Appropriate measures will depend on the circumstances of the particular case, including whether the business itself caused the impact or how much influence it has over the entity which caused the impact.
Some of the “appropriate measures” listed in CS3D have been controversial – these include in particular the requirement to put in place contractual clauses to apply the business’s code of conduct to the partner in question, to ensure the partner’s compliance with it, and potentially extend its application to further sub-contractors or sub-suppliers. This has been viewed as a quick and easy way for businesses to push down the compliance burden to business partners including potentially SMEs, who are least able to bear the burden (though the business retains responsibility for verifying compliance). The European Commission will publish model clauses for this purpose, and CS3D itself foresees that contractual clauses used in contracts with SMEs must be fair, reasonable and non-discriminatory.
As a last resort, businesses may be required to suspend or terminate business relationships where adverse impacts cannot be prevented or adequately mitigated. This disengagement can be problematic where it is concentrated on many suppliers in a specific geographic area, as it then has the potential to affect responsible businesses as well as those with problematic practices, and by extension whole communities who may depend on trade with international businesses for their livelihood.
4. Remediate
Actual adverse impacts must be remediated, which may involve the business providing financial or non-financial compensation to affected persons, in proportion to its responsibility for the impact. The Commission will publish guidance on appropriate measures for remediation (amongst many other things).
5. Stakeholder engagement
The Directive requires that businesses carry out “meaningful engagement” with stakeholders – a broad term which including its employees, employees of its subsidiaries, trade unions, consumers, civil society organisations and others. This must occur at several junctures through the due diligence process. To be meaningful, existing human rights frameworks describe an interactive, two-way communication process with good faith on both sides.
6. Complaints process
The business must establish a fair, accessible and transparent process for receiving and dealing with complaints, available to natural and legal persons affected or potentially affected, by an adverse impact, as well as their legitimate representatives such as NGOs. Separately but related, persons with substantiated concerns can submit them to the national Member State competent authorities who may then investigate whether the business has failed to discharge its legal obligations.
7. Monitor
The due diligence process must be dynamic – for example the due diligence policy must be refreshed at least every 2 years. The process must be monitored and refined to ensure that it is adequate and effective in preventing human rights and environmental adverse impacts from occurring.
8. Communicate
The business must communicate on matters covered by CS3D in an annual statement. However, for businesses already reporting under CSRD, there is no additional reporting obligation. For businesses not covered by CSRD (possible in particular for large businesses with revenue in the EU but without a legal presence), the form of the annual statement is to be determined by the Commission, but is envisaged to align (to a greater or lesser degree) with the reporting standards under CSRD.