International compliance and supply chains

International compliance and supply chains: how to adapt to Directive (EU) 2024/1760

Introduction

Corporate sustainability has ceased to be a strategic option and has become a legal obligation with specific legal implications.

With the adoption of Directive (EU) 2024/1760 on June 13, 2024, a new regulatory framework was established that requires large companies to be accountable for the impact their activities and supply chains have on human rights and the environment.

This obligation extends to both companies based in the European Union and those from non-EU countries that carry out significant activities within their territory.

For legal departments and law firms, this regulation represents a shift in approach to international compliance.

The real challenge lies not only in preventing sanctions, but in implementing due diligence systems that are effective, verifiable, and in line with key international standards.

What does the Directive require?

The new Directive introduces a systematic due diligence procedure inspired by OECD and UN principles.

The obligations imposed revolve around the identification and management of ESG (environmental, social, and governance) risks, that is, the adverse impacts a company may have on the environment, fundamental rights, or the ethical integrity of its operations.

Properly addressing these risks not only allows for compliance with the legal framework, but also helps prevent reputational damage and consolidate a more sustainable and resilient business model in the long term.

1. Integration into policies and management systems. Companies should adopt a due diligence policy that defines their commitment to human rights and the environment, integrate it into their corporate culture, and establish organizational systems that clearly assign roles, responsibilities, and resources for its implementation.
2. Identification and evaluation of actual or potential adverse effects. A rigorous risk analysis must be conducted throughout the entire chain of activities, both upstream and downstream. This assessment should be based on objective criteria such as the severity of the impact, its likelihood, and the company's ability to influence it.
3. Prevention, mitigation or elimination of these effects. Once risks are identified, the company must implement proportional measures to prevent their occurrence, reduce their impact, or eliminate them once they have materialized. This may include changes in production processes, contractual decisions, corrective action plans, or even the suspension of business relationships with non-compliant partners.
4. Monitoring the effectiveness of the measures taken. The company must establish appropriate indicators to verify that the actions taken are effective. It is recommended to conduct periodic internal or external audits and review procedures to adapt them to new realities or emerging risks.
5. Transparent public communication. Organizations must report annually and in an accessible manner on their due diligence policy, the risks identified, the measures implemented, and the results obtained. This transparency strengthens trust with consumers, investors, and other stakeholders.
6. Remediation of actual adverse effects. When damage to people or the environment has occurred, the company must establish appropriate remedial mechanisms, which may include financial compensation, rehabilitation, guarantees of non-repetition, or other proportionate and fair measures.

It also mandates the creation of accessible grievance mechanisms for affected individuals and requires active participation by stakeholders.

Area of ​​application

The Directive applies to:

• Companies established in the EU with more than 1000 employees and a global net turnover of over 450 million euros.
• Parent companies of groups that reach the same consolidated thresholds.

It also applies to companies from non-EU countries that maintain significant economic activity within their territory. In particular, it covers:

• Those entities that have exceeded 450 million euros in net turnover within the European Union;
• As well as those operating through franchise or license models, provided the following requirements are met:
  • That there is a common brand identity and management methods;
  • That income from royalties exceeded 22,5 million euros in the previous year;
  • And that net turnover within the European market exceeds 80 million euros.

This extension of the scope reflects the extraterritorial orientation of EU law in the area of ​​business sustainability.

Chain of activities: practical scope

The requirements set out in the Directive extend beyond the company's own operations, also encompassing its entire value chain and related activities.

This includes both:

• The previous stages of production: design, extraction, manufacturing and procurement of raw materials.
• As the subsequent phases: transportation, storage, distribution and disposal of products or services.

In industries such as agriculture, textiles, or technology , where supply chains are often complex, fragmented, and international in scope, compliance with these obligations represents a significant organizational challenge.

Companies must establish ongoing evaluation mechanisms, implement controls over their suppliers, and conduct periodic audits.

Furthermore, the Directive requires large companies to offer specific assistance to SMEs within their chain of activities.

This collaboration can take various forms—technical, training, or financial—depending on available resources and identified risks.

Implementation challenges for the compliance and confidentiality international

Effective implementation of this regulation requires a comprehensive transformation of corporate compliance systems, geared toward cross-cutting risk management:

• Coordinated work between departments: Areas such as legal, purchasing, sustainability, operations, and human resources must act together and in alignment.
• Technological integration: The digitalization of control processes and the use of specialized ESG platforms have become essential tools.
• Responsible hiring: It is crucial to incorporate specific due diligence clauses, termination powers, audit rights, and penalties proportional to non-compliance into contracts.

