The European Parliament adopted the Corporate Sustainability Due Diligence Directive (CSDDD) on 24 April 2024. The directive has had a long and bumpy journey since the European Commission tabled its proposal in February 2022 and we wrote an In The Picture entitled "Brace yourselves, CSDD is coming!".

A brief clarification.

It is estimated that around 5,500 companies fall within the scope of the CSDDD, meaning that its scope has been significantly narrowed: under the original thresholds, there were more than 17,000. In short, European companies fall under the CSDDD if they have an average of more than 1,000 employees and a global net turnover of more than €450 million. Non-European companies fall under the CSDDD if they have a net turnover of more than €450 million in the EU. The directive also contains some specific rules, concerning for example its application to purely holding companies and companies entering into franchise or licensing agreements in the EU.

Companies subject to the CSDDD must design and implement appropriate due diligence measures with regard to their own activities, those of their subsidiaries and those of their supply chain partners. All upstream partners are covered by this obligation, but that is no longer the case for all downstream partners. For the latter, the due diligence policy only applies if they are responsible for distributing, transporting or storing the products for or on behalf of the company subject to the CSDDD.

The due diligence policy aims to identify, prevent, mitigate and eliminate adverse human rights and environmental impacts. These impacts include slavery, child labour, loss of biodiversity, pollution and destruction of natural heritage.

Companies must first and foremost integrate due diligence into their corporate policies and risk management systems (including through a code of conduct setting out the company's rules and principles and listing the processes implemented to carry out due diligence). They should map actual and potential adverse impacts, assess where they are (likely to be) most serious, and take appropriate measures to prevent or, if this is not possible, mitigate potential adverse impacts through a preventive action plan, contractual guarantees from business partners, investments in production processes and infrastructure, etc. Otherwise, companies subject to the CSDDD may be required not to enter into commercial relationships with business partners responsible for adverse impacts or located in the supply chain responsible for the adverse impacts, or not to renew those relationships.

The CSDDD now clarifies that suspending or terminating the business relationship is only a last resort, and not necessary when a company gives substantiated reasons that it would do more harm than good.

The due diligence policy also focuses on combating climate change. The CSDDD requires companies to prepare and implement a transition plan for climate change aimed at limiting global warming to no more than 1.5°C, in line with the Paris climate agreement. In doing so, the final text no longer provides that companies are required to encourage the implementation of the plan through financial incentives for management.

Companies must involve and consult their stakeholders (including employees) on compliance with CSDDD obligations. They are also required to take remedial action towards affected individuals, communities or the environment if they have caused an adverse impact, and must organise a specific complaints procedure that is generally accessible, including to NGOs and trade unions. Finally, they must monitor and evaluate their CSDDD policies and measures at least annually, and publish information on their website regarding their CSDDD activities, unless they already report under the Corporate Sustainability Reporting Directive.

The CSDDD provides for administrative and civil sanctions to ensure compliance. Member States must appoint a supervisory authority, which has the power to request information, conduct investigations and impose fines of up to 5% of the annual net worldwide turnover. Companies may also be civilly liable for damages resulting from an intentional breach of CSDDD obligations or failure to adequately prevent, mitigate or terminate adverse impacts. However, if damages are caused solely by one of its business partners, a company cannot be held liable.

The CSDDD will apply in phases. EU companies with more than 5,000 employees and a net turnover of €1.5 billion will have to implement the CSDDD three years after its entry into force (presumably in 2027). The same applies to non-EU companies with a net turnover of more than €1.5 billion in the EU. EU companies with more than 3,000 employees and a net turnover of €900 million must implement the CSDDD four years after its entry into force (presumably in 2028). The same applies to non-EU companies with a net turnover of more than €900 million in the EU. For all other EU and non-EU companies, there is a five-year implementation period (presumably from 2029).

Concretely.

• The CSDDD has been adopted, but its scope has been visibly narrowed to larger EU and non-EU companies.
• The CSDDD requires these companies to integrate appropriate due diligence into their policies and risk management systems, and to take measures to identify, prevent, mitigate and eliminate actual or potential adverse human rights and environmental impacts within their chain of operations.
• The same goes for preparing a transition plan for climate change in line with the Paris climate agreement (limiting global warming to no more than 1.5°C).
• Obligations under CSDDD can be enforced under both administrative and civil law.
• The CSDDD will apply in phases between 2027 and 2029, depending on the size of the companies involved.
• Non-covered companies may be affected as business partners by information requests and actions by companies subject to the CSDDD.

Want to know more?

• You can find our earlier In The Picture on the CSDD proposal: “Brace yourselves: CSDD is coming!” here.
• The text of the adopted CSDDD can be found here.