The EU’s Corporate Sustainability Due Diligence Directive (CSDDD) heralds new obligations for corporations operating in the European Union (EU), with lawmarkers in the European Parliament 

voting — 374 to 235 — overwhelmingly

 in favor of the Directive. In line with a growing trend towards scrutiny of 

environmental, social and governance (ESG)

 considerations throughout companies’ value chains, the CSDDD brings challenges for boards, Chief Compliance Officers and their teams.

The CSDDD, now poised to be formally approved by the EU Council, aims to hold corporations accountable for their impact on people and the planet. Compliance professionals will be responsible for managing social and environmental impacts along the entire value chain, including direct and indirect suppliers, their own operations, products and services.

In the course of my work, I have seen my share of challenging human rights situations. These have left me in no doubt that there’s a moral obligation to address ESG issues, and especially human rights abuses, in corporate value chains. 

— Ezekiel Ward, founder of North Star Compliance Ltd.

Diligent’s partners Steele and Ezekiel Ward, founder of North Star Compliance Ltd., wrote about the draft directive’s implications and noted:

“In the course of my work, I have seen my share of challenging human rights situations. These have left me in no doubt that there’s a moral obligation to address ESG issues, and especially human rights abuses, in corporate value chains.”

To respond effectively, companies will need to implement a program of seamless, comprehensive and global supply chain 

What is the Corporate Sustainability Due Diligence Directive?

On 23 February 2022, the European Commission adopted a proposal for a directive on Corporate Sustainability Due Diligence.

The Directive will require companies in scope to carry out 

environmental and human rights due diligence

“foster sustainable and responsible corporate behaviour and to anchor human rights and environmental considerations in companies’ operations and corporate governance.”

Importantly, the Directive will cover value chains inside and outside Europe, impacting corporations globally. It builds on — and interacts with — other regulations that focus on supply chain ESG, such as the 

, which aims to improve transparency in the sustainable investment product market, the 

Corporate Sustainability Reporting Directive (CSRD)

California Transparency in Supply Chains Act

Fighting Against Force and Child Labour in Supply Chains Act

, further underscoring the global emphasis on ethical supply chains.

The EU CSDDD underpins the European Union’s focus on driving a climate-neutral approach and increased supply chain sustainability. And it’s in line with corporate priorities; as companies realize the benefits of ESG, not just for the planet and for society, but from a commercial perspective as well. Indeed, a number of businesses in the apparel sector recently signed an open letter supporting the EU in its moves to introduce corporate sustainability due diligence.

What does EU CSDDD require companies to do?

The draft European Commission corporate sustainability due diligence legislation requires in-scope companies to manage their operations' environmental and social impacts along their entire value chain. This means within their own operations, as well as those of their subsidiaries and value chains both within and outside of Europe.

Whatever current [due diligence] setup you have in place, it may need ‘lifting’ or re-positioning to meet the draft directive’s requirements.

 — Ezekiel Ward, founder of North Star Compliance Ltd.

The Directive covers a broad range of issues that existing due diligence processes might not address. These issues include human rights, social and labor rights, and environmental impacts — essentially the entire ESG spectrum.

Issues like integrity and corruption will be in scope, meaning that, as Ezekiel Ward of North Star Compliance Ltd notes, “Whatever current [due diligence] setup you have in place, it may need ‘lifting’ or re-positioning to meet the draft directive’s requirements.”

So, who does the EU Corporate Sustainability Due Diligence Directive apply to? The revised legislation significantly scales back the number of companies who are mandated to comply.

With the adoption of the CSDDD by the European Parliament, the regulation will be applicable to:

EU companies with more than 1000 employees and a net worldwide turnover of more than €450 million

Non-EU companies with at least €450 million in net turnover generated in the EU

The latest draft excludes the previous high-risk sector approach

It's important to note that, although small and medium-sized companies do not fall directly into the scope of the EU CSDDD, they are impacted indirectly, as they will need to meet standards in their role as suppliers to larger, in-scope businesses.

The EU due diligence directive will cover companies run as stock corporations, partnerships limited by shares, limited liability companies, regulated financial companies and insurance companies.

How does the EU CSDDD impact organizations outside the EU?

Though the Corporate Sustainability Due Diligence Directive comes from the EU, it will likely have a ripple effect around the globe, as certain companies that operate in the EU will need to comply.

