Compliance in France in 2022

In summary

The year 2021 and early 2022 proved eventful for compliance and white-collar crime in France, especially for anti-bribery and compliance activity. Agencies are continuing to build on Sapin II by incrementally defining anti-corruption standards and stepping up their enforcement efforts on both the administrative and judicial fronts.

Discussion points

• Sapin II and its lasting impact on French anti-bribery law
• Aggressive white-collar crime strategy and the success of CJIPs in enforcement actions
• Court of Cassation cases on successor liability and criminal corporate liability
• Reform of the blocking statute
• Duty of Vigilance Law and proposed EU directive on sustainability due diligence

Referenced in this article

• Sapin II
• OECD corruption working group’s report on France’s anti-bribery efforts
• 2021 revised AFA Anti-Corruption Guidelines
• Case No. 18-86.955, 25 November 2020 on successor criminal liability
• 2021 revised AFA Guidelines
• AFA guidance on gifts and invitations policies, construction and internal investigations
• 2021 revised AFA guidance on anti-bribery verifications in M&A
• 2020 CNIL guidance on personal data in whistle-blowing procedures
• CJIP agreements of 29 January 2020 and 26 February 2021
• 2021 CRPC cases for physical persons in conjunction with CJIPs
• 2017 Duty of Vigilance Law
• 2022 EU proposal for a directive on corporate sustainability due diligence

The year 2021 was again a year of consolidation for France’s compliance, investigations and white-collar crime ecosystem, with limited statutory changes (2022 being an electoral year in France) and a few noteworthy developments from courts and administrative agencies. After making great strides since the country heightened its anti-corruption standards with the Law of 9 December 2016 on transparency, corruption and modernisation of the economy (Sapin II), France and its authorities have since demonstrated that they are now key players in the global white-collar crime and anti-bribery landscape.

In anti-bribery compliance in particular, the French Anti-Corruption Agency (AFA) keeps building on Sapin II by providing guidance on specific topics, auditing compliance programmes of private and government entities and bringing cases in front of its sanctions board (although no new cases were heard in 2021 and early 2022).

The judicial part of this effort also proved newsworthy in 2022, with the National Financial Prosecutor’s Office (PNF) continuing to seek high fines against corporate defendants as part of judicial public interest agreements (CJIP),^[1] and other regional prosecutors stepping in to do the same. A decision from the Paris Court of Appeal in a case against a major foreign bank also showed, by significantly reducing the amount of what had been the highest fine ever imposed in the French system, that courts remain a valid option for corporate defendants despite the increased use of transactional tools.

Bribery and corruption issues still occupied the centre stage of the compliance and white-collar crime landscape, but some other areas of compliance law have recently seen renewed interest. Environmental, social and governance (ESG) issues have been a staple of French compliance law since the 2017 Duty of Vigilance Law mandated large corporations to create and publish a dedicated vigilance plan and exposed non-compliant corporations to a potentially large liability risk.

While to date very few cases tested the actual implementation of the Duty of Vigilance Law (recent decisions being largely procedural), the risks associated with those issues may resurface as in early 2022 the EU commission proposed a draft directive^[2] that would extend some aspects of the French and German duty of vigilance regimes to the European Union.

Overall – and considering the continuing disruptions resulting from the covid-19 pandemic that have slowed down the French economy and its legislative and judicial systems – the French compliance landscape is expected to continue evolving incrementally this year, at least until the end of the electoral period in June 2022. Noteworthy changes on specific issues, however, could come from courts and administrative agencies such as the AFA.

Building on the paradigmatic change of Sapin II since 2016

When assessing the French anti-bribery landscape in its late 2021 assessment report,^[3] the Organisation for Economic Co-operation and Development’s working group on bribery noted that since its last assessment in 2014, France has carried out ‘a significant number of reforms’ that have provided France with ‘a modern institutional framework and legal tools to combat foreign bribery more effectively’.

Among those key reforms was Sapin II, which is France’s comprehensive anti-corruption reform and a response to laws such as the US Foreign Corrupt Practices Act and the UK Bribery Act. The law toughened sanctions on corruption, imposed stringent compliance obligations on large corporations and created the AFA.

