The European Union’s Corporate Sustainability Due Diligence Directive (CSDDD or Directive) entered into force on July 25, 2024, establishing a framework for companies to address risks and adverse impacts on human rights and the environment in their supply chains.
Member states now have two years — until July 26, 2026 — to implement the CSDDD into their national laws.
In Germany, many companies have already taken measures under the German National Supply Chain Act (“Lieferkettensorgfaltspflichtengesetz,” or LkSG) that overlap with those under the CSDDD.
However, since the CSDDD, at least in part, stipulates stricter standards than the LkSG, companies subject to the CSDDD are encouraged to use the next two years to adapt their internal compliance procedures to meet the CSDDD’s enhanced requirements.
Meanwhile, the German government is currently discussing the possibility of suspending the LkSG until the CSDDD is implemented in order to temporarily reduce bureaucracy.
The Directive will especially impact companies operating in the following industries:
- Manufacturing
- Textile (wholesale)
- Food and beverage
- Agriculture
- Forestry
- Fishery
- Material extraction
The CSDDD has a stronger focus on climate protection and sets stricter obligations in this regard than the LkSG; the Directive is one of the tools the European Union is using to achieve the goals of the European Green Deal and the Paris Agreement.
The EU considers the private sector to play a key role in meeting the target to limit the warming of the planet to 1.5 degrees Celsius as well as other European climate protection targets (the reduction of emissions by at least 55% by 2030 and climate neutrality by 2050).
The CSDDD is intended to counteract the unequal distribution of raw materials and prevent the pollution of air, water and soil. Its overall aim is to make the economy more sustainable, focusing particularly on production in third countries.
Applicability
The CSDDD is to apply to companies according to the following schedule:
- Starting on July 26, 2027: The CSDDD will apply to companies with an average of more than 5,000 employees and more than €1.5 billion net turnover in the last financial year. Part-time and temporary workers count as fully fledged employees for the purposes of calculating the thresholds.
- Starting on July 26, 2028: The regulation will apply to companies with an average of more than 3,000 employees and a worldwide net turnover of more than €900 million in the last financial year.
- Starting on July 26, 2029: The threshold will be lowered to 1,000 employees and a turnover of €450 million in the last financial year.
Furthermore, companies incorporated under the law of a third country fall within the scope of the CSDDD if they themselves or their parent company either have a gradual net turnover of €1.5 billion (as of July 26, 2027), €900 million (as of July 26, 2028) or €450 million (as of July 26, 2029) in the EU.
Companies that do not reach these thresholds but are the ultimate parent companies of a group that on the basis of a consolidated annual financial statement reached the above thresholds in the last financial year are also subject to the CSDDD.
Moreover, the Directive will apply to a company or parent company that entered into franchising or licensing agreements in the EU ensuring a common corporate identity with a worldwide turnover higher than €80 million in the last financial year, if at least €22.5 million were generated through royalties.
If the ultimate parent company primarily holds shares in the operating subsidiaries and is not involved in management, operational or financial activities, and the subsidiary fulfills the obligations of the CSDDD, the former is not subject to the CSDDD. This exception requires an application for determination by the ultimate parent company. Even in this case, the ultimate parent company and the subsidiary remain jointly liable if the obligations of the CSDDD are breached.
By comparison, the LkSG applies irrespective of any annual turnover thresholds to companies with their head office, main branch, administrative headquarters or registered office in Germany that generally employ at least 1,000 employees.
Obligations for Companies
The CSDDD requires the implementation of a due diligence process. It covers the six steps defined by the Organization for Economic Cooperation and Development’s (OECD’s) Due Diligence Guidance for Responsible Business Conduct:
- Integrating due diligence into policies and management systems.
- Identifying and assessing adverse impacts on human rights and the environment.
- Preventing, ceasing or minimizing actual and potential adverse impacts on human rights and the environment.
- Monitoring and assessing the effectiveness of measures.
- Publicly communicating on due diligence efforts.
- Providing remediation.
Companies will also have to adopt a transition plan to make their business model compatible with the Paris Agreement global warming limit of 1.5 degrees Celsius.
In general, both upstream and downstream businesses are covered. This extends the material scope of the LkSG, which only covers activities from upstream business relationships. Downstream activities generally include all business activities of business partners that involve direct or indirect distribution, transport and storage for or on behalf of the company. The product marketing chain is included.
The term “chain of activities” is interpreted more broadly in the CSDDD than the supply chain term covered by the LkSG. As a result, companies will have to adopt the same due diligence obligations with regard to indirect suppliers as they do with direct suppliers.
Companies should conduct risk-based human rights and environmental due diligence. The Directive calls for:
- Incorporating the issues into policies and risk management systems.
- Identifying and assessing actual or potential adverse impacts.
- Preventing and mitigating those impacts.
- Providing remediation to actual impacts.
A “corporate group clause” allows most due diligence obligations to be fulfilled at group level. In addition, an obligation to carry out “meaningful engagement with affected stakeholders” has been added, under which the term “stakeholders” is defined extremely broadly.
A review every two years and an ad hoc review of the effectiveness of the measures should be planned. If necessary, action must be adjusted accordingly based on the results.
