Help us make the FRA website better for you!
Take part in a one-to-one session and help us improve the FRA website. It will take about 30 minutes of your time.
A Human Rights Approach to Due Diligence: Reflections on key principles
Search inside this publication
- Executive summary
- Introduction
- 1. Why is mandatory human rights due diligence needed?
-
2. A risk-based approach within human rights due diligence
- 2.1. Business responsibility to respect human rights
- 2.2. Risk-based approach to identification and assessment of adverse impacts
- 2.3. Shared responsibility in implementing due diligence across the chain of activities
- 2.4. Ongoing monitoring in line with a risk-based approach
- 2.5. A risk-based approach to responsible disengagement
- 3. Stakeholder engagement
- 4. Access to effective remedies and civil liability
- 5. Oversight and enforcement
- About this publication
Business responsibility to respect human rights is an emerging global standard of conduct for all companies irrespective of their geographical location, size, sector or type of economic activity. It does not replace or diminish states’ obligations to uphold human rights: it is complementary to those obligations. The responsibility also goes beyond adherence to national human rights laws and regulations [22] See footnote 1, in particular the commentary on foundational principles (section II.A).
. It requires that businesses take adequate measures to identify, prevent, mitigate and, where appropriate, remedy actual and potential adverse human rights impacts that they may cause or contribute to through their own activities or as a result of their business relationships with other parties [23] See footnote 1, in particular principles 11 and 13 and the commentaries thereon.
.
This responsibility is outlined in international frameworks like the UNGPs [24] See footnote 1.
and OECD Guidelines [25] See footnote 11.
. It applies to all internationally recognised human rights [26] See footnote 1.
including those expressed in the International Covenant on Economic Social and Cultural Rights, the International Covenant on Civil and Political Rights [27]
UN: OHCHR, ‘International Bill of Human Rights: A brief history, and the two international covenants’, UN website.
and International Labour Organization (ILO) core conventions, as well as the ILO Declaration on Fundamental Principles and Rights at Work amended in 2022 [28]
ILO, ILO declaration on fundamental principles and rights at work and its follow-up, ILO, Geneva, 2022.
. New and emerging HRDD frameworks, including mandatory legislation, should, wherever possible, align with established international standards. This alignment helps ensure policy coherence and the uniform and predictable regulation across jurisdictions.
To promote international policy coherence and ensure effective human rights protection, mandatory HRDD laws should be consistent with international standards. Article 8 of the CSDDD provides a promising example of such consistency. It enshrines a substantive obligation for in-scope companies to identify and assess their adverse human rights and environmental impacts throughout their chains of activities, building on international standards and largely reflecting a risk-based approach.
Companies can negatively impact the full spectrum of fundamental rights. While Member States have an obligation to protect these human rights, businesses have a responsibility to respect them: implementing appropriate HRDD by applying a human rights risk-based approach is the key means of discharging that responsibility. It helps companies to reduce legal and regulatory risks by identifying potential human rights abuses early and across the entire value chain, enabling them to mitigate potential harm before it materialises and potentially leads to liability. It increases stakeholder trust in companies and gives them a social license to operate, particularly in environments characterised by heightened risks. Finally, it increases the resilience of their suppliers, preventing crises and disruptions.
A risk-based approach is inherent to HRDD, as emphasised in the UNGPs and OECD Guidelines. UNGP 17 provides that:
‘In order to identify, prevent, mitigate and account for how they address their adverse human rights impacts, business enterprises should carry out human rights due diligence. The process should include assessing actual and potential human rights impacts, integrating and acting upon the findings, tracking responses, and communicating how impacts are addressed.’
Consistent with established international law, due diligence embodies a principle of responsibility and enshrines an obligation not to harm a legally protected right or interest: in the case of HRDD, the rights are those protected under human rights law. The relevant due diligence therefore relates directly to the risk of harm to, or abuse of, such rights. Due diligence cannot be separated from that risk because it is anchored in those rights and not in contractual or business relationships. It requires focusing on the risks to rights holders, meaning the potential adverse human rights impacts that a company should prevent and mitigate, as explained in the UNGP Guidelines [29]
This applies analogously to environmental due diligence, as specified in the OECD Guidelines, pp. 19–20.
. In other words, it goes beyond material risks to the company to include risks to rights holders [30]
UN Human Rights Council, ‘Improving accountability and access to remedy for victims of business-related human rights abuse: The relevance of human rights due diligence to determinations of corporate liability’, A/HRC/38/20/Add.2, 1 June 2018, paragraph 8.
. Thus, these risks are primarily the ‘outward risks’ that the company may cause or contribute to, rather than risks that company itself faces, such as financial or reputational risks although the two are linked and HRDD should be integrated in risk-management processes [31]
OECD, OECD Due Diligence Guidance for Responsible Business Conduct, OECD Publishing, Paris, 2018, p. 15.
.
