knowledge 28 March 2024 |

CS3D: Close to the finish line but at what cost?

The original proposal for the CS3D, published by the Commission in February 2022 (previously reported in our briefing here), has since been significantly watered down during the legislative process as reflected in the final compromise text (available here), endorsed by the Council on 15 March 2024.

After a protracted saga of false starts, failed votes and political wrangling, all eyes are now on the vote before the European Parliament during the last plenary session from 23 to 25 April 2024 before the elections in June 2024. It is expected that the proposals will be endorsed. CS3D is now close to the finish line, but at what cost?

Background: The CS3D Saga

The CS3D proposes to introduce new obligations for in-scope companies to identify and, where necessary, prevent, end or mitigate adverse impacts of their activities on human rights and on the environment.

The original proposal was published by the European Commission on 23 February 2022, following a public consultation and an impact assessment. The Council of the EU then finalised its negotiating position on the Commission’s proposal on 30 November 2022.¹ While the text amended the proposal, the substantive obligations remained broadly the same. This was followed by further amendments to the scope of application and obligations in the version adopted by the European Parliament on 1 June 2023.² After months of the trilogue process, the Parliament and the Council reached a provisional agreement on the text on 14 December 2023.³ The provisional agreement, which required a “qualified majority” of Member States representing 65% of the EU population to pass, was due to be voted on 9 February 2024 by the Council and on 13 February 2024 by the JURI. However, the vote was withdrawn from the 9 February agenda after Germany announced its intention to abstain over the CS3D’s potential to add bureaucratic burden and additional costs to companies, followed by Italy and Finland which had also expressed opposition. The provisional agreement was finally put to a vote on 28 February 2024 before the Council but it failed to be approved.

The final text of the CS3D, endorsed by the Council on 15 March 2024, was the result of a compromise reached after several rounds of negotiations and delays. The final compromise text reflects concessions made as a result of the political pushback received, including a narrower scope of companies and  narrower scope of activities within the value chain covered by the due diligence requirement, and a more gradual phase-in period.

Key Provisions in the Final Compromise Text

What type of company is within scope?

It is proposed that CS3D will apply to the following types of companies provided that the thresholds outlined below are met:

• Legal persons constituted as one of the legal forms listed in Annexes 1 and II of Directive 2013/34/EU (the “EU Accounting Directive”) and for non-EU companies, comparable forms. In other words, limited liability companies whether constituted in or outside the EU and their comparable forms.
• Regulated financial undertakings, regardless of legal form, listed by reference to EU legislation.⁴

Alternative Investment Funds and Undertakings for Collective Investment in Transferable Securities (“UCITS”) are excluded from the scope of CS3D but their managers or management companies may be considered in-scope as regulated financial undertakings subject to the thresholds.  In addition, CS3D also does not apply to pension institutions operating social security systems under EU law. Where a Member State chooses not to apply Directive (EU) 2016/2341 to an institution for occupational retirement, such institutions will not fall within the scope of CS3D.

Thresholds and phased application

In general terms, CS3D will be applied on a phased basis as follows:

• within a 3 year period of CS3D entering into force:
  • for any EU company that:
    • has, on an individual basis, more than 5,000 employees and a net worldwide turnover in excess of €1.5bn;
    • is an ultimate parent of a group of companies that has, on a consolidated basis, more than 5,000 employees and a net worldwide turnover in excess of €1.5bn
  • for any non-EU company that:
    • has on an individual basis, a net turnover in the EU in excess of €1.5bn;
    • is an ultimate parent of a group of companies that has, on a consolidated basis, a net turnover in the EU in excess of €1.5bn
• within a 4 year period of CS3D entering into force:
  • for any EU company that:
    • has on an individual basis, more than 3,000 employees and a net worldwide turnover in excess of €900m;
    • is an ultimate parent of a group of companies that has, on a consolidated basis, more than 3,000 employees and a net worldwide turnover in excess of €900m
  • for any non-EU company that:
    • has, on an individual basis, a net turnover in the EU in excess of €900m;
    • is an ultimate parent of a group of companies that has, on a consolidated basis, a net turnover in the EU in excess of €900m
• within a 5 year period of CS3D entering into force:
  • for any EU company that:
    • has on an individual basis:
      • more than 1,000 employees and a net worldwide turnover in excess of €450m; or
      • entered into franchising or licensing agreements in the EU with independent third parties in return for royalties, and where the royalties amount to more than €22.5m and the company has a net worldwide turnover of more than €80m;
    • is an ultimate parent of a group of companies that has on a consolidated basis:
      • more than 1,000 employees and a net worldwide turnover in excess of €450m; or
      • entered into franchising or licensing agreements in the EU with independent third parties in return for royalties, and where the royalties amount to more than €22.5m and the group has a net worldwide turnover of more than €80m
  • for any non-EU company that:
    • has, on an individual basis:
      • a net turnover in the EU in excess of €450m; or
      • entered into franchising or licensing agreements in the EU with independent third parties in return for royalties, and where the royalties amount to more than €22.5m in the EU and the company has a net turnover in the EU of more than €80m
    • is an ultimate parent of a group of companies that, on a consolidated basis, has:
      • a net turnover in the EU in excess of €450m; or
      • entered into franchising or licensing agreements in the EU with independent third parties in return for royalties, and where the royalties amount to more than €22.5m in the EU and the company has a net turnover in the EU of more than €80m.

