure of financial statements, in principle, from firms with 250 employees or more, while Germany insisted on the higher thresholds stipulated in the German Supply Chain Law,Footnote 38 starting at 1,000 employees. In the end, neither position was adopted. While the CSDDD’s threshold of 1,000 employees seems to indicate an orientation towards the German supply chain legislation, the German law requires 1,000 employees in Germany, but the CSDDD threshold applies to EU firms with 1,000 employees worldwide or, for third-country firms, 1,000 employees in the EU.
Similar to the German Supply Chain Law,Footnote 39 the CSDDD borrows from the OECD MNE Guidelines. By virtue of the CSDDD’s implementation, these guidelines become binding law in EU Member States.Footnote 40 While this mirroring of the OECD MNE Guidelines reduces the costs for very large multinational group of enterprises by harmonizing requirements across the globe, we note that multinational enterprises (MNEs) so far have been understood to include very large internationally active conglomerates.Footnote 41 This is most obvious in the French supply chain legislation which applies only to stock corporations with (including their subsidiaries) 5,000 employees in France or 10,000 employees worldwide.Footnote 42 Compared to this, the CSDDD’s scope is expansive and also covers enterprises like family firms, of which few had qualified as an MNE prior to the CSDDD.
The CSDDD also grants the right to EU Member States to set lower thresholds. For instance, Germany could refrain from considering turnover at all as part of the threshold, yet it is bound by the CSDDD to let the CSDDD duties apply where the 1,000 employee threshold is reached on a worldwide basis. As a consequence, many more companies are in the CSDDD’s scope compared to what the German and French supply chain legislation covers to date.
c. EU Nexus
Thirdly, the CSDDD requires an EU nexus. In particular, firms registered in an EU/EEA Member State are always subject to the CSDDD if they pass the size thresholds, calculated on a worldwide basis. Third-country firms and groups are subject to the CSDDD where they surpass the respective thresholds in the EU.Footnote 43
In particular, third-country firms must reach in the EU alone the EUR 450 million turnover threshold. In turn, third-country firms and groups must, in relative terms, be much larger than EU companies and groups that are subject to the CSDDD. Groups and firms surpassing the threshold in the EU could thus feel incentivized to transfer employees and turnover to third countries. This furthers regulatory arbitrage and is detrimental to the attractiveness of the EU as a business place.
d. Supervision
Supervisory powers are vested in the national competent authorities (NCAs) in the country in which the company is registered.Footnote 44 For third-country firms, the location of their branch determines the jurisdiction. Where the firm has neither a registered seat nor a branch in the EU, jurisdiction is vested in the country in which the firm has the largest turnover.Footnote 45
Third-country firms have to appoint an authorised representative for all legally relevant actions and declarations within the EU/EEA.Footnote 46 This place determines supervisory competence of the relevant NCA.Footnote 47 In the absence of an authorised representative, all NCAs in the EU/EEA are entitled to take action with a view to enforcing the obligation to appoint an authorised representative against the third-country firm.Footnote 48
2. In-scope activities
The activity-related scope of the CSDDD is derived from the term “chain activities”.Footnote 49 In principle, the CSDDD covers the firm’s “upstream” and “downstream” business including the activities of “business partners”. We find it difficult to define the boundaries distinguishing these terms.
a. Upstream and downstream
The CSDDD defines an upstream business as “the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of the products and the development of the product or the service”.Footnote 50 Meanwhile, a downstream business is classified as “a product […], where the business partners carry out those activities for the company or on behalf of the company”.Footnote 51
b. Business partner
For the concept of “chain activities”, the term “business partner” is pivotal. A direct business partner is an entity “with which the company has a commercial agreement related to the operations, products or services of the company or to which the company provides services pursuant to” the chain activities.Footnote 52 By contrast, an indirect business partner is an entity that, while not being a direct business partner “performs business operations related to the operations, products or services of the company”.Footnote 53 Similar definitions exist in the German supply chain law.Footnote 54
This definition of indirect business partners is very wide indeed. The CSDDD does not require that the indirect business partner be aware of their status as an indirect business partner. All firms that are, in the broadest sense, indirectly linked to the in-scope company on the second, third and any other layer of supply chain are covered by the term. However, note that the CSDDD does not set a materiality threshold. In turn, indirect suppliers of very small parts and with a very low economic share in the final product (for instance, screws in a lorry) are also included as indirect suppliers. While that potentially covers all indirect negative impacts, this very wide definition at the same time prompts the need to prioritise among an endless number of indirect business partners – a need which is now acknowledged in the final version of the CSDDD (infra, at IV.4.).
