The EU’s Corporate Sustainability Due Diligence Directive and Forced Labour Regulation: What Next?

The EU’s Corporate Sustainability Due Diligence Directive and Forced Labour Regulation: What Next?

March 28, 2024, Covington Alert

There have been significant developments on two key EU files relevant to business and human rights (BHR): the Corporate Sustainability Due Diligence Directive (CSDDD) and the Regulation on Prohibiting Products Made with Forced Labour on the Union Market (Forced Labour Regulation, or FLR). In this alert, we provide an overview of the current status and basic elements of these proposed laws, and outline key takeaways for companies.

Corporate Sustainability Due Diligence Directive (CSDDD)

On 15 March 2024, the Council of the EU (Council) (representing the Member States) voted to approve a substantially revised version of the CSDDD (Council Text), which will require Member States to introduce rules requiring certain EU and non-EU companies to conduct environmental and human rights due diligence on their global operations and value chains.

What is the current status?

Although the CSDDD’s legislative path has been fraught with uncertainty, it is likely that the Council Text will be approved by the plenary of the European Parliament (Parliament), followed by final approval from the Council as a required step before the CSDDD becomes EU law.

Because it is a Directive rather than a Regulation, the CSDDD will need to be implemented into the national laws of EU and EEA Member States before it applies to companies. Member States will have two years following the CSDDD’s entry into force to do so. The Council Text prohibits Member States from introducing laws that diverge from key CSDDD provisions, but Member States may still introduce obligations that are in certain respects more stringent or specific than those included in the CSDDD, which effectively means that the CSDDD sets minimum due diligence obligations.

Who will be in scope?

The thresholds were adjusted upwards in the final negotiations of the Council Text so, as compared to prior drafts, fewer companies than anticipated will be directly in scope (though others may still be impacted by virtue of their business relationships). Obligations under the CSDDD will be phased in from three years after its entry into force (around 2027) to five years after its entry into force (around 2029), ultimately (broadly) applying to:

• EU Companies with more than 1,000 employees on average and a net worldwide turnover of more than EUR 450 million (or an ultimate parent company of a group that reaches such thresholds); and
• Non-EU Companies with a net turnover of more than EUR 450 million in the EU/EEA (or an ultimate parent company of a group that reaches such thresholds).

Separate specific thresholds, including a threshold based on the value of royalties, may apply for companies (or their parent companies) that operate under franchising/licensing models. Unlike prior drafts, there are no separate thresholds for companies in higher-risk sectors.

The CSDDD contemplates that compliance can be achieved through group-level due diligence obligations, provided that necessary information is shared between the parent and subsidiary and the subsidiary abides by the parent’s due diligence policy and integrates due diligence into its own policies. Holding companies that do not have active operational or management roles will be able to apply for an exemption and designate a subsidiary to fulfil CSDDD obligations.

What due diligence measures does the CSDDD require?

Companies will be required to conduct risk-based human rights and environmental due diligence to prevent and manage “adverse impacts”. Some key aspects of these due diligence measures are as follows:

• Obligations: Companies will be required to: implement policies and risk-management systems; take steps to identify, assess, prevent, mitigate, and remediate adverse impacts; engage with stakeholders (e.g. employees, business partners and trade unions); and establish a complaints procedure.
• Due diligence must cover a relatively broad “value chain”: Due diligence obligations will apply with respect to a company’s own operations (including its subsidiaries’ operations) and with respect to “business partners” within the company’s “chain of activities.” A company’s chain of activities is defined to include the activities of: (i) upstream business partners—including direct and indirect suppliers—engaged in activities related to the production of goods or the provision of services by the company (e.g. the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials or products/ product parts, or the development of the product or the service); and (ii) downstream business partners carrying out activities for or on behalf of the company related to the distribution, transport, and storage of the product.
• Breadth of possible adverse environmental and human rights impacts: Companies are required to conduct due diligence with respect to an array of potential adverse human rights and adverse environmental impacts, which are defined by reference to a number of key international conventions. Examples of adverse impacts include impacts on biodiversity, environmental degradation, the right to enjoy an adequate living wage, and forced labour.
• Obligations for companies in the financial sector are more limited: Broadly, by virtue of a narrowing of the “chain of activities” definition in later stages of negotiations, only the upstream supply chain of regulated financial institutions, and not their downstream (i.e. investment) activities are covered by the CSDDD.

What is the climate change transition plan?