Likewise, companies must analyze the local context of the countries in which their suppliers or business partners operate.

In high-risk jurisdictions or those with low regulatory standards, these measures become even more important.

Obligations of means and civil liability

The Directive imposes obligations of means : the company is not required to guarantee the absolute absence of negative impacts, but it is required to adopt reasonable and documented measures to avoid them or address them effectively.

When a company fails to meet its due diligence obligations and this contributes to harm, the law establishes a civil liability regime.

Member States shall ensure:

• Effective access for victims to EU courts.
• Availability of adequate repair mechanisms.
• A statute of limitations of no less than five years for bringing legal action.

This system reinforces the need for clear legal traceability and documented evidence of compliance.

The role of the legal advisor

Law firms have a central role in the effective implementation of the Directive.

Among the most relevant services:

• Initial audit of regulatory compliance and ESG risks.
• Review and adaptation of international contracts.
• Design of internal due diligence policies.
• Training for employees and suppliers.
• Support in the management of disputes or litigation.

Additionally, they can collaborate with sustainability consulting firms and digital platforms to offer a comprehensive compliance approach.

Good practices for implementing the Directive

For the Directive's implementation to be effective, it is not enough to adopt isolated measures.

Companies must develop a coherent strategy that combines prevention, control and continuous improvement.

This strategy must be supported by a real commitment from senior management and reflected in the organization's daily operations.

Below are some key good practices:

1. Define a clear and public due diligence policy.
2. Prepare a ESG risk map by activity, sector and geography.
3. To implant sustainability clauses in contracts of purchase and sale and subcontracting.
4. Establish continuous monitoring and control mechanisms.
5. Publish periodic sustainability reports based on standards such as GRI or ESRS.
6. Provide specific training to staff and business partners.

These actions not only reduce legal risk, but also reinforce a responsible corporate culture and investor and consumer confidence.

Monitoring, control and compliance culture

Compliance with the Directive should not be approached as a one-time requirement, but rather as a continuous and constantly evolving process.

Companies must continuously monitor current and emerging risks and update their internal policies and procedures as their activities, supplier networks, and the international regulatory framework change.

To achieve this, it is key:

• Establish sustainability committees or compliance and confidentiality with cross-sectional representation within the organization.
• Regularly evaluate the effectiveness of implemented systems through internal and external audits.
• Promote a corporate culture based on ethics and responsibility, which encourages early risk identification and continuous improvement.

Furthermore, transparency will play an essential role : the regular publication of clear and verifiable information on the state of compliance not only meets the requirements of the Directive, but also improves corporate reputation, facilitates access to sustainable financing and strengthens the relationship with stakeholders.

Examples of practical application

To illustrate the practical application of this Directive, some representative cases affecting strategic sectors can be considered:

• En the textile sectorA company based in Spain with supplier factories in Asia must verify working conditions, avoid practices such as forced or child labor, and ensure industrial safety measures. This could involve on-site audits, hiring local agents, and preparing detailed reports.
• An technology company Any company that purchases minerals from conflict zones must identify the traceability of its suppliers and exclude those who cannot guarantee responsible practices. This requires collaborating with independent certifiers and requiring supporting documentation from the source of the resource.
• In agrifood industry, A company importing agricultural products must ensure that its crops do not originate from territories affected by illegal deforestation or violations of indigenous rights. In this case, due diligence should include contractual environmental commitments, satellite verification, and the implementation of green purchasing policies.

In all these examples, the key is the company's ability to anticipate risks and act in a documented, proportionate, and transparent manner.

The Directive does not impose a single compliance model, but it does require accountability and traceability for every business decision with a social or environmental impact.

Conclusion

Directive (EU) 2024/1760 marks a turning point in how companies must manage their social and environmental impact.

The new regulatory framework establishes clear obligations for large companies, which must adopt robust due diligence policies integrated into their corporate strategy and applicable to their entire value chain.

Complying with this regulation not only means mitigating legal risks, but also anticipating market demands, strengthening institutional reputation, and increasing the ability to adapt to changing scenarios.

Effective ESG risk management will be crucial to achieving these goals.

In this context, law firms have the opportunity to position themselves as strategic allies, providing legal advice that integrates regulatory compliance, sustainability, and long-term business projection.

RRYP Global, compliance program lawyers.