Companies that are not already subject to the Corporate Sustainability Reporting Directive will have to communicate information on their due diligence process, potential and actual adverse impacts identified, and appropriate measures and actions taken, by way of publishing on their website an annual statement, for financial years starting on or after 1 January 2028 for the largest companies identified above who will otherwise come within scope within 3 years of CS3D coming effect, and 1 January 2029 for all other companies.

CS3D will only apply to companies if the company has met the relevant thresholds for two consecutive financial years and shall cease to apply where those companies cease to meet the thresholds for two consecutive financial years.  In addition, CS3D provides that the thresholds need to be met for two consecutive financial years by both EU and non-EU companies preceding the relevant date on which CS3D becomes applicable to those companies.

The above thresholds reflect a significant reduction in scope- the provisional agreement originally stipulated 500 employees and net worldwide turnover of €150m for EU companies.  For franchises, the threshold was €40m net worldwide turnover and €7.5m in royalties. The provisional agreement’s lower employee and turnover thresholds for companies in high-risk sectors (e.g. textiles, agriculture, extraction of mineral resources and construction) have been scrapped but a review clause has been included in the compromise text which will allow the high-risk sector approach, along with the general employee and turnover thresholds to be revisited at a later stage.

Application to non-EU companies

In-scope non-EU companies will be required to appoint an authorised representative to act as a point of contact for competent supervisory authorities and to provide its contact details to its supervisory authorities and inform them that the company is a company falling under the scope of CS3D. If the third-country company does not designate the authorised representative, all Member States in which the company operates will be competent to enforce the fulfilment of this obligation, especially to designate a legal or natural person in one of the Member States where it operates, in accordance with the enforcement framework transposed in national law.

Application to groups of companies

Where a company is an ultimate parent of a group of companies that meet the relevant thresholds and are within scope of CS3D:

• that company will be responsible for meeting the due diligence obligations of CS3D, save where the parent company’s main activity is holding shares in operational subsidiaries and the ultimate parent company applies to the competent supervisory authority for an exemption. Where an exemption applies, the obligations of the ultimate parent company will instead be performed by a designated subsidiary established in the Union, which should be given all necessary means and legal authority to fulfil the CS3D obligations, particularly all relevant information and documents from the ultimate parent company. The ultimate parent company will remain jointly liable with the designated subsidiary for a failure of the latter to comply with CS3D obligations.
• that company is permitted to fulfil certain of the due diligence obligations of in-scope subsidiaries if that ensures effective compliance with the terms of CS3D, but without prejudice to the subsidiaries being subject to the exercise of the supervisory authority’s powers and to their civil liability under CS3D.  The fulfilment of the due diligence obligations by a parent on behalf of an in-scope subsidiary is subject to certain conditions specified in CS3D being satisfied.  If a subsidiary is not within scope of CS3D, then the parent company should cover operations of the relevant subsidiary as part of its own due diligence obligations.