The CSDDD will also require companies to adopt and put into effect a “transition plan for climate change mitigation.” The plan should “aim to ensure, through best efforts”, compatibility of a company’s business model and strategy with the transition to a sustainable economy and with the limiting of global warming to 1.5 degrees Celsius. The CSDDD provides an exemption for companies that have a transition plan and report on it in line with the Corporate Sustainability Reporting Directive (CSRD) and its transition plan-specific reporting standards in ESRS E1, though the CSDDD appears to further require a company to put its plan “into effect.”

What potential enforcement and liability is tied to the CSDDD?

Enforcement

Each Member State must designate a supervisory authority to monitor compliance with the CSDDD due diligence obligations. Supervisory bodies must be able to receive “substantiated concerns” from members of the public through easily accessible channels and will have the right to launch inspections and investigations. The CSDDD obliges Member States to implement “effective, proportionate, and dissuasive” penalties for non-compliance, including maximum fines not less than 5% of the company’s net worldwide turnover. The European Commission (Commission) will also establish a European Network of Supervisory Authorities tasked with ensuring collaboration and coordination between supervisory authorities.

Civil Liability

The Council Text requires Member States to establish a cause of action sufficient to enable private complainants to hold companies liable for damages caused to a “natural or legal person” provided: (i) the company intentionally or negligently failed to comply with its CSDDD due diligence obligations affecting one of the rights/prohibitions/obligations aiming to protect that person (listed in the legislation); and (ii) as a result, damage was caused to a natural or legal person’s rights. The CSDDD provides that companies cannot be held civilly liable for damage caused solely by the company’s business partners, though if damage was caused jointly by the company and its business partner, they shall be jointly and severally liable. Member States will have discretion to determine “reasonable conditions” under which trade unions, non-governmental organisations, or national human rights institutions can initiate actions on behalf of victims (i.e. such organisations may not have standing in their own right).

Forced Labour Regulation

On 13 March 2024, the Council approved the FLR after a provisional political agreement was reached between the Council and Parliament on March 5.

What is the current status?

Before the FLR becomes law, it still has to be formally adopted by Parliament—expected to vote on the text in its plenary session in late April 2024—and will then be subject to a final formal approval by the Council. The Regulation will apply in EU and EEA Member States (without the need for separate implementing legislation by Member States) three years after it has entered into force, likely in mid-2027. It is currently considered likely that Parliament will adopt the law.

Who will be in scope and what is prohibited?

The FLR makes it illegal for economic operators to place or make available on the EU/EEA market (Market) any product that was made, in whole or in part, with forced labour. It is also illegal to export such products from the EU. The FLR makes clear that economic operators include: (i) small- and medium-sized enterprises (SMEs); and (ii) companies selling products or services on the internet or “through other means of distance selling” (if they target end-users in the EU/EEA).

Forced labour is defined in line with the definition in the International Labour Organization’s Convention No. 29, which is: “all work or service which is extracted from any person under the menace of any penalty and for which the said person has not offered [themselves] voluntarily”. The FLR definition includes forced child labour. The ban applies to forced labour occurring in EU or non-EU countries at any stage of the supply chain.

The FLR expressly provides that it does not impose due diligence obligations on companies beyond those already imposed under EU or national law. In practice, however, the FLR is likely to drive additional focus on companies’ due diligence processes to identify forced labour risks in their value chains.

How will the prohibition be operationalised?

Competencies

Responsibilities for investigation, decision-making, and enforcement under the FLR are divided among the Commission and competent authorities designated by EU/EEA Member States.  Investigations will be led by the Commission when the suspected forced labour is identified outside the EU/EEA. If suspected forced labour is identified in a particular Member State, that Member State’s competent authority will lead the investigation. The FLR establishes detailed processes and principles that a lead competent authority must follow.

Investigations

Investigations may be initiated either where a complaint is received through an online information submission point, to be established under the FLR, or at a competent authority’s own instigation, based on other information available at the time (e.g. through the database of geographic and product risk factors to be set up by the Commission). The FLR maps out a detailed investigation process, including both a preliminary and full investigation stage. Companies will be given the opportunity to provide evidence that the relevant products were not made with forced labour at both stages of the investigation. Despite attempts in earlier drafts of the Regulation to shift the burden of proof onto the company (as is the case with the U.S. Uyghur Forced Labor Prevention Act), the burden of proof is on the lead competent authority to establish whether the products concerned have been made using forced labour.

