The CSDDD was formally adopted by the EU Parliament in April and published on 5 July 2024. It requires EU member states to implement legislation in accordance with the Directive, requiring extensive due diligence to identify adverse business impacts on people and the environment. 

Australian businesses will be impacted one of three ways: 

• by being directly in-scope (an ‘In-Scope Entity’); 

• by being majority owned by an In-Scope Entity; or 
• by supplying goods or services to an In-Scope Entity or their subsidiary. 

Australian businesses will need to implement governance frameworks and due diligence systems, similar to those that were in response to the introduction of similar legislation in individual EU member states (like the German Supply Chain Due Diligence Act). This Insight explains how to navigate the new law and what it will mean for Australian businesses. 

The CSDDD is a legal framework by which In-Scope Entities must:  

• Take responsibility for actual and potential adverse human rights and environmental impacts. They will do this through conducting risk-based human rights and environmental due diligence to identify, assess, cease, prevent, mitigate and remediate those impacts within their own operations, the operations of their subsidiaries and the operations of their direct and indirect business partners within their ‘chain of activities’. 

• Monitor the effectiveness of due diligence efforts. 

• Issue an annual report covering the due diligence and related requirements of the CSDDD. 

‘Chain of activities’ includes the activities of upstream and downstream direct and indirect business partners relevant to the In-Scope Entities’ operations (though the scope of downstream activities is more limited). 

‘Direct business partners’ are those that have a commercial agreement with the In-Scope Entity. 

‘Indirect business partners’ are those where no commercial agreement exists, but who perform certain business operations. 

Actual and potential adverse human rights and environmental impacts are defined by reference to certain human rights enshrined in international instruments and certain international environmental prohibitions and obligations, which are referenced in the CSDDD. They are wide ranging and include modern slavery, child labour, exploitation, adequate housing, freedom of thought, discrimination, biodiversity loss, pollution and destruction of natural heritage. 

In Australia, although some of these international obligations are integrated into Australian law already (for example, modern slavery offences or the regulation of pollution and hazardous substances), not all are. Accordingly, it may not be sufficient to rely on compliance with Australian laws in order to meet the requirements of the CSDDD. 

Once adopted by each EU member state, the CSDDD will become binding on In Scope Entities.  

Unlike traditional corporate due diligence, which is aimed at identifying and mitigating risks to the business, the objective of the CSDDD is to identify and mitigate risks to people and the environment. It requires an enterprise-wide approach to the governance of human rights and environmental risks, and consultation with an entity’s stakeholders to inform each stage of the due diligence process. 

Key requirements for In-Scope Entities include: 

• implementing a climate change mitigation transition plan aligning with the Paris Agreement global warming scenario of 1.5°C; 

• integrating human rights and environmental due diligence into relevant company policies and risk management systems; 

• identifying and assessing actual and potential adverse impacts from their own operations and from the operations of their subsidiaries and business partners; 

• prioritising identified actual and potential adverse impacts based on severity and likelihood of adverse impact and addressing those impacts within a reasonable time; 

• taking steps to prevent potential adverse impacts and bringing actual adverse impacts to an end or minimising the extent of any ongoing impact, and developing a corrective action plan; 

• conducting meaningful engagement with stakeholders at each stage of the diligence process; 

• establishing a notification mechanism and complaints procedure; and 
• monitoring the adequacy and effectiveness of diligence procedures and conducting an annual assessment. 

Significant penalties will apply for non-compliance. In-Scope Entities may also be held civilly liable for intentional or negligent failure to comply with a preventative or corrective action plan causing harm to a person (including legal person). They may further be held jointly and severally liable for damage caused jointly by subsidiaries or business partners. 

Australian subsidiaries of In-Scope Entities 

Some In-Scope Entities will require their subsidiaries to implement the substantive requirements of the CSDDD in full. This will likely be challenging for many Australian businesses who are not subject to the same regulatory requirements. Until now, many were not required to have either climate transition plans or holistic frameworks in place that operationalise human rights and environmental due diligence at the enterprise level. 

Doing business with In-Scope Entities 

The CSDDD’s prescriptive requirements will also have a significant impact on Australian businesses doing business with In-Scope Entities. Impacts may include: 

• requests for emissions data to enable In-Scope Entities to assess alignment of their transition plan to a global warming scenario of 1.5°C; 

• the imposition of stringent contractual terms in supply and other commercial agreements, as a result of In-Scope Entities seeking to ensure business partners and suppliers adopt practices directed to preventing adverse human rights and environmental impacts; and 
• requirements to indemnify In-Scope Entities against losses caused by intentional or negligent failure to comply with a preventative or corrective action plan imposed by the In-Scope Entity.

Because the Australian regulatory framework for human rights and enterprise-wide environmental impacts (including climate change) is less developed than in the EU, we expect Australian businesses will require significant uplift to existing approaches to managing human rights and environmental risks to respond to likely impacts of the CSDDD. 

Once fully implemented, the CSDDD will apply to an estimated 5,500 companies with operations in the EU. It will be introduced in three phases from 2027, giving In-Scope Entities and other impacted entities between three and five years to prepare. 

In the meantime, impacted Australian businesses should take steps to understand how and when they are likely to be impacted. For example, preparation may include: 

• Liaising with EU-based parent companies or EU-based business partners to understand if they are In-Scope Entities and when their respective obligations commence; 

• Understanding the scope of contractual obligations likely to be imposed by EU parent companies/investors and business partners; 

• Conducting a gap analysis between likely impacts and current human rights and environmental risk management frameworks; 

• Conducting a gap analysis between the scope of the human rights and environmental due diligence requirements that underpin the CSDDD and an entity’s existing due diligence processes for identifying human rights and environmental risks in operations, supply and value chains; and 

• Identifying necessary systems changes.  

Australian businesses should be mindful that although existing Australian regulatory frameworks operate to protect some human rights or require some level of due diligence to identify and assess potential environmental impacts, these are unlikely to meet the enterprise-wide focus of the CSDDD, nor span the breadth of the entity’s supply and value chains.

Australian businesses with a high dependence on supplying to or trading in EU markets should assess their readiness by understanding the scope of uplift required to existing practices. Doing so early may also provide a competitive advantage, allowing them to remain attractive as suppliers and business partners. Conversely, delay will mean limited time within which to design and implement enterprise-wide human rights and environmental due diligence – and may ultimately expose the business to potential loss of EU–generated revenue streams.