When the Corporate Sustainability Due Diligence Directive (CSDDD) entered into force on 25 July 2024, it was widely celebrated as a landmark. For the first time, EU law would require large companies to identify, prevent and address adverse human rights and environmental impacts across their value chains. Civil liability provisions would give victims a route to redress, and supervisory authorities could impose fines of up to five per cent of global turnover.
Eighteen months later, much of that ambition is also still being walked back. The Omnibus I package, endorsed by the Council in February 2026, has raised the employee threshold from 1,000 to 5,000, limited due diligence to direct (tier 1) suppliers, removed mandatory climate transition plans, and pushed the compliance deadline to July 2029. The Commission framed these changes as ‘simplification’; leading commentators and civil society organisations see something closer to capitulation.
This retreat would be less alarming if it were unprecedented. But it is not. France adopted the world’s first mandatory corporate due diligence law in 2017, and eight years of implementation offer a sobering preview of what may lie ahead for the CSDDD. This post examines what the French experience tells us about the CSDDD’s likely trajectory, before turning to the United Kingdom — which, having left the EU, has opted out of the conversation — and considering how the three regimes interact across borders.
Eight years of the Loi de Vigilance: what went wrong?
France’s Loi de Vigilance (Law No. 2017-399) requires companies employing more than 5,000 workers in France, or 10,000 globally, to publish a plan de vigilance mapping risks across subsidiaries and supply chains, with mitigation measures and a whistleblowing mechanism. Failure to comply exposes companies to civil liability.
On paper, this was groundbreaking. In practice, the results have been deeply disappointing. Three structural problems stand out.
First, nobody knows who is covered. A 2020 report of the General Council of Economy concluded that establishing a definitive list of regulated companies was ‘impossible’, offering only a non-definitive range of 200 to 250. Employee data for corporate groups is neither systematically public nor easily identifiable, and the dynamic nature of corporate structures (mergers, acquisitions, or restructurings) makes threshold calculations unreliable. If the State itself cannot identify the regulated entities, the law’s deterrent effect is fundamentally compromised. Civil society initiatives such as the Duty of Vigilance Radar have attempted to fill this gap, but remain incomplete.
Second, there is no implementing decree. More than eight years on, the government has still not published the decree meant to clarify the law’s scope and operational requirements. Companies are left to interpret vague obligations on their own, and courts must fill in the gaps case by case — as illustrated by the conflicting lower-court rulings on admissibility that plagued the early TotalEnergies climate litigation before the Paris Court of Appeal intervened in 2024.
Third, enforcement depends entirely on NGOs, and litigation has been painfully slow. The Loi de Vigilance created no supervisory authority and no administrative sanctions. The only enforcement mechanism is civil litigation, which places the burden of policing corporate conduct on under-resourced civil society organisations. Between 2017 and mid-2025, only 30 formal notices and 13 lawsuits were publicly filed, targeting multinationals such as TotalEnergies, BNP Paribas, EDF, Carrefour and La Poste.
The La Poste ruling of December 2023, the first judgment on merits, arrived six years after the law entered into force. The Court held that postal service company La Poste’s vigilance plan was inadequate, but the ruling remained narrow in scope: it addressed only procedural deficiencies in risk mapping and whistleblowing mechanisms, leaving untouched the substantive question of whether the company’s human rights approach was adequate. The second decision on merits, delivered in February 2025 against railway transport operator SNCF, dismissed the claims because plaintiffs had not sufficiently identified which risks were allegedly omitted from the company’s vigilance plan – effectively raising the pleading burden on claimant NGOs.
A turning point came on 18 June 2024, when the Paris Court of Appeal issued three rulings providing critical procedural guidance. In the TotalEnergies climate case, the Appeals Court reversed a lower-court finding of inadmissibility and clarified that a lawsuit need not mirror the formal notice exactly; the notice must simply give the company a fair opportunity to address alleged shortcomings. This lowered a procedural hurdle that had previously allowed defendants to obtain dismissals on technicalities. In the case against French energy giant EDF, the Court similarly broadened access to justice, although it restricted the participation of local authorities to those demonstrating a particular local interest. These rulings resolved some procedural uncertainties, but did not address the substantive adequacy of any company’s vigilance plan.