As a reminder, since June 2017, companies incorporated in France and exceeding a certain size threshold^[4] are required to have an anti-corruption compliance programme. Presidents, directors and managers of qualifying companies may be held personally liable for failure to implement such a compliance programme.

Compliance programmes under Sapin II that are tailored to prevent acts of bribery and influence peddling must include the following measures aimed at preventing corruption:

• a code of conduct;
• an internal whistle-blowing mechanism;
• regularly updated corruption risk mapping;
• a risk assessment (risk mapping) process;
• third-party due diligence procedures;
• accounting controls;
• training programmes for employees exposed to high risks of corruption and influence peddling;
• a disciplinary procedure; and
• an audit mechanism to assess the effectiveness of the compliance programme.

Based on the AFA audits and sanctions procedures of private entities conducted to date, the agency pays extremely close attention to the risk-mapping process (which is supposed to inform all other measures), the code of conduct and the top management’s commitment to anti-bribery. Corporations that are subject to the above-mentioned requirements should be aware that merely having the required measures in place is not sufficient as the AFA controls their quality and practical implementation.

Sapin II also introduced major procedural changes for white-collar cases, with the creation of the equivalent of the deferred prosecution agreement (DPA): the CJIP.^[5] It gives prosecutors a transactional tool to negotiate with corporate plaintiffs for a limited number of offences, including:

• active public agent bribery and influence peddling offences (eg, active foreign public agent bribery);
• active and passive private bribery offences (private ‘commercial’ bribery or sports bribery);
• tax fraud (since 2018);
• laundering proceeds of tax fraud;
• substantial harm to the environment (since 2020).

Once frowned upon by the French legal community, which is traditionally reticent on transactions in criminal law, the CJIP is now a popular tool. While some of its limits are now being tested, in particular regarding the treatment of physical persons, it has proved essential to the resolution of many high-profile cases, particularly those involving international cooperation, and has allowed France to levy more than €3 billion in fines since 2017.

Sapin II anti-bribery compliance requirements

Throughout 2021 and early 2022, the AFA continued its audits at corporations that are mandated by article 17 of Sapin II to have anti-corruption compliance programmes. Carried out at the initiative of the AFA’s director or upon the request of authorities (or approved non-governmental organisation (NGOs)), the audits verify that the company has proper compliance programmes in place.

Although AFA investigators do not have the police powers required for coercive searches (unlike competition, tax or judicial police dawn raids), they can request any information or professional document that is useful for the audit and can conduct interviews with managers and employees. Audited corporations cannot claim professional secrecy to decline to answer questions or requests for documents, and individuals or entities may be fined in the case of obstruction.^[6]

In addition, pursuant to article 40 of the Criminal Procedure Code, the AFA must report any wrongdoing it discovers as part of its mission. This means – the agency’s audit questionnaires being extremely broad – that it frequently refers wrongdoing it discovers to prosecutors (either the PNF or local prosecutors).

The agency referred three cases in 2020 (and, in total, 14 cases since its creation in 2017).^[7] The AFA regularly receives reports from third parties, which may inform its decision to audit an entity (for 17 per cent of audited entities, a credible report was received), and several reports received by the agency in 2020 were directly forwarded to a prosecutor’s office.

In 2020, the AFA initiated 19 new audits of private entities, ranging from €1.4 billion to €200 billion in turnover, and from 2,700 to 179,000 employees.^[8] To date, it has carried out 125 audits of public and private entities since its creation in 2017.

In 2022, and now that the substantial reduction of its scope considered earlier in 2022 was dropped by legislators, the AFA is expected to continue carrying on its mission across industries.

In 2019 and 2020, the first two cases were brought by the AFA’s director to its independent sanctions board for allegedly defective anti-bribery compliance programmes. Additional hearings on these cases were held in 2021, but no other new case was brought to the sanctions board.

The agency’s first case, brought on charges of defective risk mapping, code of conduct and third-party evaluation procedure, was dismissed by the sanctions board, noting for some charges that the corporation had taken swift and appropriate remedial actions after the AFA inspection pointed out some flaws in its programme. The decision also confirmed the non-binding status of the AFA’s recommendations.