FLR Decisions and Enforcement

At the conclusion of an investigation, if the products are found to have been produced with forced labour, the lead competent authority must (subject to a limited exemption) adopt a decision that will: (i) prohibit the product from being placed or made available on, or exported from, the Market (by any company); (ii) require companies subject to the investigation to withdraw from the Market any products concerned that have already been placed or made available on the Market (or are available online); and (iii) require companies to dispose of the products concerned (or parts of products). Lead competent authorities must communicate final decisions through an information and communication system established through a separate regulation on market surveillance and compliance of products (EU Regulation 2019/1020) and publish the decision on the Forced Labour Single Portal.

Critically, a decision by a lead competent authority will apply in all Member States. Competent authorities will be required to communicate such decisions to relevant authorities across Member States, including market surveillance and customs authorities. The FLR also establishes a Union Network Against Forced Labour Products to encourage structured coordination and cooperation among competent authorities. Companies will be able to request a review of a decision, and a decision may be withdrawn if a company demonstrates that it has complied with it and eliminated forced labour from the supply chain of the products concerned.

Where a company does not comply with a decision within a “reasonable timeframe”, competent authorities will be required to impose penalties on the company. When determining penalties, certain factors must be considered, including the gravity and duration of the infringement, previous infringements by the company, the company’s degree of cooperation with the lead competent authority, and any other mitigating or aggravating circumstances, such as financial benefits gained or losses avoided from the infringement.

The FLR also requires Member State customs authorities to “carry out controls” related to forced labour enforcement on products entering or leaving the Market. Key aspects of the customs authorities’ role are as follows:

• The lead competent authority is required to notify Member State customs authorities of decisions to prohibit placing of products on the Market and their export;
• If a customs authority identifies a product which is potentially non-compliant with the FLR, it shall suspend the release of the product for free circulation or export. The customs authority must then notify their Member State competent authority of the suspension. The competent authority will determine whether the product is in fact covered by a decision. If the competent authority concludes that a product is non-compliant pursuant to a decision made under the FLR, it must require the customs authority to maintain the suspension.
• Where a product is suspended from free circulation or export, customs authorities must dispose of the product, or upon request of a competent authority, seize the product and put it at the disposal of the relevant competent authority, which must ultimately dispose of it.

What Companies Can Do to Prepare for the CSDDD and FLR

These recent and far-reaching EU BHR developments will further necessitate the need for companies to develop and implement robust due diligence measures to identify and address human rights (including forced labour-related) risks in their operations and value chains.

Companies should consider taking the following actions:

1. Assess applicability: In the first instance, companies should assess whether their EU/EEA entities and/or parent company will fall in scope of the CSDDD and develop a roadmap to plan for compliance in the coming years. For the purposes of the FLR, companies should consider whether, based on their activities in the EU/EEA, they are likely to be directly (i.e. because they import or export) or indirectly (i.e. because they rely on product that is imported or exported) impacted by the FLR.
2. Review governance: As these laws add to the web of existing mandatory requirements and legal risks, companies should consider how best to develop a global, cross-functional approach to human rights- and environmental-related due diligence, or incorporate responsibilities for the new regimes into existing governance structures.
3. Take stock of existing due diligence efforts: Companies should map their existing due diligence measures against the requirements of the CSDDD and potential exposure under FLR. Where possible, companies should not “reinvent the wheel” but seek to leverage efficiencies globally. While the FLR is not a “due diligence” law per se, many of the forced labour-related diligence measures that companies may be required to demonstrate in an investigation context draw heavily on human rights due diligence principles embedded within the CSDDD. Further, companies already impacted by forced labour import bans in the U.S. and elsewhere are likely to be able to leverage efficiencies and learnings from risk mitigation efforts to address those regimes.
4. Take a holistic approach: It is critical for companies to consider the CSDDD against a backdrop of related regulations. For example, as companies plan for compliance with the CSRD, it will be important to stay live to potential CSDDD due diligence requirements as the company reports on its due diligence efforts. Similarly, these new laws should not be approached in isolation.
5. Track and engage: This is not the end of the road for the CSDDD or the FLR. Once passed, both laws anticipate development of guidance on critical issues. Moreover, Member States will have to implement the CSDDD at the national level and implementing laws may diverge from the Directive in certain respects. While the FLR will have direct effect, Member States will need to enact rules on penalties. Companies should track these developments closely and consider engagement with critical stakeholders, including regulators, as the details and interpretation of the requirements evolve.

If you have any questions concerning the material discussed in this client alert, please contact the members of our Business and Human Rights (BHR) and Environmental, Social, and Governance (ESG) practices.