On June 17, 2025, the Paris Court of Appeal’s Special Chamber (Chamber 5-12, dedicated to “emerging litigation”) delivered its first-ever ruling on the merits under France’s 2017 Duty of Vigilance Law (Loi sur le devoir de vigilance – “LdV”).

The La Poste decision by the Paris Court of Appeal’s Special Chamber is not the first ruling under France’s 2017 Corporate Duty of Vigilance law. Still, it stands out as particularly significant because earlier cases had largely turned on procedural grounds, without addressing the substance of companies’ vigilance obligations. On June 18, 2024, the newly established 5-12 Chamber of the Paris Court of Appeal issued several rulings related to France’s Duty of Vigilance Law, declaring the actions brought against TotalEnergies and EDF admissible and allowing them to proceed on the merits, while confirming the inadmissibility of the case against VIGIE GROUPE (formerly Suez).

By contrast, the La Poste decision is the first appellate decision to provide substantive judicial guidance on the content of vigilance plans and the overall vigilance process, as required under the LdV. It marks a turning point by shedding light not only on the legal expectations of some elements of the vigilance plan, but also on the methodological approach companies must adopt to comply with the law. To date, La Poste remains the only company in France found liable for failing to meet its duty of vigilance obligations.

The case was brought in 2021 by the French postal trade union SUD PTT, which raised concerns about psychosocial risks, workplace harassment, illegal subcontracting, and undeclared labour. These issues were specifically linked to working conditions, including allegations involving undocumented workers employed by a subcontractor of one of La Poste’s subsidiaries. The Paris Judicial Court issued its judgment on December 5, 2023, ordering La Poste to revise its vigilance plan. The company announced its appeal on March 11, 2024, leading to this landmark appellate ruling.

Charting the Path: The Court’s Directions for Effective Vigilance Plans

The Court was only tasked with assessing the La Poste 2021 vigilance plan’s compliance with four of the five key measures needed to be included in any vigilance plan:

• Measure 1: a risk mapping to identify, analyze, and prioritize risks
• Measure 2: a third-party evaluation procedure for periodically assessing subsidiaries, subcontractors, and suppliers with which the company has an established business relationship,
• Measure 4: a mechanism for alerting and compiling reports on the existence and occurrence of risks, developed in consultation with the company’s representative unions, and
• Measure 5: a system for monitoring the measures implemented and evaluating their effectiveness.

As a result, the Court did not examine the 2021 vigilance plan’s compliance with measure 3 (appropriate risk mitigation or serious harm prevention measures).

Through this methodical analysis, the Court provides a methodological roadmap for companies and a warning that superficial compliance will not suffice.

Prioritizing Severe Risks: Risk Mapping under LdV as Interpreted Through the UN Guiding Principles on Business and Human Rights  (“UNGPs”) and the EU Corporate Sustainability Due Diligence Directive (“CSDDD”)

The Court of Appeal reaffirmed that Measure 1, the risk mapping, is the cornerstone of any vigilance plan. In La Poste’s case, the Court criticized the risk mapping for being characterized by too high a level of generality. It made clear that companies cannot meet their duty of vigilance obligations with a generic, overly broad risk map, even if it is formally structured around the three legally required areas (human rights, health and safety, environment).

The Court noted that the 2021 vigilance plan referred to so-called “controlled risks” on several occasions, without offering any clarification regarding the degree of severity of those risks. Such vague references do not fulfill the purpose of risk mapping under the LdV, which is to identify, analyze and prioritize the most severe risks in a structured, risk-based hierarchy regardless of any measures the company may have already implemented to control them.

The Court emphasized that the LdV does not require companies to prevent or mitigate all impacts of their activities, but only the “severe risks or harms” (“risques ou atteintes graves”). This terminology must be understood as referring to the most severe actual and potential adverse human rights impacts, in line with the framing found in both the UNGPs and the EU CSDDD, as adopted on 13 June 2024.

 The Court made it clear that severity is the decisive criterion, mirroring the approach in UNGPs Principle 24, which requires companies to prioritize addressing the most severe human rights impacts first, especially seeking to prevent and mitigate those where delay would render harm irreparable. It also made explicit reference to the CSDDD, particularly Articles 8 and 9, which require in-scope companies to identify, assess, and prioritize risks based on their severity and likelihood. While the Court does not provide an explicit definition of what constitutes “severity”, its reference to the CSDDD invites reliance on the Directive’s definition. Under Article 3(v) of the CSDDD, ‘severity of an adverse impact’ means the scale, scope, or irremediable character of the adverse impact, which is aligned with the UNGPs.

By directly quoting both the CSDDD and the UNGPs, the Court effectively embedded international due diligence standards into its interpretation of French law. This reinforces the central role of a risk-based approach in shaping corporate vigilance obligations and confirms that they serve as a reliable interpretive guide and an authoritative reference for defining companies’ obligations under the LdV. Although the CSDDD has not yet been transposed into French law, the Court relied on the principle of sincere cooperation (also called loyal cooperation) under the Treaty on European Union to interpret national law in a manner consistent with EU objectives. The Court quoted: “In accordance with the duty of loyal cooperation set out in Article 4 of the Treaty on European Union (TEU), national courts must, as far as possible, refrain from interpreting domestic law in a way that could seriously undermine, after the transposition deadline, the achievement of the objective pursued by the directive.”