3. Corporate groups
The CSDDD foresees bespoke arrangements for groups of companies, industry cooperations, financial institutions, and firms subject to export controls.Footnote 55 We focus herein on privileges granted to corporate groups.
a. Delegation to group entities
In principle, all in-scope companies that form part of a group of companies are subject to the CSDDD and must comply with its duties. However, the CSDDD allows the concentration of compliance of all duties of all group companies within one group entity. Here, the CSDDD offers three options.
Firstly, as the default option, the ultimate parent company must ensure that all duties of all subsidiaries are taken care of and is liable in the event of non-compliance.Footnote 56 The Recitals stress this responsibility for all subsidiaries that are not directly in scope because of their legal form, size or place of establishment being in a third country.Footnote 57
Secondly, non-operational, holding companiesFootnote 58 or group entities that do not qualify as in-scope due to a lack of company status may delegate their duties to an operational subsidiary.Footnote 59 The NCA governing the delegating firm must approve the delegation.Footnote 60
Thirdly, all group companies can bundle their resources and comply with the CSDDD jointly.Footnote 61 In contrast to entity compliance, group compliance includes the allocation of various parts of the overall compliance task across several group entities, while all these tasks taking place at one group entity count jointly for all entities forming part of the group. This also implies that in the event of breaches, a breach in one group function will be seen as a breach committed by all other group entities, and that breach potentially results in all other group entities being held accountable and possibly liable.
From a doctrinal perspective, it is noteworthy that the treatment of corporate groups deviates from the concept of “legal entity” otherwise used in the CSDDD. For that reason, the CSDDD clarifies that the duties and liability of all in-scope companies remain in force as if they were separate rather than group companies.Footnote 62 Group-wide compliance is enhanced through a number of practical obligations, eg, to exchange information or the integration of the group-wide risk management systems.Footnote 63
b. Cooperation with third parties
The CSDDD permits explicitly cooperations with non-group entities.Footnote 64 Here, we see particular potential for industry cooperations where several clients of a supplier cooperate in the due diligence of the supplier, subject to the boundaries set by EU competition law (for details, see infra, at IV.7.).
IV. Due diligence duties of the CSDDD
The core part of the CSDDD is the risk-based human rights and environmental due diligence (HRE DD).
1. Due diligence duty as part of risk management
If, by way of due diligence, the in-scope company identifies a threat to certain rights and goods identified in the CSDDD’s Annex I, it is mandated to adopt prevention and remediation measures. The HRE DD is an expansion of the concept of the human rights due diligence taken from the UN Guiding Principles on Business and Human RightsFootnote 65 .
Figure 3 categorises the various detailed CSDDD provisions on the HRE DD in six broad procedural steps, which we then discuss in turn.
Due diligence duties of the CSDDD.
2. Integration of the HRE DD in risk management systems
A traditional risk management system focuses on the risks that, if realised, impact on the rentability, profitability, and resilience of the company as reflected in the company’s assets, financials and earnings (ie, so-called internalised risks).Footnote 66 Human rights violations, environmental damages and other externalities are integrated in these systems only to the extent that they can lead to costly penalties and sanctions, or reputational damage. The CSDDD touches upon these externalities.Footnote 67 It requires the integration of human rights and environmental factors in the risk management systems of in-scope companies as a primary risk that must be mitigated. Furthermore, Articles 5(1) and 6(1) CSDDD require that companies adopt and regularly update an HRE-oriented due diligence policy.
Risk management systems introduce stronger or more generous review standards, applying a risk-based assessment: the greater the risk, the more intense the review and the prevention measures to be applied. The CSDDD adopts this concept.Footnote 68 A company is not obliged to take all (potential) human rights violations and environmental impacts into account. This would be impossible given the sprawling chain of potential risks that follows from the wide definition of “chain activities”. Instead, the CSDDD requires focusing on those aspects of a firm’s activities where the probability of harm to the protected goods is the highest.
Taking inspiration from the French plan de vigilance, Footnote 69 firms must adopt a due diligence policy.Footnote 70 In the German Supply Chain Law, the same meaning is encompassed by the term risk management system.Footnote 71
The due diligence policy must be developed in cooperation with employee representatives, reflect a long-term perspective, and provide a binding code of conduct with principles applying to the whole group of companies, the business partners, as well as the enforcement and monitoring measures for said code of conduct.Footnote 72 It must include duties to document processes and store related data for at least five years, which can be prolonged in the event of any related judicial procedure.Footnote 73 The due diligence policy must be updated at least every two years.Footnote 74 Limits of the HRE DD are accepted with regard to the well-justified confidentiality interests of the business partners;Footnote 75 these confidentiality interests, however, must not prevent the information about the identity of the other (then indirect) business partners.
3. Information management
The quality of any risk management system depends on diligent ex ante information and data gathering. The CSDDD’s measures together result in a comprehensive information and data management system (cf. Figure 4).Footnote 76
CSDDD information and data management.