The second case concerned multiple counts of non-compliance with Sapin II and led the sanctions board, for the first time, to enjoin the company to adapt its code of conduct (which did not contain the elements mandated by law and merely redirected to another policy) and accounting controls under penalty of a fine. In July^[9] and November 2021,^[10] the sanctions board decided that the company had now complied with these two injunctions, thus ending the proceedings.

While no sanction per se has been imposed to date, the cases helped establish the AFA as a key enforcement player in the French compliance space and as a credible threat to entities that are being investigated and audited.

The AFA has also integrated some elements of the cases in its new recommendations, notably restating that they have no legal force but that an entity stating that it has followed those guidelines benefits from a prima facie presumption of compliance with the law. In turn, similar to the ‘comply or explain’ principle used in corporate governance, an entity subject to article 17 of Sapin II that decides not to follow some of or all the recommendations must demonstrate that its choices enable it to meet the requirements of Sapin II.

Revision of AFA’s main anti-corruption guidelines

On 12 January 2021, the AFA officially published its new guidelines on anti-corruption programmes (the Recommendations).^[11] In its revised 2021 version, the AFA built on its 2017 guidance by adding practical considerations gathered from its advisory and audit missions, industry feedback and, in certain cases, the first AFA sanctions board cases in which non-compliance with the Recommendations was a key issue. They include the following elements, among other things:

• for the first time, a set of high-level recommendations applicable to all entities regardless of their public or private status or their obligation to enact a compliance programme under article 17 of Sapin II;
• an increased focus on the top management’s involvement, which the Recommendations define more precisely, as they are personally accountable for the entity’s compliance with its obligations under article 17 of Sapin II; and
• a confirmation of the importance of risk mapping, which should constitute the first step of the compliance programme and must permeate the other measures (code of conduct, training, etc) based on the corruption risks it identified.

In July 2021, the AFA released a new version of the questionnaire used to audit companies.

Corporate guidance updates and industry-specific guidelines

Another illustration of the AFA’s proactive approach is its effort to provide guidance on gifts and invitations, conflicts of interest and internal investigations. Until recently, there was no official guidance on some of those topics for the private sector in France, and large multinational corporations often modelled their policies on standards applicable in other countries or used a single global policy without any local adaptation. This ‘copy and paste’ approach sometimes failed to account for local specificities, such as the explicit prohibition by the Criminal Code of private-to-private bribery.

Theses guides are intended to help entities draft their anti-corruption policies. They are not legally binding, but synthetically restate applicable law and will serve as a useful reference tool to draft a policy that takes into account the specificities of French law, regardless of whether the entity can be audited by the AFA.

In September 2020, the AFA published a definitive version of its guide on gifts and invitations policies for corporations, associations and foundations,^[12] offering step-by-step guidance on the items to consider when drafting a policy (whether to set fixed maximum amounts, transparency and accounting considerations, etc), as well as examples of problematic conduct that a good policy should prevent.

In November 2021, the AFA also released its guide to preventing conflicts of interest in the workplace to help identify risky situations and define mitigation measures. The AFA includes examples of best practices it encountered in the course of its audit and advisory missions.

Finally, in December 2021, the AFA published its final practice guide on anti-corruption for small and medium-sized enterprises and small businesses. These companies cannot be audited by the AFA, but the AFA insists that there is a real advantage in those companies taking steps to prevent corruption as it enables them not only to prevent acts of corruption and their financial, reputational and human consequences, but also to demonstrate their integrity to their business partners.

This guide will be of particular interest to multinational corporations with a small to medium-sized presence in France (ie, that do not cross the legal threshold to be audited by the AFA) as this provides a useful all-in-one compendium of baseline French anti-corruption rules and practices.

Below are examples of guides released by the AFA in 2021 and 2022:

• a guide on anti-corruption due diligence for mergers and acquisition;
• a draft of a guide on anti-corruption accounting controls in companies;
• a guide dedicated to the construction sector (which is the AFA’s first sector-specific guide and will serve, in particular, the agency and the government’s goal to promote integrity in major sports events, such as the Paris 2024 Olympic Games^[13]); and
• a draft of a guide to internal anti-corruption investigations.

