CS3D: key implications of the new EU directive on due diligence
SÉRVULO PUBLICATIONS 09 Jul 2024
1. Introduction
Within the scope of ESG corporate duties, the most relevant news of the year is the publication of Directive (EU) 2024/1760 ("CS3D" or "Directive") on corporate sustainability due diligence. The new Directive, which amends Directive (EU) 2019/1937 and Regulation (EU) 2023/2859, establishes for companies duties of identification, prevention, bringing to an end, minimisation and remediation of adverse impacts that its operations and the operations of their value chain cause or may cause to human rights and the environment.
The CS3D must be transposed by 26 July 2026, and its rules are to be applied between 1 and 3 years from that date, depending on the number of employees and the net turnover of the companies.
2. Scope
After its transposition and implementation by the Member States, the provisions of the CS3D will apply to companies which are incorporated in accordance with the legislation of a Member State and have, for two consecutive financial years, more than 1 000 employees on average and a net worldwide turnover of more than EUR 450 million in the last financial year (Article 2(1)(a) and (5)). Its provisions will also apply also to companies which are incorporated in accordance with the legislation of a third country and have generated in the Union, for two consecutive years, a net turnover of more than EUR 450 million in the financial year preceding the last financial year (Article 2(2)(a) and (5)). The Directive does not apply to alternative investment funds ("AIF") or undertakings for collective investment in transferable securities ("UCITS").
Driven by anti-circumvention concerns, the CS3D stipulates that its provisions will also apply: (i) to companies which, while not reaching the minimum thresholds in terms of number of employees and/or worldwide net turnover, are the ultimate parent company of a group that reached those thresholds in the last financial year (Article 2(1)(b) and (2)(b)); and (ii) to the company – or the ultimate parent company of a group – that entered into franchising or licensing agreements in the Union in return for royalties with independent third-party companies, where those agreements ensure a common identity, a common business concept and the application of uniform business methods, and where those royalties amounted to more than EUR 22.5 million in the last financial year (or in the financial year preceding the last financial year in the case of companies from third countries) and provided that the company had – or is the ultimate parent company of a group that had – a net worldwide turnover of more than EUR 80 million in the last financial year (or in the financial year preceding the last financial year in the case of companies from third countries) (Article 2(1)(ba)) and (2)(ba)).
Notwithstanding, the Directive provides that in cases where the ultimate parent company has as its main activity the holding of shares in operational subsidiaries and does not engage in taking management, operational or financial decisions affecting the group or one or more of its subsidiaries, it may be exempted from carrying out the obligations under the CS3D. That exemption is subject to the condition that one of the ultimate parent company’s subsidiaries established in the Union is designated to fulfil the obligations of the ultimate parent company on its behalf, including the obligations of the ultimate parent company with respect to the activities of its subsidiaries.
3. Duties of due diligence
The duty of due diligence set out in the CS3D comprises various legal duties, which include: (i) the duty to integrate due diligence into company policies and its risk management systems; (ii) the duty to identify and assess real or potential negative effects, and, if necessary, prioritising negative and potential effects; (iii) the duty to prevent and mitigate potential negative effects, cease real negative effects and minimise their extent; (iv) the duty to remedy real negative effects; (v) the duty to establish constructive collaboration with stakeholders; (vi) the duty to establish and maintain a notification mechanism and a complaints procedure; (vii) the duty to monitor the effectiveness of its due diligence policy and measures; and (viii) the duty to publicly communicate information about due diligence.
This complex and multifaceted duty applies to the operations of the companies subject to the scope of the CS3D, the operations of their subsidiaries and the operations carried out by their commercial partners within the companies’ chain of activity. Regarding corporate groups, the CS3D sets out effectiveness requirements which, if met, allow parent companies to fulfil their due diligence duties on behalf of their subsidiaries.
4. Integration into internal policies
The need to ensure the compliance with the duty of care, necessarily leads to some modifications in companies' internal governance policies and procedures, particularly regarding to risk management systems, matching with one of the six stages established by the OECD's Due Diligence Guidance for Responsible Business Conduct.
