Vigilance or compliance? - Due Diligence Act: the day after

The "law on the duty of care of parent companies and contractors" number. 2017-399 of 27 March 2017 is not limited to simple disclosure obligations, as provided for example in the "UK Modern Slavery Act" or the "Californian Transparency in Supply Chains Act". It requires certain companies to put in place an "effective" due diligence plan for environmental risks, health and safety risks and human rights violations. It concerns French companies of a certain size, employing at least 5,000 employees (including their direct or indirect subsidiaries in France) or 10,000 employees (including their direct or indirect subsidiaries, in France or abroad).

This law was adopted after a long and laborious parliamentary process, highlighting the fear among some that French companies would suffer a competitive disadvantage as a result of these new obligations. These fears are exaggerated. The players - in particular the NGOs - who supported the bill from the outset on the basis of public indignation following the Rana Plaza disaster were delighted that the law saw the light of day, even if it was stripped of its provisions on civil penalties. But like all celebrations, the day after can be characterised by a "hangover". In other words, will the law really produce the expected effects?

Clear contours and shadows

It should be remembered that the due diligence plan to be drawn up and implemented must include a certain number of "reasonable measures" to identify and prevent "serious harm" in the areas mentioned above, a map and procedures for regularly assessing these risks, appropriate actions to mitigate these risks and prevent serious harm, a mechanism for alerting and collecting reports relating to these risks, as well as a system for monitoring these measures and assessing their effectiveness. This plan must be made public in accordance with the provisions of the French Commercial Code, together with a report on its effective implementation. The activities covered are not only those of the company and its subsidiaries, but also those of subcontractors and suppliers with whom it has an established commercial relationship.

The text of the law leaves a few grey areas, in particular as to what is meant by "effective" or "reasonable measures".  That said, a number of large companies have a legal and/or compliance department (and possibly a risk department) that will help them to better understand the impact of the law and how to comply with it. The issue is likely to be even more difficult to manage for certain subcontractors and suppliers who do not necessarily have the same resources.

Although it is important for the legal, compliance and risk departments to be in a position to advise the company on the scope of the law, its substance and the measures to be put in place to meet its requirements, the company's main objective must be to carry out effective due diligence actions in the field.

Efficiency in question

However, laws that require the adoption of elaborate management procedures - such as the Duty of Vigilance Act - generally fail to achieve the desired outcome of such procedures. Numerous research studies have demonstrated the need for an organisational culture that enables formal management procedures to have the desired effects. If large French companies had organisational cultures where shareholders, directors, managers and employees were convinced that the company, when conducting its operations (including with its partners and suppliers), should identify and prevent risks other than those of the company itself, and more broadly those of potential victims, then a law like that of 27 March 2017 would be useful. But the influence of 'hard law' on organisational cultures and individual perceptions is limited. On the contrary, laws sometimes have counterproductive effects, particularly when employees perceive the existence of a disconnect between the company's formal compliance programme and its informal management routines.

A positive signal?

Furthermore, the Act of 27 March 2017 is not so binding that it could make French groups less competitive. Indeed, what is the real risk for a parent company of being held liable in the event that, for example, human rights are not respected in the context of one of its activities? The victim will have to show that damage has been caused by the absence of an effective due diligence plan. Is the mere fact that the breach and the damage exist enough to determine that the plan was ineffective? By demonstrating that they have complied with the provisions of the law point by point, aren't companies able to protect themselves from the risk of being sued by potential victims? So how does this law improve the situation for victims? It could be argued that the media and reputational risk is nonetheless there, but is that enough?

Perhaps, in the end, we could consider that this new law sends out a positive signal and is a step forward. We know of certain directors or managers of French companies who have invested a great deal of effort in significantly implementing the "United Nations Guiding Principles on Business and Human Rights", and particularly the human rights due diligence measures in the company's day-to-day activities, over and above social impact assessments.

Although it is important for the legal, compliance and risk departments to be in a position to advise the company on the scope of the law, its substance, and the arrangements to be put in place to meet its requirements, the company's main objective must be to carry out effective due diligence actions on the ground. If this is not the case, it is to be feared that the March 2017 law will have no other effect than to encourage large companies to produce sophisticated communication documents and box ticking procedures to explain how committed they are to respecting human rights and the environment. An uninformed public may be satisfied with a law that appears very demanding, but which could generate more bureaucracy than any real impact in terms of human rights and the environment. But hopefully some companies will seize this opportunity to review their strategy and business model.