Duty of vigilance and the CSDDD directive (CS3D): obligations of companies in 2026

The legal departments of large property investment companies (foncières), developers and principals in the construction sector (donneurs d'ordre) now have to deal with two partly overlapping regimes: the French 2017 law on the duty of vigilance, which already applies, and the CSDDD European directive adopted in 2024, whose transposition into French law will change the thresholds and the scope of the obligations. Between the postponement of the timetable decided in spring 2025 and the renegotiation of the content of the directive itself, the companies concerned are operating in costly uncertainty: should they invest now or wait for the transposition text? This analysis reviews the obligations actually in force, the timetable as it results from the Omnibus package, and above all the litigation risk and the liability of the parent company or principal, in connection with the question of environmental liabilities.

From the 2017 law to the CSDDD directive: two overlapping regimes

The French duty of vigilance

France was the first State to enshrine a binding duty of vigilance, with Law No. 2017-399 of 27 March 2017 on the duty of vigilance of parent companies and ordering companies. That law inserted Articles L. 225-102-4 and L. 225-102-5 into the French Commercial Code.

The central obligation is the preparation, publication and effective implementation of a vigilance plan. The plan must include reasonable measures to identify risks and to prevent serious harm to human rights, fundamental freedoms, the health and safety of individuals and the environment. Its scope covers the activities of the company, those of the companies it controls, and those of the subcontractors and suppliers with whom an established commercial relationship is maintained.

Two cumulative or alternative thresholds trigger the obligation: employing, at the close of two consecutive financial years, at least 5,000 employees within the company and its French subsidiaries, or at least 10,000 employees within the company and its French and foreign subsidiaries. In practice, only a limited number of large groups are currently concerned in France.

The plan must contain five categories of measures: a risk map, procedures for the regular assessment of the situation of subsidiaries, subcontractors and suppliers, appropriate action to mitigate risks or prevent serious harm, a mechanism for alerts and the collection of reports, and a system for monitoring the measures implemented and assessing their effectiveness.

What the CSDDD directive adds

Directive (EU) 2024/1760 of 13 June 2024, known as the Corporate Sustainability Due Diligence Directive (CSDDD or CS3D), published in the Official Journal of the European Union on 5 July 2024, harmonises the duty of vigilance at European level. It goes significantly further than the French law on several points.

First, it is framed in terms of the chain of activities (chaîne d'activités), a notion that covers the activities of upstream business partners (production, supply, design) and part of the downstream activities (distribution, transport, storage). Second, it imposes a continuous duty of due diligence rather than a simple annual document: identification, prevention, mitigation, bringing to an end of adverse impacts, remediation, monitoring and communication. Finally, its Article 22 requires the adoption of a climate transition plan compatible with limiting global warming to 1.5 °C, in line with the Paris Agreement.

The CSDDD relies on the international reference standards: the United Nations Guiding Principles on Business and Human Rights, and the OECD Guidelines for Multinational Enterprises. French companies already subject to the 2017 law will therefore have to reconfigure their systems to absorb this more demanding standard.

Which companies will be concerned and on what timetable

The thresholds

The CSDDD lowers the thresholds considerably compared with the French law and uses a criterion combining headcount and turnover. In the original text, it covers EU companies with more than 1,000 employees on average and a worldwide net turnover exceeding €450 million. Specific thresholds apply to companies from third countries generating net turnover in the Union above the same amount.

These thresholds considerably widen the target: beyond the very large groups alone covered by the 2017 law, a range of mid-cap companies, listed property investment companies and large principals will come within scope. The knock-on effect will go further still: business partners, including subcontracting or supplying SMEs, will be asked contractually to document their practices, without being directly subject to the directive themselves.

The timetable revised by the Omnibus package

The original CSDDD timetable provided for transposition by the Member States by 26 July 2026 at the latest, followed by a phased application from 26 July 2027 for the largest companies. That sequence has been changed.

On 26 February 2025, the European Commission presented a simplification package known as Omnibus, with a twofold objective: to postpone the entry into application and to lighten certain obligations. Directive (EU) 2025/794 of 14 April 2025, known as "Stop the clock", recorded the postponement of the deadlines. Transposition into national law is now expected by 26 July 2027 at the latest, and the first wave of application has been pushed back to 26 July 2028, with a gradual phasing-in for the other categories.

A second part of the Omnibus package, concerning the content of the directive itself, was still under negotiation between the European Parliament and the Council at the time of writing. The orientations under discussion aim in particular to refocus in-depth due diligence on direct business partners, to space out the frequency of monitoring, and to review the harmonised civil liability regime. Until that text is definitively adopted, the exact scope of the 2027-2028 obligations remains liable to change.

This uncertainty does not justify waiting. Large groups already subject to the 2017 law remain bound by the law in force, and the systems built today for the French law form the basis of the forthcoming European requirements.

The content of the obligations: vigilance plan and duty of due diligence

Risk mapping and the chain of activities

The cornerstone of the system remains the identification of adverse impacts. This is not a generic inventory but a ranked risk map: listing of gross risks, scoring by severity and likelihood, then assessment of the net risk after taking existing measures into account. This ranking makes it possible to concentrate resources on the most severe impacts, a principle that the CSDDD enshrines by allowing prioritisation based on severity and likelihood.