Entities complying with these information and data management requirements will be in a position where potential adverse sustainability impacts and remediation measures are widely discussed in public; contrary to the current German Supply Chain Law,Footnote 77 a firm-internal procedure will not be sufficient.
The information and data management duties suggest that the EU legislator understands enterprises as focal points of public interest, which have to engage on an ongoing basis with those affected by their activities, their representatives, as well as persons claiming to represent civil society, and which shall take their concerns seriously. This stands in line with the perspective of the OECD’s MNE Guidelines.Footnote 78 Again, it is important to bear in mind that the CSDDD will apply to EU companies and groups of companies with at least 1,000 employees worldwide, which is a comparatively low threshold. The CSDDD’s approach, though well founded for true MNEs, is doubtful when it comes to smaller in-scope firms. We understand this disparity within the CSDDD as (further) evidence that reliance on legal transplants often comes with inconsistencies.Footnote 79
a. Stakeholder engagement (Art. 13)
In the due diligence process, in-scope companies are obliged to effectively (and extensively!) engage with various stakeholders,Footnote 80 eg, when gathering the necessary information on actual or potential adverse impacts or when developing the prevention action and corrective action plans.Footnote 81
In all such cases, the company shall provide the stakeholders with relevant and comprehensive information, and additional information upon request. In addition, if “the company refuses a request for additional information, the consulted stakeholders shall be entitled to written justification for that refusal“.Footnote 82 Moreover, the company shall protect participants in these consultations from retaliation, for instance by ensuring confidentiality.Footnote 83
If the company cannot ensure effective stakeholder engagement in this way, it has to gather additional insights by consulting with external experts who “can provide credible insights into actual or potential adverse impacts”.Footnote 84
The CSDDD allows for stakeholder engagement by way of industry or multi-stakeholder initiatives, as long as these do not concern matters regarding their own employees (these matters must be dealt with along the lines defined by the EU acquis on labour law).Footnote 85
b. Complaints and notification channel (Art. 14)
Implementing Nos 29, 31 of the UN Principles on Business and Human Rights,Footnote 86 in-scope companies must offer channels for anonymous information and official complaints concerning actual or potential adverse impacts along the supply chain.Footnote 87 In particular, the detailed implementing requirements are burdensome, when compared, for instance, to s. 8 of the German Supply Chain Law: the information channels are designed for whistleblowers, while a complaints mechanism should be available to anyone (potentially) affected by the business activity as well as “the legitimate representatives of such persons on behalf of them, such as civil society organisations and human rights defenders”.Footnote 88 Other users include “trade unions and other workers’ representatives representing natural persons working in the chain of activities concerned” and civil society organisations “active and experienced in related areas where an adverse environmental impact is the subject matter of the complaint”.Footnote 89 While the CSDDD does not mention legal representation, attorneys are entitled qua officio.
Companies must ensure a number of procedural and qualitative requirements borrowed from judicial procedures, in terms of fairness, transparency, accessibility, predictability and confidentiality. Following a reasoned complaint, the company must set the CSDDD’s HRE DD duties in motion,Footnote 90 ie, either prevent, end, or remediate the adverse impact.
The company is further obliged to follow up appropriately on the complaint.Footnote 91 Companies can organise their complaints channel through industry and multi-stakeholder initiatives or global framework agreements.Footnote 92 Previously received information or a complaint submitted to the company is not a precondition for any legal measure brought against the company by individuals or their representatives.Footnote 93 However, the CSDDD does not prevent EU/EEA Member States from introducing a public pre-procedure as a precondition for legal recourse, such as an HRE Ombudsman.
c. Monitoring (Art. 15) and reporting (Art. 16)
Companies must review all due diligence measures with regard to their own activity as well as that of their subsidiaries and business partners at least annually, and whenever justified.Footnote 94
In-scope third-country firms must report annually on their websites on the HRE matters listed in Annex I CSDDD, in compliance with the details specified by the implementing legislation.Footnote 95 Since EU companies must report essentially on the same matters under the CSRD, they are not subject to the CSDDD’s website reporting requirement.Footnote 96
d. European single access point (Art. 17)
Companies must forward all documents and disclosures under the CSDDD to the European Single Access Point (ESAP). For EU companies, this requirement is not new,Footnote 97 however it is for third-country firms.
4. Identification, assessment, and prioritization of adverse sustainability impacts
The information and data management requirements are aimed at the diligent identification, assessment, and prioritisation of potential and acute adverse sustainability impacts.Footnote 98 In-scope companies must:
-
map their own operations as well as those of their subsidiaries and business partners in relation to the company’s chain of activities; and
-
carry out an in-depth assessment of these operations in the areas where adverse impacts were identified as most likely to occur and be most severe.
