What you should know about the CS3D and Forced Labor Regulation and Their Impact on Your Business Activities

A. The Corporate Sustainability Due Diligence Directive ("CS3D")

On May 24, 2024, the CS3D was finally formally adopted by the Council, which marks the final step of a long and winding legislative process.

This legislative process had begun in February 2022 with the Commission’s proposal. While after conclusion of the legislative Trilogue in December 2023, Council, Parliament, and the Commission seemed to have come to an agreement, new opposition arose from individual member states, including Germany. To secure the required majority, the Trilogue draft was adjusted to take account of the last-minute demands, which considerably narrowed the Directive’s scope of application effectively bringing it closer to its German counterpart, the German Supply Chain Due Diligence Act (“Lieferkettensorgfaltspflichtengesetz” or “LkSG”), while maintaining the Directive’s applicability to both EU and non-EU companies. This final draft was then accepted by the European Parliament on April 24, 2024. Now the long-awaited and heavily debated Directive needs to be transposed in the national legal systems of all EU member states.

The CS3D primarily aims to reduce and mitigate the negative impacts that business activities may have on the environment and human rights. For this purpose, the Directive will require mostly large companies meeting certain thresholds to comply with various due diligence obligations, including the requirement to implement and execute designated environmental protection plans.

Before outlining the different mechanisms of the Directive, this client alert will give a brief overview of the most recent changes during Trilogue and thereafter.

1. Recent Amendments

Many may still be familiar with the first Commission draft and some of the central concepts and terminology used therein. Since then, this draft has undergone major amendments during Trilogue:

• The most obvious change relates to the replacement of the previous terminology “value chain” with “chain of activities.” This change in one of the most central aspects of the Directive’s terminology likely accounts for the exclusion of most downstream activities from due diligence obligations, which would have conflicted with the broad meaning associated with the term value chain. Specifically, due diligence obligations in the downstream chain of activities are now limited to a set of specific activities like distribution, transport, and storage of products. This also means that financial institutions’ downstream activities were exempted altogether.
• Potentially drawing inspiration from the LkSG, the Trilogue introduced new provisions explicitly mandating integration of due diligence measures into risk management systems and fostering meaningful stakeholder dialogues.
• The requirement for management boards to consider sustainability in their decision making processes was deleted, something which was heavily discussed among corporate law scholars.
• In addition, the parameters of civil liability were further defined, providing enhanced ways for affected parties to seek justice.
• Something missing in the LkSG was added during the Trilogue: It was clarified that the prioritization of certain adverse impacts is possible when taking measures to comply with due diligence obligations.
• Moreover, Trilogue resulted in an emphasis of stronger safeguards for trade secrets.

After conclusion of the Trilogue and in response to German opposition, the following additional adjustments were made to address the last-minute concerns effectively bringing CS3D in line with the LkSG:

• The Directive’s scope of application was significantly narrowed, with in-scope companies now required to meet a minimum threshold of 1,000 employees and EUR 450 million in annual turnover, thereby considerably raising the previous thresholds.
• Additionally, the Directive’s application is now staggered, with employee and turnover thresholds dictating timing of the Directive’s applicability.
• Adjustments were also made to the definition of legal standing in the context of civil liability.
• Furthermore, certain provisions, such as incentivizing managements to promote the adoption of climate plans, as well as the inclusion of waste disposal in the downstream chain of activities, were removed.

2. How Does the CS3D Work?

Even after all these changes, in its fundamentals, the CS3D still works as initially envisioned by the Commission. Essentially, the Directive requires in-scope companies with close ties to the European market to comply with human rights and environmental due diligence obligations in its chain of activities, accompanied by the requirement to implement and execute environmental protection plans.

a) In-Scope Companies

The Directive’s applicability is determined by an employee threshold, as well as a financial benchmark (Article 2 CS3D).

• At a minimum, the Directive encompasses companies that were formed in accordance with the laws of a member state, have an average of more than 1,000 employees, and have achieved a worldwide net turnover of more than EUR 450 million in the last financial year.
• Third country companies are in-scope if they generated a net turnover exceeding EUR 450 million in the financial year prior to the last financial year in the EU. An employee threshold does not exist for these entities.
• Additionally, EU franchise companies are in-scope, provided they generated a net turnover of more than EUR 80 million and their royalties amounted at least EUR 22.5 million in the last financial year. The same applies to non-EU franchise companies, provided the relevant net turnover and royalties were generated in the EU.