New avenues for enforcement

The December 2020 Law on the European Public Prosecutor’s Office and Specialised Justice^[14] created a specific CJIP procedure to deal with cases of substantial harm to the environment, chargeable under the criminal provisions of the Environmental Code, with a specific monitoring procedure by specialised environmental agencies after a deal has been reached and judicially approved.

The first environmental CJIP^[15] was approved on 16 December 2021 for pollution owing to discharge of a harmful substance into a river. The second environmental CJIP,^[16] dated 18 February 2022, targeted the same type of offence and led to compensation of the ecological damage of €41,925. Transactions on environmental offences are expected to increase in the coming months.

The year 2021 was the first effective year of operation for the European Public Prosecutor’s Office (EPPO). Comprising a central college of prosecutors and a network of European delegated prosecutors in every jurisdiction, the EPPO installed delegated prosecutors in France in 2021 to prosecute cases (in the national court system), focusing on the financial interests of the European Union (such as EU subsidies fraud, large cross-border VAT fraud or EU-related bribery).^[17] The EPPO confirmed in its first annual report that it had 29 active investigations in France as of December 2021 (out of 515 across the European Union) with estimated total damages to EU funds of €46.1 million.

Highest court continues to refine position on corporate liability

In France, legal persons such as corporations are criminally liable for offences committed on their behalf by their organs (eg, a board of directors) or representatives.

In November 2020, there was a widely publicised Court of Cassation decision that reversed France’s position on successor liability. Under previous case law, and in line with the classical French approach assimilating the end of a corporation’s legal existence to the death of a physical person, the surviving corporation could not be prosecuted for the offences of the acquired entity (that ceased to legally exist as a result of the merger).

Although it was consistent with fundamental principles of French criminal law, it clashed with the European Court of Justice’s view on the matter.^[18] The approach adopted in November 2020, which only applies to mergers conducted after the date of the decision, considers that corporations may now be prosecuted for pre-merger criminal conduct of the companies they acquire (ie, criminal liability is passed on to the successor company).

Following the decision, the AFA issued revised guidance on mergers and acquisitions,^[19] which confirms the now-established (but not legally mandated) practice of assessing a target corporation’s situation in respect of bribery issues for both compliance and possible acts of corruption.

In June 2021, further expanding the possibility of bringing suits against legal entities, the Court of Cassation confirmed^[20] the emerging trend of criminally prosecuting the holding company for an offence committed by its subsidiary, despite the above-mentioned obstacles. In this case, employees of the subsidiary were considered as de facto representatives of the holding company – a deviation from previous case law that was deferential to the letter of the law and generally required identifying acts by decision-making organs or individuals formally appointed as representatives of the defendant entity.

Although this decision is not a U-turn, it reflects the French courts’ attempts to effectively hold accountable large groups and their parent companies in addition to their subsidiaries for offences committed by the latter. Courts and prosecutors are trying to adapt French criminal law, which does not yet have strict criminal liability tools (eg, failure to prevent bribery-type offences), to the modern corporate reality by pragmatically taking into account group policies and the fact that the corporate structure (ie, holdings and subsidiaries) can sometimes greatly differ from the actual management structure within the organisation.

Impact of internal investigations on CJIP deals

The joint guidelines by the AFA and the PNF issued in June 2019 offered a consolidation of the agencies’ doctrines on the prosecution of corruption offences. In the guidelines, the agencies cite the implementation of an effective compliance programme and cooperation of the targeted entity as key factors to reach a CJIP agreement with prosecutors.

Although ‘cooperation credit’ is not presented as automatic, the agencies explicitly say that cooperation can reduce penalties. They cite self-reporting and cooperation through internal investigations (turned over to the government) as essential factors for the prosecutors not only to decide whether to allow a transactional outcome but also to determine the sentence or fine.

The record-breaking €3.6 billion sanction imposed in January 2020 on an aircraft manufacturer confirmed that French prosecuting authorities and jurisdictions are now a force to be reckoned with in foreign bribery enforcement. This case involved not only government agencies – the French and British authorities formed a joint investigation team – but also an extensive internal investigation.

