News from Brussels: the EU Supply Chain Directive

A large proportion of human rights violations and environmental damage is caused by the business sector. Europe’s response is the Corporate Sustainability Due Diligence Directive (CSDDD), also known as the EU Supply Chain Directive or CS3D. Companies in the EU with more than 1,000 employees and EUR 450 million in turnover now face significantly stricter obligations to protect human rights and the environment actively. They are required to monitor the social and ecological effects of their extended supply chain and their own operations. The directive, now approved by a majority of EU countries, therefore tightens the law previously applicable in Germany. 

The EU Supply Chain Directive in brief

What are the social and ecological effects of our supply chain? In future, companies will have to address this question alongside the other challenges of commercial life. The EU Supply Chain Directive (also frequently referred to as the Supply Chain Act) requires a comprehensive internal analysis of the entire value chain. A company’s own products and services must be examined alongside its direct and indirect suppliers, and both the results and the measures taken must be documented. Companies must also publish annual information on their implementation of the Supply Chain Directive. 

Given the far-reaching consequences for EU companies, the legislative process moved more than swiftly: after the European Commission presented its proposal for a directive on corporate sustainability due diligence in February 2022, an agreement between Parliament and the Council on a draft text was announced in December 2023. The draft substantially extends companies’ due diligence obligations beyond environmental protection into the field of human rights. Its stated aims are to strengthen responsibility and reduce the effects of corporate activity.  

However, numerous EU states criticised the far-reaching obligations for companies and the bureaucratic effort involved. When Germany announced that it would abstain in the planned final vote in February 2024 under pressure from the FDP, a governing coalition party, the Belgian Presidency of the Council postponed it. Nevertheless, the unanimous view is that there is no doubt that the “EU Supply Chain Directive”, or “Corporate Sustainability Due Diligence Directive” (CSDDD or CS3D), will be adopted. Nor is there any doubt about the necessary approval by the European Parliament in April / May 2024.  

For companies, this means they should assume the following timetable for the new rules to take effect. After the Directive enters into force in May / June 2024, it will be transposed into national law in stages: in 2026, European countries must have transposed the EU Supply Chain Directive into their national law. For Germany, this will mean amending the existing German Supply Chain Due Diligence Act (LkSG). In 2027, the Directive will become binding for companies with more than 5,000 employees (and turnover exceeding EUR 1.5 billion). Companies with more than 3,000 employees (and turnover exceeding EUR 900 million) will follow in 2028, and companies with more than 1,000 employees in 2029.

Tightening the German LkSG

For Germany, the EU Supply Chain Directive brings a significant tightening of the law. Despite its high standards, the existing LkSG falls short of the provisions of the EU Supply Chain Directive. Central changes include extending corporate due diligence obligations to the entire value chain and introducing civil liability for breaches of the law.

Legal forms of companies subject to the obligations

The only area in which the EU Supply Chain Directive falls short of the LkSG is the range of companies affected. This is defined much more clearly than under the LkSG, which uses a concept of undertaking that is neutral as to legal form. By contrast, the EU Supply Chain Directive defines its scope by legal form and company size. In future, the LkSG will therefore apply to limited liability companies, public limited companies and partnerships limited by shares. Irrespective of legal form, its effect will also extend to insurance undertakings and regulated financial undertakings.

Now a “chain of activities” instead of a “supply chain”

The EU Supply Chain Directive introduces the new legal concept of the “chain of activities”, making its scope significantly broader than that of the LkSG. The latter imposes responsibility on companies only for “direct” suppliers in the “supply chain”. It extends to responsibility for indirect suppliers only by way of exception, namely where there is substantiated knowledge of their breaches of the LkSG. 

Responsibility based on the chain of activities is entirely different and considerably broader, which is why it would be more accurate to speak of an “EU Chain of Activities Directive”. It is divided into two central areas of corporate activity: the conduct of upstream and downstream business partners and service providers. Responsibility for upstream service providers encompasses the highly complex network of suppliers’ actions at every level of economic activity, whether the extraction and processing of raw materials, the manufacture and development of product components or the provision of other services. By necessity, this is so far-reaching and comprehensive that, as a rule, companies will now also bear responsibility for the conduct of indirect suppliers. 

The responsibility for downstream business partners — in other words, the product marketing chain — introduced by the EU Supply Chain Directive is less complex but novel in principle. If services are provided directly or indirectly for a company, that company will also be responsible for them under the future LkSG. These typically include distribution and transport activities or disposal and product take-back.  

The EU Supply Chain Directive therefore extends from direct / indirect suppliers through a company’s own business activities (including those of subsidiaries) to the marketing and disposal of the product.

LkSG for the medium-sized business next door?

Although the legislator designed the LkSG with companies employing 1,000 or more people in mind, it also affects small and medium-sized enterprises. Find out more in our white paper Das LkSG einfach umsetzen: Der CLARIUS.LEGAL-Guide für den Mittelstand.

Download the white paper here with no obligation!

