Newsletter | Corporate Sustainability Due Diligence Directive

On 24 April 2024, the Corporate Sustainability Due Diligence Directive (the “CS3D”) was approved by the European Parliament, after a long legislative process lasted several years. 

The CS3D is set in the context of the European Union's (the “EU”) commitment to the respect and promotion of the values on which it is founded of human dignity, freedom, democracy, equality, respect for human rights as well as the protection and improvement of the quality of the environment.

In this context, the behavior of companies, especially large ones, across all sectors of the economy is considered key to success with regard to the EU’s sustainability objectives. Indeed, it is in the interest of companies to protect human rights and the environment, in particular given the rising concern of consumers and investors regarding these topics.

The CS3D imposes requirements on the improvements that EU and non-EU companies meeting certain turnover thresholds in EU, as defined in Art. 2 of CS3D (the “Companies”), must make to their impact on the environment and human rights. The CS3D obliges the Companies to assess their negative impacts in these two areas and to take the necessary measures to prevent or mitigate them and to put into effect a transition plan for climate change mitigation which aims to ensure compatibility of the Company’s business protocols and activities with limiting global warming to 1.5 °C, in line with the Paris Agreement[1]. 

So-called global value chains[2], and in particular raw material value chains, are affected by human-induced damage and are set to increase in the future; this highlights the importance of active engagement by the Companies to address, mitigate and eliminate, wherever possible, negative impacts on their value chains, taking into account social, environmental and governance externalities and risks. In this perspective, the aim of CS3D is to ensure that the Companies exercise their due diligence on human rights and environmental protection by identifying, preventing and mitigating any negative impact of their activities and addressing any negative impact they have caused or contributed to cause in the course of their activities, both directly and through their subsidiaries and their direct and indirect supply chain, i.e. through the activities of their business upstream and downstream partners.

It must be also recalled that in 2022 the EU had already adopted the Corporate Sustainability Reporting Directive (“CSRD”)[3] whose provisions could seem, in some respects, to overlap with those of the CS3D. However, while CSRD merely outlines the prerequisites for mandatory reporting that large companies will have to undertake in the field of sustainability, CS3D regards the different, connected level of the Companies’ behavior. Indeed, while CSRD establishes reporting obligations on sustainability issues which companies are required to comply with to the extent that they choose to pay attention to and consider sustainability profiles deemed relevant to their business, CS3D imposes precise behavior obligations on Companies.

Lastly, the new obligations for Companies introduced by the CS3D can be assessed with a view to integrating the various prevention and control systems adopted by the Companies in the area of compliance with Legislative Decree no. 231/2001 (“Decree 231”) which governs the corporate criminal liability of the entities. According to Decree 231, in case a predicate offence among those listed under Article 24 and ff. is committed within the context of the business and in the interest of a company, the latter can be punished with economic sanctions, disqualification measures, along with the confiscation of the profit deriving from the offence and the publication of the judgment. A company can avoid or reduce liability under Decree 231 if, inter alia, proves that it has adopted and effectively implemented an Organizational, Control and Management Model (“231 Model”) along with the relevant protocols and procedures aimed at preventing the commission of the predicate offences, and it has entrusted an internal body with independent powers of control (“Organismo di Vigilanza”) to monitor the functioning and observance of the 231 Model. Predicate offences include, among others, environmental crimes and crimes related to the violation of health and safety at work legislation. Companies may then consider adopting and integrating these protocols with those more specifically aimed at complying with the CS3D.

***

In light of this, Art.1 of CS3D sets out the provisions relating to:

a)        obligations for Companies, regarding actual and potential human rights adverse impacts and environmental adverse impacts, with respect to their own activity, the activity of their subsidiaries, and the operations carried out by their business partners in the chains of activities of those Companies;

b)       liability for violations of the obligations as referred to in point (a); and

c)        obligation for Companies to adopt and put into effect a transition plan for climate change mitigation which aims to ensure, through best efforts, compatibility of the business model and of the strategy of the Company with the transition to a sustainable economy and with the limiting of global warming to 1,5 °C in line with the Paris Agreement.

***

Under Art. 2 CS3D applies to the following Companies:

1.        Companies which are formed in accordance with the legislation of a UE Member State and which fulfil one of the following conditions:

a.        the company had more than 1.000[4] employees on average and had a net worldwide turnover of more than EUR 450.000.000,00 in the last financial year for which annual financial statements have been or should have been adopted;

b.        the company did not reach the thresholds as referred to in point (a) but is the ultimate parent company of a group that reached those thresholds in the last financial year for which consolidated annual financial statements have been or should have been adopted;

c.        the company entered into or is the ultimate parent company of a group that entered into franchising or licensing agreements in the EU in return for royalties with independent third-party companies, where those agreements ensure a common identity, a common business concept and the application of uniform business methods, and where those royalties amounted to more than EUR 22.500.000,00 in the last financial year for which annual financial statements have been or should have been adopted, and provided that the Company had or is the ultimate parent Company of a group that had a net worldwide turnover of more than EUR 80.000.000,00 in the last financial year for which annual financial statements have been or should have been adopted.

2.        Companies which are formed in accordance with the legislation of a Third Country and fulfil one of the following conditions:

a.        the company generated a net turnover of more than EUR 450.000.000 in the EU in the financial year preceding the last financial year;

b.        the company did not reach the threshold as referred to in point (a) but is the ultimate parent company of a group that on a consolidated basis reached that threshold in the financial year preceding the last financial year;

c.        the company entered into or is the ultimate parent company of a group that entered into franchising or licensing agreements in the Union in return for royalties with independent third-party companies, where those agreements ensure a common identity, a common business concept and the application of uniform business methods, and where those royalties amounted to more than EUR 22.500.000,00 in the Union in the financial year preceding the last financial year; and provided that the company generated, or is the ultimate parent Company of a group that generated, a net turnover of more than EUR 80.000.000,00 in the Union in the financial year preceding the last financial year.

The CS3D provides an exemption for ultimate parent Companies when they have as their main activity the holding of shares in operational subsidiaries and do not in take management, operational or financial decisions affecting the group or one or more of their subsidiaries. That exemption is subject to the condition that one of the ultimate parent Company’s subsidiaries established in the EU is designated to fulfil the obligations on behalf of the ultimate parent company including the obligations of the ultimate parent Company with respect to the activities of its subsidiaries (Art. 2, par.3)[5].

***

When implementing CS3D, Member States shall ensure (Art. 4) that Companies conduct risk-based environmental and human rights due diligence by the following actions:

·       integrating due diligence into their policies and risk management systems;

·       identifying and assessing actual or potential negative impacts of their activities in order to prevent and mitigate them or put an end to them;

·       providing remediation for actual adverse impacts;

·       carrying out meaningful engagement with stakeholders;

·       establishing a notification mechanism and complaints procedures;

·       monitoring the effectiveness of their due diligence policy and measures at least every 12 months and whenever there are reasonable grounds to believe that new risks of the occurrence of those adverse impacts may arise;

·       publishing on their website an annual statement on due diligence.

Records of actions taken to fulfil due diligence obligations should be kept for at least five years.

***

The CS3D also provides that Member States shall:

·       designate one or more supervisory authorities to supervise compliance with the obligations enshrined in the CS3D. By 2 years from the entry into force of this CS3D, Member States shall inform the Commission of the names and contact details of the supervisory authorities designated, as well as of their respective competences where there are several designated supervisory authorities.

·       lay down the rules on penalties, including pecuniary penalties, applicable to infringements by Companies, taking into account the nature and gravity of the infringement, the financial advantages gained, any prior infringements, the corrective action taken and any mitigating and aggravating circumstances. The maximum limit of pecuniary penalties shall be not less than 5% of the net worldwide turnover of the Company in the financial year preceding that of the decision to impose the fine.

