The French law on the Duty of Vigilance (“devoir de vigilance” in French) was passed in 2017 and later inspired the European Corporate Sustainability Due Diligence Directive (CSDDD). The French Law introduced a fundamental shift in corporate law in order to hold companies accountable for their adverse human rights or environmental impacts. Indeed, it establishes their responsibility on an innovative basis which—though not entirely new—requires better conceptualization to fully realize its potential. In our view, drawing on the pioneering example of the French law, the duty of vigilance establishes what we call a “management norm”: managing a company cannot simply involve organizing an activity in pursuit of private interests alone. It requires the ability—and the responsibility—to organize a collective activity while managing the associated risks, particularly the risks of violating human rights.

Until now, as tragically demonstrated by the Rana Plaza disaster in 2013, existing law was unable to hold ordering companies accountable. Multinational corporations exploited the limitations of the law by locating their activities in countries with weak labor laws and through legally independent subcontractors. In this way, they could not be held liable for any accidents. The duty of vigilance changes this dynamic by holding companies accountable for all of their activities, regardless of the legal structures they may establish. More generally, until the adoption of the duty of vigilance law, management decisions could only be challenged in court in very limited circumstances. Since directors are accountable only to shareholders, the traditional framework of corporate law allowed for a certain degree of managerial irresponsibility: it could be rational for directors to transfer the risks of the activity onto other stakeholders if it increased profits for shareholders. The duty of vigilance breaks away from this logic of de-responsibilization by establishing the conditions under which the management of a collective activity is legitimate and responsible.

In this blog, we first revisit the originality of the duty of vigilance. Our analysis focuses on the French law, but it could potentially be extended to the CSDDD. We then define what we call the “management norm,” which is the mechanism at the heart of this law. We show that historical laws, such as those on workplace accidents or bankruptcies, were also based on “management norms.” We conclude by highlighting the significance of introducing management norms into corporate law for the protection of human rights, and more broadly, for ensuring that companies are managed in a way that aligns with efficient and fair ecological transitions.

The Duty of Vigilance Law: Foundations and Originality

Traditionally, a company is managed by a board of directors. This board is supposed to run the company not in the interest of the shareholders but in the interest of the corporation, which is a separate legal entity. In this regard, directors have significant managerial discretion in principle. They are considered best placed to assess what is in the company’s interest and to determine what strategic directions are appropriate to serve that interest. A decision by the directors is hardly contestable in court, except in cases of proven misconduct where directors act in their own interest to the detriment of the company or with negligence (cases of “breach of fiduciary duties”). In practice however, this leeway is quite limited: in reality, directors are appointed and also remunerated or incentivized by the shareholders. And with the support of the agency theory, corporate governance codes have encouraged tighter shareholder control over the board. Ultimately, directors’ decisions are evaluated by shareholders, who may sanction or even remove them if necessary. But as long as a decision complies with the law, there are no legal avenues for other stakeholders to challenge its legitimacy with regard to social or environmental concerns.

In this context, the duty of vigilance introduces the possibility of challenging management decisions on a radically new basis. It is important to note that the law does not start from a principle of contractual liability, nor from liability for negligence. It does not consider the parent company responsible for what happens within the subsidiary or supplying company. However, it stipulates that a company must manage the risks induced by its activities. Managing a company thus implies managing the associated risks of human rights violations. It requires a risk management plan, including a mapping of knowable risks, as well as an action plan aimed at preventing or, if necessary, remediating adverse impacts to human rights or the environment.

This principle, therefore, relates to “good” management. There can be a fault if the risk management plan is insufficient, lacks rigor, or if known or knowable risks are not included. Conversely, if the plan is established in a rigorous, or one could say professional, manner, then the occurrence of an accident will not necessarily implicate the directors’ responsibility. The law thus considers that management must be competent, but it also makes management decisions open to discussion and litigation. Already, NGOs have initiated several actions against companies such as Total, Danone, and EDF, challenging the quality of their risk management plans. And the Paris Court of Appeal announced in early 2024 the establishment of a dedicated chamber within its economic division to handle disputes related to the duty of vigilance.

