The Corporate Sustainability Due Diligence Directive: some answers, but questions remain

In terms of scope, the CS3D will apply to:

• EU companies (or groups) which:
• • had more than 500 employees and a net worldwide turnover of EUR150 million
    
    
  • had more than 250 employees and a net worldwide turnover of EUR40 million, where at least EUR20 million was generated in high-impact sectors*
    
    
• Non-EU companies (or groups) which:
  
  
• • had more than EUR150 million of net turnover in the EU
    
    
  • had more than EUR40 million of net turnover in the EU, where at least EUR20 million was generated in high-impact sectors*

* manufacture and wholesale trade of textiles, clothing and footwear, agriculture including forestry and fisheries, manufacture of food or drink, wholesale trade of agricultural raw materials, live animals, wood, food or drink, extraction and wholesale trade of mineral resources or manufacture of related products, and construction.

The extent to which financial services should be covered by the Directive has been a key point of contention from the outset. While the Commission originally proposed no special treatment for financial services firms, the Council proposed to leave member states to decide for themselves whether to include downstream financial services (a worst case scenario for those active in multiple member states), and the Parliament proposed their inclusion with some loosely worded exceptions for asset managers and institutional investors. Compromises have been made in the text with the Parliament accepting the exclusion of the financial sector's investment and lending activities from the scope of the due diligence obligations. This has been conceded on the basis that it will be subject to review in several years' time.

The CS3D obligations will apply to the in-scope company's own operations, its subsidiaries and their "chain of activities" (the term preferred by the European Parliament for the "value chain" concept). To comply with the due diligence duty, companies need to integrate a risk-based due diligence process into their policies and procedures and take appropriate steps to:

1. identify, assess and, where needed, prioritise actual or potential adverse human rights and environmental impacts;
   
   
2. prevent or mitigate potential adverse impacts; and
   
   
3. bring to an end, minimise and remedy actual adverse impacts;
   
   
4. establish and maintain a notification mechanism and complaints procedure;
   
   
5. monitor the effectiveness of its due diligence policy and measures; and
   
   
6. publicly communicate on due diligence.

In addition to the above, companies will be required to adopt a transition plan and make best efforts to ensure their business strategy is compatible with limiting global warming to 1.5oC.

National authorities will be responsible for enforcement against companies who fail to comply with the CS3D. Their powers will include an ability to launch inspections and investigations and impose penalties on non-compliant companies, including “naming and shaming” and imposing maximum fines of not less than 5% of net worldwide turnover. In addition, and variously described as both a dissuasive and persuasive measure across the EU institutions, compliance with the due diligence obligations may also be used as part of the award criteria for procurement of public contracts and concessions.

In addition to the threat of action by national authorities, the CS3D will also provide victims of a company's failure to identify, mitigate or prevent adverse impacts with an avenue to pursue civil action for damages.

In terms of immediate next steps, the agreement in principle reached by the European Parliament and the Council needs to be rendered into a draft text. We understand that this process may not be quick to achieve, as a number of issues remain open, and even the institutions' press releases regarding the conclusion of the negotiations are not in perfect alignment. The draft text, which is expected in February, will then be subject to formal approval by the co-legislators.

Once published in the Official Journal, the CS3D will enter into force 20 days after publication and Member States will have 2 years to transpose the provisions of the Directive into national law. Similarly to the CSRD, companies will be phased into scope three years from the entry into force of the directive, but unlike CSRD, non-EU companies in scope are expected to have to comply sooner rather than later.

Taking all of those steps into account, the first CS3D obligations could start applying in 2027.

It is true that the compromise deal struck between the European Parliament and the Council results in a significantly narrower scope than, in particular, the European Parliament's negotiating position which would have drawn in many more entities based on lower financial and employee thresholds. The absence of a requirement for UK and other non-EU companies to meet an employee threshold was highlighted during earlier stages as anomalous, given that EU companies must have at least 500 employees to be in scope. Overall, the lack of alignment between the scope of CS3D and CSRD is striking, as the following examples illustrate.

Though almost universally described as "groundbreaking", it is important to remember that the type of due diligence which will be required by the CS3D is already being mandated by the EU on a piecemeal basis via legislation with a specific sector focus. This includes the new Batteries Regulation, which will require implementation of due diligence within the battery supply chain, in order to avoid a range of social and environmental impacts. Similarly, the Deforestation Regulation contains extensive requirements for due diligence to prove that certain commodities are "deforestation free" and have been produced in accordance with the laws of the country of origin. (More details on these regulations can be found in our October 2023 briefing.) Each such potentially applicable regime has different criteria for application.

Furthermore, multinational entities based outside the EU and falling below the CS3D thresholds should be aware of national legislation with similar aims. CS3D was to a large extent based on the French Corporate Duty of Vigilance law; Germany and Norway have similar legislation (each with different scope) and the Netherlands is progressing a draft law which is expected to apply to some non-Netherlands entities. Despite these national developments, the final CS3D text is expected to require broad harmonisation of core requirements, but whether that will prevent the application of national measures to a different range of entities remains to be seen. Certainly in the short term, the regulatory landscape remains complex for those thinking about how to comply.