Substantive due diligence obligations

Under the CS3D, Member States must ensure that companies conduct risk-based human rights and environmental due diligence by carrying out the following categories of actions, with the detailed measures required for each category laid down in Articles 5 to 11 of the CS3D:

• integrating due diligence into their policies and risk management systems and having in place a due diligence policy that ensures a risk-based due diligence;
• identifying and assessing actual or potential adverse impacts and, where necessary, prioritising potential and actual adverse impacts based on the severity and likelihood of the adverse impacts.  Actual or potential adverse impacts are defined as breaches of prohibitions and obligations or abuse of rights contained in various international instruments listed in an Annex to CS3D;
• preventing and mitigating potential adverse impacts, and bringing actual adverse impacts to an end and minimising their extent, in each case by taking ‘appropriate measures’ (see below); 
• providing remediation to actual adverse impacts and where the actual adverse impact is caused only by the company’s business partner, voluntary remediation may be provided by the company, and the company may use its ability to influence that business partner to enable remediation;
• carrying out meaningful engagement with stakeholders;
• establishing and maintaining a notification mechanism and complaints procedure in line  with the requirements of CS3D;
• monitoring the effectiveness of their due diligence policy and measures by carrying out periodic assessments without undue delay after a significant changes occurs but at least 12 months and whenever there are reasonable grounds to believe that new risks of the occurrence of adverse impacts may arise; and
• publicly communicating on due diligence, whether on their website in accordance with CS3D or in accordance with their sustainability reporting obligations under the EU Accounting Directive (as introduced by Directive (EU) 2022/2464 (the “Corporate Sustainability Reporting Directive”)).

When considering the ‘appropriate measures’ to be taken to prevent and mitigate potential adverse impacts, it is important to note that CS3D does not require companies to guarantee, in all circumstances, that adverse impacts will never occur or that they will be stopped.  Instead, the obligation is on companies to take appropriate measures that are capable of achieving the objectives of due diligence, by effectively addressing adverse impacts in a manner commensurate to the degree of severity and the likelihood of the adverse impact, and reasonably available to the company, taking into account the circumstances of the specific case, including the nature and extent of the adverse impact and relevant risk factors. 

Specific measures referenced in CS3D include neutralising or minimising the extent of actual adverse impacts, developing preventive or corrective action plans, seeking contractual assurances, making financial and non-financial investments, adjustments or upgrades to facilities, production or processes and infrastructures, modifying or improving the company’s own business plan, strategy and operations, providing targeted supports to SMEs that are business partners, collaborating with other entities to prevent or end the adverse impact (subject to EU law, including competition law), and provide remediation.  As a last resort, the company is required to refrain from entering into new or extending existing relations with a business partner, and where entitled to do so, to suspend or terminate the business relationship with respect to the affected activities (save where the adverse impacts of so doing would be reasonably expected to be more severe than the adverse impact that could not be prevented or adequately mitigated).  Member States must provide for the availability of an option to temporarily suspend or terminate a business relationship in contracts governed by their laws, except for contracts where the parties are obliged by law to enter into them.

Scope of due diligence obligations

Due diligence should cover human rights, and environmental adverse impacts generated throughout the majority of the life-cycle of production, distribution, transport and storage of a product or provision of services, at the level of:

• companies’ own operations
• operations of their subsidiaries and
• operations of their business partners where related to their chains of activities.

The final compromise text has narrowed the definition of “chain of activities” to cover only listed parts of value chain as follows:

• activities of a company’s upstream business partners related to the production of goods or the provision of services by the company, including the design, extraction, sourcing, manufacture, transport, storage and supply of raw materials, products or parts of the products and development of the product or the service, and
• activities of a company’s downstream business partners related to the distribution, transport and storage of the product, where the business partners carry out those activities for the company or on behalf of the company.

Specifically, the definition of “chain of activities” excludes:

• downstream activities at the product disposal stage, and
• the distribution, transport, storage and disposal of a product that is subject to export control of a Member State or the export control relating to weapons, munition or war materials after the export of the product is authorised.
• activities of a company's downstream business partners related to the services of the company. For regulated financial undertakings, the definition of the term ‘chain of activities’ excludes downstream business partners (e.g. customers) that are receiving their services and products (e.g. loans). Therefore, as regards regulated financial undertakings, only the upstream but not the downstream part of their chain of activities is covered by CS3D.

CS3D defines a “business partner” as being either a “direct business partner”, meaning that the company has a commercial agreement related to the operations, products or services of the company or to whom the company provides services, or an “indirect business partner”, being one that is not a “direct business partner” but which performance business operations related to the operations, products or services of the company.