When determining the relevant application thresholds, the Directive clarifies that they must have been met over the last two consecutive financial years.

When determining the employee threshold, special rules regarding seasonal workers, temporary agency workers, and part-time workers apply.

Lastly, ultimate parent companies—both EU and non-EU—whose groups meet the thresholds are also covered by the Directive. Thus, the personal scope of application is broader compared to that of the LkSG.

b) Due Diligence Obligations

The CS3D establishes minimum standards to prevent potential or actual adverse impacts on human rights and the environment (Article 1 CS3D).

aa) Material scope

The due diligence obligations primarily extend to the owned operations of in-scope companies, as well as to those of their subsidiaries and business partners.[1] This includes both direct and indirect business partners and thus goes beyond the LkSG, which by default only covers direct suppliers and indirect suppliers only if there is substantiated knowledge of violations at the level of an indirect supplier. Direct business partners are parties to commercial agreements with an in-scope company related to the operations, products, or services. Indirect partners are not direct partners, but perform business operations related to the operations, products, or services of the company.

The chain of activities of a company includes all upstream business partners involved in the production of goods or the provision of services.[2] Downstream business partners are only included if their activities are carried out on behalf of the company and are related to the distribution, transport, and storage of a product (not its disposal), and are not subject to export control.[3]Recipients of services (including financial services) are not subject to due diligence obligations of companies as downstream chains of activity related to services are not encompassed by the CS3D.[4] Nonetheless, the legislator still expects financial institutions to assess adverse impacts and utilize their leverage to influence customers downstream in their activity chain.[5]

bb) Adverse impacts

All due diligence obligations relate to potential or actual adverse impacts. The Directive defines adverse impacts as both adverse human rights and adverse environmental impacts. As part of this definition, the Directive refers to its Annexes containing certain environmental prohibitions and obligations, as well as certain international human rights related instruments (Article 3 CS3D). Breaches of the environmental prohibitions and obligations, as well as abuses of the human rights outlined therein, are considered adverse impacts for the purpose of the Directive.

cc) Due diligence obligations

Companies are subject to a variety of different due diligence obligations that are all similar to the type of obligations under the LkSG. CS3D “due diligence” has a fundamentally different meaning from traditional due diligence, for example in a mergers and acquisitions context, which focuses on risks that may have a direct or indirect negative impact on the company carrying out the due diligence. To the contrary, CS3D and LkSG due diligence obligations are designed to identify and mitigate risks for third parties in the company’s value chain. As a consequence, an in-scope company must adapt the risk management processes.[6]

• Companies are required to integrate due diligence obligations into their risk management systems and company policies, which must be developed in consultation with employees and their representatives (Article 5 paragraph 1 (a), Article 7 CS3D).
• Companies must identify and assess the potential or actual adverse impacts.[7] Therefore, the first step must be to map the company’s own activities (see aa), along with those of any subsidiaries and business partners to the extent that they are involved in chains of activities to identify adverse impacts in the respective areas. Subsequently, the results of this analysis must undergo an in-depth assessment. The assessment should be reviewed at least every 12 months or sooner in the event of significant changes. Already at this stage, Companies may prioritize individual actual and potential impacts, if necessary (Art. 5 paragraph 1 (b), Article 8 paragraph 4 CS3D).
• In addition, companies are required to prevent, mitigate, end, or at least minimize actual and potential adverse impacts (Article 5 paragraph 1 (c), Article 10 and 11 CS3D). In this context, they have the option to prioritize impacts based on their severity and likelihood. Among the different measures to prevent negative impacts, the Directive names the development and implementation of a prevention action plan with appropriate and clearly defined timelines for the implementation of measures and qualitative as well as quantitative indicators to measure improvements (Article 10 paragraph 2 CS3D). Other measures include contractual assurances from (in)direct business partners accompanied by regular verification measures. In this context, independent third parties may be tasked with conducting the verification procedure (Article 10 paragraph 5 CS3D). The termination of a business relationship is only listed as a last resort to uphold due diligence obligations. However, if a termination becomes a potential course of action, consideration must be given to whether the termination could lead to even more severe disadvantages (Article 10 paragraph 6 (b) CS3D).
• Remedies for actual adverse impacts are to be provided (Article 5 paragraph 1 (d), Article 12 CS3D). Specifically, the Directive calls for the restitution of the affected individual(s), communities, or the environment to a situation that corresponds to or is as close as possible to the situation they would have been in if the actual adverse impact had not occurred. However, remedial measures are only mandatory if the company has at least jointly caused the adverse impact. In this context, the company is also required to effectively involve relevant stakeholders in its measures to comply with the due diligence obligations (Article 5 paragraph 1 (e), Article 13 CS3D). Member states may support affected stakeholders in exercising their rights.
• The Directive requires that a complaints procedure be set up (Article 5 paragraph 1 (f), Article 14 CS3D). The Directive considers this a separate mechanism to the internal reporting procedure under the Whistleblowing Directive (EU 2019/1937).[8] The procedure must offer a platform for expressing concerns regarding actual or potential negative impacts. It is essential that companies provide a fair, publicly available, accessible, predictable, and transparent procedure to effectively combat adverse impacts on human rights and environmental issues.
• Lastly, companies are required to periodically monitor and evaluate the effectiveness of the various measures, or without undue delay in the event of significant changes (Article 5 paragraph 1 (g), Article 15 CS3D).
• All measures are accompanied by a comprehensive documentation obligation, which also requires retention of supporting evidence for at least five years (Article 5 paragraph 5 CS3D).

