CS3D update

On 24 April 2024, the EU Parliament adopted the draft directive on corporate sustainability due diligence (Corporate Sustainability Due Diligence Directive, "CS3D"). This draft was endorsed by the Permanent Representatives Committee of the European Council on March 15, 2024 (“Council Draft”). After a series of failed votes and delays, parts of the Council Draft now differ significantly from the previous draft agreement of 14 December 2023 (“Preliminary Draft”). In particular, the Council Draft significantly limits the personal scope of the Directive. The following is a brief overview of the latest and presumably final version of the CS3D – subject to the approval of the European Council.

I. Changes to the personal scope of application

The scope of the CS3D is defined primarily by employee and turnover thresholds, with a distinction being made between EU and third-country companies:

• For EU companies, the Council Draft raises the employee threshold to 1,000 employees and the threshold for worldwide net turnover to EUR 450 million. The Preliminary Draft provided for significantly lower thresholds of 500 employees and EUR 150 million. It is worth noting that the new employee threshold is in line with the requirements of the Act on Corporate Due Diligence Obligations in Supply Chains (Lieferkettensorgfaltspflichtengesetz, “LkSG”), which only applies to companies with more than 1,000 employees. However, the way the number of employees is calculated differs in some respects from the method specified in the LkSG, with the concept of full-time equivalent (FTE) being a key factor in the Council Draft. Due to the different calculation methods and the lack of a turnover threshold defined in the LkSG, there are therefore companies that fall under the LkSG but are not covered by the CS3D. Contrary to the Preliminary Draft, smaller EU companies would not be directly covered. 
• For third-country companies, on the other hand, there is still no employee threshold – only a threshold for net turnover generated in the EU of at least EUR 450 million, as opposed to the EUR 150 million provided for in the Preliminary Draft. 
• Overall, the personal scope of the Council Draft is much narrower – covering an estimated 70% fewer companies than the Preliminary Draft. However, the CS3D also applies to the ultimate parent company of a group if the group reaches the turnover threshold – and in the case of EU companies also the employee threshold – even if this is not the case for the ultimate parent company itself. According to the Council Draft, parent companies that are merely holding companies may, however, be exempt from the CS3D under certain circumstances.
• Another significant change in the Council Draft is that there are no longer separate thresholds for companies in so-called high-risk sectors. The corresponding provision in the Preliminary Draft was deleted without replacement. 
• Under the less stringent Council Draft, companies that maintain a “common identity” in the EU through licensing or franchising agreements are only covered if they generated royalties of more than EUR 22.5 million in the last financial year (instead of the originally proposed EUR 7.5 million). EU companies must also have generated net turnover of at least EUR 80 million worldwide (instead of the previous EUR 40 million), while third-country companies must have generated net turnover of at least EUR 80 million in the EU. The number of employees a company has is irrelevant in this scenario. 

The respective thresholds must be reached in two consecutive years. It should also be noted that, apart from the different method for calculating employees, the Council Draft still covers not only corporations but also partnerships within the meaning of Annex II to Directive 2013/34/EU, i.e. general partnerships (oHG) and limited partnerships (KG) as well as comparable foreign legal forms, irrespective of whether their general partners are corporations.

II. Changes to the scope of protection

The legally protected human and environmental rights interests and agreements referenced by the CS3D were already adapted and clarified in the Preliminary Draft, and the Council Draft still contains these changes. For example, the Council Draft does not restore the general clause on human rights deleted in the Preliminary Draft, but instead makes reference to further United Nations Conventions including the International Covenant on Civil and Political Rights; the International Covenant on Economic, Social and Cultural Rights; and the Convention on the Rights of the Child. The Council Draft also specifies what type of adverse environmental impacts are covered by the CS3D – namely any measurable environmental degradation such as harmful soil change, water or air pollution, harmful emissions, excessive water consumption or other adverse impacts on natural resources.

III. Scope of due diligence in the chain of activities

Unlike the Commission’s original proposal, the Council Draft no longer uses the term “value chain”, instead focusing on the “chain of activities”. The term “established business relationship” has also been abandoned.

