Over the next few years, lawmakers and regulators in many jurisdictions will be deepening their implementation of new human rights laws that impose significantly higher compliance burdens for companies. Concerns over whether companies can tolerate the increasing challenges associated with compliance are fast being supplanted by the belief that companies must build ESG risk management systems into their cost of doing business.
Three new laws in the European Union and the United States illustrate this transformation: a soon-forthcoming E.U. Directive compelling companies to carry out stringent environmental and human rights due diligence on their operations globally; and two laws in the United States and the European Union demanding that companies importing products into their borders make sure these goods are free of forced labor and other forms of modern slavery.
This is in addition to existing, enhanced, and just-passed legal regimes in Australia, France, Germany, the Netherlands, Canada, and Mexico that codify requirements for companies to eradicate forced labor in their supply chains, with particular focus on conducting (and publicly report on) due diligence that meaningfully affirms where they may be responsible for human rights harms and steps for remediating such impacts.
E.U. Sustainability Directive: Companies Should Look at the FAQs
On 25 July 2024, the E.U. Directive on corporate sustainability due diligence (Directive 2024/1760) entered into force. The Directive will serve as a global guiding force for government initiatives seeking to establish a binding responsible business regime.
There are many companies that carry out regular internal and external assessments of rights risks with sincere intentions. We often encounter companies who are properly premising this due diligence on seminal internationally-recognized human rights frameworks like the U.N. Guiding Principles on Business and Human Rights (UNGPs), the OECD's Guidelines for Multinational Enterprises on Responsible Business Conduct, the natural resource sector's Voluntary Principles on Security and Human Rights, and the tech sector's Santa Clara Principles on Transparency and Accountability in Content Moderation.
Yet as emphasized by the European Commission when explaining the purpose of legally-binding due diligence standards, "progress has been slow and uneven" after two decades of companies in the E.U. market being left to follow their own set of standards.
To better prepare companies for enforcement under the Directive, the European Commission recently issued a Frequently Asked Questions guidance to companies before the law goes into effect. In addition, unlike the U.S. Government's enforcement of the U.S. Uyghur Forced Labor Prevention Act, the Commission had delayed full enforcement of the Directive to provide a sufficient glide scope for businesses to revamp their sustainability practices and risk management/response systems.
The FAQs issued by the European Commission explain that E.U. Member States have until July 26, 2026 to transpose the Directive into national law. On that date, the regulations will start to apply to companies, with a gradual phase-in period of between three and five years after entry into force.
The three-year phase-in will apply to all E.U. companies with more than 5,000 employees and €1,500 million in worldwide turnover, as well as non-E.U. companies with more than €1,500 million turnover generated in E.U. marketplaces. A four-year period will apply to E.U. companies with more than 3,000 employees and €900 million worldwide turnover, as well as companies headquartered outside the European Union generating more than €900 million of turnover in the E.U. market. All remaining companies whose commercial activities are below these thresholds, but still fall within the statute's scope of applicability, will have five years until they must comply with the Directive's regulatory regime.
Companies should bear in mind that the Directive's definition of "supply chains" is the same one used by human rights practitioners; both the upstream and downstream segments of a supply chain must be accounted for in the due diligence process, or every stage of production from raw material to the final sale of the finished product. So far, most – if not all – countries with similarly-minded human rights laws treat each segment in a supply chain as one and the same and interrelated. In other words, a company responsible for forced labor in one segment will generate some level of risk for all other commercial enterprises within that chain.
Companies categorized as small and midsize business enterprises, for example, do not have to comply with the Directive and will not be subject to its civil penalties. They could, however, be hindered if a company in their supply chain is assessed penalties under the Directive – since such regulatory action may lead to supply chain disruptions throughout the chain and significant demands from civil society, shareholder groups, and socially-responsible investment firms.
While E.U. and non-E.U. companies are placed into different categories for the purpose of defining their commercial activity thresholds, the quality and thoroughness of the due diligence reporting they are required to provide regulators are substantially the same.
Pursuant to the Directive, due diligence must follow a risk-based analysis – an approach that hues to the assessment methodology established by the UNGPs. Covered companies will therefore be obligated to assess the actual and potential salient harms to affected rights-holders for which their operations and activities risk causing, contributing to, or being commercially linked.
Upon identifying such adverse impacts, the UNGPs compel companies to address the harms by taking appropriate remediative steps – with greatest priority given to the most serious harms whose scope and scale risk being irremediable if left unaddressed. To supplement internal efforts, counsel from outside experts on responsible business practices can help companies' human rights managers more effectively assess all the salient risks, actual and potential salient harms, and necessary remediation measures entailed in the due diligence process.
The E.U. Directive's due diligence requirements are complemented by a suite of penalties that E.U. member states can impose on non-compliant companies. The range of administrative enforcement mechanisms at the disposal of regulators include legal injunctions (i.e. orders to cease or adopt certain conduct); proportionate sanctions (including fines); and ineligibility for public contracts or public sector partnerships. To ensure consistent enforcement, a European Network of Supervisory Authorities will ensure a coordinated approach between the authorities in E.U. member states and allow for cooperation in enforcement cases and information-sharing initiatives.
