On 23 February 2022, the European Commission (EC) published its proposal for a Directive on corporate sustainability due diligence (the Directive). Its objective is for companies to act with due diligence when identifying, preventing, mitigating, eliminating, or failing that minimising, external damage resulting from actual or potential adverse impacts on human rights and the environment, both in their own operations and those of their subsidiaries and in those in the value chain that are carried out through established direct and indirect commercial relationships, in order to contribute to sustainable development and the transition towards sustainable economies and societies. The Annex to the Directive contains lists specifying the adverse impacts on human rights and the environment relevant to the Directive. The Directive also sets obligations for certain companies to have in place a plan to ensure that their business model and strategy are compatible with the transition to a sustainable economy and with the limiting of global warming to 1.5°C in line with the Paris Agreement.

Some Member States (MS) have already introduced national due diligence rules and some companies have taken measures on their own initiative, but larger scale improvement is difficult to achieve with voluntary action. The Directive seeks to avoid this fragmentation and create equal conditions for companies within the European Union (EU), which is why companies from third countries that operate in the EU are also included on the basis of a similar volume of business criterion.

The national supervisory authorities designated by the MS will ensure that companies comply with the obligations of the Directive.

The Directive must be transposed no later than two years after its entry into force and will be reviewed seven years after its entry into force.

Companies subject to the obligations of the Directive

1) EU companies:

a) Group 1: limited liability companies with more than 500 employees on average and a global net turnover of more than €150 million in the last financial year.

b) Group 2: companies that do not reach the thresholds for Group 1 but had more than 250 employees on average and a worldwide net turnover of more than €40 million in the last financial year, providing at least 50% of this net turnover was generated in one or more high-impact sectors. For these companies, the requirements would apply two years after the end of the transposition period, so they have a longer adaptation period than those in group 1. In addition, for these companies the due diligence obligations will focus on the severe¹ adverse impacts. The Directive details the high-impact sectors based on the OECD sectoral guidance on due diligence. However, although included in this guidance, the financial sector has not been included in the Directive’s high-impact sectors due to its specificities, particularly with regard to the value chain and the services offered. When the EC reviews the Directive it will also review this list.

2) Companies from third countries that have significant operations in the EU:

a) Group 1: with a net turnover generated in the EU of more than €150 million in the last financial year.

b) Group 2: with a net turnover generated in the EU of between €40 million and €150 million in the la financial year, providing at least 50% of their net worldwide turnover was generated in one or more high-impact sectors. The regime is the same as for group 2 EU companies.

For these companies, the criterion of turnover in the EU is chosen because it is considered to create a territorial link and is an indicator of the effects that their activities could have on the internal market. On the other hand, the concept of “employees” in the Directive is based on EU law and cannot be easily transposed. These companies must designate an authorised representative established or domiciled in one of the MS in which the company carries out its activity, empowered to receive communications from supervisory authorities and with the necessary powers and resources. The supervisory authority of the MS in which the authorised representative is domiciled or established and, where it is different, a supervisory authority in the MS in which the company generated most of its EU net turnover in the last financial year, must be informed.

The definition of company includes financial undertakings regardless of their legal form².

SMEs are excluded from the due diligence duty and the Directive establishes measures to limit the passing on of the burden from large companies to smaller suppliers in the value chain and to apply fair, reasonable, non-discriminatory and proportionate requirements to SMEs.

Obligations for companies

MS must ensure that companies comply with all their obligations. Specifically, companies must:

A) Integrate due diligence into all company policies and have in place a due diligence policy, which must be updated annually and include a description of the approach taken, a code of conduct to which the workers and subsidiaries of the company must adhere, as well as a description of the processes established to apply due diligence (including measures to verify compliance with the code of conduct and extend its application to established business relationships).

B) Adopt appropriate measures to identify actual and potential adverse impacts on human rights and the environment arising from their own operations, those of their subsidiaries and their established business relationships, direct or indirect, in the value chain (severe impacts only, relevant to the corresponding sector, in the case of group 2 companies). For financial companies, this detection will be carried out only before they provide their services.

C) Adopt appropriate measures to prevent potential adverse impacts detected or to mitigate them adequately when prevention is not possible or not immediately possible.