Companies are required to report on their due diligence measures. For companies in scope of the Corporate Sustainability Reporting Directive (“CSRD”), this requirement is fulfilled by complying with CSRD reporting obligations.[9] Only if there are no reporting obligations under the CSRD, an annual report concerning relevant information on due diligence policies and activities must be published at least every 12 months on the company’s website (Article 5 paragraph 1 (h), Article16 CS3D). The Commission was tasked with developing the details of this dedicated CS3D reporting and to align it as closely with CSRD reporting requirements as required and possible (Article 16 CS3D).

cc) Transition plan for climate change mitigation

Companies must adopt and put into effect a transition plan for climate change mitigation (Article 22 CS3D). Through their climate plans, companies must aim to ensure, through best efforts, that their business model and strategy are compatible with the transition to a sustainable economy and with the limiting of global warming to 1.5°C in line with the Paris Agreement, as well as with the objective of achieving climate neutrality, including the 2050 climate neutrality targets. Where relevant, the climate plans should also outline the company’s exposure to coal-, oil- and gas-related activities. Climate plans should include:

• time-bound targets based on conclusive scientific evidence;
• absolute emission reduction targets for scope 1, 2, and 3 greenhouse gas emissions;
• a description of decarbonization levers and key actions planned to reach climate targets;
• an explanation and quantification of the investments and funding supporting the implementation of the climate plan; and
• a description of the role of management.

Companies that report a climate plan in accordance with CSRD shall be deemed to have complied with the obligation to adopt a climate plan (Article 22 paragraph 2 CS3D). This suggests that CSRD reporting does not deem companies to have complied with the obligation to put into effect their climate plans.

dd) Limiting financial impacts of CS3D compliance on in-scope companies and third parties

Despite these far-reaching obligations, Companies are under no concrete obligation to completely eradicate human rights and environmental violations from their chains of activities as long as they take suitable countermeasures in line with the Directive. It is thus sufficient that due diligence measures are capable of achieving the Directive’s objectives.[10]

Furthermore, the Directive grants companies’ discretion to prioritize specific adverse impacts if it is not possible to address all identified adverse impacts simultaneously (Article 5 paragraph 1 (b), Article 9, recital (44), (80) CS3D). Such prioritization is possible when it comes to preventing, mitigating, bringing to an end, or minimizing the extend of actual or potential adverse impacts (Article 5 paragraph 1 (b), Article 9 CS3D). As a result, companies may assess their processes accordingly and identify “hot spots” where negative impacts may typically occur. This enables them to prioritize their actions based on the severity and likelihood of potential negative impacts.

Additional limitations to the exercise of due diligence obligations may arise from the treatment of trade secrets (Article 5 paragraph 3 CS3D), the extent of the company’s level of involvement in an adverse impact (Recital (45) CS3D), and, lastly, the available resources (Article 3 paragraph 1 (o) CS3D).

ee) Small and medium-sized enterprises

Given the potentially substantial effects on small and medium-sized enterprises (“SMEs”),[11] the Directive provides measures to mitigate the impact of due diligence obligations on such companies. Notably, it aims at limiting the burden associated with inquiries and requests directed at SME business partners by encouraging in-scope companies to address such requests directly to the lower-tier supplier level where adverse impacts are usually anticipated. Moreover, Member States are empowered to extend targeted assistance to small businesses, such as offering direct financing or low-interest loans (Article 10 paragraph 2 (e) and 5, Article 11 paragraph 3 (f) CS3D). When requesting contractual assurances, the specific interests and situation of SMEs should also be taken into account by in-scope companies (Article 10 paragraph 5 CS3D). In addition, if SMEs underwent a third-party verification process and paid part of the costs they will be allowed to use the results of the verification vis-à-vis in other in-scope companies.

ff) Additional facilitation of CS3D compliance

Additional facilitation of the exercise of due diligence obligations is set to be accomplished through multistakeholder and industry initiatives allowing companies to leverage influence on both direct and indirect business partners when identifying, mitigating, and preventing adverse impacts (Article 20 paragraph 3 CS3D). The Directive aims at promoting digital tools and technologies to facilitate CS3D compliance,[12] while also encouraging independent third-party verification processes to support implementation of due diligence obligations (Article 20 paragraph 5 CS3D).

Moreover, to assist in achieving compliance with due diligence standards, the EU Commission, as well as the member states and stakeholders will provide support in the form of model contract clauses,[13] as well as general guidelines and best practice approaches (Article 19 CS3D).

3. Enforcement and European Network of Supervisory Authorities

To ensure compliance with the Directive, member States are required to designate one or more national supervisory authorities that are legally and functionally independent (Article 24 CS3D).

Representatives from these national supervisory authorities are expected to collaborate to form a European Network of Supervisory Authorities, fostering cooperation among member states (Article 28 CS3D). Additionally, the supervisory bodies are required to cooperate when responding to assistance requests from other national supervisory authorities.

Penalties imposed on companies for non-compliance with due diligence obligations must be both proportionate and effective (Article 27 CS3D). In addition to pecuniary penalties, a public statement on an infringement can be issued, particularly if a company fails to comply with a decision imposing a pecuniary penalty. The calculation of pecuniary penalties should consider the company’s net worldwide turnover, with a maximum fine threshold set at no less than 5% of the worldwide net turnover. Furthermore, the consolidated turnover of the ultimate parent company should be taken into account when imposing penalties.

In addition, the member States are required to ensure that non-compliance with due diligence obligations is taken into account for the purpose of public procurement, public support, and public concessions (Article 31 CS3D).

4. Private Enforcement and Civil Tort Liability

In stark contrast to the LkSG, the CS3D provides for civil tort liability of in-scope companies vis-à-vis affected persons, thereby creating another enforcement level through private individuals (Article 29 CS3D). Civil liability requires that companies acted with intent or at least negligence. If responsibility for the damage solely lies with a business partner within a company’s chain of activities, the respective company cannot be held liable. Companies can also not be held liable if the damage is linked to adverse impacts that the company has deprioritized in accordance with the Directive.[14]To help affected persons bolster the plausibility of their claims in court proceedings, companies may be compelled by courts to disclose relevant evidence. Additionally, provisions for authorizing third parties to enforce claims and for establishing joint liability of subsidiaries or business partners in cases of joint damage causation will be introduced.

5. Next Steps and Implementation

The application of CS3D is staggered in three stages counting from its transposition into national law and depends on company size and turnover (Article 37 CS3D):

• Three years after transposition into national law: EU companies and ultimate parent companies with a minimum of 5,000 employees and a worldwide turnover of at least EUR 1.5 billion net, and non-EU companies and ultimate parent companies with a minimum net turnover of EUR 1.5 Four years after transposition into national law: EU companies and ultimate parent companies with at least 3,000 employees and a worldwide turnover of at least EUR 900 million net, and non-EU companies and ultimate parent companies with a minimum net turnover of EUR 900 million within the EU.
• Five years after transposition into national law: (1) EU companies and ultimate parent companies with at least 1,000 employees and a worldwide turnover of at least EUR 450 million net, and non-EU companies and ultimate parent companies with a net turnover of at least EUR 450 million within the EU; and (2) EU and non-EU companies that have entered into certain franchising or licensing agreements.

