After months of discussion – and years of development – on December 14, 2023, the European Council and the Parliament reached a provisional agreement on the Corporate Sustainability Due Diligence Directive (“CSDDD”). The CSDDD requires that certain EU-based and non-EU-based companies conduct broad human rights and environmental due diligence across their operations and supply chains. We have been chronicling the journey toward enactment of the CSDDD since 2020, when serious discussions first emerged after the publication of a lengthy scoping study (see here, here, here, here and here, just to get started), and engaged in debates formal and informal. The provisional agreement, along with documents that appear to reflect the discussions, provides the contours of the agreement – but leaves open a range of immediate and long-term questions.

Here is what we know so far.

Who is in Scope

The Directive is a compromise of the drafts from the Commission, Council and Parliament. It will apply to EU-based companies with more than 500 employees and a net worldwide turnover of €150 million. It will cover non-EU companies with €300 million of net turnover generated in the EU, applying three years after the Directive enters into force. The Commission will publish a list of those non-EU companies coming within the Directive’s scope.

As contemplated by the Commission’s draft, the Directive also will apply to EU companies with 250 or more employees and a global net turnover above €40 million in the last financial year, if €20 million or more (and non-EU companies and parent companies with equivalent turnover in the EU) is generated in a specified “high risk” sector: manufacture and wholesale trade of textiles, clothing and footwear; agriculture, including forestry and fisheries; manufacture of food products and beverages, and trade of raw agricultural materials; extraction and wholesale trade of mineral resources or manufacture of related products (including basic metal products); and construction.

Resolving one of the most significant points of dispute, it appears that the financial sector (e.g., banks, insurance companies, private equity firms and asset managers) will only be required to conduct due diligence on their own operations and supply chains, but not their clients or investments. In line with global policy developments on transition planning, they will also be required to prepare a climate transition plan. It appears from the announcement, however, that this may be reviewed again down the road.

What’s Required

The core requirement of the preliminary materials released in respect of the Directive is not a surprise, as it was reflected in the drafts of all three EU institutions. Covered companies will be required to conduct due diligence regarding actual and potential adverse impacts on the environment and human rights. More specifically, companies will be obliged to identify, assess, prevent, mitigate, bring to an end and remedy their adverse impacts and those of their upstream and certain downstream business partners. Due diligence components will include adopting due diligence policies, instituting risk-management systems, incorporating contractual assurances, instituting grievance or complaints mechanisms, publicly reporting on due diligence policies and regularly monitoring the effectiveness of those policies and the relevant steps taken to mitigate, prevent and address adverse impacts. As part of their due diligence processes, companies also must carry out meaningful engagement, including a dialogue and consultation with affected stakeholders, which was a priority in the Parliament’s draft.

Certain aspects of the due diligence obligations remain unclear. For instance, while the Directive will apply to upstream and downstream “business partners,” the final definition of “business partners” is not yet known.

As predicted, the Directive will cover limited downstream activities, including (per the press releases) distribution and recycling but not end-use, sales and disposal of goods.

Further, companies will be expected to use their leverage to effect change throughout their value chains. However, at Parliament’s insistence, companies that identify adverse impacts on human rights or the environment by a business partner will, if the impacts cannot be prevented or stopped, be required to terminate the relationship.

Importantly, it appears that duties of directors to oversee the due diligence process did not make the cut in the provisional agreement.

What are the Covered Rights

The covered rights and impacts will, as has been the case in each of the drafts, appear in Annex I to the Directive – though the scope of those rights is not yet clear. The Provisional Agreement adds new elements for vulnerable groups and Core International Labour Organization conventions, which can be added to the list once ratified by all EU member states. The Provisional Agreement also clarifies that the nature of environmental impacts to be covered will be measurable environmental degradation, such as harmful soil change, water or air pollution, harmful emissions or excessive water consumption or other impacts on natural resources.

How is Climate Treated

Large EU companies, including those in the financial sector, are going to have to adopt a climate transition plan that is aligned with the Paris Agreement, ensuring their business model complies with limiting global warming to 1.5° C. Companies with more than 1,000 employees are expected to link executive remuneration to the plan’s implementation.

What are the Penalties

Enforcement is contemplated both through regulatory and civil proceedings. As anticipated, Member State supervisory agencies can launch investigations and impose penalties on non-compliant companies, which can include injunctions and fines of up to 5% of their net worldwide turnover.

In addition, pursuant to the provisional agreement, companies can be liable for damages for intentional harms or negligence under national law if their failure to comply with the CSDDD results in harm (but damages are not available when failing to adopt a climate transition plan). Affected persons will have at least five years to bring damages claims relating to adverse impacts, and claims can be brought to representative parties – including unions and civil society organizations. Claimants also will reportedly benefit from reduced disclosure and cost requirements. However, it appears that companies will not be liable for harms caused by partners in their value chains. Importantly, companies that have participated in industry or multi-stakeholder initiatives, or used third-party verification or contractual clauses to support the implementation of due diligence obligations, can still be held liable.

CSDDD compliance also may be considered in awarding public contracts and concessions by Member States.

What are the Next Steps

The Provisional Agreement still must be formally approved by the European Parliament and European Council, and further changes may be made during the negotiation. The text of the legislation will then be signed and published in the Official Journal of the European Union and will enter into force 20 days later to complete the lawmaking process – likely before EU elections in June.

The Directive then needs to be transposed into national law by the EU member states, who are expected to have two years to do so. Company obligations will likely begin in 2026 (and 2027 for non-EU companies).

And the Questions …

While the Provisional Agreement is groundbreaking and hugely significant, there remain as many questions as the Provisional Agreement answers. Short term, they include:

• How will existing EU domestic due diligence laws, such as those in Germany, Norway and France, reconcile with the CSDDD? To that end, will companies be expected to extend due diligence to the raw material phase, beyond the first tier, where there is no “substantiated knowledge,” as required in Germany?
• What human rights ultimately will be in scope for the CSDDD? Will it include rights that have, traditionally, applied only to states, and thus may not naturally transpose to companies? How will the rights be defined in application – e.g., what are the elements – if they have vague or differing elements among jurisdictions?
• What will state supervisory agencies consider to be “reasonable” due diligence, and how will that be applied across a vast range of sectors, with widely different risk profiles?
• How is the requirement of stakeholder engagement going to be defined and interpreted in practice, and how substantial must it be (and with whom)? Will it reflect the stakeholder engagement provisions of the Corporate Sustainability Reporting Directive (“CSRD”)?
• If reporting requirements are aligned with the CSRD, will company due diligence efforts be limited to those areas where double materiality has been identified? How will the two obligations work together in practice? And if a company does not report under the CSRD, what will the reporting expectations actually include?

Longer term, they include:

• Will human rights due diligence, in practice, be defined by the contours of the CSDDD, and human rights reporting be limited to the contours of the CSRD? Will companies have the bandwidth to do more? What differences in enforcement approaches will we see across EU Member States, including in those states with existing regimes?
• Assuming the CSDDD is finalized, will it influence a larger, global business and human rights treaty? Will additional countries outside the EU adopt their own versions of the CSDDD?
• How will the CSDDD mesh with the International Sustainability Standards Board sustainability disclosure standards on social topics?

We will be paying close attention to these questions and others over the next few months and years.