For a property investment company or a developer, the risk map must reach down into the construction chain of activities. Typical impacts concern working conditions on construction sites, the use of posted workers or workers in an irregular situation by second- or third-tier subcontractors, the safety of structures, the sourcing of high-risk materials, and environmental harm linked to soil sealing or to the management of demolition waste.

Prevention, mitigation and remediation

The directive clearly distinguishes three families of measures. Prevention measures operate upstream: contractual vigilance clauses, supplier charters, selection and qualification of partners. Mitigation measures reduce an impact that cannot be immediately eliminated: a corrective action plan with a defaulting supplier, targeted audits, support for the partner in achieving compliance. Remediation measures apply when the harm has occurred: compensation for the damage suffered by the persons affected, restoration of the environment.

The assessment of third parties feeds the risk map and is in turn fed by it. A supplier identified as sensitive during the mapping will be subject to enhanced due diligence, the results of which will in turn refine the scoring of risks. This continuous loop distinguishes the duty of due diligence from a simple annual documentary exercise.

The alert mechanism completes the structure. It must allow stakeholders, including workers in the chain of activities and neighbouring communities, to report harm. Its coordination with the internal reporting system provided for by Law No. 2016-1691 of 9 December 2016, known as Sapin II, as amended by Law No. 2022-401 of 21 March 2022, must be designed so as to avoid redundant channels.

The case of property investment companies and principals in the construction sector

The real estate sector concentrates several risk factors that call for particular vigilance. Cascading subcontracting on construction sites dilutes the traceability of working conditions. A principal that steers a construction operation does not directly control the practices of a remote-tier subcontractor, but its liability may be sought if it has not deployed the reasonable measures expected of it.

In concrete terms, a property investment company must include vigilance clauses in its project management (maîtrise d'œuvre) and works contracts, provide for site audits, and verify that the participants actually comply with their social obligations. These requirements also join the existing vigilance obligations on undeclared work under the French Labour Code, as well as the financial joint liability of the principal where it uses a subcontractor employing workers without work authorisation. The CSDDD duty of vigilance is added to these systems without replacing them.

The liability of the parent company and of the principal

The civil liability regime

Under the 2017 law, liability rests on the ordinary law of fault. Articles L. 225-102-4 and L. 225-102-5 of the French Commercial Code refer to the regime of Articles 1240 and 1241 of the French Civil Code: the victim must demonstrate a breach of the duty of vigilance, damage and a causal link. The Constitutional Council (Conseil constitutionnel), in its Decision No. 2017-750 DC of 23 March 2017, struck down the civil fine mechanism originally provided for, held to be insufficiently precise in light of the principle that offences and penalties must be defined by law. There is therefore no automatic financial penalty in French law, but there is the possibility of an injunction with a periodic penalty payment (astreinte) and an action in liability.

The CSDDD, in its adopted text, provides for a civil liability regime in its Article 29, allowing injured persons to obtain compensation where an intentional or negligent breach of the duty of due diligence has caused damage. The text also provides for administrative sanctions, which may reach a significant percentage of worldwide net turnover. It is precisely these provisions that are the subject of the Omnibus package discussions, the exact scope of the harmonised civil liability being one of the most debated points.

What is at stake for the parent company is the reversal of the traditional logic of the autonomy of legal entities. The principle remains that a company is not liable for the faults of its subsidiaries or partners, but the duty of vigilance creates an obligation of its own, borne by the parent company or principal: that of preventing harm within its chain of activities. It is the breach of this own obligation, and not the fault of the third party, that founds liability.

Connection with environmental liabilities

The duty of vigilance meets the question of environmental liabilities on common ground: the anticipation of environmental harm caused by the activities of the company and of its chain. Where the environmental liability regime deals with the remedying of damage already incurred (polluted sites and soils, site restoration obligations, accounting provisions), the duty of vigilance operates upstream, in a preventive logic. The contractual treatment of such liabilities on an acquisition, in particular through the environmental liability and polluted soil warranty, is examined in our dedicated article.

A property investment company holding an industrial or commercial portfolio must connect the two logics. The vigilance risk map identifies the potential environmental impacts of the chain of activities, while the assessment of environmental liabilities quantifies the remediation and site restoration costs attached to the assets held. A failure of vigilance upstream may moreover turn into an environmental liability downstream, where the harm that was not prevented materialises and gives rise to obligations to make good the damage.

Litigation risk: formal notice, summary proceedings and action on the merits

The 2017 law sets up a specific procedure. Any person with standing may serve formal notice (mise en demeure) on the company to comply with its obligations. Failing compliance within three months, the competent court may be seized to order the company, where appropriate subject to a periodic penalty payment, to comply with its obligations. Law No. 2021-1729 of 22 December 2021 for confidence in the judicial institution gave the Paris Judicial Court (tribunal judiciaire) exclusive jurisdiction over such actions.

