The CSDDD Directive: what are the consequences for businesses?

Objectives of the introduction of the CSDD

On 15 March 2024, the Council of the European Union approved the EU Corporate Sustainability Due Diligence Directive (CSDD), due to increasing social and environmental awareness.

The main objective of this act is to reduce the negative impact of companies’ activities on the environment and society and to make corporations more accountable for their actions affecting the aforementioned areas.

Accordingly, the new regulation places a legal obligation on companies to address human rights and environmental violations in their supply chain.

The directive therefore introduces new due diligence rules for business.

The directive covers both large and medium-sized companies, which will have to introduce due diligence procedures in all areas of ESG, including against child labour, exploitation of workers, environmental protection, pollution prevention and protection of biodiversity.

In this way, the EU wants to combat exploitation, bonded labour and child abuse, which is particularly problematic in the context of global corporations.

In addition to social issues, the regulations introduce specific environmental and biodiversity obligations that companies must incorporate into their business plans and internal policies.

Companies will have to present concrete plans that show how they intend to reduce the impact of their activities on global warming.

Who is affected by the CSDD?

The CSDD will not cover small and medium-sized enterprises, but the entry into force of its provisions will also affect the SME sector.

• New obligations under the CSDD

The CSDD provides specific guidelines for companies to follow.

It places obligations on companies to identify, prevent, minimise and eliminate adverse impacts on human rights and the environment.

These provisions are intended to reinforce existing voluntary responsible business standards, including the OECD Guidelines for Multinational Enterprises, the UN Guiding Principles on Business and Human Rights (which include a definition of due diligence), the ISO 26000 Standard, the Ten Principles of the UN Global Compact and others.

There are also examples of such EU regulations, i.e. Directive 2014/95/EU amending Directive 2013/34/EU as regards the disclosure of non-financial and diversity information by certain large entities and groups.

However, to date, voluntary corporate due diligence and the provisions provided for in the above-mentioned directive have not resulted in improvements in respect for human rights and implementation of environmental legislation in specific sectors.

As a result, negative externalities of companies’ activities can be observed both inside and outside the Union.

According to the position of the government of the Republic of Poland, the planned regulation will therefore have the effect of accelerating the green transition and strengthening the protection of human rights within and outside the Union.

A number of Member States have already introduced national due diligence legislation and some companies have also taken action in this area on their own initiative.

However, there is a need for larger-scale solutions to meet objectives that are difficult to achieve with voluntary commitments by companies, and this is what the CSDD aims to do.

Indeed, the recitals of the directive indicate that companies will have to take “appropriate measures” to identify, prevent, minimise and remedy violations.

“Appropriate measures”, in turn, means measures that have a real impact on the achievement of the intended objectives and not mere marketing slogans.

The directive indicates that companies should rely on ‘quantitative and qualitative’ information obtained from public reports or their own sources.

According to the CSDD, the company should then take into account the circumstances of the specific case, the nature and extent of the negative impact and relevant risk factors, including in preventing and minimising the negative impact, the specific nature of the company’s business and its chain of business, the sector or geographic area in which its business partners operate, the company’s power to influence its direct and indirect business partners and whether the company could increase its power to influence.

The due diligence process set out in the CSDDD should include six steps for responsible business conduct, which include due diligence measures for companies to identify and address negative impacts on human rights and the environment.

The process includes:

• • integrating due diligence into policies and management systems;
  • identifying and assessing negative impacts on human rights and the environment;
  • preventing, stopping or minimising actual and potential negative impacts on human rights and the environment;
  • monitoring and evaluating the effectiveness of measures;
  • communicating;
  • providing remedies

.

It remains individual for each company to find appropriate practices for the implementation of these legal obligations, tailored to the specific nature of its business and safeguarding the organisation from potential liability.

Sanctions for non-compliance with the regulations of the CSDD

It is worth noting that the responsibility for the implementation of the aforementioned requirements does not only lie with the company itself.

The CSDD also imposes a verification obligation .

As indicated in the recitals of the draft, the aim of the regulation is not to achieve full assurance that a company’s activities do not have a negative impact on the environment or society, but rather to take all possible measures to do so.

According to the legal definition, this verification means verification of compliance of the undertaking or part of its chain of activities with the human rights and environmental protection requirements of this Directive by an expert who is objective, completely independent from the undertaking, free from any conflict of interest and external influence, experienced and competent in environmental or human rights issues, depending on the nature of the negative impact, and responsible for the quality and credibility of the verification.

The Commission, in cooperation with Member States, shall issue guidance setting out performance criteria and methodology for companies to assess the performance of external verifiers and guidance on monitoring the accuracy, efficiency and reliability of external verifications.

In turn, violations of due diligence provisions will result in significant administrative penalties.

Indeed, under Article 20 of the CSDD, Member States will be required to introduce provisions on penalties, including fines, which must be effective, proportionate and dissuasive.

The amount of fines is to depend on the revenue of the company, but the maximum limit of the fine cannot be less than 5% of the worldwide net turnover of the company’s business in the financial year preceding the decision to impose the fine.

It is worth noting that decisions by supervisory authorities to impose penalties for breaches of the Directive are subject to publication by Member States.

In addition to criminal sanctions, companies that fail to comply with due diligence requirements will also face civil liability, including the need to pay damages (the Directive, in Article 22, regulates the civil liability of companies for damages that arise as a result of adverse business effects).

In addition, the European Commission is required to establish a European Network of Supervisors to facilitate supervisory cooperation and the coordination and alignment of regulatory, investigative, sanctioning and supervisory practices of supervisors and, where appropriate, the exchange of information between them.

The Commission may invite EU agencies with relevant expertise in the areas covered by this Directive to join the European Network of Supervisors.

The biggest challenge for firms will therefore be to identify and implement concrete mechanisms to ensure that ‘due diligence’ is actually complied with.

This is particularly difficult given that the penalties stipulated are high and there is little guidance on how to implement these obligations.

It is worth noting that the situation will be different for companies working with a small group of well-known and credible suppliers, who themselves strive to be ESG leaders, compared to companies with numerous relationships with smaller entities, who do not have due diligence policies and may find it difficult to provide the necessary data.

Overseeing the enforcement of the Directive on a national scale

Due to the fact that the new rules have been adopted in the form of a Directive, this means that they must be implemented in individual EU Member States.

Implementation is planned to take place within two years of the publication of the legislation in the Official Journal of the EU.

Each member state will have to designate a supervisory authority responsible for monitoring, investigating and imposing sanctions on non-compliant companies.

The directive stipulates that, once implemented in member states, each member state will decide whether a single authority will be responsible for monitoring compliance or whether several will need to be designated.

It is not clear which authority in Poland would be in charge of this, nor whether a new authority will need to be established.

According to the recitals of the directive, it is important that these authorities are free from conflicts of interest and external influences that could affect their decisions.

Therefore, Member States will have to ensure that these bodies are adequately funded and staffed to guarantee their independence.

It is worth mentioning that Article 30 of the CSDD introduces a phased approach to the application of the provisions of the Directive.

Initially, the provisions will apply three years after the entry into force of the directive, but for the largest EU companies, which have more than 5,000 employees and had a global net turnover exceeding EUR 1,500 million in the last financial year.

For non-EU companies, the obligation applies to net turnover generated in the EU and exceeding EUR 1,500 million.

After 4 years from the entry into force of the directive, the thresholds for EU companies covered by the directive will decrease to 3,000 employees and EUR 900 million in global net turnover.

In turn, after 5 years, the provisions of the Directive will cover companies meeting the lowest thresholds set out in Article 2 of the CSDD.