As mentioned above, countries not headquartered in the EU are covered by the proposed EU due diligence directive if they meet certain criteria: doing a certain amount of business in the EU and/or making money in specific high-risk sectors.

Any organization meeting those thresholds must comply with the EU due diligence legislation without delay. In-scope third-country companies, for example, must designate an authorized representative within the EU.

Even if you fall out of scope of the EU CSDDD, growing pressure to align operations and supply chains with ESG objectives is likely to drive similar legislation in other jurisdictions. Getting your arms around your supply chain and reviewing your compliance with human rights and environmental requirements can only be a positive step.

What steps does your organization need to take to comply with CSDDD?

In-scope companies must take the following steps to comply:

Identify any actual or potential negative impacts on the environment and human rights within your operations and along your value (supply) chain.

Put in place measures to prevent, mitigate and remediate these impacts.

Fully integrate your supply chain due diligence into your company policies, management systems and internal controls.

Implement a complaints procedure that everyone along your supply chain can access.

If your annual turnover is more than €150 million, you must outline a transformation plan that intends to enable you to meet the Paris Climate Agreement emission reduction targets.

As mentioned above, if you’re an in-scope third-country company, designate an authorized representative located within the EU.

Publicly report on your organization’s success in fulfilling its supply chain due diligence obligations. This includes including relevant data in your annual report.

Failure to comply with the EU Corporate Sustainability Due Diligence Directive comes with penalties:

A relevant regulatory authority (designated by the EU Member States) will be able to impose sanctions, including fines and compliance orders.

Any victims of noncompliance with CSDDD obligations will have a right to apply for compensation for damages resulting.

Corporate Sustainability Due Diligence Directive timeline for compliance

Now that the EU has voted in favor of the Corporate Sustainability Due Diligence Directive, organizations will have varying timelines to comply. Here are the specifics:

Companies with over 5,000 employees and a turnover exceeding €1.5 billion

Companies with over 3,000 employees and a turnover above € 900 million

Companies with over 1,000 employees and a turnover above € 450 million

Due diligence software can be invaluable in helping you to comply with supply chain due diligence legislation — including the EU CSDDD.

A software-led approach to due diligence will enable you to gather the intelligence you need to make informed decisions and move beyond checkbox compliance with in-depth investigations into all partners along your value chain. Find out more about how 

 from Diligent can enhance your approach and ensure you comply with the upcoming EU Corporate Sustainability Due Diligence Directive along with other due diligence regulations.

How the EU Corporate Sustainability Due Diligence Directive (CSDDD) impacts your supply chain operations

The first three months of 2024 were dominated by ESG developments, with the Securities and Exchange Commission (SEC) finalizing its climate reporting rule on March 6 and the EU Council ratifying the Corporate Sustainability Due Diligence Directive (CSDDD) less than two weeks later on March 15. Globally, efforts to eradicate slave labor from supply chains remain a regulatory priority.

Meanwhile, sanctions, FCPA and export control enforcement continue to be hot topics.

While many companies have long been collecting and reporting climate-related data, sustainability officers will need to pay close attention to the slate of new rules coming out.

“2024 presents a turning point in the ESG regulatory landscape, with various laws, including reporting requirements, coming into effect,” noted law firm 

 in a client memo, which also predicted more private litigation against reporting companies above and beyond government enforcement.

Among the rules entering the data-collection phase before reporting requirements kick in is the 

EU’s Corporate Sustainability Reporting Directive (CSRD)

. Not to be confused with the CSDDD, the CSRD includes climate reporting requirements tougher even than the SEC rule and applies to companies with a modest amount of revenue generated within the EU.

While the SEC’s rule was hotly anticipated, preparing for it was made more difficult by speculation as to what might be dropped from the proposed rule, as well as planned lawsuits from groups opposed to its main objectives.

, which derive from a company’s value chain including customers of its product, were excluded from the final requirements as some investors raised concerns that methodologies for calculating them were inconsistent.

Companies may not avoid Scope 3 for long, however. 

 and the CSRD require disclosure of the data and most investors continue to request it from some sectors. Indeed, the global recommendation of the 

International Sustainability Standards Board

understand the implications of the SEC rule

 featured a deep dive on the subject, while Diligent has also produced 

Companies that are already advanced in their ESG reporting journey are at the stage of navigating pain points to stay in compliance with increased regulation. — 

Russell Dover, Principle Solution Design at Diligent

Following the adoption of the rule, a dozen long-prepared lawsuits were filed challenging the SEC’s authority. Most argue that the SEC exceeded its authority and cannot require companies to make non-financial disclosures, although at least one argues the SEC did not go far enough.

