Due Diligence: What Scope of Application ?
RULES OF THE GAME - Finance, CSR, Ethics

Due Diligence: What Scope of Application ?

[part 2/4]


It is clear that as regards the scope of application of the 2017 French Duty of Vigilance Act (which currently only applies to the largest companies), the NGOs consulted have very varying views.

  • Some want to limit the law to multinationals, while others want to extend it to all companies.
  • Some favour differentiating criteria linked to the number of employees, turnover or the level of risk involved in operations.
  • For others, the terms of the law and in particular the notion of “reasonable vigilance” remain to be clarified.

This raises a major question about the standard. This is because, to meet associations’ expectations, the legislator could be tempted to exponentially increase the number of standards designed to respond to the concerns and demands regarding the technical points raised by these associations in their varied fields of expertise. One essential point of vigilance in this sphere is undoubtedly to resist this temptation, otherwise companies without sufficient financial resources to address these issues seriously will go under, and companies with the resources to take expert advice will adopt effective circumvention strategies.

This article is the 2nd of a series of 4, presenting the results of an NGO consultation as part of a global report on corporate due diligence.

Read part 1: Due Diligence: What do NGOs Think of France’s 2017 Duty of Vigilance Act? Is it adequate? Is it effective? 

Read part 3: Due Diligence: What are NGOs’ minimum requirements for companies?

The next phase of the project will focus on the views of large companies on the impact of the law on their governance.

Should the 2017 French Duty of Vigilance Act only apply to very large companies (as is currently the case)? Wouldn’t it be better if it covered all companies of any size (Mid-caps, SMEs and VSEs)?

As regards the scope of application of the French Duty of Vigilance Act, which was significantly extended by the Directive on corporate sustainability due diligence adopted by the European Parliament on 1 June 2023 and currently awaiting the decision of the trialogue, NGOs do not hold a unanimous position.

The NGOs consulted have diverging opinions as to whether the act should apply to only very large companies, as is currently the case, or involve all companies regardless of size. For a better understanding of the debate and to shed greater light on it, the nature of the texts governing the issue needs to be considered.

What thresholds are imposed by the 2017 Act and what does the draft directive propose?

In the 2017 text, only very large companies are targeted. Article  L. 225-102-4.-I. specifies that: “Any company that employs, at the close of two consecutive financial years, at least five thousand employees within the company and in its direct or indirect subsidiaries with registered offices located in France, or at least ten thousand employees within the company and in its direct or indirect subsidiaries with registered offices located within or outside France, must draw up and effectively implement a vigilance plan. […] Subsidiaries or controlled companies that exceed the thresholds indicated in the first paragraph are deemed to meet the obligations stipulated in this article if the company that controls them, within the meaning of Article L. 233-3, draws up and implements a vigilance plan concerning the activity of the company and all the subsidiaries or companies it controls.”

The draft directive significantly lowers these thresholds by targeting:

  • European Union (EU) companies with more than 500 employees and a worldwide net turnover of over €150 million;
  • EU companies with more than 250 employees and a worldwide net turnover of over €40 million, if more than half their net turnover is generated in a high-risk sector (high-risk sectors being the manufacture of textiles, leather and related products, agriculture, forestry and fishing, and the extraction and manufacture of mineral products);
  • non-EU companies with a net turnover of more than €150 million in the EU;
  • companies in third countries (i.e. outside the EU) with a net turnover of more than €40 million in the EU and at least half of whose worldwide turnover is generated in one of the high-risk sectors indicated above.

Although small and mid-sized enterprises do not fall directly within the scope of the directive, they are indirectly affected, since as suppliers they will be required to provide guarantees to the large companies to which it applies, and which will not take the risk of working without guarantees of compliance with legal provisions.

The European directive on corporate sustainability due diligence contains new obligations for companies operating in the EU, notably by significantly broadening the scope of the structures covered. In addition to the joint stock companies and limited stock partnerships already targeted under national law, it includes limited liability companies, regulated financial institutions and insurance companies. 

It also provides that compliance professionals will be responsible for managing social and environmental impacts throughout the value chain, including those of direct and indirect suppliers, in addition to the impacts of their own operations, products and services.

How are NGOs responding to these developments?

Some consider that the act should apply only to very large companies, as is currently the case. Others feel it would be preferable to extend its scope to all companies, whatever their size.

Why are there such widely differing views?

Limiting the law to multinationals

Some NGOs, such as “Notre Affaire à Tous”, which is particularly interested in climate issues, believe that in terms of action, only challenging multinationals will have any effect. This is because large groups have the means to control their emissions throughout their value chain and reduce them directly, unlike governments, for example, which can only act very indirectly through regulation alone. It is thus far more effective to take legal action against multinationals than against governments, which accounts for the increasing number of formal notices and proceedings brought against them since the act was passed.

