EU: A harmonised approach to corporate sustainability

European Parliament formally adopts a compromise CSDDD text to prevent, end or mitigate the negative impact of adverse human rights and environmental practices.

Why should I read this?

With the Corporate Sustainability Due Diligence Directive (CSDDD or CS3D) coming into effect, we anticipate a huge transformation in EU business operations. Companies will need to allocate substantial resources—both time and financial— and train their staff and establish a robust system for monitoring and addressing potential harms within the company’s supply chains.

Hailing it as a landmark text with the EU doing their bit to “ensure no products on the market come at the cost of human lives and environmental destruction” the European Parliament, on 24 April 2024, voted by “solid majority” to formally adopt the CSDDD in a compromised form. Once in force, companies that meet certain thresholds must conduct due diligence to identify, prevent, and mitigate adverse human rights and environmental impacts across their operations and chain of activities (upstream and downstream) using a risk based approach. This includes using their influence to promote environmental sustainability, improve standards of living and support their SME partners; integrating due diligence into company policy; implementing risk management systems; producing climate transition plans; being responsible for harms caused and remediating them; engaging with their stakeholders and affected communities; implementing grievance mechanisms; and ensuring the effectiveness of such measures through monitoring and reporting.

Navigating CSDDD implementation: balancing legal landscapes and stricter rules across the EU

The CSDDD aims to standardize supply chain and due diligence requirements, ensuring a uniform legal environment for businesses across the EU. However, some might argue the final text compromises this aim by introducing longer transition periods and narrowing the parameters of in-scope companies. Such compromises raise concerns of a fragmented legal landscape, especially as countries like Germany and France have already enacted their own due diligence laws with distinct requirements. With other EU nations considering similar legislation, achieving a standardized framework will set a positive baseline but note that Member States are free to legislate further and therefore companies may face a patchwork of regulatory obligations, varying significantly across different EU jurisdictions.

Is my company in-scope for CSDDD?

The compromised agreement narrows the original CSDDD's scope so that it now only targets EU companies with over 1000 employees and an annual net turnover exceeding €450 million and non-EU companies with a net turnover of more than €450 million in the EU. The conditions must occur in two consecutive financial years.

While the thresholds have risen, the scope has broadened to encompass EU parent companies of groups hitting the thresholds and EU firms engaged in franchising or licensing deals with third parties in return for royalties (which meet specified thresholds).

In scope financial undertakings are covered for their upstream activity. The text, however, has dropped additional thresholds for high-risk sector companies (e.g. textiles, mining and agriculture). This will remain under review by the Commission together with whether further rules might be required for regulated financial undertakings providing financial services and investment activities. The Commission will also issue guidance to sectors on fulfilling due diligence obligations.

Companies that are exempt include:

Ultimate parent companies that are non-operational.
Companies that cease to meet the applicable criteria in the last two financial years.
Alternative investment funds and companies for collective investment in transferable securities.

Key CSDDD Provisions

Transposition periods table

Transition period following CSDDD becoming law	EU Companies (including ultimate parent companies of a group)	Non-EU companies (including ultimate parent companies of a group)
3 years – late 2027/early 2028	More than 5,000 employees and more than EUR 1,500 million net worldwide turnover	Net Union turnover of more than EUR 1,500 million
4 years – late 2028	More than 3,000 employees and more than EUR 900 million net worldwide turnover	Net Union turnover of more than EUR 900 million
5 years – late 2029	More than 1000 employees and more than EUR 450 million net worldwide turnover Companies entered into a franchising or licensing business model in return for royalties with independent third-party companies, and where the royalties amount to more than EUR 22,5 million in the last financial year (for which annual financial statements have been or should have been adopted) and provided that the net worldwide turnover is worth more than EUR 80 million in the last financial year (for which annual financial statements have been or should have been adopted)	More than EUR 450 million net Union turnover Companies entered into a franchising or licensing business model in return for royalties with independent third-party companies, and where the royalties amount to more than EUR 22,5 million in the last financial year (preceding the last financial year) and provided that the net Union turnover is worth more than EUR 80 million in the financial year (preceding the last financial year)

Due diligence obligations

Originally, due diligence obligations were linked to a company’s value chain but this has since been replaced with “chain of activities”. Under CSDDD, the chain of activities includes all upstream business partners connected to the products manufactured or services provided by the company and all downstream business partners which transport, distribute or store the products for the company. Note the provision of services downstream is not included in the scope of the “chain of activities” which reduces the scope of the due diligence obligation.

In-scope companies are required to:

conduct a risk analysis of their business and chain of activity to identify and evaluate potential negative social and environmental impacts. When risks are identified, companies must implement necessary actions (including remediation), prioritizing the most critical ones. These records must be maintained for a minimum of five years.
Engage actively with stakeholders impacted by adverse social and environmental effects to ensure their concerns are addressed.
create a robust due diligence framework that includes company-wide due diligence processes, a code of conduct, and details the integration of due diligence tasks. This framework should be revised with major changes and undergo a biennial review.
set up a clear and accessible complaint handling process that is open to the public, guaranteeing proper responses to feedback and concerns.
produce an annual report detailing the company’s business activities, available in at least one official EU language for public access.
draft, implement and annually update a climate transition plan with scope 1, 2 and 3 emissions targets.

Penalties

Member States will establish rules on penalties, including financial penalties. These pecuniary penalties will need to be effective, proportionate, and dissuasive. Fines will be calculated based on worldwide net turnover and will be not less than 5% of worldwide net turnover (in the financial year preceding the fining decision). The civil liability of companies will persist, with companies that intentionally or negligently breach obligations under the CSDDD being liable to pay damages.

What happens next?

Once adopted by the European Council, the CSDDD will enter into force 20 days after being published in the Official Journal of the European Union. This will trigger the following transposition periods: 2 years for Member States to implement and 3, 4, or 5 years for companies to comply depending on their size (please see our transposition periods table listed above).

In preparation, companies should establish compliance schedules in anticipation of the Directive's provisions coming into effect. Naturally, this will require engagement from the board level down with operations teams being appointed to ensure companywide compliance. In scope companies should think about: