New CS3D: risk-based approach

Sustainability and Corporate Due Diligence 

In our 11th post on sustainability and corporate due diligence, we discuss the new CS3D arising from the Omnibus I process, which was approved by the European Parliament on December 16. In our analysis of the amendments to the original wording of the CS3D, we start with those affecting article 8 and those thanks to which the risk-based approach has been reinforced after being at jeopardy during the review process.

Access previous publications in this series here:

Post | The CS3D in perspective

Post | Who does the CS3D affect?

Post | Legal interests protected by the CS3D

Post | Risk-based approach

Post | The Shell case and its potential implications for corporate due diligence

Post | Obligations to end adverse impacts and to provide remediation beyond financial compensation

Post | Due diligence in the chain of activities: a contractual perspective

Post | Omnibus I and impact on CS3D

Post | Omnibus I Proposal and corporate due diligence: an update

Post | Groundbreaking court decision: Human rights and pollution arising from intensive livestock farming

Introduction

The new CS3D arising from the Omnibus I review process amends significant aspects of the version originally approved in June 2024. Amendments worth highlighting are:

• The substantial reduction of the number of companies falling under the scope of CS3D (subjective scope of application), increasing the thresholds from 1,000 to 5,000 employees and from €450 million to €1.5 billion for turnover (article 2).
• The elimination of climate transition plans (article 22).
• The elimination of the European civil liability scheme, although the right to access justice and to effective remedy (full compensation without punitive damages) is maintained under the domestic regime of each Member State (article 29).
• Postponement of its application until 2029.
• Read a summary of the amendments in our Legal Flash | Approval of Omnibus I.

In this context, due to its positive assessment, the result of the review of article 8 in relation to the obligations to identify and assess adverse impacts on human rights and on the environment stands out, and we take this as an excuse to reflect on the new CS3D arising from Omnibus I. This provision governs one of the key aspects of the corporate due diligence standard involving human rights and the environment. And it does so by reinforcing the risk-based approach.

The new wording of article 8 clarifies the measures that companies falling under the scope of CS3D must apply to identify and assess the adverse impacts of their operations, those of their subsidiaries and those in their chain of activities; in this way, it favors a solid base to deploy the other obligations under this standard of conduct (prevent, mitigate, eliminate and repair), keeping human rights and the environment at the center of due diligence. 

Obligation to identify adverse impacts and risk-based approach. Why is the new wording of article 8 CS3D positive?

In both official and unofficial debates arising from the regulatory review of the Omnibus I package, we have read and heard that the original CS3D had laid down an entity-based approach across the value chain, as opposed to the risk-based approach under the United Nations Guiding Principles and the OECD Guidelines.

From that criticism, the review of the Directive has been justified because it involved (i) a costly exercise which, on occasions, seemed impossible for the companies under the scope of CS3D with a complex, long and changing chain of activities; and (ii) an extraordinary burden for the companies in the chain of activities due to the foreseeable avalanche of information requests.

Although the term "map" own operations, those of their subsidiaries, and those of their chains of activities, used in the original article 8.2 a) justified a certain amount of concern, this could be moderated with a calm reading of the article in full, together with article 7 and recitals 40 and following.

It is also possible that these concerns were generated from a formalist perspective of the measures to be applied to identify the areas of adverse impacts in the chain of activities, considering that they would lead to (i) an increase in the practice of mass questionnaire sending—more or less long and identical—to all the business partners in the successive links in the chain of activities, and (ii) the subsequent processing of the answers collected. And we must acknowledge that this has been market practice.

New article 8 brings clarity and, above all, eliminates or reduces the concerns over these types of practices which, on the other hand, have never been aligned with the corporate human rights due diligence standard. It also abandons some versions of the wording of article 8 that proposed material limits for the identification and assessment of adverse impacts involving a distancing from the risk-based approach, which would probably have led to the Directive not establishing a due diligence standard, but something different.

Under the new article 8 CS3D:

• The obligation to identify and assess adverse human rights and environmental impacts must be extended to own operations, those of companies’ subsidiaries and those in their chain of activities (article 8.1), without limits in their links or tiers (beyond those arising from the definition in article 3.1 (g)).
• This obligation must be carried out by focusing on the severity and likelihood of the adverse impacts, considering the relevant risk factors, including facts, situations and circumstances of the (a) business partners; (b) context of the geographical area of the operations—own, of subsidiaries or of a business partner—; and (c) sector, operations and the product or service (article3.1 (u) and article 8.2 first paragraph).