·       ensure that Companies provide the possibility for individuals or organizations with legitimate concerns about possible adverse impacts to file complaints. There should therefore be a fair, public, accessible, predictable and transparent procedure for handling complaints, of which all interested parties should be informed. It will be necessary to create notification mechanisms that allow individuals and organizations to submit information about adverse impacts as well.

·       ensure that any decision of the supervisory authorities concerning penalties related to the infringements of the provisions of national law adopted pursuant to CS3D is published, remains publicly available for at least five years and is sent to the European Network of Supervisory Authorities.

***

Under the CS3D a breach of certain obligations may result in civil liability for damages against natural and legal persons in the event of failure to comply with the obligations to be imposed by the Member States: however, the Company cannot be held liable for any damage caused only by its business partners in its chain of activities. The CS3D sets the rules and procedure for obtaining compensation for injured parties.

***

The CS3D will have to be formally adopted by the Council and will afterward come into force on the 20th day following that of its publication in the Official Journal of the European Union[6]. As represented in the following table, the CS3D will need to be implemented by Member States within 2 years from its entry into force and will apply gradually to the Companies falling in its scope of application.

***

Companies should start preparing now, regardless of the implementation timeline, due to the importance of expectations and liabilities in the CS3DD.

Indeed, the CS3D provides specific measures to be adopted, which will need time to be implemented, also considering that such implementation will entail the involvement of functions and entities across multinationals, and that it will be advisable to involve several stakeholders, and legal and compliance functions as well in the process.

The next steps Companies should be considering to implement include inter alia:  

·       creating and executing a plan for mapping any potential risk - also within their chain of activities - for preventing and/or bringing to an end actual adverse impacts on human rights and/or environment, that has reasonable and clearly defined timelines for the implementation of appropriate measures, and both qualitative and quantitative indicators to evaluate progress;

·       ensuring that the Company's code of conduct describing the rules and principles to be followed throughout the company and its subsidiaries and the Company’s prevention action plan are being compliant with CS3D and followed;

·       perform any necessary financial or non-financial investments, adjustments, or upgrades, including those related to facilities, production, or other operational processes and infrastructures;

·       inserting appropriate contractual language into business partner contracts and training employees not limiting to persons directly involved with sustainability compliance and reporting;

·       offer support that is targeted and proportionate to a small to medium-sized enterprise that has a business partnership with the company.

[1] The Paris agreement reached on 12 December 2015 commits to keeping the temperature rise below 2° and - if possible - below 1.5° above pre-industrial levels. The agreement was signed by 195 countries, including Italy, on 22 April 2016 in the UN General Assembly Hall in New York.

[2] The CS3D defines “chain of activities” as activities of a company’s upstream and downstream business partner as follows:

·        upstream business partners, relating to the production of goods or the provision of services by the company, including the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of the products and development of the product or the service;

·        downstream business partners, relating to the distribution, transport and storage of the product, where the business partners carry out those activities for the company or on behalf of the company.

[3] The Ministry of Economy and Finance has launched a public consultation regarding the draft Delegated Decree for the transposition of the CSRD, the outcomes of which are awaited. Member states’ transposition of the CSRD must take place no later than July 6, 2024.

[4] CS3D defines in paragraph 27 the methodology for calculating workers: "as regards the employee thresholds, temporary agency workers, and workers posted under Article 1(3), point (c), of Directive 96/71/EC of the European Parliament and of the Council should be included in the calculation of the number of employees in the user company. Posted workers under Article 1(3), points (a) and (b), of Directive 96/71/EC should only be included in the calculation of the number of employees of the sending company. Other workers in non-standard forms of employment should also be included in the calculation of the number of employees insofar as they meet the criteria for determining the status of worker established by the Court of Justice of the European Union (CJEU)".

The term ‘worker’ has a meaning in EU law and cannot be subject to national definitions or be interpreted restrictively. It covers any person who undertakes genuine and effective work for which he is paid under the direction of someone else. It does not cover third country migrant workers.

[5] The ultimate parent company shall remain jointly liable with the designated subsidiary for a failure of the latter to comply with its obligations.

[6] To this day, the CS3D has not been published.