“Notre Affaire à Tous” feels that the inclusion of SMEs and mid-caps in the scope of the Vigilance Act or the future directive is not progress as such. For since the directive covers more companies but limits its ambitions as regards substance, there will be no benefits in terms of impact. Furthermore, the NGO posits that when a company is asked to integrate CSR standards in application of this act, the cost involved is extremely high and there comes a time when this is not relevant, or is even counterproductive if it concerns a company that is too small or generates little turnover.

In addition, as multinationals move towards the systematic application of the Vigilance Act, the companies with which they have commercial relations will naturally be led to incorporate the desired measures themselves, on pain of disqualification. So, since multinationals are now responsible right through to the end of the chain, they are inclined to work with companies that comply with CSR rules. 

Lowering the threshold for the number of employees

Other NGOs, like “Les Amis de la Terre”, believe that the threshold should be much lower, with a minimum of 250 employees within companies and in their subsidiaries. 

This position is stricter than those proposed by France and the European directive, as the European threshold is only defined for each company, and does not include subsidiaries. 

The fact that various organisations do not share the same vision of the Act’s scope and maintain that all companies should be involved and impacted is not necessarily contradictory, according to the NGO “Notre Affaire à Tous”. This position can be explained by the fact that these organisations work on different issues.

For if we look at the value chain of the textile industry, which is radically different from the climate sector’s, it may be relevant and consistent, as pointed out by the NGO “Mighty Earth”, to consider including companies other than multinationals.

To counter the argument that small companies are put at risk because they do not have the means to ensure compliance with all these new vigilance standards, a support system could usefully be introduced, either by each Member State or by the EU via the Commission or another institution, through a back-up body offering services and guidelines to help companies that find it difficult to interpret the act. However, the States, and France in particular, would still have to be able to pinpoint the companies concerned by this act in order to ensure compliance with it, which is far from being the case today, according to “CCFD Terre Solidaire”. The NGOs criticise the lack of traceability regarding the number of companies concerned, the fact that the content of vigilance plans is not rigorously audited, and what they consider the often inadequate risk mapping produced by companies subject to the act.

Turnover as a differentiating criterion

Some NGOs, like “CCFD Terre Solidaire” and “Sherpa”, also stress that, rather than workforce numbers, companies’ turnovers should be taken into account to ensure the proper application of the act. In their view, this indicator is much more relevant because it reflects the company’s size more accurately than the number of employees, which is actually very hard to determine, depending on a company’s legal structure.

They also believe that, for greater consistency, all companies working in high-risk sectors (extractive industries, minerals, textiles, agri-food) should fall under the act, whatever their size or corporate form.

For these organisations point out that the Duty of Vigilance Act, included in Book 2, Title 2, Chapter 5 of the French Commercial Code, which applies only to SAs (“societés anonymes”: public limited companies), effectively excludes other corporate forms from its scope, such as SARLs (limited liability companies) and cooperatives.  As a result, some companies that may have a negative impact on social, societal or environmental aspects escape its application because of their corporate purpose, turnovers and subcontracting networks. This is notably the case with ZARA France, a ready-to-wear clothing company with a turnover of €1.3 billion and a workforce of 6,443, which has strategically chosen to operate as a SARL (limited liability company), thereby avoiding the application of the Vigilance Act.

Given this situation, the NGOs want companies, regardless of their corporate form, to be subject to the act as soon as they reach the legal thresholds (which should be revised downwards once the directive is adopted). They are also calling for the introduction of an alternative criterion stipulating a minimum turnover, which would make it possible to inhibit the avoidance strategies of legally well-advised companies that take advantage of loopholes to sidestep the regulations.  

Extending the law to all companies

Lastly, other NGOs such as “CCFD Terre Solidaire” believe that all companies should be covered by the duty of vigilance, as the aim of the text is systemic. This is because the duty of vigilance seeks to promote respect for human and environmental rights throughout the value chain. It concerns all types of players, both private and public, when they operate in the economic sphere. They must be able to respect human and environmental rights regardless of the long-term nature of the commercial relationship, not just in the context of an established commercial relationship as specified in the 2017 act.

Introducing a new criterion: risk inherent to operations

The NGO FIDH indicates that the extent of the duty of vigilance should depend on the risk inherent to operations. These risks may be linked to the location of the source, the type of product involved in the value chain, the co-contracting parties involved throughout the value chain, the type of operations carried out and the methods used.  The NGO considers that in terms of financial and human resources, an SME is perfectly able to question itself in terms of assessing these risks in its value chain and then to implement its duty of vigilance. In the end, this must be proportionate to the type of activity, and fundamentally concerns risks and damage, not the size of the company. 

“FIDH”, taking the example of SMEs that sell surveillance software to repressive regimes like those of Libya and Syria, which are responsible for serious human rights violations, believes that a company acting in this way cannot be completely exonerated from responsibility on the pretext of its size.

