French Duty of Vigilance Law
Contents
France's Duty of Vigilance Law at a glance
France’s Duty of Vigilance Law requires certain very large companies established in France (generally, those with at least 5,000 employees in France or 10,000 worldwide) to appropriately identify, prevent and address harms across their own operations, operations of companies they control, and, under certain circumstances, operations of subcontractors and suppliers. Companies covered by the law must publish an annual vigilance plan detailing these due diligence (or vigilance) measures.
The law also provides for civil liability. This means that individuals can bring a lawsuit before French courts to seek compensation for damages resulting from a company’s failure to comply with its human rights and environmental due diligence obligations under the law.
The Duty of Vigilance Law will be revised in the coming years as France is incorporating the EU’s Corporate Sustainability Due Diligence Directive (CSDDD) into national legislation.
Which companies fall under the French Duty of Vigilance Law?
The law applies to companies that:
- Are established under French law: This means the company is legally incorporated and registered in France under specific corporate forms (primarily SA, SCA, SE, as well as SAS; SARL not covered).
- Meet one of the following size thresholds:
- At the end of two consecutive financial years, it has more than 5,000 employees in France, which includes employees at its direct and indirect subsidiaries on French territory; OR
- At the end of two consecutive financial years, the company has more than 10,000 employees worldwide, which includes employees at its direct and indirect subsidiaries across the globe.
In practice, this means most companies covered by the law are headquartered in France. Even if their French headquarter and presence are relatively small, they may still meet the second threshold for size (10,000 employees worldwide).
A French subsidiary of a company headquartered outside of France may be covered if the subsidiary is legally constituted in France under a relevant corporate form (see above) and is large enough to meet one of the thresholds, typically the first (5,000 employees in France).
What are direct and indirect subsidiaries?
Direct subsidiaries are companies in which the parent company holds a controlling stake (typically over 50% of voting rights) directly and there's no intermediary entity between them.
Indirect subsidiaries are companies controlled through one or more intermediary entities. For example, if Company A controls Company B, and Company B controls Company C, then C is an indirect subsidiary of A.
How to check if a company is covered
If you are concerned that a company possibly covered by the Duty of Vigilance Law may be involved in (local) risks and harms but you need to find out more about potential connections, you can refer to basic guidance here.
There is no official public list of covered companies under this law, but experts estimate around 100–250 companies are covered.
If you know the name of the company: Sherpa has identified a number of companies that likely fall under the law here. In their vigilance plan, the companies should also include a list of direct and indirect subsidiaries considered for the calculation of the number of employees during the last two financial years, the number of employees per entity included, and the entities’ location.
If the company is not on the list, you can take the following steps to determine whether the Duty of Vigilance Law applies:
- Check online whether the company meets the criteria. It can be helpful to search for information online whether the company is headquartered in France and has at least 5,000 employees nationally or 10,000 employees globally, or whether a French subsidiary/branch of a foreign company meets one of these thresholds. Information on the specific legal form of the company may also be available online. Some databases (for instance, Pappers) compile consolidated financial statements published by French companies, which generally contain information on their number of employees in France and/or worldwide.
- Seek out support. If you still are unsure whether the company is covered under the Duty of Vigilance Law, you can find information on how to reach out to someone for support in our legal assistance directory, for instance.
What to do if the company is not covered
If the company does not meet the above criteria, the law cannot be applied.
You can explore alternative remedy pathways here or answer a few questions to receive suggestions for what pathways may be most appropriate for your specific situation here.
What are companies expected to do?
Under the French Duty of Vigilance Law, companies must identify and prevent severe negative impacts on human rights and fundamental freedoms, on the health and safety of individuals, as well as on the environment – caused by their own activities, activities of companies/subsidiaries they control, and certain activities of subcontractors and suppliers with whom they have an established commercial relationship.
Companies must establish, publish and implement a vigilance plan explaining these measures. It should be published on the company’s website and included in their annual report.
Companies must report every year on the progress they have made and whether their measures are actually working.
The law applies to severe violations of human rights and fundamental freedoms, as well as risks to human health, safety and the environment. It covers all business sectors.
The Duty of Vigilance Law establishes an obligation of means or effort, not an obligation of result. This means companies in scope are required to make a serious effort to prevent harm, but the mere occurrence of damage does not automatically trigger liability if the company has taken all reasonable, necessary and effective measures.
The law does not clearly define when due diligence (or a vigilance plan) is “good enough”; it might be helpful to look at case examples or ask legal experts.