Scope of protection: human rights and environmental protection

Alongside introducing the far-reaching chain of activities, the EU Supply Chain Directive also expands the scope of protection for human rights and environmental interests previously provided by the LkSG. These are specifically listed in the annex to the Directive. Even under the EU Supply Chain Directive, however, companies can continue to use one central test: “If we had to hold a press conference today, could we in good conscience justify the conduct of our company and our suppliers with regard to the people and environmental interests affected?”

Due diligence obligations under the EU Supply Chain Directive

The due diligence obligations arising from the EU Supply Chain Directive are most easily understood through the OECD Guidelines for Responsible Business Conduct. These have been adopted by the Directive and can be divided into the following six steps: in an initial phase, due diligence obligations are integrated into corporate activity by identifying problematic human rights and environmental situations. Remedial measures are then provided with the aim of preventing or mitigating adverse effects. Finally, these actions are communicated internally and externally.

Complaints procedure

One of the greatest challenges introduced by the EU Supply Chain Directive is the redesigned complaints procedure. Although this already exists under the current LkSG, in future it must cover the entire value chain. This creates a new and very large group of people and bodies potentially entitled to submit complaints. All private individuals involved in the entire value chain, as well as trade unions and other employee representatives, will now be entitled to access the procedure. Even organisations active in areas affected by the value chain will be entitled to submit complaints.  

Affected companies will therefore be required to establish a well-staffed complaints office. The remedial measures requested by complainants will need to be assessed and implemented. Management will not, however, be able to delegate all responsibility to the office. The Directive also provides affected persons with the right to meet company representatives about their concerns. The complaints office will thus occupy a key position within the company. Beyond monitoring compliance with the LkSG, it will have to organise the appropriate handling of complaints together with the press office and management.

What does such a complaints procedure look like?

One of the most important elements of reliable LkSG implementation is a flawless complaints procedure. Our lawyers have summarised the principal points to observe in a checklist for you.

Download the checklist here with no obligation!

Effectiveness reviews, monitoring and reporting obligations

The complaints procedure is only one part of the far-reaching package of obligations that companies will face in relation to their chain of activities. The Directive also provides for companies to conduct regular annual reviews and event-driven reviews. To do so, they must define indicators for tracking both the measures taken and the general effectiveness of the company’s defined standards. The reviews, in turn, require the results to be processed and analysed and follow-up measures to be defined. For companies, this will also mean continuously monitoring and analysing not only specific incidents involving suppliers, but also the general global political situation. 

This annual review of the company’s supply-chain situation is accompanied by a reporting obligation. Companies must now prepare and publish an annual report. In practice, this task can only be carried out in close cooperation with corporate communications in order to present a consistent external picture of the company’s conduct.

Authorised representative

The LkSG’s “human rights officer” is replaced by an “authorised person” under the Directive who receives communications from supervisory authorities. Appointing such a person is now mandatory, and they must be granted the necessary powers in a manner similar to a data protection officer. Responsibility for implementing and monitoring the Directive’s obligations nevertheless remains with management. This introduces personal responsibility at the highest level of management that can be delegated only to a limited extent. It is intended to make the Directive more effective by at least paving the way for management’s personal liability. This provision will substantially increase the personal risk for companies’ senior management, and future legal developments must be watched closely.

Sanctions and new civil liability

Like the LkSG, the EU Supply Chain Directive provides for turnover-based fines. However, as these will be regulated by the individual Member States, the German legislator is likely to follow the existing and similarly far-reaching sanctioning options under the LkSG. A company’s conduct in investigating and remedying breaches will now, however, be taken expressly into account when determining the amount of a sanction. 

The Directive breaks new ground by introducing civil liability for breaches of the due diligence obligations it establishes. Although this must also be transposed into the relevant national law, the resulting legal developments will be closely watched in future. The Directive itself now provides for liability where a company fails to prevent or bring to an end potential or actual adverse effects of its business activities. This will find its way into the national laws of numerous EU countries. Under the Directive, liability also extends to the conduct of suppliers and subsidiaries; a standard of liability is even provided for indirect business partners, albeit a less stringent one. 

The central standard for liability is the occurrence of, or failure to prevent, adverse environmental and human rights effects and resulting damage. These, in turn, must arise from a failure to observe the due diligence obligations under the Directive. It is already foreseeable that this basis of liability will create novel scenarios for civil litigation, leaving considerable scope in future for complex proceedings involving numerous international parties.

Recommendation

With the adoption of the final version of the EU Supply Chain Directive and a clear timetable for its entry into force, potentially affected companies urgently need to act. In many respects, the new requirements go far beyond the existing legal position under the LkSG. In particular, the novel concept of the chain of activities makes an extensive reassessment of companies’ current supply-chain situation necessary. Together with the new bases of liability and the large number of potential claimants and new actors, this creates a complex liability landscape that will take considerable time to address.

One approach

With our LkSG Business Partner Monitoring, you can implement the EU Supply Chain Directive and the German Supply Chain Due Diligence Act (LkSG) with sound technical and legal safeguards.

This ensures efficient, cost-effective and legally comprehensive implementation of the statutory requirements. Our lawyers support you with legal expertise and experience in all relevant compliance matters. Legal technology solutions enable efficient, holistic handling.

Request a demo