This summer, the European Union is expected to finalize and pass a law – albeit in a materially different form from previous versions – that will place substantial human rights obligations on global employers.  On March 15, 2024, the E.U. Council voted in favor of the draft “Corporate Sustainability Due Diligence Directive” (“the Draft Directive”), which, if finalized in its current form, will require large businesses to conduct wide-ranging human rights and environmental due diligence of their global “chain of activities” (arguably, a concept broader than “supply chains”), as well as to publish these efforts. 

This is a draft law.  Why should companies care? 

The Draft Directive is likely to pass into law, and soon.  The current version of the Draft Directive was achieved after much compromise among E.U. Member States, and therefore represents significant political consensus.  Indeed, a prior version that was much more onerous was watered down after objections from various states, including Germany, eventually leading to passage at the E.U. Council. 

The next step is for the E.U. Parliament to vote on the draft, which is expected to occur prior to June 2024.  Thus, the Draft Directive will likely come into force in the summer of 2024, by which point E.U. Member States will have two years to transpose it into their local law.  

Significantly, many E.U. Member States like Germany, France, and the Netherlands, already have national human rights due diligence laws, but they will have to amend their laws to conform them to the Draft Directive’s broader requirements.  Thus, this summer will likely mark the point at which all E.U. Member States will start to conform their respective local laws to place broader human rights due diligence obligations on covered companies operating within their borders. 

Which companies will be covered? 

If the Draft Directive is passed in its current form, the following companies will be covered:

• A company “established within”¹ the E.U.:
  
  • if it has over 1,000 employees and €450 million in global revenue in the last financial year for which annual financial statements have been or should have been adopted; or
  • that does not reach the above thresholds, but is the ultimate parent company of a group that reaches the thresholds in the last financial year for which consolidated annual financial statements have been or should have been adopted; or
  • that entered into or is the ultimate parent company of a group that entered into franchising or licensing agreements in the E.U. in return for royalties with independent third-party companies, under certain additional conditions.
• A non-E.U. company:
  
  • that is not “established within” the E.U., but generates over €450 million in revenue within the E.U. market in the financial year preceding the last financial year; or
  • that does not reach the above thresholds, but is the ultimate parent company of a group that, on a consolidated basis, reaches the above thresholds in the financial year preceding the last financial year; or
  • that entered into or is the ultimate parent company of a group that entered into franchising or licensing agreements in the E.U. in return for royalties with independent third-party companies, under certain additional conditions.

When the Draft Directive’s obligations will apply to covered companies depends on the companies’ headcount and annual revenue:

• Within 3 years of the Draft Directive coming into force at the EU-level:  companies with 5,000+ employees and global revenue of €1,500M+ per annum;
• Within 4 years:  companies with 3,000+ employees and global revenue of €900M+ per annum; and,
• Within 5 years:  companies with 1,000+ employees and global revenue of €900M+ per annum.

If the company is not covered, does it still need to care about this law? 

Quite possibly, yes. 

As set forth below, one of the main requirements imposed upon covered companies is to ensure that they conduct human rights due diligence to address any adverse human rights impacts within their “chain of activities.”  This term is defined as: 

activities of a company’s upstream business partners related to the production of goods or the provision of services by the company, including the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of the products and development of the product or the service, and activities of a company’s downstream business partners related to the distribution, transport and storage of the product, where the business partners carry out those activities for the company or on behalf of the company.

Thus, “chain of activities” has wide-ranging scope.    

Thus, even if a company is not directly covered under the Draft Directive but is a “business partner” of a covered entity within the “chain of activities,” then it will likely have material obligations to those covered business partners to have its own human rights-related policies and processes in place.  This business-to-business pressure has been a growing feature of the business and human rights space for years, but the codification of hard law on this issue is quite likely to accelerate these pressures and obligations on smaller and medium-sized enterprises, many of which do not have existing policies and protocols.

What are covered companies required to do?

• Integrate human rights and environmental due diligence into their corporate policies and risk management systems, and have in place a due diligence policy containing a description of the company’s approach to due diligence, a code of conduct for employees and subsidiaries, and a description of the processes in place to implement due diligence;
• Identify, assess and, where necessary, prioritize actual or potential adverse human rights and environmental impacts arising out of their own operations or those of their subsidiaries, and where related to their value chains, from their established business relationships;
• Prevent and minimize potential adverse impacts and bring actual adverse impacts to an end and mitigate their extent;
• Provide remediation to actual adverse impacts;
• Carry out meaningful engagement with stakeholders;
• Establish and maintain a notification mechanism and complaint procedure;
• Monitor the effectiveness of their due diligence policy and measures;
• Publicly communicate on due diligence by publishing an annual statement on their website; and
• Designate a legal or natural person as its authorized representative with the necessary powers and resources to cooperate with supervisory authorities.

What are the consequences of non-compliance?

• Legal liability:  Non-compliant companies can be held civilly liable for damages if their non-compliance caused harm to people or the environment.  
• Fines and penalties:  Member States must designate and empower authorities to enforce the Draft Directive, including with the ability to fine up to 5% of a non-compliant company’s global revenue. 
• Exclusion from public procurement:  Member States may designate that non-compliant companies will be barred from government contracts. 

Once the Draft Directive is passed, what will Member States have to do?  Germany and Poland as examples:

As mentioned above, each Member State will have two years from the Draft Directive’s passage to transpose the Directive into local law.  In this regard, Member States fall into two categories:  (1) those that have already passed some version of a human rights due diligence law; and (2) those that have not. 

Currently, only three E.U. Member States – France, Germany, and the Netherlands – have passed such laws and fall into Category 1.²  All of the other 24 Member States fall into Category 2. 

We discuss each category below using Germany as an example of a Category 1 country, and Poland as a Category 2 country:

Germany: 

The German Supply Chain Due Diligence Act came into force on January 1, 2023, and applies to businesses that have (1) their central administration, principal place of business, administrative headquarters, statutory seat, or foreign companies with a domestic branch office in Germany; and (2) normally have at least 3,000 employees in Germany (this number was reduced to 1,000 employees in Germany on January 1, 2024). 

The law obliges the covered companies to:

• Establish a human rights risk management system;
• Define an in-house representative for monitoring the risk management;
• Carry out comprehensive human rights risk analyses;
• Publish a policy statement on the company’s strategy, specifying how the new obligations are to be dealt with, e.g., on the company’s website;
• Take preventive measures and remedial actions;
• Establish a complaints procedure; and
• Undertake comprehensive documentation and reporting including filing of annual reports on the fulfillment of obligations to the competent authorities as well as publishing them on the companies’ website.

Sanctions for non-compliance may include fines against both the company and individuals (e.g., Managing Directors), on-site inspections, and exclusion from public contracts.  

Thus, the German Act already overlaps with many aspects of the Draft Directive.  However, as compared to the Draft Directive, the German Act involves only “supply chains” (not “value chains”), has no civil liability provisions, and has (in some respects) a narrower definition of covered entities.  Therefore, once the Draft Directive is passed at the E.U. level, in transposing into national law, the German Act will have to be amended to conform to the broader reach of the Draft Directive. 

Poland: 

Currently, Poland has no due diligence law in place.  However, the Polish government has openly supported the Draft Directive at the E.U. level.  In doing so, the government also identified “an expected increase in awareness and familiarity by businesses” with documents that informed the Draft Directive, including the UN Guiding Principles on Business and Human Rights, and the OECD Guidelines for Multinational Enterprises.  Thus, Poland is expected to enact a law that is in line with the Draft Directive quickly, once the E.U. passes it. Unlike Poland’s previous administration, the current government openly confirms its determination to transpose all E.U. directives in a timely and accurate manner. As the legislative departments of all respective ministries have received clear instructions to prioritize this, it is likely that once passed by the E.U., the Draft Directive will be adopted into the national law in Poland well before the two-year deadline to do so.   

What can companies do as next steps?

The first step will be to look inward to determine if the company is covered under the Draft Directive’s coverage threshold.  If covered, the company will have to take stock of its human rights infrastructure, determine where the gaps lie, and take appropriate gap-filling measures. 

If the company is not covered, it should nonetheless still determine if it falls within the “chain of activities” of business partners that are covered and conduct the same gap-filling measures.  Indeed, any company with E.U. business relationships or revenue will likely be impacted – either directly or indirectly – by the Draft Directive’s requirements. 

These next steps – as well as the subsequent compliance steps – should be handled carefully, with the advice of experienced counsel, and in light of each company’s unique business activities and geographic reach.³

Even those companies with no E.U. connections whatsoever should consider human rights due diligence as part of their obligations under the United Nations Guiding Principles of Business and Human Rights, as well as under the growing patchwork of national laws relating to corporate human rights compliance that are emerging from South Korea to Canada.