Due diligence under the Duty of Vigilance Law in detail
1. Identifying and analysing risks
The company should explain in its vigilance plan how it identifies human rights and environmental risks and what tools or methods it uses. It should clearly describe the risks and severe impacts it has identified. This information could cover specific products, regions, business activities, subsidiaries, suppliers or sectors where harm may occur. If the company says it has not identified all risks, it should explain why and say when they expect to do so.
The company is then allowed to prioritise or rank the risks it identified and explain how and why it thinks certain risks are most urgent. Generally, risks should be prioritised based on how serious the harm could be, how many people may be affected, whether the harm can be repaired, and how likely the harm is to happen or become worse. Prioritising risks does not mean other harms can be ignored. It simply means the company may need to address the most severe risks first while still working to address other risks.
2. Assessing the situation of subsidiaries and suppliers
The company should explain how it checks whether its subsidiaries, suppliers, and subcontractors are linked to human rights or environmental risks.
It should describe the tools and methods it uses, what it is assessing, and when and how often these checks happen. The company should use different methods to make sure risks are not overlooked. It should also share the results of these evaluations, including indicators showing improvements, lack of progress, or worsening situations. If problems are found, the company should explain what corrective action will be taken and by whom.
3. Taking appropriate action to mitigate risks or prevent serious violations
The company must take steps to prevent harm, reduce risks, and provide remedy when harm occurs. These measures should be developed together with affected stakeholders where possible.
For each major risk, the company should explain in its plan what actions it plans to take, when the actions will happen, and how it will measure whether the actions are effective. The company should also explain where its data comes from and how it chose the indicators it uses to measure progress.
4. Operating a complaints mechanism to collect information on potential or actual harms
The company should create safe and accessible ways for people to report risks or harms. These systems should exist both locally and globally.
The company should clearly explain in its vigilance plan how people can report concerns, who can use the mechanism(s), how confidentiality and safety are protected, and how complaints are handled. The mechanism should distinguish between reporting a possible risk and reporting an actual abuse or violation. The company should also publish information showing whether complaints are being properly addressed, including anonymised examples where possible. If the system is not fully developed yet, the company should explain what steps are still planned and when they will be completed.
The company should explain how workers, trade unions, and other stakeholders were involved in designing the complaint system. Ideally, trade unions should also help monitor how complaints and alerts are managed in practice.
Stakeholder engagement: Under the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises, there is an expectation on companies to meaningfully and safely consult with stakeholders like workers, communities and other affected people to better understand and tackle human rights and environmental risks and harms. The French Duty of Vigilance Law states that the company’s vigilance plan, a key instrument mapping out all due diligence (or vigilance) measures, should be developed together with stakeholders. It also says that the company’s alert and complaints mechanism shall be set up in consultation with union organisations (within the company).
5. Monitoring measures and evaluating their effectiveness
The company should regularly monitor whether its vigilance plan and actions are actually working. This monitoring should cover each identified risk or abuse, the actions taken to address them, and the overall effectiveness of the vigilance plan.
The company should use indicators to measure both the efforts and resources invested, and the actual results achieved.
The company should also explain how indicators were selected, what data sources are used, and how the information is monitored and updated over time.
The monitoring system should be regularly updated as risks and situations change.
If you know the company, you can find many vigilance plans here or look for them on the company's website.
What can I do if a company does not meet the obligations?
If a company does not comply with its obligations (for example, it has no vigilance plan, publishes an incomplete one or does not implement it properly), any concerned party (such as individuals, communities, trade unions or NGOs) can hold the company accountable under this Law through certain pathways:
- Concerned parties can seek to engage the company and/or report risks via its alert mechanism;
- Concerned parties can file a Formal Notice and ask the company to comply with the law;
- If the company fails to meet its obligations within three months, anyone (with legal standing) can ask a court to order the company to comply;
- This could be, for example, an order to establish, publish and implement a vigilance plan;
- In some cases, affected people may also seek compensation before a court if they can show that the company failed to comply with its vigilance obligations and that this failure caused harm that could have been avoided (civil liability).
Possible outcomes:
- Dialogue with the company;
- Improved vigilance plan;
- Periodic penalty payment in case of non-compliance;
- In some cases, compensation for harm.
It can be very helpful to seek support before taking action. You may consider contacting NGOs for guidance or seeking legal advice from lawyers experienced in corporate accountability and/or the French Duty of Vigilance Law. They can help you understand your options, support the collection of evidence, assist in submitting complaints, and connect with others.
1. Engaging with the company
Companies in scope of the law are invited to engage with stakeholders including unions to the very least when they develop their vigilance plan, which basically maps out all due diligence (or vigilance) measures, and when they set up their alert mechanism. Even if it is on the company to initiate stakeholder engagement, contacting other NGOs who are already in touch with the company, or using its alert and complaints channel, can be a way to actively demand such dialogue.