With respect to the Directive's civil liability regime, when covered companies intentionally or negligently fail to comply with their duty to prevent, mitigate, and minimize or cease adverse impacts, and this failure causes or contributes to damage, such companies can be held liable for the damage suffered. They will not be liable if only the business partner(s) in their chain of activities caused the damage. In instances where the company is considered liable, it will have to provide full compensation to the victim for the damage suffered. Injured parties may authorize a trade union, a non-governmental human rights organization, or other non-governmental organization domiciled in a member state to bring actions on their behalf.
The Commission has also been circumspect to assure companies that ample guidance to industry will be published as the Directive is advanced. In practice, the Commission plans to issue general and sector-specific guidelines that detail risk factors; how to conduct due diligence in accordance with the Directive, such as the identification process, the prioritization of impacts, stakeholder engagement, and responsible disengagement (remediation); model contractual clauses for the relationship with business partners; criteria and a methodology for companies to assess the fitness of industry and multistakeholder initiatives as well as outside experts; and data assessment tools.
This support will become all the more important when the European Union's new forced labor law goes into full effect by 2026 or 2027, as multinationals operating in E.U. markets will need relevant guidance to ensure their due diligence under the Sustainability Directive addresses forced labor risks across their global supply chains.
The FAQs provide considerably more information than what is discussed in this article, and companies should consult with their internal teams and external human rights experts in reviewing them and determining the right course of compliance.
U.S. Human Rights Laws and Corporate Requirements: A Work in Progress
The United States, by comparison, has imparted a narrower set of binding requirements. This is primarily centered on prosecuting human trafficking within the United States, through the Victims of Trafficking and Violence Prevention Act and its many reauthorizations – and preventing goods derived from forced labor from entering through enforcement of the U.S. Tariff Act. As is common knowledge by now, the U.S. Uyghur Forced Labor Prevention Act (UFLPA) amended Section 307 of the Tariff Act to focus enforcement on companies and their supply chain partners who produce imports, made in whole or in any part, from forced labor in the Uyghur-majority Xinjiang region and other parts of China where persecuted minorities may be subject to modern slavery conditions.
Although the UFLPA is focused on preventing abuses against laborers from Chinese minority groups, it provides the U.S. Customs and Border Protection agency with enhanced authorities to detain and seize imports made with forced labor beyond just China.
But companies whose supply chains share a nexus with U.S. imports and high-risk regions of China have been quite vocal regarding the flimsy industry guidance to which CBP has thus far committed. There are a number of paradoxes in the agency's guidance that make forced labor risk management exceedingly difficult. Of particular concern, the agency calls for robust supply chain due diligence based on the UNGPs, but will not accept factory audits in China as evidence when trying to reverse a shipment detention order.
There are valid concerns over the credibility of human rights assessments conducted under the watch of Chinese authorities – ask any human rights organization whose advocacy focuses on supply chain issues. But it leaves U.S. importers and their supply chain partners with an immutable level of risk, even if they adhere to the highest standards in assessing their human rights impacts.
Regarding binding U.S. requirements that emulate the E.U. Sustainability Directive, the Supreme Court's evisceration of federal agencies' Chevron deference augurs poorly for regulations that would require companies to conduct due diligence on human rights and other responsible business practices. The only U.S. agency to have advanced requirements for certain sustainability reporting is the Securities and Exchange Commission. The Supreme Court's ruling, however, threatens that progress and will prevent corresponding regulations on corporate due diligence by other agencies.
In the interim, CBP has pledged tougher enforcement of the UFLPA, after receiving intense criticism from human rights groups and members of Congress from both parties. Due to resource constraints and perhaps to give companies some latitude in these first years of enforcement, CBP has routinely released detained shipments even when company has not provided the high "clear and convincing" standard of evidence required under the statute. Overall, 50% of imports that were detained by CBP under the UFLPA have been subsequently released with little to no closure on the evidentiary standard that CBP applied to those releases.
Companies attempting to comply with the UFLPA have also not caught a break from Congress. In addition to many congressional letters criticizing the Biden Administration's enforcement effort, Republican and Democrat members of the House Select Committee on China this year issued a letter denouncing Volkswagen's decision to volitionally disclose potential forced labor risks in its auto parts supply chains linked to Xinjiang. The company subsequentially worked with CBP to recall a large shipment of vehicles made with the suspect parts.
Yet despite Volkswagen taking steps above and beyond to immediately identify and remediate potential forced labor harms, many members of Congress who pushed the UFLPA into law want more from importers and their commercial partners. In fact, the hearings and reports by the Committees that wrote the UFLPA point to a Congress that wants U.S. companies to exit Xinjiang and China entirely. In their view, the statute's ultimate intent is to create an unending specter of enforcement risk, thereby making the United States and other countries with higher labor standards more attractive places to operate.
There will surely be some steps back in the movement towards a binding responsible business standard, with partisan pushback to sustainability, DEI, and environmental justice welling to the surface – particularly in the United States. And globally this effort remains very much a fledgling patchwork of legal obligations. But for those who see the longer-arc pattern that is emerging, the transformation to mandatory bears a resemblance to the Civil Rights Movement of the 1960s; it's gaining critical mass in the conscience of societies and stands little chance of being stopped.
Originally published 11 August 2024
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