The chain of activities covers activities of a company’s upstream business partners related to the production of goods or the provision of services by the company, including the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of the products and development of the product or the service. It also includes activities of a company’s downstream business partners related to the distribution, transport and storage of the product where the business partners carry out those activities for or on behalf of the company. However, it does not cover the distribution, transport or storage of goods that are subject to export control. It is worth noting that the provision of services in the downstream chain of activities continues to be excluded. Parts of the Council Draft go even further, and exclude not only the disposal level from the scope of the Directive, but also the downstream activities of indirect business partners.

IV. CS3D does not apply to financial services

There was much political debate whether to include the financial sector in the scope of the CS3D. As a compromise, the Preliminary Draft stipulated that financial services, i.e. the downstream chain of activities, would at least initially not be included in the CS3D. Financial companies will however have to fulfil the due diligence requirements laid down by the CS3D when it comes to the upstream part of their chain of activities. Only certain funds (AIFs as defined in Article 4(1) Directive 2011/61/EU and UCITS authorised in accordance with Article 1(2) Directive 2009/65/EC) are completely excluded from the scope of the CS3D. These decisions to include the financial sector in the scope of the CS3D are however subject to subsequent evaluation – and if necessary, revision.

V. Obligation to prevent and remedy adverse impacts

Changes had already been made with regard to the due diligence obligations laid down in the CS3D. For example, the CS3D includes adjustments to a company’s own business plan or business strategy as well as investments in factories, plants and operational processes as suitable measures to prevent or mitigate adverse impacts.

In addition, affected companies will be required to provide comprehensive support to their business partners that are SMEs, including in the form of monetary payments, where compliance with their code of conduct would jeopardise the viability of the business partner.

VI. Reporting

Whereas the European Commission’s proposal stipulated that companies had to publish an annual statement by 30 April each year, the Council Draft requires companies to publish their statement on their website no later than 12 months after the balance sheet date of the financial year for which the statement is drawn up. In addition, from 1 January 2029, the statements must be submitted to a national “collection body”, which is responsible for making the statements available on the European Single Access Point (ESAP). The ESAP is a central access portal where investors can get free, user-friendly, centralised and digital access to financial and sustainability-related information about EU companies and EU investment products.

The Commission will adopt a delegated act concerning the content of the reporting by 31 March 2027 at the latest. This act is intended to contain detailed information on the description of the due diligence, potential and actual adverse impacts identified and appropriate measures taken with respect to those impacts.

It should also be noted that the obligation to submit an annual statement will take effect on three different dates, depending on the size and turnover of the companies affected, namely either 1 January 2028, 2029 or 2030.

Companies subject to sustainability reporting under the Corporate Sustainability Reporting Directive (CSRD) or included in the consolidated sustainability report of their parent company are exempt from submitting annual statements.

VII. Obligation to adopt and implement a transition plan for climate change mitigation

The Council Draft still requires companies to protect the climate. The CS3D will require large companies to adopt and implement a transition plan for climate change mitigation that aims to ensure that the company’s business activities are compatible with the 1.5°C target of the Paris Agreement and the objective of achieving climate neutrality as established in Regulation (EU) 2021/1119 (Article 15(1) CS3D). The Council Draft deems companies that already report on their climate transition plan under the CSRD to have complied with their obligation under Article 15(1) CS3D.

The obligation to adopt and implement a transition plan for climate change mitigation can be seen as a paradigm shift in corporate law. Currently, managing directors have the discretion to consider climate protection in business decisions under the business judgement rule, but can also prioritise other concerns. Once the CS3D has been transposed into German law, they will however be obliged to implement the climate transition plan to the best of their ability, even if this is at the expense of other concerns such as social aspects. There are likely to be cases in which the climate transition plan required by the Draft cannot be realised within the scope of a company’s existing business purpose or in which its implementation will jeopardise the existence and long-term profitability of the company.

The Council Draft also somewhat weakens this aspect compared to the Preliminary Draft: Companies with more than 1,000 employees are no longer required to implement their transition plan for climate change mitigation through financial incentives to members of their administrative, management or supervisory bodies – a requirement that could have obligated those companies to include climate targets in the variable remuneration of such persons, particularly managing directors. 

