Corporate Sustainability Due Diligence to become mandatory across the EU

On 15 March 2024, the European Union Council voted to adopt the Corporate Sustainability Due Diligence Directive (CS3D). The scope of the approved CS3D has been significantly watered down from the provisional agreement reached on the text by the European Council and European Parliament in December 2023. Whilst some companies may now be excluded from the scope of the directive, large companies domiciled in the EU and foreign companies generating significant revenues in the EU will be obliged to comply with the new sustainability due diligence obligations.

The directive will now need to be formally approved by the European Parliament before being transposed into national law throughout the EU.

Background

On 14 December 2023, the European Council and the European Parliament announced that they had reached a provisional agreement on the text of the CS3D, see our article here. However, the political agreement on CS3D failed to pass a vote by the EU Member States held in February 2024. Following further renegotiations on aspects of the text, member states were ultimately able to reach an agreement to adopt the directive on 15 March. This agreement has been endorsed by the European Parliament's Legal Committee but is awaiting formal adoption by the European Parliament (see Next Steps below).

The CS3D has two key objectives: to require companies to carry out due diligence to avoid adverse environmental and human rights impacts and to ensure accountability in case of actual adverse impacts being caused.

The approval of CS3D is the latest adoption of sustainability-based regulations by the EU, including the recent adoption of a regulation to ban products made from forced labour from the EU market (see our article on the EU Forced Labour Regulation here), and the introduction of the Corporate Sustainability Reporting Directive (CSRD) in January 2023 (see our articles here and here). CS3D will work alongside these existing regulations, by establishing obligations on companies to carry out due diligence and to prevent adverse impacts, and, in turn, enabling companies to meet their reporting requirements and ensure compliance with the forced labour ban. CS3D will also impact the previously adopted French and German national laws on sustainability due diligence.

Requirements for in scope companies

CS3D requires companies to carry out risk-based due diligence, in particular, to:

• integrate due diligence into their policies and risk management systems;
• identify, assess and (where necessary) prioritise potential and actual adverse impacts;
• prevent and mitigate potential adverse impacts;
• bring actual adverse impacts to an end, or minimise their extent;
• remediate actual adverse impacts;
• carry out meaningful engagement with stakeholders;
• establish and maintain a notification mechanism and complaints procedure;
• monitor the effectiveness of due diligence policy and measures; and
• communicate publicly on due diligence.

CS3D also requires in scope companies to "put into effect" a transition plan for climate change mitigation. This is to align the companies' strategies with climate neutrality targets and the Paris objectives.

Key revisions to the text

Since the provisional agreement in December 2023, there are some key provisions of the CS3D which have been renegotiated. In particular, the scope of the directive has been significantly narrowed.

Scope

1. Turnover and size

The adopted CS3D will apply to:

• EU companies with:
  • >1000 employees; and
  • net worldwide turnover of at least EUR 450 million in the last financial year;
• non-EU companies with at least EUR 450 million turnover generated in the EU in the year preceding the last financial year; and
• ultimate parent companies of a group which based on consolidated financial statements would fall into one of the above categories.

These conditions must be met in each of the last two relevant consecutive financial years for the directive to apply to the relevant company.

The turnover threshold in the previous version of the text was EUR 150 million and with a threshold of > 500 employees. These thresholds have been increased substantially.

2. High-risk sectors

There was also previously a carve out from the turnover/size requirements, which brought companies which did not meet those thresholds, but which operated in certain high-risk sectors, within the operation of the text. This carve out has been removed from the approved text, further reducing the number of companies within scope of the CS3D. However, CS3D now includes a provision requiring the Commission to assess, within 6 years after the date CS3D enters into force, whether a sector-specific approach for high-risk sectors needs to be taken regarding the thresholds for the scope of the directive.

3. Exemption for pure holding parent companies

CS3D also now includes an exemption from its obligations for an ultimate parent company where its main activities are holding the shares of subsidiaries, and where that parent company does not engage in taking management, operational or financial decisions which affect the group.

Transposition

Changes have also been made to the provisions of CS3D which specify when the obligations will become effective for certain companies. The largest companies, both EU and non-EU, with turnovers of over EUR 1500 million will be required to comply with CS3D within 3 years, while companies with lower turnovers or fewer employees will have longer to comply, as detailed in the table below.

*This assumes implementation of the directive in 2024.

Civil liability

A company can be held liable for damage caused to any person where the company has failed, intentionally or negligently, to comply with the obligations in CS3D. Any such claims may be brought for at least 5 years, which does not differ from the provisional agreement.

A provision which would have required member states to ensure that third parties (such as trade unions, NGOs or National Human Rights Institutions) could bring claims to enforce victims' rights has been deleted in the approved text, although member states will be permitted to introduce provisions for these sorts of representative actions if they wish to.

Penalties

The provisions regarding penalties remain the same as stated in the provisional agreement. Member states will determine the penalties that will be applicable to infringements of national provisions adopted under CS3D. However, CS3D requires that member states shall provide for pecuniary penalties, and a public statement indicating the company responsible and nature of the infringement, in the event of a failure to comply with a pecuniary penalty. Pecuniary penalties shall be a maximum of 5% of the net worldwide turnover of the company in the financial year preceding the penalty decision.

Next steps

If the European Parliament approves the final text (the vote for which is currently scheduled to go ahead on 24 April 2024), member states will have up to two years to transpose the directive into national law, although they may do so any time after its adoption. If approved, as detailed above, there will be a phased-in approach to compliance, starting with the largest EU and non-EU in-scope companies^[1] that will be required to comply within three years of the directive entering into force. As such, obligations for the largest companies would likely start to apply to companies from 2027, whilst obligations around reporting would begin from 1 January 2028.

All companies doing business in the EU should consider whether they are within the scope of CS3D and companies who will be in scope should review their due diligence processes and policies to consider whether they will be compliant with the requirements of CS3D. Companies should also monitor introduction of national legislation in view of the possibility of gold-plating that may be added by member states when CS3D is transposed into national law. Companies which are already subject to national legislation on supply chains and/or human rights (eg the German Supply Chain Act or the French Vigilance Law) should also analyse to which extent existing processes and disclosures will suffice the new CS3D obligations.

Please note, in this briefing we refer to our article 'CS3D: a new age of mandatory due diligence', first published in the International Compliance Association's 'inCOMPLIANCE' member publication, from which we have reproduced some content.

¹. See table above.