The agreements – DPAs in the United Kingdom and the United States and a CJIP in France – were discussed at length in the media for the sheer size of the fines imposed. The case highlighted that the PNF’s willingness to work on transactional agreements has allowed France to assert its role in French-centric cases where US extraterritorial jurisdiction would have gone unchallenged in the past. It also highlighted the benefits of cooperation efforts by corporations charged with corruption-related wrongdoing.

By conducting an internal investigation of a scale rarely seen in Europe, the company displayed cooperation that was taken into account as a mitigating factor, even though it did not self-report the wrongdoing.

In August 2021, a French company entered into a CJIP that demonstrated the positive outcome that can arise from internal investigations. Following an internal inquiry that uncovered acts of bribery, the corporation self-disclosed to the PNF. The latter was already investigating the company (for other contracts) and reduced the penalty in consideration of the corporation’s cooperation efforts.

In February 2022, in cooperation with the PNF, the AFA published a draft guide to internal anti-corruption investigations. It describes the circumstances in which an investigation is warranted, the conditions under which it can be carried out and the consequences to be drawn from an organisational, disciplinary and legal standpoint.

However, despite the guidelines and recent cases presented above, the French regime still does not outline a clear framework for how cooperation credit may be awarded in such cases; at times, cooperating can feel like a leap of faith for corporate defendants who do not know what to expect.

In addition, a crisis of confidence may be looming as prosecutors and practitioners are reminded that judicial approval is a key step of negotiated justice for both corporations and individuals in France.

Since physical persons are ineligible for CJIPs, the fate of directors, officers or employees involved in (or accountable for) wrongdoing has long involved using, after the corporation’s settlement, a negotiated procedure offering an agreed-upon sanction in exchange for a guilty plea (CRPC). The two proceedings are, in practice, negotiated at the same time but remain subject to judicial approval and are, in principle, procedurally separate. This means that there is a risk that judges approve the corporation’s CJIP but not the CRPC for one or more individuals (which would then be sent to trial, defeating in part the purpose of negotiated proceedings).

This risk materialised for the first time on 26 February 2021, when the Paris Criminal Court approved the €12 million CJIP for a French corporation accused of public agent bribery and fraud in an African country, but declined to approve the proposed sanctions for the CEO and two officers of the corporation (the individuals had agreed to a €375,000 sanction) because they were deemed too lenient.

More recently, in December 2021, this issue occurred again, stress-testing a key aspect of the French regime. The Paris court approved the €10 million CJIP for a French corporation accused of influence peddling in France, but refused to validate the CRPC of one individual involved (who was not a director or employee of the corporate target).

These very public refusal decisions raised an issue practitioners had long been worried about: are faster negotiated proceedings such as CJIPs any use if directors, officers and employees always remain at risk of being sent to lengthy and taxing criminal trial proceedings? Practitioners, prosecutors and legislators (who already started proposing amendments on the issue in recent judicial reform bills) are likely to try to solve this issue in 2022 to maintain the credibility of such proceedings and the attractiveness of the French forum to self-report white-collar matters. This situation could be addressed by a new comprehensive anti-bribery bill that was introduced in Parliament; however, this bill is not yet scheduled for discussion, and this process is expected to take time.

CJIP deal or trial? Courts are still an option to consider

Sapin II’s creation of the AFA and its capacity to audit and administratively sanction corporations does not mean that judicial enforcement (ie, by prosecutors, in contemplation of a trial or an agreement when available) is a lesser legal risk.

The past four years have proven that the CJIP procedure is successful. It bolstered the credibility of French enforcement, especially in comparison to the US and the UK systems. It is now systematically considered by professionals in eligible cases, including lower-stakes cases and cases outside of the Paris area that are handled by local prosecutor’s offices (eg, a CJIP in Nice in May 2020 for tax fraud and laundering that included a €1.4 million fine).

