Over the next few years, lawmakers and regulators in many jurisdictions will deepen their implementation of new human rights laws that impose significantly higher compliance burdens on companies. Concerns over whether companies can tolerate the increasing challenges associated with compliance are quickly being supplanted by the belief that companies must build ESG risk management systems into their cost of doing business. 

Three new laws in the European Union and the United States illustrate this transformation: a closely followed E.U. Directive compelling companies to carry out stringent environmental and human rights due diligence on their operations globally and two laws in the United States and the European Union demanding that companies importing products into their borders make sure these goods are free of forced labor and other forms of modern slavery. 

This is in addition to existing, enhanced, and just-passed legal regimes in Australia, France, Germany, the Netherlands, Canada, and Mexico that codify requirements for companies to eradicate forced labor in their supply chains and conduct (and publicly report on) due diligence that can affirm they are not responsible for human rights harms. 

E.U. Sustainability Directive: Companies Should Look at the FAQs
On 25 July 2024, the E.U. Directive on corporate sustainability due diligence (Directive 2024/1760) entered into force. The Directive will serve as a global guiding force for government initiatives seeking to establish a binding, responsible business regime. 

Many companies regularly assess rights risks with sincere intentions and properly premise them on internationally recognized human rights frameworks like the OECD Guidelines for Multinational Enterprises and the U.N. Guiding Principles on Business and Human Rights (UNGPs). Yet as repeatedly emphasized by the European Commission during every iteration of the Directive’s development, “progress has been slow and uneven” after two decades of companies being left to follow their own standards.

To better prepare companies for enforcement under the Directive, the European Commission issued a Frequently Asked Questions guidance to companies when the law went into effect. In addition, unlike the U.S. Government’s enforcement of the U.S. Uyghur Forced Labor Prevention Act, the Commission had delayed full enforcement of the Directive to provide a sufficient glide scope for businesses to revamp their sustainability risk management systems.

The FAQs issued by the European Commission explain that E.U. Member States have until 26 July 2026 to transpose the Directive into national law. On that date, the regulations will start to apply to companies, with a gradual phase-in period of three to five years after entry into force. 

The three-year phase-in will apply to all E.U. companies with more than 5,000 employees and €1,500 million in worldwide turnover, as well as non-E.U. companies with more than €1,500 million turnover generated in E.U. marketplaces. A four-year period will apply to E.U. companies with more than 3,000 employees and €900 million worldwide turnover, as well as companies headquartered outside the European Union generating more than €900 million of turnover in the E.U. market. All remaining companies whose commercial activities are less than the above categories but still fall within the statute’s scope of applicability will have five years until they must comply with the Directive’s rules. 

Companies should bear in mind that the Directive’s definition of “supply chains” is the same one used by human rights practitioners; both the upstream and downstream segments of a supply chain must be assessed in the due diligence process, or every stage of production from raw material to the final sale of the finished product. So far, most – if not all – countries with similarly-minded human rights laws treat each segment in a supply chain as the same and interrelated. In other words, a company responsible for forced labor in one segment will generate some risk for all other commercial enterprises within that chain.  

For example, businesses categorized as small and midsize enterprises do not have to comply with the Directive and will not be subject to its civil penalties. However, they could be hindered if a company in their supply chain is assessed penalties under the Directive since such regulatory action may lead to supply chain disruptions throughout the chain and expensive demands from civil society and shareholder groups.   

While E.U. and non-E.U. companies are placed into different categories to define their commercial activity thresholds, the quality and thoroughness of the due diligence reporting they are required to provide regulators are the same.

Under the Directive, due diligence must follow a risk-based analysis – an approach that hues to the assessment methodology established by the UNGPs. Covered companies will, therefore, be obligated to assess the actual and potential salient harms to affected rights-holders for which their operations and activities risk being responsible. Upon identifying such adverse impacts, the UNGPs compel companies to address the harms by taking appropriate remediative steps – with the greatest priority given to harms whose scope and scale are deemed irremediable if left unaddressed. To supplement internal efforts, counsel from outside experts on responsible business practices can help companies’ human rights managers more effectively assess all the salient risks, potential harms, and necessary remediation measures in the due diligence process. 

The E.U. Directive’s due diligence requirements are complemented by a suite of penalties that E.U. member states can impose on non-compliant companies. The administrative enforcement mechanisms at regulators' disposal include legal injunctions (i.e., orders to cease or adopt certain conduct), proportionate sanctions (including fines), and ineligibility for public contracts or partnerships. To ensure consistent enforcement, a European Network of Supervisory Authorities will ensure a coordinated approach among the authorities in E.U. member states and allow for cooperation in enforcement cases and information-sharing initiatives.