D) Adopt appropriate measures to bring actual adverse impacts to an end and, where an adverse impact produced at the level of established commercial relationships, direct or indirect, cannot be brought to an end, they must minimise its extent.

Both for the prevention of potential adverse impacts and for bringing actual adverse impacts to an end, where necessary companies must develop and apply a preventive or corrective action plan, respectively, with defined action timelines and qualitative and quantitative indicators for measuring improvement. Hey must also seek contractual assurances from commercial partners with a direct relationship that they will comply with the code of conduct and, as necessary, the action plan³. In addition, they must make the necessary investments to carry out these measures, provide specific and proportionate support to SMEs with which they have an established relationship if compliance with the code of conduct or the action plan could compromise their viability and collaborate with other entities. to increase their ability to bring adverse impacts an end, especially where no other action is appropriate or effective.

With regard to potential or actual adverse impacts that cannot be sufficiently prevented, brought to an end or mitigated, the company may seek to enter into a contract with a business partner with an indirect relationship to achieve compliance with the code of conduct or the execution of an action plan. When contractual assurances are obtained from, or a contract is concluded with, an SME, the clauses used must be fair, reasonable and non-discriminatory.

Companies will prioritise engaging with value chain business relationships rather than ending them, which will be an action of last resort. However, where measures have failed to adequately address actual or potential adverse impacts, companies shall refrain from entering into new or expanding existing relationships with the business partner in question and, where permitted by law, temporarily suspend business relationships. while the appropriate measures are applied or terminate the commercial relationship with respect to the activities in question if the adverse impact is considered severe (to this end, the MS must ensure that the contracts regulated by their legislation include this option). On the other hand, financial companies will not be obliged to terminate the credit, loan or other financial service agreement when there is a well-founded expectation that such termination will cause significant damage to the entity to which the service is being provided.

E) Provide the possibility of submission of complaints by those persons affected or with reasonable grounds to believe that they might be affected by an adverse impact, trade unions and other workers’ representatives representing workers in the affected value chain, and civil society organisations in the field concerned when they have legitimate concerns about those potential or actual adverse impacts. The company must establish a procedure for handling complaints (including those considered unfounded) and ensure that complainants are able to meet with company representatives.

F) Carry out periodic assessments of the application of their due diligence measures based on quantitative and qualitative indicators every twelve months and whenever there are reasonable grounds for believing that new and significant risks may arise.

G) Companies not subject to Directive 2013/34/EU on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings must report on the aspects regulated by the Directive and publish an annual statement on their website, no later than 30 April of each year, relative to the previous year. The EC will adopt delegated acts on its content and criteria.

H) EU and third-country companies in group 1 must adopt a plan to ensure compatibility with the transition to a sustainable economy and with limiting global warming to 1.5°C in accordance with the Paris Agreement. The plan will determine the extent to which climate change poses a risk to, or constitutes an adverse impact of, their activities. If it is or should be a principal risk for the business, the company must include emission reduction objectives in its plan.

Obligations of directors of EU companies

Directors must take into account the consequences of their decisions in terms of sustainability in the short, medium and long term. MS shall ensure that their provisions regulating non-compliance with directors’ obligations apply also to these obligations. Directors will be responsible for putting in place and overseeing the due diligence measures, taking into account stakeholders’ contributions and reporting to the board of directors. They will also do what is necessary to adapt the company’s strategy. Where company directors or senior management have variable remuneration, they must be incentivised to contribute to the fight against climate change with reference to the business plan.

Supervisory authorities

MS must designate one or more national supervisory authorities to ensure that companies comply with their obligations under the Directive. For EU companies the competent supervisory authority will be that of the MS where the company has its registered office and for companies from third countries it will be that of the MS where the company has a branch. If the company does not have a branch in any MS, or has branches located in different MS, the competent supervisory authority shall be that of the MS in which the company generated most of its net EU turnover in the last financial year. In the event of a change in circumstances, companies may submit a duly reasoned request to change the competent supervisory authority.

Where a MS designates more than one supervisory authority, it shall clearly define the competences of each and ensure that they cooperate effectively. Also, MS may designate the authorities for the supervision of regulated financial undertakings as supervisory authorities for the purposes of this Directive.

Supervisory authorities must be independent and their staff and those responsible for their management must be free from conflicts of interest, subject to confidentiality requirements and refrain from any incompatible action. The MS will inform the EC of the designated supervisory authorities and the EC will publish a list of them on its website.