On this basis, which fixes the extent of the obligation and the risk-based approach, companies must carry out a double exercise:

• First, they must scope the "general areas" where the adverse impacts on human rights and on the environment are most likely to occur and be most severe, using exclusively “reasonably available” information (article 8.2 (a)). This means not requesting this information from business partners. Although companies are no longer required to “map” their own operations, those of their subsidiaries or those in their chain of activities, it seems logical to think that, to scope general areas for adverse impacts, it will be necessary to have reasonable knowledge of those operations.
• Second, they must carry out an in-depth assessment of the areas scoped in the first exercise (article 8.2. (b)). For this second exercise:
• Companies can request information from their business partners when it is "necessary". If the business partner has fewer than 5,000 employees, the information request must go through an additional filter: it cannot be reasonably obtained by other means (article 8.3 (a)).
• Where information can be obtained from different business partners, companies will prioritize requesting such information, when reasonable, from business partners where the adverse impacts are most likely to occur (article 8.3 (b)). A similar rule already existed in article 8.4 of the original CS3D.
• Where adverse impacts are equally likely or equally severe in several areas, companies can (they are not obliged) prioritize the in-depth assessment of those areas involving their direct business partners (article 8.3 c)). As this is a right based on the equivalence of the factors of severity and likelihood, it seems reasonable that its use is minimally justified in each particular case. In any case, later, companies must assess the other areas.

Along the way, proposals have been cast aside because they limited due diligence to Tier 1 (Council Common Position) or they limited dialog to one between a large buyer and a large seller in the chains of activities, and even seemed to prohibit information requests (position of the Juris Committee of Parliament). The approved wording enables the identification and assessment process to focus on the most likely and most severe for human rights holders, and once the general areas of adverse impacts have been scoped, it enables the in-depth assessment to request information delimited by content and recipient based on criteria of necessity, reasonability, focus and usefulness, thus avoiding generalized and mass exercises, and always applying a risk-based approach.

Practical reflection

The most relevant aspect of this new wording of the obligation to identify adverse impacts is that it highlights the following realities and correlative responsibilities of companies under the scope of CS3D.

• Generally, companies have the resources and information to carry out the first identification exercise (scoping) of the main areas at risk. This is understood in practice if the following is considered:
• A source of information about the risk can be found in the companies’ own operations and in those of their group, i.e., in their business strategies and conditions for design, production, purchases and distribution.
• Another relevant source is public independent information about systemic risks inherent to (i) activity sectors, e.g., gender discrimination and child labor in the textile sector, or the risk of modern slavery in maritime transport; (ii) regions, e.g., operations in areas with low state presence, in areas of conflict, or indigenous lands; and (iii) products and services, e.g., conflict minerals, or a raw material whose extraction or production generates toxic waste or an intensive use of natural resources, or certain technology.

• Notification mechanisms and dialog with stakeholders as key tools in the chain of activity. Both for the initial scoping of areas with adverse impacts and for the in-depth assessment, companies under the scope of CS3D can and should use the available quantitative and qualitative information, independent expert reports and sectoral and multi-stakeholder initiatives (article 8.4). However, there are also two relevant additional tools:
• The notification mechanisms are a direct source of information of general risk areas, as well as of specific risks in individualizable operations, both in own operations and in those of the chain of activities (article 14), and
• the consultation or dialog with relevant stakeholders (article 13.3).  

• Abandoning of general information-request forms?: After the scoping exercise, for the in-depth assessment of risks it is possible and usual for companies to need, in addition to the mentioned sources and tools, to request information from the business partners in the chain of activities. However, sending general questionnaires indiscriminately is not of much use. In response to these practices, it will now be necessary to provide a better and more detailed justification of the requests and, therefore, a tailormade and justified information request will be required.

• Impact on supplier codes and on contracts: All of the above should lead to a review of suppliers’ usual codes of conduct and the contractual instruments with those business partners that become key after the process for identifying and assessing adverse impacts in the chain of activities. Also here, risk-based solutions with greater individualization seem more efficient, and their fulfillment and enforceability gain legal certainty. Building on a minimum common basis, it may be recommendable to minimize the use of general clauses and conditions to facilitate customized, agreed-on and effective commitments for exchange of information, dialog and collaboration, which consider the most serious and likely risks for human rights and the environment.

Conclusion

New article 8 of CS3D shows that the identification and assessment of adverse impacts on human rights and the environment is not a formalistic exercise, rather it is substantive and substantial element of the due diligence obligation:

• It must focus on the legal asset protected by the regulation: the likelihood and severity of the adverse impacts for the holders of human rights and for the environment. 
• It must be carried out using reasonable—but also solid and trustworthy— information sources that the obliged company has available to it; including the request for information to the business partners when it is necessary and is justified both due to the recipient and to the content.
• Notification mechanisms and dialog with the relevant stakeholders are key and useful tools.  

Despite the limits resulting from the high thresholds under the new CS3D and from the reduction of the definition of relevant stakeholders, the new wording of article 8 seems to be better aligned with the United Nations Guiding Principles numbers 17 and 18. Moreover, article 8 has ruled out legislative options that put at risk the very existence of the human rights due diligence standard and puts an end to mass indiscriminate practices with little effectiveness for the regulation’s objectives.

In our next posts, we will continue to reflect on other issues that have been reviewed in CS3D.