The climate dimension deserves particular attention. The Loi de Vigilance has become one of the few European legal instruments enabling NGOs to challenge major corporate polluters on climate grounds. In January 2020, NGOs and local authorities sued TotalEnergies to compel alignment with the 1.5°C Paris Agreement target. In February 2023, Les Amis de la Terre, Notre Affaire à Tous and Oxfam France filed the world’s first climate lawsuit against a commercial bank, BNP Paribas, over its financing of fossil fuel expansion. Neither has yet produced a ruling on the merits: the TotalEnergies hearing took place in February 2026, with a decision expected in June 2026, and the BNP Paribas case is also still pending. Six years and counting for TotalEnergies illustrates both the potential and the limits of litigation-only enforcement: the law might provide a pathway to hold major emitters accountable, but the absence of any supervisory authority means each step forward requires years of costly judicial proceedings. Given the urgency of climate action, this slowness risks rendering the framework ineffective at the very moment when accelerated decarbonisation is most needed. Cross-border effects compound the problem: in the Belgian Farmer case against Total, Belgian proceedings were stayed pending the French outcome, illustrating how delays in one jurisdiction propagate across Europe’s interconnected climate litigation landscape.
Academic commentary has been equally critical. A systematic study of 134 companies subject to the law found an average compliance score of only 66%, with just 24% conforming to the UN Guiding Principles on Business and Human Rights. Other critics have emphasised that the burden of proof – in particular establishing what companies knew or should have known about supply chain risks – is a major obstacle to enforcement. Palombo has argued that the law fails to provide effective remedy because victims must prove a causal link between a parent company’s monitoring failure and the harm suffered, which is exceptionally difficult in practice. A recent empirical study moreover found no significant impact on firms’ engagement with the UN Global Compact, suggesting that hard-law regulation alone, without effective enforcement, may be insufficient to alter corporate conduct. As Kilimcioğlu put it, the French experience ‘carries great importance’ for the CSDDD precisely because it shows how ambitious legislation can produce modest results when the enforcement infrastructure is absent.
Yet the French experience should not be read as entirely negative. The Loi de Vigilance has created a legal framework unique in Europe: it provides NGOs and affected communities with a judicial pathway to challenge the climate strategies and human rights practices of some of the world’s largest companies. The TotalEnergies and BNP Paribas proceedings, however slow, have generated significant pressure for corporate behavioural change. No other national law in Europe currently permits comparable climate litigation against private actors – a notable achievement that any evaluation of the French regime must acknowledge.
The UK: watching from the sidelines
The United Kingdom offers a revealing counterpoint. Since Brexit, the UK’s principal instrument for supply chain accountability has been section 54 of the Modern Slavery Act 2015 (MSA), which requires companies with annual turnover above £36 million to publish an annual statement on steps taken to prevent slavery and trafficking. Crucially, however, the Act imposes no obligation to actually take any steps, provides no penalties for non-compliance beyond injunctive proceedings, and creates no civil liability for victims.
The contrast with both the French and EU models is significant: whereas the Loi de Vigilance and the CSDDD impose substantive due diligence obligations backed by civil liability, the MSA remains a transparency regime without teeth. Yet the UK has not entirely escaped EU regulation. The CSDDD applies also to non-EU companies generating more than €1.5 billion in annual EU turnover. For UK-headquartered multinationals with significant European operations, compliance with the Directive will be mandatory regardless of English law. This is the Brussels effect in action: EU regulation shaping corporate behaviour extraterritorially through market access conditions.
The practical consequence is a two-tier system. Large UK companies with EU exposure will implement due diligence procedures that far exceed domestic requirements, while smaller firms or those operating outside the EU will remain subject only to the narrower MSA regime. This asymmetry creates incentives for regulatory arbitrage rather than genuine improvements in corporate conduct, and means that UK perspectives – including the considerable experience gained under the common law tradition – are absent from a regulatory conversation that will nonetheless govern a substantial share of UK corporate activity.