B. The Forced Labor Regulation (“FLR”)

1. Scope of the Main Prohibition

Essentially, the regulation on prohibiting products made with forced labor on the Union market[15] will prohibit any product manufactured using forced labor at any stage of the supply chain to be imported, made available, or exported.

The Regulation will have a global scope by focusing on the product. It will target forced labor worldwide by applying its rules to all kinds of goods. A product under the Regulation is defined as any product that can be valued in money and is capable, as such, of forming the subject of commercial transactions (Article 2 FLR). Due to the definition of the term “product,” services do not fall directly within the scope of the Regulation. However, services can be relevant to the Regulation when being classified as forced labor and being used for making a product. Recital 18 clarifies though that the Regulation will not apply to the provision of transport.

The Regulation will mainly prohibit economic operators from “placing” and “making available on” and “exporting from” the EU market of any product where “forced labor has been used in whole or in part at any stage of its extraction, harvest, production, or manufacture, including working or processing related to a product at any stage of its supply chain.”

“Making available” means any supply of a product for distribution, consumption or use on the EU market in the course of a commercial activity, whether in return for payment or free of charge. Cases where a product is offered through for sale online or other ways of distance selling will also be included (Article 4 FLR). Thus, the Regulation will apply on the EU’s internal market as well as to import and export operations between third countries and the EU.

“Forced labor” in this regard means any kind of forced or compulsory labor, including forced child labor, as defined in the Convention on Forced Labor, 1930 (No. 29).[16]By citing the Convention of the International Labor Organization and aligning the Regulation with both international standards and the EU legislation already in place, the overall objective of the Regulation fits with the EU’s efforts in the area of forced labor and modern slavery so far.[17]Against this backdrop, the Regulation is said to not apply to imports into or exports from or trade in the EU of goods produced with the assistance of imprisoned criminal convicts for the benefit of a state authority.

Apart from that, the Regulation defines “supply chains” broadly as systems of activities, processes and actors involved at all stages upstream of the product being made available on the market.

Unlike in the CS3D, there is no employee or turnover threshold. All natural and legal persons or associations of persons who place, supply, or export products on the EU market are in scope. The Regulation’s main prohibition will aim at any economic operator regardless of where the operator is based. In contrast to the CS3D[18] the FLR will include also SMEs, and (after a transition period) will be directly applicable instead of following a staggered entry-into-force approach.

However, the Regulation clarifies that it does not cover the withdrawal of products which have reached the end-user in the Union market (Article 1 FLR).

2. Competent Authority

Member states will have to designate one or more competent authorities to enforce the Regulation in their territories. Those will then work in close cooperation with the Commission to ensure the effective implementation of the Regulation as well as closely coordinate and exchange information with the relevant national authorities, including those responsible for investigations against human trafficking (Article 5 FLR). A list with all competent authorities will be publicly available. In Germany, it remains to be seen whether the Federal Office for Economic Affairs and Export Control (“Bundesamt für Wirtschaft und Ausfuhrkontrolle” or “BAFA”) will become the designated competent authority as the BAFA is already responsible for the supervision of companies with regard to compliance with the German Supply Chain Due Diligence Act.

3. Preliminary Investigation

Before initiating a formal investigation, a member state’s competent authority will first have to determine whether there is a “substantiated concern” that an economic operator acts in violation of the prohibition of products made with forced labor (Article 17 FLR). This requires a reasonable indication based on objective, factual and verifiable information, for the competent authority to suspect that products were likely made with forced labor.

The competent authority will have to base its determination on a risk-based methodology (Article 14 FLR). For that it will have to take into account the following sources of information:

• the EU database of forced labor risks;
• submissions by natural and legal persons and associations;
• the up-coming Commission’s guidance on risk indicators;
• information requested of other competent authorities; and
• information requested of those economic operators under assessment about their compliance with due diligence standards recommended or mandated by the EU or relevant international institutions.

Depending on whether the suspected forced labor is allegedly taking place inside or outside the territory of the EU, investigations will be allocated differently. Investigations outside the EU’s territory will be led by the Commission whereas an investigation on the territory of a member state will be led by the member state’s competent authority (Article 15 FLR). However, the Commission and the national authorities shall cooperate closely and provide each other with mutual assistance where efficient.