Climate transition plan obligation

In-scope companies will be required to adopt and put into effect a transition plan for climate change mitigation which aims to ensure, through best efforts, that the business model and strategy of the company are compatible with the transition to a sustainable economy and with the limiting of global warming to 1.5 °C in line with the Paris Agreement and the objective of achieving climate neutrality as established in Regulation (EU) 2021/1119, including its intermediate and 2050 climate neutrality targets.

Such requirements are so-called ‘obligations of means’ and CS3D notes that “[b]eing an obligation of means, due account should be given to the progress companies make, and the complexity and evolving nature of climate transitioning. While companies should strive to achieve the GHG emission reduction targets contained in their plans, specific circumstances may lead to companies not being able to reach these targets, where this is no longer reasonable.  In this regard, it is worth noting that the powers of supervisory authorities with respect to the transition plan are limited to supervision of its adoption and design rather than its implementation.  Similarly, the civil liability regime described in CS3D is not expressed to extend to the obligation to adopt and put into effect a transition plan.

Importantly, to avoid duplication, companies that report a transition plan for climate mitigation in accordance with Article 19a, 29a or 40a (as applicable) of the EU Accounting Directive which were inserted by the Corporate Sustainability Reporting Directive, and which is due to be implemented into Irish law by 6 July 2024 are exempt from the obligation to adopt a transition plan under CS3D.

Climate transition plans should provide for:

• time-bound targets related to their climate objectives for 2030 and in five-year steps up to 2050 based on conclusive scientific evidence and where appropriate, absolute emission reduction targets for significant categories of greenhouse gas emissions;
• a description of decarbonisation levers identified and key actions planned to reach the targets mentioned in the point above, including where appropriate changes in the undertaking’s product and service portfolio and the adoption of new technologies;
• an explanation and quantification of the investments and funding supporting the implementation of the transition plan; and
• a description of the role of the administrative, management and supervisory bodies with regard to the plan.

Such plans will have to be updated every 12 months to assess progress towards the targets set out therein.

Enforcement and liability

Member States will be required to designate one or more supervisory authorities to enforce the due diligence and climate transition plan requirements under CS3D, which will be competent over EU companies which have their registered office in that Member State and non-EU companies which have a branch in that Member State or otherwise generate most of their net turnover in the European Union in that Member State. Such supervisory authorities will have the necessary powers to require information and carry out investigations relating to due diligence obligations, and to supervise the adoption and design of climate transition plans.

Member States will be required to impose harmonised penalties which include, at a minimum:

• pecuniary penalties of up to 5% of the net worldwide turnover of the company or the group of companies; and
• a public statement indicating the company responsible and the nature of the infringement if the company fails to comply with the decision imposing a pecuniary penalty within the applicable timeframe.

Moreover, the CS3D will require Member States to introduce civil liability mechanisms to hold companies liable where it intentionally or negligently fails to comply with its obligations under the CS3D, thereby affecting a claimant's rights, prohibitions or obligations protected under the CS3D and as a result of such failure causes damage to a claimant's protected legal interests under national law. A company, however, should not be held liable for damage caused only by the company’s business partners in the company’s chain of activities.  Causality for the purposes of imposing civil liability is not defined by CS3D, and so will be determined in accordance with the legal systems of each Member State.

The civil liability mechanism will be independent from the decisions of supervisory authorities as regards to companies’ compliance with the CS3D. Such claims can be made by natural or legal persons suffering damages related to CS3D obligations, trade unions, non-governmental organizations, and other national human rights’ institutions. Member States are free to decide the conditions under which trade unions, non-governmental organizations or national human rights institutions can initiate collective redress mechanisms on behalf of victims.

Where a company is held liable, a natural or legal person shall have the right to full compensation for the damage caused in accordance with Member State law provided that such compensation must not lead to overcompensation, whether by means of punitive, other types, or multiple types of damages.

Next Steps

Following the JURI approval on 19 March 2024, a definitive European Parliament vote will take place during the plenary session from 22 to 25 April 2024. Once final Parliament approvals are received, the CS3D will enter into force on the twentieth day following its publication in the EU Official Journal. Member States will have two years to transpose the CS3D with substantive requirements to apply in accordance with the phase-in timeline from 2027.

Also contributed by Morris Hung