2. Alerting the company through its complaints mechanism
Every company covered by the Duty of Vigilance Law must have an alert and complaints mechanism in place that allows people to report human rights and environmental risks or harms related to the company’s operations and value chain.
To file a complaint, you usually need to contact the company through one of these official channels. You can usually find this information on the company’s website or through business or multistakeholder initiatives they are part of.
You can often type in the name of the company and “grievance mechanism” or “whistleblowing system” into your internet search bar to find a channel for filing a complaint. The company will usually – or at least it should – provide information on how this process works as well as other information, such as how your data is being handled and how you are protected.
Where possible, you should generally explain:
- What happened or what risk you identified;
- Where and when the risk or harm occurred;
- Which company operation or supplier is involved; and
- Any supporting information or evidence.
After filing the alert or complaint with the company, it should acknowledge receipt, review the matter and then respond to you.
What is the outcome of such complaint?
The Duty of Vigilance Law does not prescribe a specific outcome for every alert or complaint. The outcome depends on the case.
However, the company must properly examine the alert complaint, discuss the facts with the complainant, and try to find a plausible solution.
3. Formal notice
Any individual or organisation can send a formal notice (“Mise en demeure”) to a company requesting compliance with the law. French courts have made clear that this step is mandatory before legal action can be taken – you must show that you previously put the company on notice if you want to file a lawsuit. The categories of risks, adverse impacts and obligations you want to bring to court later must be identified in this notice.
Most often, the process works in these steps:
a. Formal notice to the company
Any concerned individual or organisation can send a formal notice to the company, if it falls within the scope. There are a number of formal aspects to consider, and it may be advisable to seek legal advice.
The notice should:
- Clearly identify the company that falls under the Duty of Vigilance Law;
- Explain how it is failing to meet its due diligence obligations (for example no vigilance plan, incomplete plan, or lack of implementation);
- Request that the company complies with the Duty of Vigilance Law; and
- Be sent via registered postal mail with acknowledgment of receipt, as an electronic registered letter, or served by a court official (“Commissaire de justice”)…
- directly to the official headquarters of the entity that falls under the Duty of Vigilance Law (normally the French parent company), addressed specifically to its chief legal representative…
- …with the explicit title "Mise en demeure".
b. Three-month waiting period
After receiving the formal notice, the company has three months to comply with its obligations under the French Duty of Vigilance Law.
During this period, the company can take steps to address the issues raised, for example, by publishing, improving and implementing its vigilance plan.
4. Civil claim for damages
Under the French Duty of Vigilance Law, companies can be held liable through civil claims based on French tort law if the company did not comply with its duty of vigilance.
This path is only possible if the formal notice was sent and did not resolve the issue (see above).
In a lawsuit, there are three things that must be proven:
a. The company had a duty to act
The company had a legal responsibility to comply with all obligations under the Duty of Vigilance Law if the company falls under it. It does not mean the company must guarantee that no harm will ever happen, but it must show that it took serious and appropriate steps to identify risks and prevent violations. These obligations are all found in the law.
b. The company failed to comply
The company did not properly fulfil its legal obligations. This could mean that:
- It failed to create a vigilance plan;
- The plan was incomplete or too vague;
- Risks were not properly identified;
- Meaningful preventive measures were missing; or
- Complaints and harms were ignored or poorly handled.
Courts may consider factors such as:
- Whether it worked with trade unions, communities or civil society organisations; and
- Whether it adopted concrete and effective preventive, mitigation, and remedial measures.
A company may still be found non-compliant even if it had a formal plan on paper, if the measures were ineffective or not properly implemented in practice.
c. The fault caused harm
The harm must be ongoing and/or have occurred after 2017 when the Duty of Vigilance Law became applicable. The plaintiff must show that there is a direct connection between the company’s failure to comply with its due diligence (vigilance) obligations and the harm that was caused. For example, the argument may be that the harm could have been prevented if the company had properly identified the risk, monitored and engaged with suppliers, responded to warnings or taken other appropriate action.
This is often the hardest part to prove in court. It can be difficult to demonstrate exactly how the company’s lack of action, weak measures or failures contributed to the harm. Proving that the company knew (or should have known) the risks and had the capacity and powers to intervene has been deemed sufficient in one of the first lawsuits brought under the Duty of Vigilance Law (Yves Rocher).
Evidence may include:
- Internal company documents;
- Reports or complaints that were ignored;
- Audit failures;
- Witness testimony; or
- Proof that risks were already known but not addressed.
If a company implements a vigilance plan and takes all reasonable, necessary and effective measures to prevent harm, it cannot be held liable even if damages occur.