4. Formal Investigation

If the lead competent authority determined a “substantiated concern,” it will be required to open a formal investigation. In this case, the economic operator will be informed of the initiated investigation, of its reasons and possible consequences, of the product concerned, and of the right to submit additional information. Upon request, the economic operator will have to submit any information relevant to the case and, where appropriate, identify the part of the product to which the investigation should be limited. In requesting such information, the authority in charge shall prioritize the economic operator closest to where the forced labor likely occurs (Article 18 FLR). The deadline for submitting such information shall not be less than 30 working days and not exceed 60 working days.

Where necessary, the competent authority may also collect information by interviewing any relevant natural or legal person relating to the subject matter, including relevant economic operators and any other stakeholders. However, for conducting interviews the competent authority needs the consent of the respective person. The Regulation does not stipulate enforcement measures in this regard. In exceptional cases, the authority can also conduct field inspections with consideration to where the risk of forced labor is located (Article 19 FLR). This includes field inspections within the EU as well as in third countries. However, in case of the latter the Commission may carry out checks and inspections only if the economic operators concerned give their consent and if the government of the third country has been officially notified and raises no objection.

The authority must then review all information gathered and complete the investigation within a reasonable period of time but not later than nine months from initiating the investigation.

When conducting its investigation and before making a decision the authority will have to take into account the following aspects:

• the size and economic resources of the economic operators, in particular whether the operator is an SME;
• the quantity of products concerned;
• the complexity of the supply chain; and
• the scale of suspected forced labor.

To support economic operators and their business partners in the supply chain, in particular SMEs, the Commission will develop measures and make them available through a “Forced Labor Single Portal” (Article 10 FLR). While it remains unclear which measures will be made available specifically, SMEs will be provided with certain information via contact points that will also provide further assistance to SMEs with regard to engaging in dialogue with competent authorities in case of an investigation. Also, member state competent authorities will have to organize trainings for economic operators on certain forced labor risk indicators.

5. Burden of Proof and Comparison to the U.S. Uyghur Forced Labor Prevention Act

Under the FLR, the lead competent authority bears the burden of proof. It must establish that forced labor took place in the production, manufacture, harvest, or extraction of the product in question. In contrast, the initial draft of the Regulation had clearly drawn inspiration from the U.S. Uyghur Forced Labor Prevention Act (“UFLPA”) by providing for a reversal of the burden of proof in cases where state-ordered forced labor is suspected. The Regulation puts the burden of proof on the national authorities by obliging them to prove that the product in question was manufactured using forced labor. This is a significant difference compared to the UFLPA which has been in force in the United States since June 2022 and imposes import bans into the United States on goods manufactured in Xinjiang or by companies listed by U.S. authorities due to the suspicion of benefiting from forced labor.[19] Under the UFLPA there is the presumption that such products coming from Xinjiang or a listed company are made with forced labor. In such cases, companies need to demonstrate that their supply chain is free from forced labor,

However, if a company refuses to cooperate or provide information during the investigation, the competent authority may consider any kind of verifiable information gathered during the preliminary and formal investigation as sufficient. While this is not a reversal of burden of proof for products from areas at risk of state-imposed forced labor, a company’s cooperation and capability to present exonerating facts might be crucial.

6. Decisions by the Lead Competent Authority

The investigating authority must conclude the outcome of its formal investigation by issuing a formal decision (Article 20 FLR).

The investigated economic operator will be notified of any decision to close the investigation.

If the authority establishes a violation of the main prohibition, it shall adopt a decision containing:

• a prohibition to place or make the products concerned available on the EU market and to export them;
• an order to withdraw from the EU market the products concerned that have already been placed or made available on the market or to remove content from an online interface referring to the products or listings of the products concerned; and
• an order to dispose products concerned or, if the parts of the product, which are found to be in violation of the main prohibition, are replaceable, an order to dispose the respective parts. By way of exception and where the authority deems it appropriate in view of preventing disruptions of a supply chain of strategic or critical importance for the EU, it may refrain from imposing an order of disposal. Instead, it can order the product to be withheld for a defined period of time necessary to eliminate the respective forced labor at the costs of the economic operator. If the operator can demonstrate that it has eliminated the forced labor from the supply chain, the authority will have to review its decision.