The identification and assessment shall consider independent reports as well as anonymous information and complaints received, and shall screen business partners on a risk-adjusted basis.Footnote 99 Where it is impossible to prevent, end, or mitigate all adverse sustainability impacts, the company must prioritise its measures along the probability/severity axis.Footnote 100 The CSDDD, however, refrains from providing additional guidance on how to reconcile competing goods where conflicts among them occur.
Yet, implementing such prioritisation is far from simple. Think of cobalt, an important ingredient for batteries produced in very few countries, all with dismal human rights records. In this regard, is the body and indeed the life of an employee (which is under threat in some production countries in Africa, albeit with a low probability) a greater good than personal freedom and the right to demonstrate (which is virtually non-existent in some production countries in Asia)? The CSDDD does not solve this conflict; it follows the example of the French and German supply chain laws as well as the procedural approach of the OECD MNE GuidelinesFootnote 101 : companies are required to ensure due procedures, be aware of these conflicts, and define a solution thereto, seeking out a reasoned compromise along the probability/severity axis to which the company commits by way of disclosure. Where these procedures are applied diligently, the effective result is of secondary importance. This constitutes an obligation of means, rather than result, which is the CSDDD’s guiding motive as we will show in the next section.
5. Options: prevention, correction and remediation
The identification, assessment, and prioritisation of potential and acute adverse effects triggers one of three obligations: prevention of potential adverse impacts,Footnote 102 ending actual adverse impacts (if possible),Footnote 103 and initiating remediation and compensation measures (if necessary).Footnote 104
If a negative impact is likely to occur or already has occurred, the company is obliged to take appropriate measures to prevent or terminate it. This duty is procedural in nature (ie, an obligation of means)Footnote 105 rather than an obligation of result. The same applies in principle under the GermanFootnote 106 and the French supply chain laws.Footnote 107
In each case, the CSDDD requires a distinction between avoidable and unavoidable effects. Avoidable and terminable negative effects must be avoided or ended to the greatest extent possible; otherwise, the effects must at least be adequately mitigated.Footnote 108 What is required in detail depends on the given circumstances.Footnote 109
When determining the required action, causation must be taken into account. Stricter standards apply to active actions performed by the in-scope entity, compared to omissions and effects arising from (indirect) business partners.Footnote 110 Even if the wording only suggests this,Footnote 111 the core criterion for determining the necessary prevention measures is the potential influence of the company on the continuation of the negative impact.
a. Measures on the first layer
The greatest potential to improve the HRE situation exists at the level of in-scope companies and their direct business partners. This is where the focus of the Directive lies (which is in this regard similar to the German Supply Chain LawFootnote 112 ). It presents a non-exhaustive catalog of measuresFootnote 113 to be implemented on the first layer for cases in which preventing or ending the adverse impact appear possible. These steps take priority over remediation and compensation (see infra, at IV.5.e. and VI.2.).
i. Prevention action and corrective action plans
The first resort is a so-called “prevention action plan” or a “corrective action plan” for own and chain activities with reasonable implementation schedules and success measurements.Footnote 114 That instrument, borrowed from French law,Footnote 115 can be conceptualised as an industry or multi-stakeholder initiative.
ii. Support of suppliers
Targeted, appropriate support for SME business partners (eg, through capacity building, training, or improvement of management), and, where economically necessary, direct and indirect financial support to comply with the code of conduct and the prevention action and corrective action plans are further options to consider here.Footnote 116
iii. Contractual arrangements
The CSDDD also mentions contractual assurances from direct business partners to implement the code of conduct and, if applicable, the prevention action and corrective action plans, which may be accompanied by corresponding assurances from indirect business partners.Footnote 117
Every contractual assurance should be accompanied by measures to monitor compliance with said provisions. As a tool, the CSDDD refers (not exhaustively) to verifications by independent third parties (eg, industry or multi-stakeholder initiatives).Footnote 118 Fair, appropriate and non-discriminatory contractual conditions and (financial) support shall be granted to SMEs of the value chain by in-scope companies.Footnote 119
iv. Investments, business and strategy change
In-scope companies should also consider additional expenditures and investments in technological advancements and other types of business aimed at reducing negative impacts as well as changes in strategy, along with overhauling supply and distribution practices and product design.Footnote 120
A practical issue will arise here regarding the degree to which the obligation to adapt one’s own activities extends. This is particularly true in relation to the very strict conditions of the CSDDD for terminating business relationships (see IV.5.d.).Footnote 121
v. Enhancement of own influence
Furthermore, the CSDDD mentions cooperation with other companies and organisations (within the limits set by competition law) as a means to increase the in-scope company’s influence on HRE matters.Footnote 122 Reducing or avoiding externalities usually increases the supplier’s costs. As long as other customers of the supplier also benefit from the reduction of adverse HRE impacts and all customers subject to the CSDDD share these costs, on an equal footing, competition law is less likely to be breached. In this regard, exclusive contracts may pose problems.