It seems that judicial white-collar enforcement will get tougher in the foreseeable future, as suggested, in particular, by the €3.7 billion fine for a Swiss bank (2018) and €800 million in damages after it declined a CJIP deal for a smaller amount (€1.1 billion). In December 2021, the Paris Court of Appeal partially overturned this conviction, significantly reducing the fine to €3.75 million (with an additional confiscation penalty of €1 billion and €800 million in damages to be paid to the state, still making the total amount to be paid one of the most consequential in French judicial history).

The Court of Appeal drastically decreased the amount of the fine because the Court of Cassation ruled in September 2019 that the basis of the proportional fine incurred by the perpetrator of a tax fraud laundering operation needed to be based on the actual tax loss for the state (and not the total taxable sums concealed, which was the base used by the first court in 2018).^[21] The Court of Appeal again found the bank guilty and ruled it was not able to calculate a proportional fine using the new method because of ‘the indeterminacy of the exact amount of the proceeds of the money laundering’. It therefore defaulted to imposing the maximum discretionary fine for legal entities for this offence – €3.75 million. As is allowed by law, the Court of Appeal also ordered the seizure of €1 billion as proceeds of the offence. A recourse before the Court of Cassation is pending.

This saga shows that in France, despite the success of CJIPs, trial can still be an option to consider in some cases. Counsel and corporate clients should factor in the length, publicity and uncertainty of the trial, as well as the opportunity to get thorough judicial review on key aspects, such as the computation of proportional fines and disgorgements.

Judicial cooperation: towards reform of the French blocking statute?

Heavy fines on French corporations on international sanctions matters (eg, the US$8.9 billion fine for a French bank in 2014) or anti-bribery (eg, the US$772 million fine for a company operating in the transport sector in 2014) based on extraterritorial jurisdiction have become a very sensitive issue in the French political space. The need for more protection of French companies’ data and documents has incited the government to act on the issue.

Since 1968, the French have had a blocking statute designed to prevent the abuses of entering into discoveries or subpoenas on French entities or individuals. It criminalises the transmission of information to foreign courts outside the channels set forth by treaties (eg, the 1970 Hague Convention for civil matters or the mutual legal assistance treaties for criminal issues). Although it was applied recently (in an attempt to conduct depositions in the Executive Life case), it is widely considered as not being strictly enforced (notably by the US Supreme Court in its 1987 Aérospatiale decision).

After several failed reform attempts by previous legislatures, French MP Raphaël Gauvain was tasked by the prime minister to write a report on measures to limit the impact of extraterritorial assertions of jurisdiction, which included a possible reform of the French blocking statute. The report, which was published on 26 June 2019, proposed, among other things:

• stricter enforcement of the statute, with heightened sanctions in the event of transmission of evidence in civil or criminal proceedings (up to two years’ imprisonment and a €2 million fine for physical persons and €10 million for legal entities);
• administrative sanctions of up to €20 million for physical persons and up to 4 per cent of the global turnover for legal entities (eg, cloud service providers) that unlawfully transfer data abroad in anticipation of litigation – this provision aims to limit the extraterritorial effects of the US CLOUD Act and its coercive power on French or European companies; and
• mandatory registration with the Ministry of Economy’s economic intelligence office (SISSE) of corporations targeted by foreign investigations – the government may directly conduct the dialogue itself in certain important cases where strategic issues are at stake.

In 2022, rather than opting for a bill and increasing penalties in the event of a violation of the blocking statute, the government chose to clarify the reporting process via a decree enacted in February, followed by a regulation in March. The decree indicates that companies receiving requests that may fall within the scope of the blocking statute must inform the SISSE.

In practice, a filing must be submitted to the SISSE, which has one month to reply regarding the applicability of the blocking statute. The violation of the obligation to report to the SISSE is not sanctioned by any specific penalty.

Although these 2022 amendments help identify the relevant agency, it does not make the incurred penalties higher, nor does it substantially change how the law is enforced. For these reasons, these technical changes alone are unlikely to change the current position of foreign courts when assessing the credibility and actual enforcement risk of the French blocking statute.

In parallel with these French developments, EU-level solutions are also in the works.

EU projects, including the upcoming e-evidence regulation, are intended to pursue this effort and offer a common defence of EU companies and data while still providing a framework for cooperation against crime. Trilogue negotiations on this regulation started in February 2021 between the European Parliament, the Council and the Commission.