“CCFD Terre Solidaire” maintains that the argument of the administrative and human cost of applying an act like this to SMEs put forward by some is not acceptable. Although this cost would probably hit hard at first, once appropriate support was introduced, these new practices would fit in with the rationale, and constitute an approach for growth attractive to younger generations keen to work in a meaningful environment aligned with values of respect for people and the environment. It would also attract consumers, now increasingly demanding as regards the conditions in which their product or service has been produced. Some SMEs are on the right track, in fact, and are making major changes to become more respectful and move towards a fair ecological, social and societal transition.

Establishing a solid body of case law

The NGO “Mighty Earth”, while in complete agreement with the other NGOs on the points raised above, nonetheless stresses that the most urgent issue lies elsewhere.

It considers it a priority to introduce a solid body of case law to ensure that the act applies to players potentially dangerous in terms of impact other than those expressly targeted by the texts, and which are keeping under the radar as a result. The courts will have a major role to play in interpreting and defining the legislation’s scope of application.

For the Vigilance Act to be applied fairly, the fundamental point is to be able to measure a product’s impact throughout its production chain when analysing its life cycle. The greatest impact is generally at the production stage.

According to “Mighty Earth”, if we take the example of beef and deforestation, the problem is not so much the transport of the beef from A to B, or the machines that process it, but the consequences of producing this beef in a given area, particularly the deforestation and social problems arising during production. The NGO’s argument is based on several studies, which show that the proportion of the impact linked to the production area is between 60% and 90%, taking all impacts  into consideration. In its view, then, the root of the evil lies very largely in production.

Although the Duty of Vigilance Act places responsibility on the end players, which must provide proof to consumers of a certain rigour in complying with the rules set by the legislator, it does not explicitly target intermediaries, although these have an established, direct commercial relationship with the players involved in deforestation and various social and environmental impacts in the production area. Consequently, the key point for NGOs concerned about this issue is to show that an established commercial relationship does not stop at the next level down from the company, which is what companies brought before the courts seek to defend, but extends to the entire chain.

If we take the example of beef again, we can see that the biggest impacts are found at the production level, with indirect suppliers. The beef chain is complex.  Before slaughtering there is a fattening phase, which is generally well regulated by law and relatively respectful of animal welfare. However, the preceding “intermediate” phases – when the cattle, as calves, are raised on different farms – are the ones that pose the most problems in terms of CSR. Yet they are not taken into account in the legislation.

If the impact of human activities is mapped correctly, we are supposed to see that beef farming is the main cause of deforestation, and as concerns the main beef retailers in a country like Brazil, where this problem is extremely critical, the question of indirect suppliers is a crucial one. But according to the NGO, nothing to date has been put in place in this respect.

The central issue of impact and risk mapping has not yet been addressed, or has not been properly dealt with.  The Vigilance Act does not allow for a broad interpretation of the law, which is of great concern to activists, who believe that risks should be considered at every level of the chain, thereby making the companies acting as principals responsible overall. 

As it stands, the act enables players unwilling to make all the financial and structural efforts required to set up a truly effective CSR policy to argue that the text only targets the commercial players with which they have an established business relationship – which they consider to be only the next level down and no further. 

Clarify the terms of the law

Lastly, the act uses the expression “reasonable vigilance”, which raises problems in interpretation.

The NGOs consider that the term “reasonable” should be understood as reasonable in relation to the level of global issues.  Given that, as a result of deforestation, the Amazon may well reach a tipping point and risk losing the battle against climate change in the next few years, it seems reasonable to the NGOs that the leaders in mass distribution and the main meat retailers in Brazil should tackle this issue head on by introducing sufficient tools and people to be able to properly address this issue, not just one or two, as is too often the case today. Genuinely proactive compliance departments need to be set up to influence policy and make this aspect the compass for steering the company, not merely an issue dealt with on the sidelines.

The way the act is drafted allows for different levels of interpretation, which confuses the issue.  Real clarification is essential and can only come about through case law.

This is how NGOs justify the legal action they take. In 2022, 23 proceedings (17 formal notices and 6 summonses) were initiated on the basis of the Duty of Vigilance Act in France, i.e. twice as many as in March 2021.


It is clear that as regards the scope of application of the 2017 Act, the NGOs consulted have very varying views. This raises a major question about the standard. This is because, to meet associations’ expectations, the legislator could be tempted to exponentially increase the number of standards designed to respond to the concerns and demands regarding the technical points raised by these associations in their varied fields of expertise. One essential point of vigilance in this sphere is undoubtedly to resist this temptation, otherwise companies without sufficient financial resources to address these issues seriously will go under, and companies with the resources to take expert advice will adopt effective circumvention strategies.