The supply chain (part three)

Briefing

In our previous contribution, we explored how a company's chain of activities is composed, what companies should keep in mind, and how the new European Corporate Sustainabilty Due Diligence Directive will have a major impact in the coming years.

In this article, we look at what sanctions are provided for companies that do not comply, and what best practices companies can develop to come into line with the new rules.

Penalties and liability for infringements

The CSDDD is anything but a paper tiger, and provides for serious penalties that national regulators will be able to impose on companies that fail to exercise appropriate due diligence to ward off problems with parts of their chain of operations.

The range of possible sanctions, which must always be effective, proportionate and deterrent, is not very varied but will be no less effective for that reason.

National governments, when designing sanctions in national legislation, will have to provide at least for:

Fines, which are based on the company's worldwide net turnover. The maximum limit for fines is at least 5% of the company's worldwide net turnover in the financial year preceding the year of the fine. The calculation of fines for companies covered by the CSDDD because of franchise agreements takes into account the consolidated turnover reported by the ultimate parent company.
A public statement disclosing the company responsible for the infringement and the nature of the infringement, if the company fails to pay the fine within the applicable time limit.

In addition to these severe, direct penalties listed above, companies that commit violations will also suffer consequences in other areas.

As such, a company will be liable under national rules, and may be forced to pay damages if the (national) conditions (fault - damages - causal link between the latter two) for doing so are met.

A liability for damage caused to a legal or natural person will be able to be imposed if:

the company intentionally or negligently failed to fulfil its duty to prevent or terminate potential adverse effects, and;
as a result of that omission, damages have been caused to the legal interests of a natural or legal person protected by national law.

Finally, an important nuance, however, is that the company itself cannot be held liable if the damage was merely caused by one of its business partners in its chain of activities.

If a company is held liable, a natural or legal person is entitled to full compensation for the damages incurred. However, full compensation under the CSDDD should not lead to overcompensation, whether punitive, multiple or other forms of compensation.

Accompanying measures to implementation and responsibility for the activity chain

In imposing all these obligations, the European legislator has not forgotten that the introduction of the CSDDD (and its transposition into national legislation) will have a huge administrative impact on its own companies, which will obviously generate a lot of accompanying efforts and costs.

This means that the new sustainability rules are currently approached rather negatively by companies, which is obviously not conducive to their adoption and implementation. There is a perception that Europe has decided that it must (or better: wants to) be climate neutral by 2025, but cannot afford to pay for it itself let alone implement it on its own, and is consequently imposing the effort to do so on its companies.

In order to inform and support enterprises, their business partners and stakeholders, Member States will set up specific websites, platforms or portals, individually or jointly, with logistical and financial support from the European Union. Particular attention will be paid to small and medium-sized enterprises in the business chain, which will naturally also be affected by this new avalanche of legislation and related rules.

Independently of any rules and regulations on (prohibited) state aid, Member States may provide financial support to their companies. Member States may also provide support to stakeholders to facilitate the exercise of rights set out in this directive.

So it is certain that an additional stream of green business subsidies will be launched alongside all the new rules.

Impact on all types of businesses

It should be emphasised that the CSDDD, being the first-ever due diligence directive imposing appropriate due diligence across the entire chain of activities to avoid negative environmental and human rights impacts, initially targets only the very largest companies.

The final thresholds of the CSDDD are expected to ensure that around 5,400 companies in the EU will have to comply with the rules.

While the direct obligations of the CSDDD (and subsequent national law from 2026 onwards) are primarily aimed at larger entities, smaller companies are indirectly affected by their business relationships with larger companies. Indeed, these larger companies must ensure that their entire supply chains and commercial partnerships comply with sustainability practices, which in turn affects the companies associated with them.

This creates opportunities:

Access to new markets or business partners: compliance with sustainability measures can open new markets to and vis-à-vis companies that prioritise environmentally and socially responsible products.
Increased brand value: By adapting to sustainable practices, companies can improve their brand reputation and appeal to a broader customer base that values responsible business practices.

And at the same time, there will be serious challenges:

Limited resources: Implementing extensive due diligence processes can be resource-intensive for companies, which often have limited financial and human resources. Here we do refer to the European legislator's intention to initiate a flow of subsidies, combined with a relaxation of the rules on (prohibited) state aid in that context.
Complex supply chains: For smaller companies, it can be challenging to have full visibility or control over their extensive supply chains compared to larger companies.
Underestimation of resistance within companies: based on commercial reasons, as one might have to reveal trade secrets, or even risk being eliminated from the market by the (partly competing) larger players by releasing data. Indeed, the latter will be able to make cost savings by replacing their suppliers or distributors in some cases.

Concrete examples that these due diligence rules will entail:

Supplier audits: a company producing, for instance, textiles may have to carry out audits of its own suppliers (either itself or at the request of a larger buyer) to ensure that no child labour or environmental violations take place upstream. Indeed, a company that is at the top of such an activity chain and has to comply with the CSDDD will have to demand it if it is not to run into trouble itself in the long run. In addition to the intended effects, such audits can also bring other insights that cause a cooperation to be terminated (e.g. excessive profit margins or inefficiencies at the supplier, etc.).
Sustainability training: companies will implement training programmes for its staff on all kinds of topics as part of environmental compliance.
Sustainability administration: companies will keep more and more detailed records of compliance efforts as evidence of the appropriate due diligence carried out, which can be crucial during audits or inspections by both governments and companies upstream in the activity chain.

