Enterprises' duty of care with regard to sustainability

On 16 May 2023, draft law No. 8217 on enterprises' duty of care with regard to sustainability (the "Draft Law") has been submitted to the Luxembourg Parliament (Chambre des Députés).

Which enterprises have a duty of care?

The Draft Law’s provisions will apply:

• to enterprises when two of the following three thresholds are reached:

1° at least 250 employees,

2° annual turnover of more than EUR 50 million,

3° a balance sheet total of more than EUR 43 million;

• to small and medium-sized enterprises when they are active in risky economic activities, the list of which is to be established by a grand-ducal regulation.

The Draft Law is to apply to all entities irrespective of its legal form exercising an economic activity, not just companies.

The duty of care is to apply two years after the adoption of the Draft Law.

What are the duty of care obligations for enterprises?

The duty of care requires enterprises to:

• examine whether its own activities, those of its subsidiaries or those of its “business relations” may have or are having negative impacts on human rights or the environment in countries other than the Grand Duchy of Luxembourg, and to draw up an inventory of these actual or potential impacts;
• take all necessary measures to prevent or end the negative impacts identified;
• mitigate impacts that cannot be totally avoided and provide measures to remedy them;
• if, despite these measures, these impacts cannot be sufficiently mitigated to avoid serious harm to stakeholders, the climate or the environment, refrain from the activity concerned or terminate the relationship within a reasonable period of time.

“Business relations” is very broadly defined as meaning not only suppliers and sub-contractors of an enterprise but also all other entities in its upstream and downstream chain of activities in any way linked to the activities of the enterprise, including its financing, insurance and re-insurance.

Enterprises must also:

• establish through public consultation and effectively implement a vigilance plan involving all levels of management; and
• provide a complaints service on its website, whereby the company responds to complaints within one month and works diligently to remedy potential violations.

What are the consequences of a breach of the duty of care?

A breach to comply with the obligations of duty of care gives rise to civil liability on the part of the perpetrator, who is obliged to compensate for the damage caused. Trade unions and civil society organisations acting in the public interest can bring collective actions before the courts on behalf of and for the protection of the interests of victims. By way of a reversal of the burden of proof, an enterprise is deemed to be liable for a breach of duty of care if it cannot prove that it had taken all necessary measures reasonably in its powers to prevent or preclude negative impacts. Account is, however, to be taken of the actual power of the enterprise to control or influence its subsidiaries or other entities in its value chain.

In addition, the Draft Law creates a duty of care supervisory authority, the "regulator", entitled to:

• open an investigation on its own initiative or following a complaint from any natural or legal person;
• ask enterprises to provide all the information needed to carry out these tasks within a reasonable timeframe;
• impose an administrative fine not exceeding 10% of the net turnover of the non-compliant company.