Last October, well before recent events in Ukraine, our Human Rights Team had warned of the growing challenges to maintaining responsible supply chains after 24 months of pandemic emergencies, climate disasters and conflict had resulted in widespread human rights violations in the world’s major sourcing countries.

The additional disruption to global supply chains caused by the Russia-Ukraine conflict has added further risk to sourcing, with businesses scrambling to plug gaps potentially having to turn to new suppliers in jurisdictions with dubious track records on human rights and ESG.

This will increase the exposure of many Western businesses, investors and shareholders to potential reputational, legal and operational risks.

On 23 February, the day before Russia invaded Ukraine, the European Commission sent to the Parliament (EP) and Council (EC) a (long-awaited) proposal for a directive on ‘corporate sustainability due diligence’.

According to our Senior Human Rights Analyst Victoria Gama, this proposed directive would establish a ‘corporate sustainability due diligence duty’ requiring certain companies (including both EU and non-EU companies meeting specific criteria) to identify and, where necessary, prevent, end, or mitigate the potential or actual adverse impacts of their activities on human rights and the environment – across the full extent of their value chains, as well as their own operations and those of subsidiaries – repeating these periodic assessments at least every 12 months.

This wide-ranging and far-reaching proposal adds to the growing body of EU legislation on ‘sustainability’ across value chains, such as the Corporate Sustainability Reporting Directive and the EU Taxonomy’s minimum social safeguards.

Importantly, however, the proposal goes beyond ‘mere’ reporting duties (often very onerous in practice), by imposing on companies direct, mandatory human rights due diligence obligations.

For now, only extra-large companies, plus large companies in the ESG-sensitive agriculture, textiles and extractive sectors, would need to comply with the directive.

Once approved, large companies operating out of the European Single Market (ESM) would thus be required to identify, prevent and mitigate actual (or potential) adverse human rights and environmental impacts by setting up new due diligence policies and management systems.

These must include: a description of the company’s due diligence approach, the processes put in place to implement it periodically, and a code of conduct to be followed by the company, employees and subsidiaries.

The duty of these big companies to conduct due diligence would extend specifically to ‘established business relationships’ across the value chain, mainly focusing on strategic suppliers and contractors with proximate relationships. But this means that SMEs, which are not included in the proposal, will also have to adapt in order to remain in the supply chain of larger entities.

For the financial sector, the new due diligence directive would be limited to the pre-contractual phase of relationships, and to the activities of large corporate clients. This means that financial institutions effectively get a partial waiver – and will not be required to assess all clients’ value chains.

Critically, company directors will be held individually responsible for assuring that human rights and environmental impacts are addressed in company operations, and would be personally liable for any breach of this duty of care.

Failure to comply would result in proportionate and dissuasive penalties. However, the extent of these sanctions for companies has yet to be defined, and would require legislation at member state level, while the implications for directors from the proposed revisions to ‘duty of care’ obligations under company law (again legislated for and enforced by individual member states) is also unclear.

However, they would likely include civil and administrative sanctions, with some member states potentially also imposing criminal penalties. Neither can we rule out temporary or indefinite exclusion from public procurement, or the imposition of substantive financial penalties of, for example, up to 10% of a company’s worldwide revenue.

Equally, it is important to know that the proposal gives the courts of EU member states global jurisdiction. Member states thus will also be required to pass civil liability legislation, to ensure that victims of violations occurring outside of the EU can receive compensation from a company’s failure to comply.

This may considerably up the litigation risk for companies.

Gama suggests that companies can reduce liability risks by including contractual clauses obliging direct partners to comply with their codes of conduct; or use their purchasing power as leverage to nudge vendors into compliance. As a last resort (and provided EU member state laws permit), they could opt to unilaterally terminate the business relationship.

The proposal remains at very early stages. The Parliament and Council have yet to negotiate the definitive text, which Gama does not expect to be approved before mid-2023.

And the final version will likely include substantive changes. The issue of directors’ ‘vigilance’ obligations is a particular hot potato. In the European Parliament, the Greens and Social Democrats want to strengthen directors’ obligations. But in the Council, Sweden, Denmark and Finland take the opposite view.

Once approved, EU member states will have two years to transpose the Directive into national law. This two-year transition window will also give companies time to adjust corporate policies and practices, Gama notes.

Meanwhile, Gama suggests that companies kick start their human rights due diligence journey by browsing through the Business & Human Rights Navigator (BHR Navigator) - a new tool backed by Verisk Maplecroft working in close collaboration with the UN Global Compact and the German government’s Helpdesk on Business & Human Rights. We also stand ready to support companies directly, through our best-in-class human rights risk data and expert advisory services.