The SEC has stayed the rule temporarily as a practical matter, allowing the challenges to be consolidated. But it intends to fight vigorously to keep the rule intact. According to 

, “The SEC believes that the final rule is a lawful exercise of its regulatory authority, but a voluntary stay will allow the consolidated cases to focus on the merits of the appeal and avoid regulatory uncertainty in the meantime.”

Supply chain and third-party due diligence continues to be of critical importance to both public and private companies, driven by a focus on forced labor and sanctions enforcement.

The first quarter of 2024 saw a 4% increase in the number of sanction records globally, according to Diligent data. Those increases were driven by a focus on individuals in Moldova and connected to Hamas, in response to the wars in Ukraine and the Middle East, respectively.

According to the FCPA Clearinghouse, a joint project between Stanford Law School and Sullivan & Cromwell, the typically slow start to the year in FCPA enforcement activity was in line with 2023. However, its 

 cited a focus on international commodity trading companies that allegedly paid bribes in Latin America and Africa, plus a new whistleblower reward program from the Department of Justice designed to bring the agency into line with the SEC and other bodies.

Separately, the DOJ reported on the first year of its 

Disruptive Technology Strike Force Efforts

, citing cases related to exports to Russia, China and Iran, and partnerships with international governments and private sector parties. Export controls, along with sanctions, are expected to be a focus for enforcement actions in the near term.

Ratification of the CSDDD is on track with the EU Council agreeing a scaled back proposal in March. Amnesty International Policy Advisor Hannah Storey said that despite the new rule affecting around 30% of the companies covered by the initial scope of the rule, “this legislation remains a vital step toward establishing the principle in EU law that businesses must address human rights risks in their operations and value chains.” The rule now goes to the EU Parliament for approval.

 to how the rule affects your supply chain operations. And for an overview of other supply chain rules, including the 

, the U.S. Uyghur Forced Labor Prevention Act, 

Canada's Fighting Against Forced and Child Labour in Supply Chains Act

Diligent was out in force at Compliance Week in Washington D.C. at the beginning of April, where Principal of Solution Design Russell Dover noted that two big topics were 

“While there’s a lot of excitement about potential new applications for AI that can help compliance teams, there’s also an understanding of the need to fully vet any AI solutions and compatibilities with other software so as not to introduce additional risk,” he said. “Using AI in a trusted and vetted platform is a common approach.”

Dover moderated a panel discussion on a Proactive Approach to ESG and said, “Companies that are already advanced in their ESG reporting journey are at the stage of navigating pain points to stay in compliance with increased regulation. These include the reliability of future projections, differing materiality standards between U.S. and EU rules, and practical issues such as increased volumes of customer surveys.”

Diana Kelley, the chief information security officer at Protect AI, presented to the conference on the importance of applying compliance to the rollout of artificial intelligence tools such as machine learning (ML), including risk assessments, policies and procedures, and monitoring.

“Awareness of the AI and ML visibility problem is increasing, I know companies want to do the right thing,” Kelley told Diligent after the event. “I’m very happy to see that compliance teams – both internal and external audit – are looking at AI and ML security. And excited to know that this was of enough importance for Compliance Week to invite me to come and speak about the need for auditability of AI and ML and that people wanted to have the conversation.”

Learn more about improving your compliance program with Diligent One

 streamlines your risk management, ESG reporting and compliance programs by delivering best-in-class solutions and centralizing all of your GRC activities in one place. Find out more about how software from Diligent can enhance your approach and ensure you comply with your due diligence obligations, stay on top of climate reporting requirements and get AI-ready 

Diligent

Blog

How the EU Corporate Sustainability Due Diligence Directive (CSDDD) impacts your supply chain operations

Q1 2024 compliance overview: Navigating climate risk, supply chain regulations and AI challenges

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

How the EU Corporate Sustainability Due Diligence Directive (CSDDD) impacts your supply chain operations

Q1 2024 compliance overview: Navigating climate risk, supply chain regulations and AI challenges

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company