The supervisory authorities must have the appropriate skills and resources to carry out their control and execution functions. They will have, as a minimum, powers to a) order the cessation of infringements of the national provisions adopted pursuant to this Directive, abstention from any repetition of the relevant conduct and, where appropriate, remedial action proportionate to the infringement and necessary to bring it to an end, b) impose pecuniary sanctions and c) adopt interim measures to avoid the risk of severe and irreparable harm. They will have the power to request information and carry out investigations. They shall also carry out inspections in accordance with the national legislation of the MS in which each inspection takes place and with prior warning to the company, except where prior notification hinders the effectiveness of the inspection. When an inspection has to be carried out in another MS, assistance will be requested from the supervisory authority of that State, which will take all measures to respond without delay, no later than one month from receipt.

The EC will create a European Network of Supervisory Authorities made up of representatives of the national supervisory authorities to facilitate and ensure the coordination and harmonisation of practices and the exchange of information. It may invite EU agencies with specialised and relevant knowledge to join the Network.

Any natural or legal person who has objective reason to believe that a company is not adequately complying with the provisions of the Directive may submit their substantiated concerns to the supervisory authorities in the MS of that person’s habitual residence, registered office or work, or in which the alleged infringement occurred.

In order to provide support to companies or supervisory authorities of the MS on compliance by companies with their due diligence obligations, the EC may issue guidelines, for specific sectors or specific adverse impacts, in consultation with the European Union Agency for Fundamental Rights, the European Environment Agency and with international bodies with experience in due diligence. In addition, the MS and the EC must provide accompanying measures to companies covered by the Directive and to actors in global value chains that are indirectly affected by the obligations. Such support may range from the operation of websites, portals or specialised platforms to financial assistance for SMEs and the facilitation of joint initiatives by stakeholders. Companies may also rely on sectoral regimes and multilateral initiatives to support the application of due diligence and the EC, in collaboration with MS, may issue guidelines for assessing the fitness of such schemes.

Liability and sanctions

The Directive establishes a combination of sanctions and civil liability.

MS must ensure that companies are liable for damages if they fail to comply with their obligations and as a consequence an adverse impact occurs that should have been identified, prevented, mitigated, brought to an end or minimised and this has caused harm. Civil liability refers only to established business relationships that are expected to last. The company will not be liable at the level of indirect business relationships if it has used a contractual cascade and assurances and has taken measures to verify their compliance, unless these are not adequate. In addition, when assessing the existence and extent of liability, due account must be taken of the company’s efforts to comply with any corrective measures required by a supervisory authority, any investments made and any specific support to deal with adverse impacts in its value chains. This civil liability approach also seeks to limit the risk of excessive litigation. MS must ensure that liability is not denied by the mere fact that the law applicable to such complaints is not that of a MS.

MS must establish rules on the sanctions applicable to infringements of national provisions pursuant to the Directive and must take all the necessary measures to ensure their application. When financial penalties are imposed, they shall be based on the turnover of the company, in order to ensure their proportionality. Any decision of the supervisory authorities containing sanctions relating to non-compliance with the provisions of the Directive must be published.

¹ Severe adverse impacts are those that are especially significant by their nature, or affect a large number of persons or a large area, or which are irreversible or particularly difficult to remedy.

² Credit institutions, investment firms, CIS management companies, insurance undertakings, reinsurance undertakings, pension funds, pension institutions operating pension schemes which are considered to be social security schemes as well as any legal person established for the purpose of investing in said schemes, collective investment schemes (CIS), central counterparties, central securities depositories, authorised insurance or reinsurance special purpose vehicles, “securitisation special purpose entities”, insurance holding companies or mixed financial holding companies that form part of an insurance group that is subject to supervision at group level and that are not exempt from group supervision, payment institutions, electronic money institutions, crowdfunding service providers and crypto-asset service providers providing one or more crypto-asset services.

³ To this end, they must in turn obtain the corresponding contractual assurances from their business partners in the company’s value chain, for which the EC must adopt guidelines on non-binding standard contractual clauses that companies can use when cascading the obligation in their value chain.

Useful links:

Proposal for a Directive on corporate sustainability due diligence

Annex to the proposal for a Directive on corporate sustainability due diligence