VIII. Directors’ duties

The provisions requiring directors of companies to take into account the consequences of their decisions for sustainability matters when fulfilling their duties, as well as to set up and monitor measures for the fulfilment of due diligence obligations, were already removed in the Preliminary Draft. Under German law, however, directors are already – based on the duty of legality – responsible for implementing and monitoring fulfilment of the CS3D’s due diligence obligations. Even though the Council Draft does not contain explicit provisions on D&O liability, members of corporate bodies may be exposed to personal liability based on general principles (section 43 Limited Liability Companies Act (Gesetz betreffend die Gesellschaften mit beschränkter Haftung), section 93 Stock Corporation Act (Aktiengesetz)) if obligations arising from the CS3D are breached.

IX. Sanctions; civil liability; consideration in procurement procedures

The EU Member States will be responsible for laying down rules on sanctions for possible infringements of the CS3D, but must establish financial sanctions and a naming & shaming mechanism. The maximum fine for infringements is to be at least 5% of a company’s net worldwide turnover.

The CS3D still provides for a civil liability regime that permits claims for breach of human rights and environment due diligence obligations, but only for intent or negligence. However, participation in industry initiatives or the use of third-party verification or contractual clauses will not reduce liability. It should also be noted that the Council Draft still expressly excludes liability for the actions of direct or indirect business partners, meaning that companies can only be held responsible for their own sphere of influence. However, a breach of obligations within a company’s sphere of influence may relate to a violation of human rights and environmental protection by a business partner. The basis for any liability is not the business partner’s actions, but rather the breach of human rights and environment due diligence obligations under the CS3D.

In order to effectively enforce these claims, various procedural simplifications are to be introduced for potential claimants:

• Evidence disclosure obligations allowing courts to order the production of documents (this mechanism already features in the new Product Liability Directive and similar Directives)
• Prima facie evidence and disclosure obligations (“discovery light”)

• Knowledge-based limitation periods of at least five years (longer depending on national law)

• Admissibility of third-party standing for NGOs and trade unions if appropriate requirements are met
• Injunctive measures
• Prohibition of excessively high litigation costs for claimants

Compliance with the obligations under the CS3D is also to be taken into account as an award criterion when awarding public and concessions contracts in accordance with the relevant EU directives.

X. Outlook

As the European Parliament adopted the Council draft on 24 April 2024, the European Council must formally confirm this once again. The latter is very likely – the CS3D would then enter into force on the twentieth day after its official publication in the Official Journal of the EU. Member States would then have two years to transpose it into national law. The German legislator would likely revise the LkSG.

Under the Council Draft, the legal acts transposing the CS3D into national law must take effect according to the following timeline, depending on the size of the company:

• Three years after the CS3D comes into force for EU companies with more than 5,000 employees and net worldwide turnover of more than EUR 1,500 million in the last financial year before the CS3D comes into force; the same timeline applies to third-country companies with a net turnover of more than EUR 1,500 million in the EU
• Four years after the CS3D comes into force for EU companies with more than 3,000 employees and net worldwide turnover of more than EUR 900 million in the last financial year; the same timeline applies to third-country companies with a net turnover of more than EUR 900 million in the EU
• Four years after the CS3D comes into force for companies with more than 1,000 employees and net turnover of more than EUR 450 million; the same timeline applies to third-country companies with a net turnover of more than EUR 450 million in the EU
• Five years after the CS3D comes into force for all other companies covered; see, for example, the regulations for franchising and licensing companies.

Once the CS3D is passed, companies will essentially face the following legal tasks: Reviewing the applicability of the CS3D and, if necessary, reviewing existing risk management, risk analysis and supplier relationships to see if any adjustments need to be made. The allocation of responsibilities and the preparation and implementation of the necessary processes should therefore be tackled at an early stage. Companies should also start to draw up climate transition plans if not already doing so under their CSRD reporting obligations. 

As it stands, smaller companies with fewer than 1,000 employees are directly covered neither by the LkSG nor by the obligations of the CS3D. However, if such companies have business partners that are or will be subject to the requirements of the LkSG or CS3D, the business partners could also require those companies to meet (some of) the obligations of these acts – which would be the only way the business partners could meet their own supply-chain obligations. In other words: No matter what the thresholds are, smaller companies will also have to deal with the obligations arising from the LkSG and CS3D in order to meet their business partners’ requirements.