The actions taken must be published in an annual report. The reporting obligation under the CSDDD is aligned with that under the Corporate Sustainability Reporting Directive (CSRD), meaning that there is no double reporting obligation. The CSRD should have been transposed into German law as of July 6, 2024. However, implementation has been delayed and is not expected to be completed before the end of 2024. The CSRD replaces the Non-Financial Reporting Directive (NFRD) from 2014.
A function similar to that of the human rights officer under the LkSG is to be established. This person (an authorized representative) should work together with a supervisory authority in the member state where the authorized representative is domiciled or established.
Companies must also set up a complaints procedure to which all potentially affected persons along the chain of activities must have access. This includes trade unions, employee representatives and certain civil law organizations. A complainant is entitled to request appropriate follow-up on the complaint from the company.
EU member states must individually or jointly provide detailed online information on companies’ due diligence obligations via websites, platforms or portals. This includes, in particular, access to the content and criteria for reporting, the European Commission’s guidance about voluntary model contract clauses, the Commission’s “single helpdesk” (through which companies can request additional information and guidance), and information for stakeholders and their representatives on how to engage throughout the due diligence process.
Compliance and Consequences
Oversight Responsibilities
Each member state must designate one or more supervisory authorities to oversee compliance with the CSDDD obligations. The competent supervisory authority in Germany is expected to be the Federal Office of Economics and Export Control (“Bundesamt für Wirtschaft und Ausfuhrkontrolle,” or BAFA), same as for the LkSG.
BAFA has so far pursued a cooperative approach with companies in its role as the LkSG’s supervisory authority:
- In 2023, BAFA carried out 486 inspections of companies for compliance with the LkSG.
- The majority of the inspections covered companies from the following sectors: automotive, chemicals, pharmaceuticals, mechanical engineering, energy, furniture, textiles, and the food and beverage industry.
- Of these, 78 inspections were carried out on an ad hoc basis, irrespective of the sector.
- Of the 38 complaints BAFA received via the complaints procedure, 20 had no reference to due diligence obligations under the LkSG or were insufficiently substantiated. BAFA contacted the companies in only six cases.
- BAFA has thus far imposed no sanctions.
- Regarding the new sustainability reporting obligations for companies under the CSRD, BAFA has announced that it will not review the availability of reports until January 1, 2025. Even if the submission of a report to BAFA and its publication in accordance with the LkSG was due before this date, BAFA will not sanction the failure to meet the deadline if the report is submitted to BAFA by December 31, 2024.
Penalties
The CSDDD provides for turnover-based penalties, the amount of which will be determined by the individual member states. The amount of the penalty is to be based on worldwide net turnover and provides for a maximum limit of at least 5% of worldwide net annual turnover.
Publicly Naming Noncompliant Companies
Under certain circumstances, as in many other EU directives, publicly naming noncompliant companies is expected to be a consequence.
Civil Liability
A violation of the LkSG’s obligations does not currently give rise to civil liability. Thus, under current German civil law, companies can be held liable for supply chain related wrongdoing only if the basis for the claim exists independent of the LkSG — for example, in general tort law.
This will change once the CSDDD has been implemented into German law. The CSDDD requires member states to ensure that a company can be held liable for a damage caused to a natural or legal person if the company intentionally or negligently failed to comply with specific obligations stipulated in the CSDDD. However, the company’s liability is excluded if the damage was caused only by the company’s business partners.
The CSDDD also requires member states to establish that the injured party may authorize a trade union or nongovernmental organization (NGO) to bring legal actions on its behalf. This provision is broadly in line with its corresponding provision in the LkSG.
In addition, the CSDDD provides for a disclosure obligation. When a claimant brings a plausible claim and indicates that additional evidence lies in the sole control of the company, courts must be enabled to order the company to disclose such evidence in accordance with national procedural law. The LkSG does not contain such a provision.
Once adopted into national law, activist NGOs will likely use the CSDDD’s civil liability provision as a gateway to file lawsuits against companies. For several years, NGOs have been making an effort to enforce human rights and environmental standards through civil actions. These legal actions, which are often accompanied by a professional marketing campaign and attract publicity, are mainly brought against well-known companies with high revenues.
We anticipate that NGOs will focus their CSDDD-related actions on companies that have already attracted public attention because of proven or alleged past violations of human rights or environmental standards. We also expect that companies operating in industries where toxic emissions may occur (including the clothing, mining and automotive industries) will likely become targets for CSDDD-related lawsuits.
Related Developments
In April 2024, the EU Parliament approved a new regulation that will enable the EU to ban the sale, import and export of goods produced using forced labor. It provides for the prohibition and removal from the internal market of such products, regardless of whether they were produced in the EU or imported into the EU.
The regulation enables member state authorities and the European Commission to investigate suspicious goods, supply chains and manufacturers. If a product is found to have been produced using forced labor, it can no longer be sold on the EU market (including online), and shipments will be intercepted at EU borders.
Sanctions can be imposed in the event of a breach of the regulation. Member states will determine sanctions as part of the individual implementation process.
The next step is for the European Council to approve the draft. Member states must transpose the regulation into national law within three years of it coming into force.
