Getting Ready Series: Corporate Sustainability Due Diligence Directive

The Corporate Sustainability Due Diligence Directive ("CS3D" or the "Directive"), which has now been formally adopted by both the European Parliament and the European Council, is expected to enter into force in July. The CS3D will introduce new and extensive obligations on how companies engage on human rights and the environment, with knock-on effects on their business partners.

The CS3D imposes obligations on in-scope companies to take measures to address potential and actual adverse environmental and human rights impacts (“adverse impacts”) within their operations, their subsidiaries' operations, and across their entire “chain of activities”. This chain of activities extends beyond tier 1 suppliers to include direct and indirect business relationships, both upstream (suppliers that contribute to a company's production of goods or provision of services, such as the supply of raw materials or manufacturing services) and downstream (the distribution, transport and storage of a product) of the in-scope company. Regulated financial undertakings will benefit from an exemption for their downstream value chain, subject to a review by the European Commission in two years.

Adverse human rights impacts are defined by reference to the rights enshrined in various international instruments, which are listed in the Annex to the Directive. This broad approach contrasts with the definition of environmental impacts, which excludes climate impacts. The EU Commission is required to review whether the Annex needs to be modified or extended to cover additional adverse impacts, and whether the Directive’s provisions on combatting climate change need to be revised, by 2030.

Due diligence and remedial obligations

The CS3D introduces due diligence and remedial obligations across a company’s chain of activities, in respect of which in-scope companies are to take “appropriate measures”, taking into account the severity and likelihood of the impact, as well as the sector and geographical area in which a company’s business partners operate and its power to influence them.

The CS3D requires companies to integrate human rights and environmental due diligence into internal policies and risk management systems and to identify and assess adverse impacts, including mapping by likelihood and severity. These diligence processes are to be supported by notification and complaints procedures and effectiveness monitoring. Companies are also expected to carry out meaningful engagement with stakeholders and to publish information regarding their due diligence efforts on their website (with an exemption for companies reporting under the Corporate Sustainability Reporting Directive (“CSRD”)).

The Directive also introduces obligations to prevent, mitigate and remedy adverse impacts, depending on the company’s proximity to the actual or potential adverse impact:

• where the company causes or jointly causes an adverse impact, it must provide remedy; whereas,
• where the impact is caused by a business partner, companies may provide voluntary remediation themselves, and may also look to influence their business partners to provide a remedy, but are not obligated to do so.

Transition plans

The Directive requires in-scope companies to adopt a climate transition plan setting out their Paris Agreement-aligned climate transition strategy. This differs from the CSRD and climate reporting and listing regimes outside the EU, which generally only require certain companies to disclose transition plans if they have them.

The CS3D is expected to enter into force in July this year. Member States will have two years (until July 2026) to transpose the CS3D into national legislation which will apply to companies on a phased basis (as set out in ‘Who?’ below). When a company comes into scope of the legislation, it will immediately be subject to the substantive due diligence and remedial obligations set out above, and will then be required to report on its activities in the following financial year.

The CS3D applies to EU companies and non-EU companies with an EU nexus, in each case if they meet the relevant thresholds for turnover and, in the case of EU companies, employee numbers, for two consecutive financial years. Based on the expected date for entry into force, the CS3D will apply to companies in the following three waves:

Ultimate group parent companies, whether EU or non-EU based, which meet the criteria above based on their consolidated accounts, will be in scope of CS3D. There is however an exception for holding companies which do not engage in taking management, operational or financial decisions affecting the group or one or more of its subsidiaries and which designate an EU-based subsidiary to fulfil its CS3D obligations on their behalf.

The objective of the CS3D is to ensure that companies that do business in the EU tackle adverse impacts within their own operations, those of their subsidiaries and those in their “chain of activities.” It also aims to address fragmentation arising from the adoption of national rules on supply chain due diligence within the EU. Member States such as Germany and France have already set national due diligence standards which may need revision to comply with the CS3D.

For many companies, the CS3D will mark a step change in their legal obligations and associated risks, bringing many recommendations from international, voluntary guidance into Member State laws. In addition to any reputational risk, failure to comply with the CS3D poses significant financial risk. The maximum sanction is 5% of net worldwide turnover of the relevant company or group while, under a civil liability provision, an affected natural or legal person has a "right to full compensation" in accordance with national law for the damage caused by a company's intentional or negligent failure to comply with the obligations to prevent potential adverse impacts and bring an end to actual adverse impacts.