For companies operating across France, the EU and the UK, the coexistence of three regulatory regimes – each with its own scope, obligations and enforcement mechanisms – creates genuine legal uncertainty. A French parent company with UK subsidiaries and EU-wide operations must navigate the Loi de Vigilance, the CSDDD (once transposed), and the MSA simultaneously, with no mutual recognition framework to ensure consistency. The CSDDD’s extraterritorial reach adds a further layer: non-EU companies may find themselves subject to European standards without ever having a voice in their elaboration.
The CSDDD post-Omnibus: repeating France’s mistakes?
Against this background, the CSDDD’s retreat must be assessed both on its own terms and against the French experience that preceded it.
On scope, the original CSDDD, as adopted in 2024, appeared better equipped than the French law. Combined employee and turnover thresholds applicable to both EU and non-EU companies generating sufficient EU revenue provided a more objective basis for determining scope. Clearer scope criteria (1,000 employees and €450 million in net worldwide turnover) were designed in a way that would have captured significantly more companies than the French law: the Commission estimated over 5,000 companies, against an estimated 250 to 280 covered by French law. The Omnibus I amendments have eroded much of this advantage. The revised thresholds of 5,000 employees and €1.5 billion in turnover are strikingly close to the French law’s, which have been widely criticised as too narrow.
On the chain of activities, the limitation to ‘tier 1’ suppliers abandons the original logic that distinguished the CSDDD from existing national laws. Most human rights and environmental harms in global value chains occur well beyond direct contractual counterparties; confining due diligence to tier 1 substantially reduces the Directive’s practical reach.
On climate obligations, the deletion of mandatory climate transition plans removes one of the Directive’s most distinctive features at a time when the TotalEnergies and BNP Paribas cases demonstrate the growing centrality of climate obligations in corporate due diligence litigation. Where hard obligations are absent, climate accountability must be constructed painstakingly through the courts, with all the delay and uncertainty that entails.
On enforcement, the original CSDDD represented its clearest improvement over the French model: supervisory authorities in every Member State, harmonised penalties of up to five per cent of global turnover, and no exclusive reliance on private litigation. The Omnibus has not dismantled this architecture, but the narrower scope significantly reduces the number of companies subject to supervision, potentially replicating the ‘who is covered?’ problem that has plagued the Loi de Vigilance.
The parallels are uncomfortable: the Loi de Vigilance sets high thresholds, produces limited enforcement, and leaves companies uncertain about their obligations. The CSDDD now risks doing the same at EU level, but with an added layer of complexity: 27 Member States must transpose the Directive by July 2027, and the scope for divergent implementation is considerable. France and Germany, which already have national due diligence laws, will need to reconcile these regimes with the new European standard. The result may be a patchwork rather than the harmonisation the Directive was supposed to deliver. The UN Working Group on Business and Human Rights has already warned that the Omnibus package risks ‘misaligning’ with the UN Guiding Principles.
What comes next?
The CSDDD, even in its post-Omnibus form, retains genuine value. The requirement for supervisory authorities is an advance over the French model. Harmonised EU penalties create stronger deterrence than any single national law can achieve. And the civil liability provisions, though narrowed, still offer victims a route to redress that UK law does not currently provide.
Nevertheless, the speed of the CSDDD’s retreat is a warning sign. If transposition follows the French pattern – delayed, ambiguous, and under-enforced – the Directive risks becoming another symbolic framework that fails to change corporate behaviour in practice. The ongoing negotiations around the broader Omnibus II package also suggest that further dilution is possible. Whether the original CSDDD would have been capable of enabling the kind of climate and human rights litigation the Loi de Vigilance has facilitated, and whether the post-Omnibus version retains that potential across 27 Member States, thus remains one of the most consequential unknowns of this regulatory landscape.
The lesson from the French experience is clear: legislative ambition without clear scope, institutional enforcement, and accessible remedies produces a framework that is symbolically powerful but operationally fragile. The CSDDD still has time to avoid the worst of France’s difficulties. Whether the political will exists to deliver on its original promise is the question the next two years will answer.