EU's due diligence directive has crossed the finishing line

The long-awaited Corporate Sustainability Due Diligence Directive (CS3D) has cleared the last major hurdle, with EU ministers announcing final approval of the directive on 24 May 2024. CS3D now awaits publication in the Official Journal of the EU after which it will enter into force 20 days later. The directive introduces obligations on in-scope companies to address actual or potential adverse human rights and environmental impacts arising from their own operations, their subsidiaries and their business partners.

In recent times, the directive has faced a raft of challenges. In December 2023, a provisional political agreement was reached on a more robust version of the directive, but it required further political negotiations after failing to secure sufficient votes in February this year. The version of CS3D that the Council of the EU approved in March was significantly watered-down, limiting the directive's scope to apply to fewer businesses and delaying its application. 

Yet, CS3D should by no means be underestimated. In this note, we explore the broad objectives of the directive, its recent changes, and implications it will have for businesses.

CS3D in focus

CS3D requires businesses falling under its remit to conduct and report on risk-based due diligence processes. It aims to ensure that businesses integrate due diligence into everyday actions, and identify, assess and prioritise remedial action for potential and actual adverse impacts. It places the onus on companies to remediate actual adverse impacts, carry out meaningful engagement with stakeholders and establish and maintain a notification mechanism and complaints procedure.

Consequences for failure to comply include fines of up to 5% of net worldwide turnover, public ‘naming and shaming’ and potential claims for damages from impacted individuals.

What has changed?

The three core elements of the revamped CS3D affect scope, high-risk sectors and implementation timelines.

To begin with, it has a significantly narrowed scope. Application thresholds have increased substantially, reducing the number of companies falling within its remit – those now caught will have twice as many employees and three times the net worldwide turnover than originally planned.

Second, specific rules that were designed to catch businesses that were under the thresholds but operating in certain high-risk sectors such as agriculture, construction and mining have been removed, though these could be restored under a provision to review the directive’s scope.

Third, the changes provide for a more staggered timeline for transposing into national law, with three separate applicability phases for in-scope companies. For EU companies, thresholds apply to worldwide turnover; for non-EU companies, they apply to turnover generated in the Union. Employee number thresholds apply only to EU companies.

Those with a turnover of at least €1,500 million and more than 5,000 employees fall within the earliest phase; CS3D will apply to these companies three years after it comes into force – potentially as soon as 2027.

Companies with a turnover of at least €900 million and more than 3,000 employees will have an additional 12 months to prepare.

Lastly, CS3D will become applicable to all remaining in-scope companies five years after it comes into force.

In addition to the above, in this agreed version of CS3D, only individuals suffering as a result of adverse impacts can bring claims against responsible companies. A provision requiring member states to ensure third parties such as trade unions, NGOs or national human rights institutions could bring claims on behalf of individuals has been deleted.

Impacts on businesses

Despite fewer companies having to comply with CS3D’s requirements, there remains no room for complacency; CS3D’s indirect impacts are likely to be far reaching.

A key issue that may become relevant for out-of-scope companies is the potential for EU member states to adopt and extend the provisions when transposing CS3D into their national laws. Member states may not dilute the directive, but they may choose to make certain aspects more stringent.

Of course, the EU may be a leader in terms of introducing such an extensive due diligence-based directive, but it is anticipated that others will follow. Indeed, proposals for similar mandatory due diligence laws have already been raised in other countries, including the UK and South Korea. To stay ahead of the curve, businesses should keep track of developments, monitor the extent to which requirements will align and diverge, and understand how this will impact the scope and nature of their due diligence obligations across their international operations and supply chains.

CS3D’s due diligence and reporting obligations extend past a company’s own operations to those of its subsidiaries and business partners. It means companies doing business with in-scope entities will increasingly be expected to support compliance efforts by identifying, monitoring and addressing their own adverse impacts on the environment and human rights. This will have a knock-on effect on commercial contracts, which are likely to need reconsideration and renegotiation to allow for CS3D compliance.

Boards may also seize the opportunity to demonstrate a genuine commitment to sustainable practices by implementing robust due diligence processes on a voluntary basis. In an environment in which customers, shareholders and stakeholders are acutely aware of the importance of sustainability, this is undoubtedly a wise approach.

The regulatory environment is unmistakably moving towards demanding more stringent due diligence practices from businesses. CS3D provides a framework for companies to establish procedures that help them fulfil the mandates of other sustainability-oriented laws. Decision-makers need to comprehend the broader ramifications of the directive and to evaluate their existing due diligence methods to prepare their companies to meet the expanding requirements.

*This article was first published in Governance + Compliance here. We have since updated the article to include the directive's final approval on 24 May 2024.