In this context, Article 7 of the CS3D obliges companies to include a duty of care in their risk management policies and systems. Likewise, it presupposes the implementation of a due diligence policy that guarantees risk-based due diligence. These policies must be updated every 2 years or whenever a significant change occurs.
5. Analysis, evaluation, and prioritization of negative impacts
The CS3D requires companies to identify, through appropriate measures, the real or potential negative effects on human rights and the environment resulting from their operations, their subsidiaries' operations, and their commercial partners' operations within the company's chain of activities (Article 8(1)). Thus, companies must map operations (their own, those of their subsidiaries, and/or those of their commercial partners, if related to their chain of activities) in order to specify the general areas in which there is a higher probability of negative effects occurring and being more serious, and based on the results of this mapping, evaluate these operations in depth (Article 8(2)). This identification should be carried out dynamically and at regular intervals.
If the information needed to identify negative effects can be obtained from commercial partners at different levels of their chains of activities, and in order to limit the burden on smaller companies created by requests for information, companies should refrain from approaching commercial partners who do not themselves present risks of negative effects, favoring direct contact with those commercial partners at levels of their chains of activities where, on the basis of the mapping, there is a higher probability of real or potential negative effects occurring, if deemed reasonable (Article 8(3)).
In cases where a company cannot fully and simultaneously prevent, mitigate, cease, or minimise all identified real and potential negative effects, the Directive stipulates that the company should prioritise the negative effects according to their severity and likelihood. In concrete terms, severity considers the extent of the negative effect, including the number of people affected and the extent to which the environment is or may be damaged or otherwise affected, its irreversibility, and the limits on the ability to restore, within a reasonable time, the situation to what it was before the effect. Naturally, once the more severe and probable negative effects have been mitigated/resolved, the company should address those of lesser severity and probability (Article 9).
6. Prevention of Potential Negative Effects
The establishment of a duty to prevent potential negative effects on human rights and the environment is a key element to be pursued by companies active in the internal market, their subsidiaries, and their business partners (actors in the “value chains”) in their contribution to sustainable development and the promotion of economic and social transition, in the context of the fulfilment of due diligence obligations. The centrality of this duty is reflected in Article 4 of the CS3D, which stipulates that Member States may not introduce into their national laws any provisions that establish less stringent obligations than those set out in the Directive in this context.
This duty is based on Article 10 of the CS3D, which requires the adoption of preventive measures or appropriate mitigation measures (if prevention is not possible) for potential negative effects that have been or should have been identified.
For companies covered by the CS3D, these measures constitute obligations of means, which may include: (i) the development and implementation of preventive action plans for the application of appropriate measures, (ii) obtaining contractual “guarantees” from direct business partners whereby they commit to ensuring compliance with the company’s code of conduct and, if necessary, the preventive action plan, (iii) making the necessary investments, adjustments, or updates, namely in facilities, production processes, or other operational processes and infrastructures, (iv) making modifications to the company’s business plan and overall strategies, (v) providing specific support to SMEs, and (vi) if admissible under competition law, establishing forms of cooperation between companies.
If the application of these measures fails, meaning that the potential negative effects have not been prevented or adequately mitigated by their application, the CS3D establishes obligations for in-scope companies to modify their established contractual relationships. In this context, the company will be obliged to refrain from establishing new relationships or extending existing relationships with the partner involved in the negative effect. The company must either (i) establish an enhanced preventive action plan and suspend the business relationship in question, or (ii) if there is no reasonable expectation that the plan will be successful, promote the early termination of the business relationship in question.
7. Termination of real negative effects
The CS3D also requires the adoption of appropriate measures to put an end to the real negative effects identified, regarding the operations of the companies and the operations of their subsidiaries and business partners in the companies' chains of activities. To this end, in the design of those measures, the directive provides for several factors to be taken into account, namely: what caused the actual negative effect (whether the company alone, or the company together with the subsidiary or trading partner), where this effect occurred (in the operations of a subsidiary or a trading partner) and what the real influence of the company is on the trading partner that caused the negative effect.