b. Measures in other cases, in particular contractual arrangements
If effective prevention, mitigation or termination is unlikely at the first level (ie, for cases in which the HRE impacts have their origins at the second, third, to nth level), the company can seek contractual assurances from indirect business partners.Footnote 123 The provisions under IV.5.a.iii. apply mutatis mutandis.
c. Contractual termination rights
In order to make the catalog of measures more effective, the CSDDD asks Member States to foresee termination rights in their contract law in cases where adverse HRE effects have been identified during the contract’s duration.Footnote 124 Statutory termination rights in the laws of Member States, however, have limited effects due to the free choice of law in commercial transactions.Footnote 125 Hence, for the contractual structure between companies and direct business partners in accordance with Articles 10(2)(b) and 11(3)(c) CSDDD, the EU Commission should develop “voluntary” model clauses.Footnote 126
d. Contract ban as a last resort
In addition to termination, a contract ban represents the most extreme form of interference with the freedom to contract. Following the example of the German Supply Chain Law, which establishes a contract ban as a last resort,Footnote 127 the CSDDD prohibits the entering into of new contracts or the extension of existing contracts if the prevention action and termination action plan measures previously described have not been successful. However, in contrast to German supply chain law, the CSDDD involves the supervisory authority in the continuation of the business relationship.Footnote 128
In-scope companies must inform the authority of the reasons for continuing the given business activities despite their negative HRE impacts, and details of the unsuccessful prevention measures and steps taken to end the HRE impacts. Upon receiving the relevant authority’s approval, in-scope companies must continuously monitor and review whether the reasons provided for continuation still exist.
For the remaining measures, the CSDDD is meticulous in its detail.
First, companies must develop enhanced prevention action and corrective action plans for this specific impact. The temporary interruption of the business relationship should be used as a means of exerting pressure, provided there are reasonable prospects that this measure will be successful. The temporary interruption should be accompanied by an open search for alternative business partners.Footnote 129 In a single supplier situation and if the measures prove unsuccessful (for example, because the political situation is unchangeable, or if the expanded plan fails to achieve its goal), the business relationship must be terminated in cases of severe negative HRE impacts.Footnote 130
Before doing so, however, a prognostic decision is warranted as to whether discontinuation would have a more serious impact than continuation despite the severe adverse impact in a specific case where the impact is addressed by the enhanced prevention action and corrective action plans.Footnote 131 The CSDDD explicitly requires a balancing decision; this is merely implicitly required by the German Supply Chain Law.Footnote 132 In our opinion, to strike the appropriate balance, the violation of a specific HRE good that cannot be remedied must be compared to possible further violations of the HRE good likely to materialise from the termination of the business relationship. This also includes, for example, recognising that HRE factors will continue to be impaired even if this results from a business relationship established with companies not subject to the CSDDD.
Take the example of cobalt and copper mining that is reported to take place under socially and ecologically unacceptable conditions.Footnote 133 These would probably persist even if only companies from China or Russia were to source cobalt and copper from these countries in the future. Business termination by in-scope companies would have no impact on the affected HRE goods. A careful adjustment according to the premise of “change through trade” would be more beneficial for the HRE good concerned. If this was indeed applied, the company would have to weigh up whether negatively contributing to climate change by abandoning electric cars with cobalt batteries is acceptable. Then, the cynical question that would arise is how much human life, slavery, and environmental pollution is acceptable in return for mitigating climate change in the EU economy. The CSDDD does not resolve this conundrum.
If the interest in the acceleration of such a transformation of the economy justifies continuation, the company remains committed to prevention, termination, remediation and compensation. Meanwhile, continuation, if applied, would mean (1) carefully influencing (direct or indirect) business partners in the cobalt producing countries (eg, via model projects or training courses) and (2) investing in alternatives to cobalt-based batteries, for example by promoting sodium-ion and LFP batteries.Footnote 134
e. Remediation and compensation (Art. 12)
If negative impact is identified, the company that contributed to the impact must take steps towards remediation or compensation.Footnote 135 Meanwhile, if the adverse impact was caused exclusively by business partners, there is the option of voluntary remediation or compensation provided by the in-scope company. Alternatively, business partners can be persuaded to ensure that they provide remediation or compensation.Footnote 136
The CSDDD goes beyond what the German Supply Chain Law requires, which merely mandates terminating the adverse impact and does not foresee remediation and compensation.Footnote 137 Obligations equivalent to compensation are inconsistent with the German public enforcement model. These, in turn, are borrowed from the civil law enforcement of the French supply chain legislation (V.2. below).