In addition, the authority’s decision must include the findings of the investigation, the information on which these findings were based and a time limit by which the operator is to comply with these orders (not less than 10 working days in case of perishable goods, animals and plants or 30 working days in case of any other goods). Also, the operator will have to be informed about the possibilities for a judicial review against the decision. Apart from that, the operator has the right to request a review of the decision by the authority (Article 21 FLR). The operator then will bring forth new substantial information on why the product is in compliance with the main prohibition. The authority will then take a new decision within 30 working days and, if applicable, withdraw its decision for the future.

If the operator shows it complies with the orders contained in the decision and that forced labor is excluded from its operations or supply chain in relation to the products concerned, the authority will be obliged to withdraw its prohibition decision. If the operator does not comply with the orders, the authority will have to take all necessary steps to ensure the main prohibition is put into effect. Then the products will be withdrawn from the EU market and will be disposed of at the operator’s expense.

7. Enforcement and Penalties

Any prohibition decision by a competent authority must be recognized and enforced by other competent authorities. In respect of the concerned products, the Regulation will contain provisions requiring cooperation in enforcement actions and the exchange of information between the competent authorities and the customs authorities of member states (Article 26 FLR). Following the communication of a competent authority’s prohibition decision, customs authorities will have to identify any product that may not comply with that decision and for that purpose carry out controls on products entering or leaving the EU.

Furthermore, the Regulation will require member states within 24 months from its entry into force to lay down rules on penalties applicable to non-compliance with a decision by a competent authority and shall take all measures necessary to ensure that they are implemented in accordance with national law (Article 37 FLR). Those penalties shall give due regard to the following, as applicable:

• the gravity and duration of the infringement;
• any relevant previous infringements by the economic operator;
• the degree of cooperation with the competent authorities; and
• any other mitigating or aggravating factor applicable to the circumstances of the case, such as financial benefits gains, or losses avoided, directly or indirectly, from the infringement.

In addition, member states shall take utmost account of the guidance on the method for calculating financial penalties and the thresholds applicable. This guidance is one of several points which a guideline developed by the Commission and relevant stakeholders will include. The guideline will be made available to authorities, economic operators and their suppliers no later than 18 months after the Regulation entered into force (Article 11 FLR). These guidelines will also include the information on risk indicators of forced labor and on how to identify them as well as guidance on due diligence in relation to forced labor.

8. Interlinkage of CS3D and FLR

The FLR is intended to complement the CS3D.

The CS3D imposes its obligations on companies, requiring them to assess and address environmental, as well as any kind of human rights risks such as forced labor risks in their supply chains. It does not define administrative measures specifically preventing the sale of products that benefited from forced labor. The FLR, on the other hand, provides for a ban on the product itself, but does not contain any specific requirements for assessing or addressing forced labor risks in supply chains. Violations of the CS3D, however, may result in administrative fines and civil lawsuits by affected parties. Both outcomes are intended to discourage the sale of products that benefited from forced labor and therefore indirectly boost the intended impact of the FLR. Companies can benefit from the interdependencies of both regimes by using and further advancing the CS3D’s risk based approach for being able to demonstrate compliance with the FLR. The fulfillment of CS3D obligations will help companies gain a deeper understanding of their supply chains and related forced labor issues and thereby facilitating measures to prevent or remedy product bans imposed under the FLR.

9. Additional Due Diligence Obligations for Economic Operators

For many economic operators inside and outside the EU, the new Regulation might create additional obligations with regard to their forced labor due diligence efforts across their supply chains. However, companies that are already in compliance with the German Supply Chain Due Diligence Act or will be in scope of the CS3D can generate significant synergies when it comes to analyzing their risk exposure to forced labor occurrences in the supply chain.

First of all, due to its generous scope, the Regulation will apply to operators all over the world as soon as they make available in the EU products that benefited at least partially from forced labor. This applies particularly to companies operating distance selling systems like online retailers. This will include many companies who do not have to comply with such holistic regulatory approaches so far. Companies based in countries with a high-risk regarding forced labor that distribute their products in the EU will have to take additional compliance measures and be ready to demonstrate to the authorities that their products do not benefit from any kind of forced labor. While there is no reversal of the burden of proof in this regard, authorities might consider reliable information concerning high-risk countries as sufficient in order to determine a “substantiated concern” if not challenged by exonerating information.

Secondly, the new Regulation will apply not only to large companies like the CS3D but also to SMEs. Even though, the Regulation promises certain support measures particularly aimed towards SMEs and has to take into account the size and economic resources of the economic operators as well as the quantity of products concerned, these companies will have to intensify their current measures when it comes to screening their suppliers from third countries with regard to forced labor. This will mitigate enforcement or at least reputational risks of becoming subject to investigations.