This anticipatory approach means companies should already begin aligning their vigilance efforts with CSDDD expectations.

The message is clear: superficial or generic risk mapping will no longer suffice. Vigilance plans must demonstrate a UNGPs-aligned, evidence-based methodology for identifying, analyzing, and prioritizing the most serious adverse human rights and environmental risks, moving beyond mere compliance checklists. While the Court acknowledged that a synthetic (concise) presentation of the risk mapping is possible, it insisted it must remain precise.

A Missed Opportunity for Stakeholder Engagement

However, the ruling also clarifies that, under the LdV, the risk mapping stage is not subject to mandatory stakeholder engagement (“concertation”), even though the vigilance plan is meant to be developed “in association with” stakeholders and the overall process of the elaboration of the vigilance plan is intended to encourage “dialogue and exchange”.

This limitation appears misaligned with the spirit of the UNGPs, which emphasize that the purpose of human rights due diligence is “to understand the specific impacts on specific people, given a specific context of operations” (Principle 18 Commentary).

The UNGPs stress that meaningful stakeholder engagement lies at the heart of effective due diligence, with a clear priority given to those most at risk of harm. Engaging directly with affected stakeholders is essential for companies to identify, understand, and address severe adverse impacts from the perspective of those who experience them in their daily lives.

Aligning third-party evaluation procedures with Risk Mapping

The Court, in its analysis of Measure 2, stressed that the procedures for assessing subsidiaries, subcontractors, and suppliers must be directly connected to the risk mapping. In La Poste’s case, because the risk mapping itself was overly general, the resulting third-party evaluation procedure were necessarily inadequate.

La Poste described a three-phase control mechanism: a questionnaire completed by suppliers and subcontractors, a remote documentary audit carried out by an Afnor evaluator, and on-site audits. While these procedures may appear structurally sound, the Court found that they were not properly correlated with the specific risks identified, nor with their level of severity.

The Court ordered La Poste to establish targeted, risk-based evaluation procedures. In line with the UNGPs, those should be understood as being more specifically directed at business partners most exposed to severe risks, as identified through a properly constructed risk mapping.

The ruling reinforces that a vigilance plan must not consist of disconnected formalities, it must be a coherent and integrated framework: companies must establish a logical chain linking risk identification and evaluation procedures.

Ensuring Engagement with Trade Unions from the Design Phase of Alert Mechanisms

The Court, regarding Measure 4, delivered one of its most decisive findings by affirming that the alert mechanism must be developed through engagement (“concertation”) with representative trade unions.

This form of engagement distinguishes from mere consultation on a pre-established draft. It requires both the transmission of relevant information and a genuine exchange of views and proposals on the content and implementation of the alert mechanism prior to its development. One-way communication does not meet the legal standard of the LdV engagement. In other words, engagement must begin at the initial stage of reflection, not once the key features of the alert mechanism have already been decided or established. The burden is on the company to demonstrate that it had engaged in substantive dialogue with trade unions at the design stage of the alert mechanism, prior to its development.

This interpretation aligns with UNGP Principle 31(h), which stresses that effective grievance mechanisms should be based on engagement and dialogue.

This interpretation raises practical questions, as many French companies have chosen to extend their existing whistleblowing systems, aligned with the French SAPIN II  Act, to cover risks falling under the LdV. In practice, this has often involved consulting trade unions on the extension of the existing mechanism and related safeguards, rather than engaging in a dedicated, forward-looking dialogue specific to the design of a vigilance-related alert system.

From Metrics to Meaning: Monitoring Must Reflect Effective Vigilance in Action

The Court, in its analysis of Measure 5, delivered a pointed critique of La Poste’s monitoring framework, finding that it relied primarily on various generic indicators, such as gender equality ratios, absenteeism rates, or workplace accidents, which bore little or no connection to the specific human rights and environmental risks identified in the risk mapping. Such a disconnection prevents any meaningful evaluation of the effectiveness of vigilance measures concerning the actual risks identified.

The vigilance plan provided no explanation as to how the corresponding vigilance measures had been implemented, nor any assessment of their impact on the prevention or mitigation of severe risks or harms.

It emphasized that the indicators used, and the systems put in place to monitor vigilance measures, as well as to assess their effectiveness, must clearly be correlated with the risks that have been identified.

This approach aligns with Article 15 of the CSDDD, which requires companies to evaluate the effectiveness of their due diligence measures using tailored qualitative and quantitative indicators.

The La Poste ruling represents a key milestone in clarifying the scope and substance of France’s Duty of Vigilance Law. For the first time, an appellate court has set out concrete expectations for what an effective vigilance plan must look like: not a mere formality, not a checkbox exercise but a practical, risk-based tool for identifying and preventing severe human rights and environmental harms. By anchoring its reasoning in both the UNGPs and the CSDDD, the Court confirmed that international and EU standards now shape how French companies must interpret and implement their vigilance obligations.

French businesses: it’s time to re-open your UNGPs!