Sustainability due diligence: CSDD is law

On 5 July 2024, the Corporate Sustainability Due Diligence Directive (CSDD), also known as the Supply Chain Act, was published in the Official Journal of the European Union. A turning point for EU companies, as this Directive imposes new standards of responsibility and sustainability, with significant implications for both large multinationals and small and medium-sized enterprises (SMEs). After the Sustainability Reporting Directive and the ESRS standards, the CSDD is a further step towards strengthening the sustainability reporting standards with reference to the ESG criteria. With the CSDD in fact, companies become responsible for actual or potential negative impacts on environment and human rights not only concerning their own activities, but also those of their suppliers and subcontractors. The CSDD will become law from the 20th day after its publication in the Official Journal and thus from 26 July 2024.

The companies that fall within the scope of the CSDDirective are:
- The companies in the European Union that exceed 100 employees and whose overall net turnover exceeds 450 million;
- Franchising companies operating within the European Union and whose turnover exceeds 80 million euro, of which at least 22.5 million euro from licence fees;
- Non-EU companies whose net turnover exceeds 450 million euro within the EU, regardless of the number of employees.
Companies are therefore required to implement a series of strategies to monitor their own activities and those of the companies they have contracted with (suppliers and subcontractors), to prevent, mitigate or minimise any negative impacts. Small and medium-sized enterprises, together with micro-enterprises that perform procurement functions, although not directly affected, will be affected by decisions taken by large groups.

The CSDD establishes a set of seven main obligations for companies to integrate sustainability practices throughout the supply chain. First, companies must incorporate due diligence into their policies and risk management systems, developing codes of conduct and describing processes to ensure compliance. In addition, assessment of current and potential negative impacts on human rights and the environment is required, prioritising areas such as damage to ecosystems, deforestation and child labour. Companies must also establish accessible and transparent reporting channels for complaints about negative impacts, protecting whistleblowers from possible retaliation.

Another obligation is to conduct effective involvement with actual and potential stakeholders (e.g. employees, trade unions, consumers) through effective and transparent consultations. Businesses are also expected to prevent, reduce or minimise negative impacts through detailed action plans and clear corrective measures, requiring stakeholders to comply with codes of conduct, and continuously improving operational practices. Finally, verification and monitoring of the effectiveness of the due diligence measures taken with periodic evaluations are essential, which should be based on qualitative and quantitative indicators and information from the company's stakeholders. Finally, the detailed reporting of policies and actions undertaken in line with the CSRD directive and the ESRS standards is essential.

As reported in Il Sole 24 Ore, companies are liable for damages caused to people and the environment if they have intentionally or negligently failed to comply with due diligence obligations to prevent and mitigate negative impacts. Failure to comply with due diligence obligations is sanctioned with fines of up to 5% of the company's global net turnover. In addition, companies that fail to comply with their duty of due diligence will be held liable for damages caused and fully compensate the victims.

The EU Member States will have to comply with the CSDD within two years (i.e. by 26 July 2026), following a specific timetable depending on the size of the company:
- at 3 years from the entry into force of the Directive (by 26 July 2027) for companies with more than 5,000 employees and €1,500 million net turnover worldwide;
- to 4 years after the entry into force of the Directive (by 26 July 2028) for companies with more than 3,000 employees and €900 million net turnover worldwide;
- 5 years after the entry into force of the Directive (by 26 July 2029) for companies with more than 1,000 employees and EUR 450 million net turnover worldwide.