Furthermore, the Regulation creates additional due diligence obligations even for those companies already in scope of the German Supply Chain Due Diligence Act as well as those that will be in scope in the future by indirectly demanding that the entire supply chain is screened and not just the direct supplier. This can help to reliably demonstrate to the authorities that the product does not contain any parts that have been manufactured using forced labor. It is also likely that authorities will base their proceedings on how reliable and convincing the information is that companies report under the LkSG or according to the CS3D.

This could also be an opportunity for companies to expand their approaches which they already apply under the LkSG or which they will apply anticipating the CS3D to develop a holistic upstream supply chain management. Looking at the numerous EU directives and regulations that are aimed at making supply chains more transparent, such an approach seems more and more inevitable. Time will show where further obligations and risks are hidden compared to other applicable regimes. Certainly, the Commission’s guidelines as well as the EU database of forced labor risks will provide more information in this regard.

10. Prospects for Companies

To approach this new regime, companies that operate in the EU should thoroughly assess whether the new provisions will apply to them, to their operations and processes, as well as to their supply chains, and be ready to demonstrate that the products they offer do not contain any part that benefited from forced labor. Otherwise, they could face the product’s ban and its disposal on company’s costs if the competent authority establishes that forced labor took place. The centerpiece to tackle these increasing human rights obligations will be a thorough analysis of the own risk exposure as well as the implementation of mitigating measures.

On the plus side, the new FLR will define a level playing field among companies importing products in or exporting products from the EU with regard to forced labor due diligence. In contrast to the CS3D, the FLR will apply directly throughout the EU. The CS3D, on the other hand, needs to be transposed into national law, which gives national lawmaker certain liberties and leads to 27 domestic supply chain acts that are going to be similar but not the same.

For SMEs the FLR not only provides certain support measures which they are best advised to thoroughly study as soon as they are published. The Regulation also names a company’s size and capabilities as well as the gravity and duration of the infringement decisive factors that competent authorities will have to consider before deciding to open an investigation or to order a product’s ban.

When finally approved by the Council, companies will be granted a transition period of three years to ensure that their supply chains are free of forced labor.

As often in compliance, a well-designed risk management process, training of employees and suppliers, efficient controls, the exercise of audit rights, contractual safeguards, and proper documentation will be key.

__________________________________________

[1] Recital (16) CS3D.

[2]Recital (25) CS3D.

[3]Recital (25) CS3D.

[4] Recital (26) CS3D.

[5] Recital (51) CS3D.

[6] Article 5, 7, 8, 10, 11 CS3D.

[7] Article 5 paragraph 1 (b), Article 8 CS3D.

[8] Recital (59), (60) CS3D.

[9] Please find out more about the CSRD in our client alert.

[10] Article 3 paragraph 1 (o), Article 8 paragraph 1,2, Article 10 and 11 CS3D.

[11] Micro, small or medium-sized undertakings, irrespective of their legal form, which are not part of a large group; Article 3 paragraph 1, (i) CS3D.

[12] Recital (68) CS3D.

[13] Article 18, Recital (66) CS3D.

[14] Recital (80) CS3D.

[15] European Parliament legislative resolution of April 23, 2024, on the proposal for a regulation of the European Parliament and of the Council on prohibiting products made with forced labor on the Union market (COM (2022) 0453 – C9-0307/2022 – 2022/0269 (COD)), adopted text.

[16] The FLR refers to the ‘forced labor’ definition set out in Art. 2 of the Convention on Forced Labor, 1930 (No. 29) of the International Labor Organization, without further elaborating on its modern application.

[17] E.g., the Regulation supplements and follows the EU Directive (2011/36) on combatting trafficking in human beings and protecting its victims.

[18]The criteria to determine which companies have to carry out due diligence in compliance with the CS3D on the other hand are based on the number of employees (more than 1,000 calculated on a full-time equivalent basis) and the net worldwide turnover in the last financial year (more than EUR 450 million) for EU companies, and on the net turnover generated in the EU (more than EUR 450 million) for non-EU companies (Article 2 CS3D).

[19] Please find out more about the UFLPA in our article.

MoFo research assistant Marie Scheidt contributed to this client alert.