The first disputes brought on this basis, in particular the case between non-governmental organisations and TotalEnergies concerning an oil project in Uganda, showed the importance of the formal notice stage and the difficulty for claimants of identifying precisely the breaches alleged. The courts in particular checked that the complaints in the formal notice corresponded to those put before the judge. These decisions confirm that vigilance litigation is technical and that the quality of the plan, its precision and its effective implementation are the best defence. The first decision upholding on the merits the liability of a parent company for breach of its duty of vigilance is discussed in our article on the international duty of vigilance.

Reputational risk goes hand in hand with legal risk. Legal proceedings based on a breach of the duty of vigilance, even unsuccessful, expose the company to lasting media exposure, to tensions with lenders and investors sensitive to non-financial criteria, and to distrust among its stakeholders. For a listed property investment company, the impact on valuation and on access to green financing is not negligible.

Preparing before 2027: the priority workstreams

The transposition deadline set for 26 July 2027 leaves limited time to build a credible system. The companies concerned would be well advised to start several workstreams without delay.

• Carry out or update the risk map by working down the chain of activities, as far as sensitive subcontractors and suppliers, with a documented severity/likelihood scoring
• Revise the contractual framework to include vigilance clauses enforceable against business partners, accompanied by audit rights and exit mechanisms in the event of breach
• Structure an alert mechanism accessible to external stakeholders and coordinate it with the existing Sapin II system
• Prepare the climate transition plan required by Article 22 of the directive, consistently with sustainability reporting obligations
• Appoint dedicated governance and entrust the validation of the system to an independent reviewer, in line with the logic of second-level control

These workstreams should not be conceived as isolated compliance documents. Their legal value lies in their effective implementation and in the traceability of the actions taken, the only way to demonstrate, in the event of litigation, that the reasonable measures expected were in fact deployed.

Conclusion

The duty of vigilance is no longer a distant prospect: the 2017 law already applies to the largest groups, and the CSDDD will extend the obligation to a much wider circle of companies, property investment companies and principals, from 2028 according to the timetable revised by the Omnibus package. The bet on waiting, justified by the persistent uncertainty over the final content of the directive, would be an error of analysis. The foundation of the obligations, ranked risk mapping, assessment of third parties, prevention, mitigation, remediation, will not change in its principles, and building it takes time.

The real issue lies in liability: the duty of vigilance creates an obligation of its own borne by the parent company and the principal, distinct from the fault of the third party, and makes litigation before the Paris Judicial Court possible. For real estate and construction players, this liability is closely linked to the management of environmental liabilities, of which it is the preventive side. Before any roll-out, have your chain of activities audited and your vigilance plan validated by an independent reviewer: it is the traceability of your diligence, and not the existence of a document, that will protect you before the judge.

Frequently asked questions

Which companies are subject to the French law on the duty of vigilance in 2026? The law covers companies employing, at the close of two consecutive financial years, at least 5,000 employees within the company and its French subsidiaries, or at least 10,000 employees including foreign subsidiaries. These thresholds, set by Law No. 2017-399 of 27 March 2017, cover only a limited number of large groups. The CSDDD directive will lower these thresholds when it is transposed.

When will the CSDDD directive come into application? The original timetable of Directive (EU) 2024/1760 was postponed by Directive (EU) 2025/794 of 14 April 2025, known as "Stop the clock". Transposition into national law is expected by 26 July 2027 at the latest, and the first wave of application has been pushed back to 26 July 2028, with a gradual phasing-in according to the size of companies. The content of the directive itself was still being renegotiated as part of the Omnibus package.

What are the thresholds provided for by the CSDDD? The original text covers EU companies with more than 1,000 employees on average and a worldwide net turnover exceeding €450 million, as well as companies from third countries exceeding that turnover in the Union. These thresholds are one of the points under debate as part of the Omnibus package and could still change before transposition.

Is a property investment company or a property developer concerned by the duty of vigilance? Yes, where the headcount and turnover thresholds are met. The sector presents specific risks linked to cascading subcontracting on construction sites, to the working conditions of the participants and to environmental harm. The vigilance plan must reach down into the construction chain of activities, as far as remote-tier subcontractors.

What is the liability of the parent company in the event of a breach? The 2017 law refers to the fault-based liability regime of Articles 1240 and 1241 of the French Civil Code: the victim must prove a breach of the duty of vigilance, damage and a causal link. The Constitutional Council struck down the civil fine originally provided for in its Decision No. 2017-750 DC of 23 March 2017. The CSDDD provides in its Article 29 for a civil liability regime of its own, the scope of which is the subject of the Omnibus package discussions.

How can a third party bring an action for breach of the duty of vigilance? Any person with standing may serve formal notice on the company. Failing compliance within three months, that person may bring the matter before the Paris Judicial Court, which has had sole jurisdiction since the law of 22 December 2021, to obtain an injunction with a periodic penalty payment and, where appropriate, compensation for the damage. The first disputes have shown the importance of the precision of the complaints made from the formal notice stage.

Should one wait for the transposition of the CSDDD before acting? No. Groups already subject to the 2017 law remain bound by the law in force, and the systems built today form the basis of the forthcoming European requirements. The risk map, the assessment of third parties and the alert mechanism take several months to build, which makes anticipation necessary despite the uncertainty over the final text of the directive.