At first sight, it would appear that remediation and compensation come on top of liability for breach of the prevention and termination obligations because the liability provision in Art. 29 CSDDD does not refer to Article 12 CSDDD. One may wonder whether remediation and compensation can only be enforced by NCAs pursuant to Articles 25(4) and (5)(a)(iii) CSDDD. However, Article 11(3)(h) CSDDD lists remediation and compensation as a mode of termination, meaning that they are to be understood as part of the termination. In turn, respective claims for remediation and compensation are privately enforced according to Article 29 CSDDD. A possible omission of Article 12 CSDDD in Articles 25 and 29 CSDDD can be explained by the fact that Article 12 CSDDD was moved to a separate provision in the course of the Council negotiations. In short, the CSDDD does not stop at requiring such prevention and termination; it fully opens up private and public enforcement of the duty to remediate and compensate. This is, from the perspective of many legal systems, a drastic change.
6. Included standards
The HRE due diligence is limited to a list of international conventions for the protection of the environment and human rights explicitly mentioned in Annex I CSDDD, dealing with (1) rights and prohibitions from international human rights conventions; (2) human and fundamental rights instruments; and (3) obligations and prohibitions from environmental conventions.
Some of these are especially precise, showing the authors’ obvious inclination for detail. For instance, besides referring to Article 6(1) of the UN Civil Covenant,Footnote 138 the right to life explicitly includes “private or public security guards protecting the company’s resources […] causing the death of a person due to a lack of instruction or control by the company”. Apparently, the EU legislator seeks to react to known incidents and anticipate objections and evasive strategies. Yet, given the level of precision, one may reasonably wonder about the practical application to international supply chains and thereby the effective outreach of the CSDDD’s objectives.
7. Delegation to group entities and third parties
In pursuit of cost-efficient implementation by bundling tasks, the CSDDD enables the delegation of some obligations to group companies and third parties.Footnote 139 Such delegation does not release the in-scope company from liability.Footnote 140 Instead, following the example of the EU financial law acquis, the duty to respect the obligations under Articles 7 and 8 CSDDD remains.
These rules represent a compromise between cost efficiency and quality assurance. The regulation limits the selection of delegates to companies belonging to the group of companies and qualified third parties. The European Commission should specify the high requirements through guidelines on the competence (“fitness”) of these delegates as well as a methodology for testing competence and constant monitoring of the accuracy, effectiveness, and integrity of third-party verification.Footnote 141 These extensive regulations are to be understood as a measure that seeks to address the scholarly criticism relating to sustainability ratings.Footnote 142
These delegates subject to bespoke conditions laid down in the CSDDD may be other firms (which may also be part of the supply chain) or industry/multi-stakeholder initiatives that can demonstrate experience and competence in HRE matters, and are responsible for the quality and reliability of the information they provide.Footnote 143
V. Transition plan for climate change mitigation
In addition to the due diligence obligations, in-scope companies must draw up a transition plan for climate change mitigation.Footnote 144 This plan contains, in a nutshell, the information mentioned in Articles 19a(2)(a)(iii), 29a(2)(a)(iii) and 40a of the EU Accounting Directive, as amended by the CSRD. The transition plan must provide for time-bound climate targets for the year 2030 and targets divided into five-year stages up to 2050. Moreover, it must be based on scientific evidence and provide for absolute emission reduction targets for certain GHG categories. This includes decarbonisation levers identified, actions taken to reach the climate targets with potential adaptation of the range of products and services offered by the company, and the use of new technologies. Furthermore, information is required on investments and funding in support of the implementation of the transition plan as well as on the role of the administrative, management, and supervisory bodies of the company regarding the transition plan. It must be updated annually and include a description of the progress the company has made towards the plan’s objectives.Footnote 145
The CSDDD fundamentally changes the nature of the transition plan. Under the CSRD, companies with at least 250 employees and a turnover of at least EUR 50 millionFootnote 146 are required to report on the manner (including implementing measures and related financial plans) in which the company intends to ensure that its business model and strategy are consistent with the transition to a sustainable economy and limiting the increase of global warming to 1.5°C in line with the 2015 Paris Agreement. This “transition plan for climate change mitigation” shall also address, where applicable, the company’s exposure to activities related to coal, oil and gas.Footnote 147
The CSDDD implements this wording literally, but establishes an obligation to “adopt and put into effect a transition plan” (emphasis added).Footnote 148 This reinforces the picture provided by the CSDDD’s HRE risk management system, signaling a shift from disclosure to the prevention of adverse sustainability impacts.
