The CSDDD: A New Era of Corporate Responsibility

The Corporate Sustainability Due Diligence Directive (“CSDDD”) launches a new era of corporate responsibility in Europe. The European Parliament finally approved the CSDDD on 24 April 2024 after a long period of uncertainty on the CSDDD’s fate. Thus, a common ground for EU Member states regarding the required level of sustainability due diligence will soon become reality, mandating companies to integrate sustainability into their core operations.

The CSDDD, which faced a period of uncertainty, has been streamlined in scope through negotiations, with the directive now set to be formally adopted and implemented across EU member states, including Finland, within two years.

Many Finnish companies in the scope of the CSDDD have already started to prepare for the new legislation. As the chain of activities of large companies will ultimately include and affect other companies as well, now is good time to consider the impact of the CSDDD on Finnish businesses.

The CSDDD is set to progressively encompass a wide range of companies, focusing initially on the largest entities. Here is the essence:

Ultimate parent companies are covered if they meet these criteria, except pure holding companies. The CSDDD kicks in if thresholds are crossed for two consecutive years. High-risk sectors are no longer covered by the CSDDD but may be added in the future.

The CSDDD requires companies to create a climate transition plan in line with the Paris Agreement, reportable under the Corporate Sustainability Reporting Directive (“CSRD”). Companies subject to the CSRD will not need a separate plan as the CSRD is aligned with the CSDDD. Still, they must implement, regularly update, and report on this plan annually. Even companies not covered by the CSRD must disclose their due diligence and impact measures, including their climate plan. The European Commission will issue guidelines for the climate plan within 36 months of the CSDDD's enactment. Those not yet with a plan under the CSRD and ESRS standards must state their intentions regarding the plan adoption, allowing some leeway for companies under the CSRD but not in the scope of the CSDDD.

Companies must conduct risk-based due diligence on human rights and environmental impacts, integrating this into their policies and risk management systems. Effective communication and remediation for negative impacts are required, with stakeholder engagement beyond just contractual terms.

Building a due diligence process is a complicated task and the CSDDD does not give too much practical insight into the six-step due diligence process itself. Some challenges are expected as companies start to develop and adopt due diligence mechanisms and to embed them into their business structures, as there is no established market practice yet on what constitutes a sufficient procedure. The Commission is expected to provide guidance on model contractual clauses and best practices. Future case law will also determine the “due” in due diligence.

Director roles and liability remain governed by national laws, and there is no requirement to link executive pay to the implementation of the climate change plan, as these provisions are now excluded from the CSDDD.

The CSDDD's due diligence obligations cover a company's activities, its subsidiaries, and business partners within its value chain. The new definition of the value chain, i.e. the ”chain of activities”, covers the following areas:

A company may face liability for damages resulting from intentional or negligent failure to adhere to the due diligence obligation, such as not addressing its adverse impacts. Liability under the CSDDD is confined to damages caused by the company or in conjunction with its subsidiaries or business partners. Third-party verification or contractual clauses alone do not exempt a company from liability, but the company must actively exercise its obligation of due diligence. However, a company is not liable for damages caused solely by its business partners in its chain of activities.

Provisions regarding the evidence production and collective actions, which Finland opposed, have been excluded from the CSDDD’s final version. Still, injured parties can authorise trade unions or NGOs to represent them in court, a practice previously limited to consumer protection cases in Finland.

The enforcement of the CSDDD remains the same as stated in the provisional agreement. The CSDDD empowers supervisory authorities in Member States to initiate inspections and investigations and impose penalties in case of a violation of due diligence obligations. These penalties can include public exposure, often referred to as “naming and shaming,” and fines of up to 5% of net worldwide turnover. The penalties are set by Member States at national level under the CSDDD.

If you have any questions about this Legal Alert, please feel free to contact the undersigned or your regular Borenius contact.