Management Norm: Definition and Historical Precedents

We propose to qualify the duty of vigilance as a management norm. By ‘management norm,’ we mean a legal rule that must be adhered to by directors for the collective actions they organize to be considered legitimate, even when such actions entail risks. A management norm is based on management practices or standards, i.e. guidelines or processes designed to ensure the efficiency, consistency, and quality of management decisions (e.g. ISO international standard, or industry-specific professional standards). However, unlike in-use management standards, a management norm leverages this knowledge to hold management legally accountable, making it a duty for leaders.

This process, where management knowledge becomes a source of law, is not new, even if it has not been conceptualized until now. Two important historical precedents can be cited: the law on workplace accidents (1898 in France), which laid the foundations of modern labor law, and the law on bankruptcies.

The law on workplace accidents deviated from the usual principles of liability as it established a principle of default employer liability. Furthermore, it also introduced the concept of liability without fault. What does this mean?

The activity of the company and its workers is designed and organized by the employer. The employer chooses the machinery, determines the location, the working hours, and therefore the concrete conditions of the work. This activity, especially in modern industry, involves risks. It is therefore only legitimate if the employer has sufficient knowledge about the process they are implementing (notably about how the machinery operates) and if they adhere to safety measures that control the risks. Therefore, a body of knowledge is required to ensure that the activity is organized responsibly.

In these conditions, if an accident occurs, there are two possibilities. There is fault if the risk was manageable but the safety measures were not implemented. Conversely, there is no fault if the employer had “managed well”: the accident that occurs cannot be attributed to their faulty conduct, and the insurance—which the employer is required to subscribe to—must then cover the damages. The employee is compensated, but no responsibility is attributed to the employer.

A similar pattern can be seen with the French bankruptcy law (1889). Prior to its adoption, an entrepreneur who could not honor their debts was stripped of their civil rights. The fault seemed inexcusable. However, the law recognized that business risks are not always the entrepreneur’s fault. To distinguish between the honest entrepreneur who manages “well” and the unscrupulous or even fraudulent one, the law built upon another management technique: accounting. While poor bookkeeping makes the entrepreneur culpable in bankruptcy, proper bookkeeping makes it legitimate to borrow despite the risks of non-repayment to creditors.

Here we see how the law built upon these techniques of good management and managerial knowledge to establish the conditions for directors’ liability. More generally, it is essential to emphasize that management cannot simply mean pursuing one’s own interest, the interest of shareholders, or even the interest of the corporation. Management requires careful attention to negative effects of the activities, vigilance, and responsible behavior. This is the regulatory tradition on which the duty of vigilance is based.

Perspectives

The duty of vigilance has several implications for the future.

First, to be effective, it requires a deep and shared understanding of the risks involved. This demands high level of expertise and constant efforts to update it, not only from the directors but also from the parties responsible for monitoring the quality of the plans. One might think that the necessary learning will require collective approaches, such as that of the Bangladesh Accord in the aftermath of the Rana Plaza disaster.

Second, while Corporate Social Responsibility relied on enlightened directors to consider social and environmental issues, it is now critical to recognize the limitations of this approach. Corporate law has allowed activities with potentially massive global adverse impacts to be managed with a narrow focus on the shareholders’ interest. The duty of vigilance introduces a significant shift by anchoring responsible management within the legal constitution of the corporation and by allowing stakeholders to hold corporations accountable if they are not managed responsibly, e.g. with consideration for a range of public interests.

This principle, imposed through management norms, opens radically new perspectives. For while the respect of human rights is imperative, states cannot themselves define all the necessary conditions to ensure that corporate activities are responsible. However, companies can define their own management norms at their level: they can incorporate into their articles of association the rules they will have to abide by in the management of their future activities. French law has introduced in 2019 the option for companies,  regardless of their initial legal form, to become “société à mission“. Sociétés à mission are companies that enshrine in their corporate constitution (articles of association) a purpose broader than profit, with specific social and environmental objectives for their activities, and adopt a special governance structure to oversee the fidelity of management to purpose. To date, there are around 1,700 companies that have opted to become sociétés à mission in France. However, regardless of the number of companies concerned and beyond the French case, the principles introduced by the duty of vigilance to reshape the legal foundations of management appears highly promising. This approach deserves to be further explored and implemented if we want companies to become not only accountable but also effective actors in the much-needed social and ecological transitions.