VI. Enforcement and liability
Key provisions of the CSDDD include its extensive enforcement provisions. In fact, the CSDDD mandates the coexistence of a private law enforcement concept based on French law and a public law enforcement concept modelled on the German supply chain law.
1. Public enforcement
Member States must ensure that any person can submit substantiated concerns to the NCA indicating, based on objective circumstances, that a company is in breach of its CSDDD obligations.Footnote 149 This opens up the state enforcement mechanism called for in No. 27 of the UN Principles on Business and Human Rights in addition to the internal company complaint mechanism. Of note, the German supply chain legislation had forgone this.Footnote 150
The framework of the CSDDD provides for protection of the complainant’s identity on request, and obligations for NCAs to effectively react on the substantiated concerns received.Footnote 151 Interestingly, NCAs are not only obliged to react vis-à-vis of the complainant, but also towards persons with legitimate interests in the matter about the decision.Footnote 152 These persons must have access to judicial review just like the complainant.Footnote 153
The CSDDD provides for an extensive catalog of penalties, as is well known from other legal acts of financial market law.Footnote 154 The starting point is a penalty of up to 5 per cent of the global group turnover, combined with a “name and shame” publication of the concrete legal infringement and the sanction. For the actual calculation of the penalty, aggravating and mitigating circumstances must be taken into account.Footnote 155 Yet, non-compliance with the CSDDD may entail exclusion from public procurement and financial support for the company in the event of a breach of the provisions of the CSDDD.Footnote 156
Compliance with the CSDDD, based on exchange of information, is to be coordinated across Europe via the European Network of Supervisory Authorities (ENSA).Footnote 157 Penalties imposed and third-country companies subject to the CSDDD are also published by the ENSA.Footnote 158
Whistleblower protection under European law also extends to reports of breaches under the CSDDD.Footnote 159
2. Private enforcement and liability
The CSDDD introduces a private liability claim against the in-scope company where a natural or legal person suffers damages as a result of inadequate prevention and termination. This liability for breach of due diligence obligations must be distinguished from general tortious liability.
From the perspective of the German Supply Chain Law,Footnote 160 the civil liability opened up by the CSDDD and borrowedFootnote 161 from French law is new. Objections in the Council negotiations stressing the risk of excessive liability were countered with a reference to French legislation that had led to only a handful proceedings since 2017.Footnote 162 Of course, that comparison is ill-founded from the outset: French supply chain legislation applies to stock corporations with at least 5,000 employees in France or groups headquartered in France with at least 10,000 employees worldwide. Very few French companies meet these requirements. The scope of the CSDDD, starting at 1,000 employees in the EU and covering all companies,Footnote 163 is significantly larger.
a. Applicable law, standing to sue
For CSDDD civil actions, the law in a Member State is to be applicable even if the applicable law is determined by statute or contract as the law of a third country.Footnote 164 Conflict-of-law provisions cannot therefore undermine the effect of the CSDDD. This is coherent in light of (a) the most likely locations of HRE infringements in third countries, and (b) the desired deterrent effects of the CSDDD across the EU.
The legal standing for lawsuits is defined broadly and includes as legal representatives nationally registered trade unions, NGOs, and human rights institutions.Footnote 165 Permissible conditions for admission here include a presence in the Member State, a ban on commercial activity (seeking to prevent a “litigation industry”), and the certain continuity of doing business in that Member State.
b. Precondition of liability
The CSDDD’s liability conditions include (1) a breach of duty, (2) a third-party protective effect of the impaired HRE standard listed in Annex I, (3) damage, (4) causality that establishes and fills in liability, and (5) the absence of an exclusion of liability and non-applicability of statutory limitations.
i. Breaches of CSDDD duties
The in-scope company must have intentionally or negligently violated its obligations to prevent or terminate (including remediation and compensation, IV.5.e. supra) under Articles 7 and 8 CSDDD.
The CSDDD obligations are obligations of means, rather than obligations of results. In turn, the occurrence of an HRE violation in the supply chain alone does not result in the in-scope company’s liability. Examples that do trigger the company’s liability include: (1) refraining from establishing and implementing a prevention action plan despite knowledge of particular risk factors; and (2) disregard of substantiated facts on HRE violations which the information management system has provided, whereby the company refrains from drafting and executing a corrective action plan or remediation measures.
ii. Third-party effects of HRE standard violation
The violated HRE standard must aim at protecting third parties.Footnote 166 We have little doubt that the objective of protecting third-parties will be a focus point of CSDDD litigation; the stipulations of the Annex may provide guidance in this regard.
iii. Causality and damage
The infringement of the CSDDD must have caused damage to the person. Since an infringement may only relate to rules and standards specified in Annex I, we hold that there must be a causal connection between the damage and the violation of Annex I rules. If, for example, there is a violation of prevention obligations with regard to environmental standards, damages suffered by claimants due to human rights violations (e.g. deprivation of liberty) would not be sufficient for a successful claim.