With respect to the Directive’s civil liability regime, when covered companies intentionally or negligently fail to comply with their duty to prevent, mitigate, and minimize or cease adverse impacts, and this failure causes or contributes to damage, such companies can be held liable for the damage suffered. They will not be liable if only the business partner(s) in their chain of activities caused the damage. When the company is considered liable, it must provide full compensation to the victim for the damage suffered. Injured parties may authorize a trade union, a non-governmental human rights organization, or other non-governmental organization domiciled in a member state to bring actions on their behalf.

The Commission has also been circumspect in assuring that ample guidance to industry will be published as the Directive is advanced. In practice, the Commission plans to issue general and sector-specific guidelines that detail risk factors and how to conduct due diligence in accordance with the Directive, such as the identification process, the prioritization of impacts, stakeholder engagement, and responsible disengagement (remediation); model contractual clauses for the relationship with business partners; criteria and a methodology for companies to assess the fitness of industry and multistakeholder initiatives as well as outside experts; and data assessment tools.

This support will become all the more important when the European Union’s new forced labor law goes into full effect in about two years. Multinationals operating in E.U. markets will need relevant guidance to ensure their due diligence under the Sustainability Directive addresses forced labor risks across their global supply chains.    

The FAQs provide considerably more information than what is discussed in this article, and companies should consult with their internal teams and external human rights experts to review them and determine the right course of compliance.  

U.S. Human Rights Laws and Corporate Requirements: A Work in Progress 
The United States, by comparison, has imparted a narrower set of binding requirements. This is primarily centered on prosecuting human trafficking within the United States and preventing goods derived from forced labor from entering. With respect to the latter, the U.S. Uyghur Forced Labor Prevention Act (UFLPA) is aimed at companies and their supply chain partners who produce imports that are made in whole or in any part from forced labor. Although the UFLPA is focused on preventing abuses against laborers from Chinese minority groups, it provides the U.S. Customs and Border Protection agency with enhanced authority to detain and seize imports made with forced labor beyond just Xinjiang and other regions in China.  

However, companies whose supply chains share a nexus with U.S. imports and high-risk regions of China have been quite vocal regarding the flimsy industry guidance to which CBP has thus far committed. Several paradoxes in the agency’s guidance make forced labor risk management exceedingly difficult. The agency's call for robust supply chain due diligence based on the UNGPs is of particular concern. Still, it will not accept factory audits in China as evidence when trying to reverse a shipment detention order. There are valid concerns over the credibility of human rights assessments conducted under the watch of Chinese authorities – ask any human rights organization whose advocacy focuses on supply chain issues. However, it leaves U.S. importers and their supply chain partners with an immutable level of risk, even if they adhere to the highest standards in assessing their human rights impacts.

Regarding binding U.S. requirements that emulate the E.U. Sustainability Directive, the Supreme Court’s evisceration of federal agencies’ Chevron deference augurs poorly for regulations that would require companies to conduct due diligence on forced labor. The only U.S. agency to have yet established requirements for certain sustainability reporting is the Securities and Exchange Commission. However, the Supreme Court’s ruling threatens that progress and will prevent corresponding regulations on corporate due diligence by other agencies. 

In the interim, CBP has pledged tougher enforcement of the UFLPA after receiving intense criticism from human rights groups and members of Congress from both parties. Due to resource constraints and perhaps to give companies some latitude in these first years of enforcement, CBP has routinely released detained shipments even when a company has not provided the high “clear and convincing” standard of evidence required under the statute. Overall, 50% of imports detained by CBP under the UFLPA have been subsequently released. 

Companies attempting to comply with the UFLPA have also not caught a break from Congress. In addition to many congressional letters criticizing the Biden Administration’s enforcement effort, Republican and Democrat members of the House Select Committee on China this year issued a letter denouncing Volkswagen’s decision to volitionally disclose potential forced labor risks in its auto parts supply chains linked to Xinjiang. The company subsequently worked with CBP to recall a large shipment of vehicles with the suspect parts. 

Despite Volkswagen taking steps above and beyond to immediately identify and remediate potential forced labor harms, many members of Congress who pushed the UFLPA into law want more from importers and their commercial partners. The hearings and reports by the Committees that wrote the UFLPA point to a Congress that wants companies operating in the United States to exit Xinjiang and China entirely. In their view, the statute’s ultimate intent is to create an unending specter of enforcement risk, thereby making the United States and other countries with higher labor standards better places to operate.