On a more concrete level, the adaptation measures we've been talking about include: (i) from the start, neutralising the negative effect or minimising the extent of its effects; (ii) if the measure referred to in the previous point is not feasible, drawing up and implementing an action plan with appropriate measures and specifically defined deadlines; (iii) entering into contracts with its contractual partner to ensure compliance with the company's code of conduct; (iv) making investments of a financial and non-financial nature, as well as improvements to facilities and production processes and infrastructures; (v) making changes and improvements to business plans, strategies and overall operations; (vi) provide concrete and adequate support to small and medium-sized companies that are partners of the company; (vii) and if none of the measures described above are adequate or effective in remedying the said real negative effects, then companies should collaborate with other entities in order to strengthen their capacity to combat the negative effect, using the legal mechanisms provided for in Competition Law, as well as other EU legislation; (viii) and finally, remedy the real negative effects found.
In addition, it is also stipulated that even before a company temporarily suspends or terminates a business relationship with a subsidiary or business partner, prior consideration must be given, as to whether the suspension or termination of the business relationship has manifestly more serious consequences compared to the negative effect that could not be concretely terminated or minimised. If this is not the case, the European legislator stipulates that the company must notify its business partner of the decision to suspend or terminate the business relationship, with reasonable notice, and with a periodic obligation to review the decision taken.
8. Information duties
Public scrutiny of the due diligence duties provided for in the CS3D is ensured through the inclusion, in article 16, of a duty to report relevant information on due diligence policies, processes and activities carried out to identify and correct actual or potential negative effects, including findings and results of such activities.
For this purpose, companies covered by the CS3D must publish annually, on their website, an informative statement on the issues covered by the Directive, written in an official language of the Union used by the designated supervisory authority and, if necessary, also in a language that is customary in the sphere of international business. This statement must be published within a reasonable period of time, not exceeding 12 months after the balance sheet date of the financial year, or by the date of publication of the annual financial statements, if the company voluntarily reports information in accordance with Directive 2013/34/EU. Companies incorporated in third countries must also include information about the authorized representative designated under this Directive.
This disclosure obligation does not apply to companies subject to sustainability reporting requirements in the CSRD Directive, in order to avoid duplication of reporting obligations.
By 31 March 2027, the Commission shall adopt delegated acts detailing the content and criteria of the information to be reported, aligning them with sustainability reporting standards, and also avoiding duplication for companies subject to Regulation (EU) 2019/2088, maintaining the minimum obligations of the Directive.
Article 17 of the Directive also determines that, from January 1, 2029, in addition to publishing the informative statement on their website, companies must submit it to a collection body, designated by each Member State, in order to make it accessible at the single European access point created by Regulation (EU) 2023/2859.
9. Climate transition plan
The companies covered by the CS3D have a duty to adopt and implement a climate transition plan, which must ensure, by all possible means, that the company’s business model and strategy are compatible with the transition to a sustainable economy, limiting global warming to 1.5°C, in line with the Paris Agreement, and aiming to achieve climate neutrality, in accordance with Regulation (EU) 2021/1119, also known as the European Climate Law.
The climate transition plan must include (i) specific targets for the year 2030 and interim targets at five-year intervals up to 2050, all based on robust scientific evidence, which should include, where appropriate, absolute targets for reducing greenhouse gas (GHG) emissions; (ii) a description of decarbonisation mechanisms and key measures to achieve the established targets, including possible changes to the company’s product and service portfolio and the adoption of new sustainable technologies; (iii) the quantification of the investments and financial resources required to implement the decarbonisation actions; and (iv) a clear description of the role of the administrative, management, and supervisory bodies in the implementation and monitoring of the plan.