The CSDDD requires “full compensation”. The exact meaning of this is to be determined by the law of the Member States implementing the CSDDD. To avoid the creation of adverse incentives, the CSDDD prohibits overcompensation.Footnote 167 Yet, definitions of “damage” differ widely across Member States.Footnote 168
iv Preclusion of liability and statute of limitations
The liability of the in-scope company is excluded if the impairment of legal interests was caused exclusively by one of its business partners.Footnote 169 This should apply even if the in-scope company has refrained from any preventive and termination measures. However, we expect courts to see a total refusal to undertake any preventive measures as a contributory cause to the HRE violation, while a lack of terminating measures could be understood as intensifying an existing HRE impact. In both cases, courts will be tempted to find some co-causality of in-scope companies.
Under the CSDDD, a claim expires within five years unless national law provides for longer statutory limitation periods.Footnote 170
c. Costs and discovery
The CSDDD aims to ensure that cost barriers do not prevent liability litigation.Footnote 171 Further, it prescribes a kind of discovery procedure if the claim is well founded: if the facts support the claim, and there are indications that there is further evidence in the company’s sphere of control,Footnote 172 the court may order the company to disclose more facts, within certain limits.
d. Liability within corporate groups
The claim against the in-scope company does not exempt other group companies and their business partners from civil liability.Footnote 173 Indeed, the former may be liable jointly. At the same time, a CSDDD claim does not protect against liability of the companies under EU or Member State law for human rights or environmental violations.Footnote 174
VII. Conclusion and summary of results
-
1. The CSDDD concerns negative externalities caused by the operations of companies. In terms of double materiality, the CSDDD focuses on sustainability impacts.
-
2. The CSDDD marks a transition from reporting on to mandating the prevention and offsetting of negative sustainability impacts. This represents a fundamental change of direction at the EU level but follows the examples of France and Germany.
-
3. The CSDDD applies to significantly more companies than the German and French supply chain regulations. It also covers licensing models and larger companies from third countries that operate in the EU, but in the end discriminates against domestic EU companies through setting EU-focused rather than global thresholds.
-
4. The CSDDD focuses on the potential influence of in-scope companies, which is based materially on the OECD MNE Guidelines and seeks to establish a link with the CSRD reports and documents in the ESAP. Large, globally active companies have been aware of the OECD MNE Guidelines and sustainability reports for years. Concerns are raised on the costs the CSDDD imposes on “smaller large companies”.
-
5. SFDR, CSRD, and CSDDD overlap. Due to a lack of implementing standards, institutional investors cannot yet assess the cost-intensiveness of SFDR and CSRD sustainability reporting nor take it systematically into account in their investment decisions. Achieving the hoped-for sustainability goals with less intervention intensity would be the preferable solution.
-
6. The CSDDD is characterised by legal transplants: the OECD MNE Guidelines, the EU Accounting Directive, the French private law enforcement and the German public law enforcement models. The result is not balanced and could result in over-enforcement.
-
7. The information the CSDDD requires at the Member StateFootnote 175 and Union levelFootnote 176 and the bundling of information at the ESAPFootnote 177 have a cost-reducing effect. Cooperation within the group, among customers as well as reliance on third parties should also reduce costs. Yet, liability at the outsourcing entity’s level entails costs relating to monitoring of delegates.
-
8. The CSDDD imposes additional bureaucratic efforts on companies, resulting from value-driven differentiation of the standards mentioned in Annex I CSDDD, documentation requirements, abundant procedural requirements for compulsory communication with people who feel called upon or interested, reduced contractual freedom in the supply chain, and potential involvement in liability lawsuits that can be initiated by persons beyond those directly affected. These negative impacts on competitiveness of EU companies could lead to higher production costs, and in turn loss of market share, and relocations of production activities.
-
9. The CSDDD is another component of the ongoing legalisation of corporate organisation taking place in the EU. We criticise it, on the one hand, for its technical deficits, with uncertainties on scope, blind adoption of legal transplants and overly expansive rules granting standing to various stakeholders as notable examples, potentially resulting in over-enforcement, reverse discrimination of and, in turn, lesser competitiveness of EU firms. On the other hand, it shows elements of a “Brussels compromise” in which workable rules for companies come at the expense of ideological concessions (here, at the procedural level). This undermines the role of the EU as the lead regulator on economic issues on an EU as well as global level (so-called “Brussels” effectFootnote 178 ).
Some of these concerns are of general nature and could be considered in the current revision of the EU sustainable finance framework.
Acknowledgments
We are grateful to Charles Kaveh Koukabi for his diligent research assistance.
Open access