Overview CSDDD: importance for every business - not a future, far-off show

Why should a company not immediately covered by the CSDDD be alarmed by such legislation? After all, it still seems somewhat abstract at the moment, and mainly applicable to large and listed companies.

The CSDDD, and incidentally similar regulations such as the CRSD) as well, are relevant to all types of companies.

There is a (very) wide application: regulations such as the CSDDD and subsequent national legislations apply to a very wide range of businesses, including those not immediately covered by the direct scope. Even for small companies this is relevant, because even if they are not directly covered by these regulations, they may be indirectly affected by their business relationships with larger companies that do have to comply with these regulations and will request all kinds of sustainability data.
Transparency of the entire supply chain: The CSDDD requires appropriate due diligence throughout the supply chain. This means that any company involved in the supply chain of a larger company must comply with certain operational standards regarding human rights and environmental practices.
Financial and business consequences: Compliance or non-compliance with sustainability practices has direct financial consequences. Non-compliance, as explained above, can lead to significant fines or loss of business from larger companies seeking partners who do comply with all the rules. Conversely, demonstrating robust ESG practices can open up new business opportunities with those same types of companies.
Investor and market expectations: Investors and consumers increasingly prefer companies that adopt sustainable practices. This shift in market expectations means that all companies, regardless of size, should consider how their environmental and social governance affects their marketability and attractiveness as investors. It no longer really matters then whether a company is directly affected by the CSDDD and similar regulations.

It is thus clear that rules and corporate conduct requirements such as those imposed by the CSDDD are not only important for large entities, but equally for all types of companies managing complex supply chains in today's globalised economy.

Best practices for compliance CSDDD

Effective risk assessment is crucial for successful implementation of appropriate due diligence in a company and its entire chain of activities.

All risk assessment strategies will first and foremost stand or fall with the following elements:

Systematic, regular and comprehensive risk assessments will need to be set up to identify potential hazards and vulnerabilities. This involves the cooperation of all actors within the company and its supply chain, and includes analysing internal processes, external threats and industry-specific risks.
Identified risks should be assessed based on likelihood and potential impact. A risk assessment matrix can be designed tailored to the company to categorise risks and prioritise mitigation.
Qualitative risk assessments are best converted into quantitative standards to get a clearer picture of the potential financial impact. This helps in making informed risk management decisions.
Specific strategies are then created to address identified risks, taking into account the hierarchy of controls. This can range from risk avoidance to risk acceptance, depending on the nature and severity of the risk.
Risk assessments are best reviewed and adjusted periodically to take into account changing circumstances, new threats and the effectiveness of existing controls.
In the specialised market, specialised risk management tools and software already exist to streamline the process of risk identification, assessment and monitoring.

Effective stakeholder engagement and transparency are essential for a robust compliance programme:

Inter-departmental cooperation: different departments of the company will obviously need to be involved in the risk management process to get a holistic view of all organisational risks and to obtain all relevant data of the company, its subsidiaries and business partners.
Clear communication: the company will need to develop a clear communication plan to share risks, assessments and mitigation strategies with all relevant stakeholders. This promotes a culture of risk awareness throughout the organisation.
Training and awareness: a company will need to provide regular training to employees on risk management and compliance to promote a proactive approach.
Transparent reporting: A system should be implemented for transparent reporting of risks and compliance activities to senior management, the board of directors and external regulators as required.
Management involvement: active involvement of senior management in the risk management process is essential to set the right tone at the top of the company and allocate sufficient resources.

By integrating these habits and systems in a company for risk assessment and stakeholder engagement, organisations can strengthen their compliance programmes and be better prepared for potential risks and challenges along the entire activity chain.

This is true for companies that are initially targeted by the CSDDD, but companies that are in the activity chain of such companies should also be prepared for this.

After all, sooner or later, these companies will also face these issues.

***

Influenced by the European regulator, a trend has been set in motion that involves a flood of new sustainability regulations for companies.

In addition to the existing financial reporting obligations, there is now also a non-financial reporting obligation for the largest companies with a fairly far-reaching responsibility of these same companies for their entire chain of activities. The Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CSDDD) play a crucial role in this transition by requiring companies to thoroughly assess and clearly report on their human rights and environmental impacts.

While companies must adapt to new regulations and pressure from investors, governments and consumers to be more transparent about their activities, the average company will want to strike a balance between efficiency and compliance with all ESG-related regulations.

Clearly, no company, large or small, can meet these challenges alone. Companies will need to invest not only in technologies that promote transparency, but also in relationships based on mutual trust and shared values. Collaboration across the entire chain, from suppliers to end users, is becoming increasingly important.

A company's ability to be proactive on this playing field as well, will mean the difference between being ahead, being left behind or, in the case of companies that fail to adapt, disappearing.

This calls for a fundamental shift in how companies think about their activity chain: not as a series of separate, individual links, but as a dynamic and integral system that must evolve toward greater resilience, efficiency equity, and sustainability of every company that is in this activity chain.