After months of negotiations, on 14 December, the EU Parliament and Council reached a provisional agreement on the principles that will underpin the Corporate Sustainability Due Diligence Directive ("CS3D").

The substance of the legislation remains as previously proposed (and as described in our early briefing). CS3D will impose a due diligence duty on in-scope large companies operating in the Europe Union, requiring that they take steps to identify, prevent and mitigate human rights and environmental impacts connected with their own operations, those of their subsidiaries and in their value chains.

While the agreed text has not yet been published, the legislators provided enough information to alleviate some of the key areas of uncertainty, for example around scope.

1 SCOPE

In terms of scope, the CS3D will apply to:

  • EU companies (or groups) which:
    • had more than 500 employees and a net worldwide turnover of EUR150 million

    • had more than 250 employees and a net worldwide turnover of EUR40 million, where at least EUR20 million was generated in high-impact sectors*
  • Non-EU companies (or groups) which:
    • had more than EUR150 million of net turnover in the EU
    • had more than EUR40 million of net turnover in the EU, where at least EUR20 million was generated in high-impact sectors*

* manufacture and wholesale trade of textiles, clothing and footwear, agriculture including forestry and fisheries, manufacture of food or drink, wholesale trade of agricultural raw materials, live animals, wood, food or drink, extraction and wholesale trade of mineral resources or manufacture of related products, and construction.

2 Excluding the financial sector from scope

The extent to which financial services should be covered by the Directive has been a key point of contention from the outset. While the Commission originally proposed no special treatment for financial services firms, the Council proposed to leave member states to decide for themselves whether to include downstream financial services (a worst case scenario for those active in multiple member states), and the Parliament proposed their inclusion with some loosely worded exceptions for asset managements and institutional investors. Compromises have been made in the text with the Parliament accepting the exclusion of the financial sector's investment and lending activities from the scope of the due diligence obligations. This has been conceded on the basis that it will be subject to review in several years' time.

3 Core Requirements

The CS3D obligations will apply to the in-scope company's own operations, its subsidiaries and their "chain of activities" (the term preferred by the European Parliament for the "value chain" concept). To comply with the due diligence duty, companies need to integrate a risk-based due diligence process into their policies and procedures and take appropriate steps to:

  1. identify, assess and, where needed, prioritise actual or potential adverse human rights and environmental impacts;
  2. prevent or mitigate potential adverse impacts; and
  3. bring to an end, minimise and remedy actual adverse impacts;
  4. establish and maintain a notification mechanism and complaints procedure;
  5. monitor the effectiveness of its due diligence policy and measures; and
  6. publicly communicate on due diligence.

In addition to the above, companies will be required to adopt a transition plan and make best efforts to ensure their business strategy is compatible with limiting global warming to 1.5oC.

4 Enforcement

National authorities will be responsible for enforcement against companies who fail to comply with the CS3D. Their powers will include an ability launch inspections and investigations and impose penalties on non-compliant companies, including "naming and shaming" and imposing maximum fines of not less than 5% of net worldwide turnover. In addition, and variously described as both a dissuasive and persuasive measure across the EU institutions, compliance with the due diligence obligations may also be used as part of the award criteria for procurement of public contracts and concessions.

In addition to the threat of action by national authorities, the CS3D will also provide victims of a company's failure to identify, mitigate or prevent adverse impacts with an avenue to pursue civil action for damages.

5 Timeframe

In terms of immediate next steps, the agreement in principle reached by the European Parliament and the Council needs to be rendered into a draft text. We understand that this process may not be quick to achieve, as a number of issues remain open, and even the institutions' press releases regarding the conclusion of the negotiations are not in perfect alignment. The draft text, which is expected in February, will then be subject to formal approval by the co-legislators.

Once published in the Official Journal, the CS3D will enter into force 20 days after publication and Member States will have 2 years to transpose the provisions of the Directive into national law. Similarly to the CSRD, companies will be phased into scope three years from the entry into force of the directive, but unlike CSRD, non-EU companies in scope are expected to have to comply sooner rather than later.

Taking all of those steps into account, the first CS3D obligations could start applying in 2027.

6 A sigh of relief for UK business?

It is true that the compromise deal struck between the European Parliament and the Council results in a significantly narrower scope than, in particular, the European Parliament's negotiating position which would have drawn in many more entities based on lower financial and employee thresholds. The absence of a requirement for UK and other non-EU companies to meet an employee threshold was highlighted during earlier stages as anomalous, given that EU companies must have at least 500 employees to be in scope. Overall, the lack of alignment between the scope of CS3D and CSRD is striking, as the following examples illustrate.

Company A is a German limited company. It has 1000 employees worldwide, a turnover of EUR145 million and a balance sheet of EUR48 million.

Company A is NOT in the scope of CS3D because it does not meet the financial threshold even though it does meet the employee threshold. If not repealed or amended (as a result of CS3D), Company A is likely to be covered by the due diligence obligations in Germany's supply chain diligence law (LkSG) from 2024.

Company A is in the scope of CSRD because it meets two of the three thresholds for employee numbers, balance sheet and turnover.

Company B is a UK limited company. It has 200 employees, and generates EUR200 million of revenue from the EU. It does not however have a physical or legal presence in the EU.

Company B is in the scope of CS3D because it meets the single financial threshold.

Company B is NOT in the scope of CSRD because it does not have either an in-scope subsidiary or a branch in the EU. It is expected, however, to report on matters covered by CS3D consistently with CSRD, with the exact requirements to be determined by the Commission at a later stage.

Company C is a Spanish company with 249 employees, turnover of EUR155 million and a balance sheet of EUR24 million.

Despite its significant size, Company C is not in the scope of either CS3D or CSRD.

Company C is not in the scope of CS3D as it does not meet the employee threshold, even though it does meet the financial threshold.

Company C is also not in the scope of CSRD as it does not meet two of the three thresholds for employee numbers, balance sheet and turnover.

Company D is a US company listed on an EU regulated market. It has 1000 employees and turnover of EUR300 million, with EUR100 million deriving from the EU.

Company D is not in the scope of CS3D because it does not meet the financial threshold.

Company D is in the scope of CSRD due to having securities listed on an EU regulated market.

Though almost universally described as "groundbreaking", it is important to remember that the type of due diligence which will be required by the CS3D is already being mandated by the EU on a piecemeal basis via legislation with a specific sector focus. This includes the new Batteries Regulation, which will require implementation of due diligence within the battery supply chain, in order to avoid a range of social and environmental impacts. Similarly, the Deforestation Regulation contains extensive requirements for due diligence to prove that certain commodities are "deforestation free" and have been produced in accordance with the laws of the country of origin. (More details on these regulations can be found in our October 2023 briefing.) Each such potentially applicable regime has different criteria for application.

Furthermore, multinational entities based outside the EU and falling below the CS3D thresholds should be aware of national legislation with similar aims. CS3D was to a large extent based on the French Corporate Duty of Vigilance law; Germany and Norway have similar legislation (each with different scope) and the Netherlands is progressing a draft law which is expected to apply to some non-Netherlands entities. Despite these national developments, the final CS3D text is expected to require broad harmonisation of core requirements, but whether that will prevent the application of national measures to a different range of entities remains to be seen. Certainly in the short term, the regulatory landscape remains complex for those thinking about how to comply.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.