Following its experience with Sapin II, France is spearheading an EU-level push to adopt common legislation on the detection and prevention of corruption. This may imply a new role for the EPPO, which started its operations in June 2021 and is, for now, an independent prosecution body focused on defending the financial interests of the European Union across its member states’ courts.

Duty of Vigilance Law now EU-wide?

Enacted on 27 March 2017, the Duty of Vigilance Law is France’s initiative to promote the accountability of large corporations regarding the prevention of ESG risks related to their operations (including their subsidiaries and business partners, such as subcontractors or suppliers).

Although norms on this topic, such as the UN Guiding Principles on Business and Human Rights of 2011, have long remained non-binding soft law, France’s initiative was original as it initiated a ‘hardening’ of human rights obligations for businesses.

The Law applies to companies with at least 5,000 employees within their company and in their direct and indirect subsidiaries when their registered office is in France, and 10,000 employees when their registered office is located abroad. This includes French subsidiaries of foreign companies or global groups insofar as they meet the above-mentioned requirement.

The ‘vigilance plan’ is the key measure of the Duty of Vigilance Law, requiring qualifying companies to set up a plan containing measures designed to identify and prevent risks of human rights violations, serious physical or environmental damage and safety risks.

In line with the spirit of the Sapin II-mandated compliance plan for bribery, the vigilance plan must cover items such as:

• risk mapping;
• procedures for evaluating subsidiaries, subcontractors and suppliers with whom an established commercial relationship is maintained;
• appropriate actions to mitigate risks or prevent serious violations;
• a mechanism for alerting and collecting alerts; and
• a mechanism for monitoring the measures implemented to assess their effectiveness.

The plan must be published in the corporation’s annual report, which can be enjoined to establish and publish a plan if it fails to do so. ^[22]

In the past few years, NGOs have actively tracked qualifying corporations’ compliance with the law,^[23] and proceedings were initiated in 2019 against a French oil company, alleging insufficiencies in the vigilance plan regarding extraction operations in Uganda and pursuing – as a first remedy – an injunction to correct the plan.^[24] The case hit a procedural roadblock on 30 January 2020 as the Nanterre Civil Court declined jurisdiction in favour of the commercial court, which plaintiffs consider less likely to support their case. On 10 December 2020, the Versailles Court of Appeal confirmed the decision and the jurisdiction of the Nanterre Commercial Court.

According to a January 2020 government report citing external studies,^[25] some eligible corporations are not yet compliant with the law, exposing themselves to major liability and damages if an incident happens.^[26]

Failure to comply with the law (ie, to effectively implement the plan described above) exposes the corporation to a new form of fault-based civil liability in the event of an incident, where it can be liable for damages ‘repairing the harm that [its] compliance with the law could have avoided’.^[27] This means that, although the occurrence of an accident in a subsidiary or subcontractor does not necessarily mean that the corporation is liable (as a fault is required), companies are bound by a duty of care that comprises thoroughly implementing the vigilance plan.

The very broad writing of the law means that only the first liability cases will allow us to grasp its real extent and assess whether it reached its goal to foster accountability without creating an overly burdensome liability regime. To date, few proceedings were initiated,^[28] and no decision on the merits has been handed down in France.

France, whose approach to ESG issues through ‘hard law’ was at first isolated among the EU member states, was followed by Germany in June 2021. Besides differences with France in terms of the scope and the due diligence requirements under the German Duty of Vigilance Act, the main discrepancy concerns enforcement: in Germany, non-compliant companies face the risk of being excluded from public contracts for up to three years and fines of up to 2 per cent of their global annual turnover.

In February 2022, after public consultation, the European Commission proposed, in February 2022 a directive on corporate sustainability due diligence that would set an obligation for corporations to perform due diligence on human rights and environmental risks. Administrative authorities designated by each member states would be in charge of imposing fines in the case of non-compliance, perhaps curing some of the enforcement deficiencies observed in France, and victims would have the right to take legal action against such companies for ‘damages that could have been avoided with appropriate due diligence measures’.

*The authors wish to thank Matthieu Delignon for his contribution to this article.

Notes