Companies that already report a climate transition plan under Directive 2013/34/EU will be deemed compliant with the CS3D. However, it is not sufficient to merely adopt the plan; companies must implement it and update it regularly to ensure they are making adequate progress toward their climate goals. In this regard, supervisory authorities are responsible for monitoring the adoption and implementation of the climate transition plan, as well as its annual updates, which must include a description of the progress made by the company towards the established targets.
The climate transition plan is, therefore, a crucial component for companies to fulfil their climate commitments and contribute to the goal of limiting global warming to 1.5°C. The implementation of this plan requires a continuous commitment and the mobilisation of adequate resources, as well as rigorous oversight and regular updates to ensure its success.
10. Public procurement
In the realm of public procurement, the CS3D presents three noteworthy implications. First, the Directive confirms that its obligations can be taken into account by contracting authorities, either as award criteria or within the scope of the execution of public contracts (Article 33).
Second, the Directive allows for the exclusion of economic operators from participating in a procurement procedure if the contracting authorities can demonstrate, by any suitable means, the violation of applicable obligations in the fields of environmental, social, and labour law (Recital 92).
Third, the CS3D requires the Commission to consider amending the public procurement directives regarding the requirements and measures that Member States must adopt to ensure compliance with sustainability obligations and due diligence throughout the awarding and concession procedures (Recital 92).
11. Civil liability
Regarding civil liability for breach of the duty of due diligence, Article 29 of the Directive regulates essential aspects of the regime to: (i) define who has active and passive legitimacy to to bring indemnification actions for damages (the injured party and third parties in specified cases); (ii) limit compensation to cases of willful misconduct or negligence; (iii) delimit compensable damages; (iv) allow the injured party to exercise their right for a reasonable period (setting a limitation period of 5 years); (v) ensure the proportionality of the compensation awarded, where appropriate, without punitive damages; (vi) allow the use of sensitive or confidential evidence, access to which is, as a rule, restricted or prohibited; (vii) ensure that the cost of the judicial process does not hinder the exercise of the injured party's rights.
Additionally, the Directive aligns the established regime with national legal systems, referring to them regarding the extent of the compensation obligation; the rules for assessing causality; the legitimate interests that justify a liability action; the procedural mechanisms for the exercise of rights by third parties other than the injured party; the regime of joint liability of wrongdoers, as well as the corresponding right of recourse.
Furthermore, this provision determines the immediate application of the regime that transposes the Directive to situations of transnational civil liability. This implies that in cases where the applicable law for claims is not the national law of a Member State, the court of the Member State must ensure that the provisions of national law transposing this article are immediately and mandatorily applicable.
12. Meaningful engagement with stakeholders and whistleblowing
The Directive provides for the duty of meaningful engagement with stakeholders in the fulfilment of companies' sustainability due diligence, establishing that they must be consulted during the stages of the due diligence process (Article 13) and that the information they provide must be considered when monitoring the companies themselves, their subsidiaries, their business partners, and the company's chain of activities (Article 15).
Specific whistleblowing mechanisms are also provided for (Article 14). Due to a broader list of persons or organisations entitled to lodge complaints and a wider scope of the subject matter of complaints (Article 14(2)), the complaint procedure under this Directive is considered distinct from the internal whistleblowing procedure set up by companies in accordance with Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law.
However, this does not preclude the possibility of using both complaint procedures when a breach of Union or national law covered by Directive (EU) 2019/1937 can also be considered to have an actual or potential adverse impact on the operations of the companies themselves, the operations of their subsidiaries or the operations of their business partners in its chain of activities, and the complainant (whistleblower) is an employee of a company directly affected by that actual or potential adverse impact.
It is also not denied, on the one hand, that well-founded complaints may be submitted through easily accessible channels to any supervisory authority when there are objective grounds to believe that a company is not complying with the national provisions adopted under the Directive (Article 26); on the other hand, the possibility of applying Directive (EU) 2019/1937 in the context of the transposition of the CS3D is established, determining its application to the reporting of all breaches of national law transposing CS3D and the protection of persons reporting such breaches (Article 30).
