On 25 July 2024, following a long and complex legislative process, Directive 2024/1760, better known as the 'Corporate Sustainability Due Diligence Directive' or 'CS3D' (hereinafter the 'Directive'), entered into force and on the same day the European Commission has already provided the first “Frequently asked question”[1].
The Directive lays down rules on: (i) due diligence obligations with respect to adverse impacts on human rights and the environment; (ii) adoption and implementation of a climate transition plan; (iii) liability for violations of these obligations.
Compared to the original text of the European Commission's draft directive, there are many differences, starting with the scope of application. In fact, CS3D has significantly raised the thresholds at which companies incorporated under the laws of a Member State ("EU companies") and companies incorporated under the laws of a non-EU country ("non-EU companies") are obliged to comply. More precisely, the following companies (hereinafter referred to as 'obligated companies') fall within the scope of the Directive, regardless of the industry to which they belong:
EU companies with more than 1,000 employees and a total net turnover of more than EUR 450 million in the last financial year for which financial statements have been adopted, and parent companies that, on a consolidated basis, have reached this limit;
non-EU companies with a net turnover in the EU of more than EUR 450 million in the financial year preceding the last financial year, and parent companies that, on a consolidated basis, have reached this limit;
EU and non-EU companies that have concluded franchise or licensing agreements in the European Union in exchange for licence rights with independent third-party companies, provided they operate in the European Union with a turnover of more than EUR 80 million, the licence rights exceed EUR 22.5 million, and such agreements guarantee a common identity, a common business concept and the application of uniform business methods.
There is no longer any reference to 'high-impact sectors', which - in the text of the proposal - was a notion that led to an extension of the scope of the Directive.
In the light of the new size criteria, the European Commission has estimated the total number of obliged companies to be 6900 (6000 EU companies and 900 non-EU companies)[2], i.e. less than half of the number envisaged on the basis of the text of the draft directive.
The companies thus identified will have to comply with the obligations provided for relating to the adverse impacts on human rights and the environment generated by their activity, understood not only as the activity carried out by the companies themselves or by their subsidiaries, but also by their business partners belonging to the 'chain of activity'. Precisely, the 'chain of activity', a term that has replaced the previous notion of 'value chain' provided for in the text of the proposal of Directive, covers the activities of the upstream and downstream business partners of an obligated company, namely:
production of goods or provision of services, including the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of products and the development of the product or service;
distribution, transport and storage of the product, where business partners carry out these activities for or on behalf of the obligated company.
On the other hand, storage, dismantling, recycling, composting or landfilling activities, which are instead included in the notion of 'value chain' in the text of the proposal, are excluded.
Turning to the content of the obligations, the obliged companies will be required to exercise risk-based due diligence on human rights and the environment through what are typically the tools of risk-based and compliance, namely:
integration - after consultation with employees and their representatives - of the due diligence into the risk management policies and systems, and preparation of a policy on due diligence, including a description of the procedures put in place and a code of conduct;
identification and assessment of actual or potential adverse impacts through a risk mapping and assessing system;
prevention and mitigation of potential adverse impacts, with the preparation of prevention action plans where appropriate;
bringing actual adverse impacts to an end and minimising their magnitude, with corrective action plans drawn up as appropriate;
remediation of actual adverse impacts;
establishment and maintenance of a notification mechanism and procedure to allow anyone with a legitimate concern about the adverse impacts of a company or its supply chain to submit a complaint;
monitoring of the effectiveness of the policy and of the due diligence measures;
public communication on due diligence.
Although the due diligence obligations formally fall only on the obligated companies, the consequences of CS3D will substantially affect all the companies in their chain. In fact, depending on the case, the obligated companies will have to:
require contractual assurances from each business partner regarding compliance with the code of conduct and, if necessary, the prevention and/or corrective action plans;
require business partners to obtain, in turn, equivalent contractual assurances from their respective partners for activities falling within the 'chain of activity' of the obligated companies;
refrain from entering into a new relationship or prolonging an existing relationship with a business partner in connection with which or in the chain of activity of which an adverse impact has arisen;
temporarily suspend or even terminate business relations with a business partner.
As previously mentioned, on 25 July 2024 the Directive entered into force, and it began to run the two-year deadline for Member States to transpose the rules. On the same day the deadlines for the obligated companies to fulfil their obligations began to run which vary between three and five years, depending on the net turnover and/or number of employees.
Lastly, the Directive provides for enforcement mechanisms that should incentivise compliance with the obligations it contains. In particular, pecuniary sanctions are provided for, which, in the final version of the text, are connected to the net worldwide turnover of the company (with a maximum limit of no less than 5% of the company's net worldwide turnover), and the naming and shaming mechanism, which affects the reputation of the sanctioned company. Civil liability of both EU and non-EU companies is also provided for in the event of non-compliance with obligations under the Directive as a result of which damage is caused.
As previously mentioned, on 25 July 2024 the Directive entered into force, and it began to run the two-year deadline for Member States to transpose the rules. On the same day the deadlines for the obligated companies to fulfil their obligations began to run which vary between three and five years depending on the net turnover and/or number of employees.
Despite the seemingly abundant time available, obligated companies as well as companies part of their chain are called upon as soon as possible to promptly implement due diligence systems adapted to the changes introduced by the Directive.
[1] The “Frequently asked questions” can be consulted by clicking the appropriate link at the bottom of the page https://commission.europa.eu/business-economy-euro/doing-business-eu/sustainability-due-diligence-responsible-business/corporate-sustainability-due-diligence_en.
[2] Official website of the European Commission, accessed on 12.07.2024
Author: Beatrice Facci
Contact: Avv. Luisa Romano l.romano@bergsmore.com
Comments