A risk-based approach is also proportional under the OECD Guidelines. A risk-based approach implements the general principle that companies’ risk management should ‘… a) target those areas of the business where risks are greatest and, on that basis, prioritise the highest risk business partners, [and] b) be proportionate and tailored to the degree and nature of risk that individual companies face.’ (p. 4). HRDD is carried out with due regard to the size of an enterprise, the nature and context of its operations and the severity of the risks of adverse human rights impacts (p. 25).
In EU context, CSDDD reflects a risk-based approach [32] In this context, the CSDDD limiting of the due diligence scope across the downstream value chains (especially for the financial sector), itsapplicability to only a group of very large companies and a lack of specific focus on high-risk sectors or contexts such as conflict areas are a limitation, as they leave out potentially severe harms that could be prevented through due diligence.
by establishing a core substantive obligation for companies to take appropriate measures to identify and assess actual and potential adverse impacts arising from their own operations or those of their subsidiaries. Companies should consider factors like company level, operations, location, products and sector. They should use established criteria of severity and likelihood to assess potential or actual human rights and environmental adverse impacts and to prioritise responses if necessary. The directive requires companies to integrate due diligence in their policies and risk management and highlights the need to consider the specific nature of the company’s operations and value chain. In keeping with a risk-based approach, the CSDDD also asks for proportionate responses: Article 9 requires that companies prioritise adverse impacts identified pursuant to Article 8, and that such prioritisation is based on the severity and likelihood of the adverse impacts. Once the most severe and most likely adverse impacts are addressed within a reasonable time, the company must address less severe and less likely adverse impacts. CSDDD requires companies to take appropriate measures to identify and address their potential and actual adverse impacts – meaning measures ‘capable of achieving the objectives of due diligence’ within the circumstances, as outlined in the definition [33] Article 3(1)(o) of the CSDDD: ‘“appropriate measures” means measures that are capable of achieving the objectives of due diligence by effectively addressing adverse impacts in a manner commensurate to the degree of severity and the likelihood of the adverse impact, and reasonably available to the company, taking into account the circumstances of the specific case, including the nature and extent of the adverse impact and relevant risk factors.’.
‘Severity’ and ‘risk factors’ are further defined in Article 3(1)(u) and (v) of the CSDDD.
. It is an obligation of conduct: the directive acknowledges that addressing adverse impacts by a company across its value chains may not be always possible and depends on many factors [34] Recital 19 includes relevant guidance: ‘This Directive should not require companies to guarantee, in all circumstances, that adverse impacts will never occur or that they will be stopped. For example, with respect to business partners, where the adverse impact results from State intervention, the company might not be in a position to arrive at such results. Therefore, the main obligations in this Directive should be obligations of means.’.
, although companies should aim to prevent and mitigate human rights risks and end actual adverse impacts effectively [35]
‘[D]ue diligence must manifestly aim at achieving the outcome of no harms; however, the occurrence of a harm is not in itself sufficient evidence that the due diligence was inadequate.” (emphasis original) in: Davis R., ‘Legislating for Human Rights Due Diligence: How outcomes for people connect to the standard of conduct’, Shift Viewpoints, 2021.
.
In practical terms, a key first step of the HRDD process is the identification and assessment of potential and actual adverse impacts. In line with the UNGPs, this encompasses the key steps of mapping supply chains and assessing risks, as it is essential that companies ‘understand the specific impacts on specific people, given a specific context of operations’ in order to be able to prevent, mitigate and address them [36]
UNGP 18 – commentary.
United Nations Development Programme, ‘Human Rights Due Diligence: An Interpretive Guide’, 2021, q. 34.
. According to the UNGPs, this should involve ‘assessing the human rights context prior to a proposed business activity, where possible; identifying who may be affected; cataloguing the relevant human rights standards and issues; and projecting how the proposed activity and associated business relationships could have adverse human rights impacts on those identified’ [37]
UNGP 18 – commentary.
.
According to applicable international frameworks, businesses are expected to implement a risk-based [38]
OECD, ‘Translating a risk-based due diligence approach into law: Background note on regulatory developments concerning due diligence for responsible business conduct’, 2022.
approach to HRDD, prioritising the most severe and probable impacts they might be connected to, no matter where these impacts occur within the value chain. This approach is well established and already widely used by companies worldwide. Limiting the scope of the in-depth assessment to a company’s own operations and direct business partners only – unless companies have substantiated knowledge that suggests potential or actual adverse impacts in indirect business partners’ operations – as for example in the German Supply Chain Act [39]
For example, the German Supply Chain Act model requires assessment until tier 1 suppliers and further if there is ‘substantiated knowledge’ about possible adverse impacts, which is considered one of the drivers of many companies adopting formalistic compliance approaches over risk-based due diligence.
Bright, C., Elliott, J., Gonzalez De Aguinaga, S., Huyse, H., Marx, A., Otteburn, K. and Pietropaoli, I., ‘Policy Brief – Implementing the CSDDD: Lessons learnt from the comparative experiences’, 2025.
– could render HRDD reactive rather than proactive, thereby severely undermining its effectiveness.
Shifts away from a risk-based approach artificially direct the focus of companies’ due diligence to direct business relationships instead of the entire chain of activities, thereby misunderstanding both the nature and the locus of human rights risks that business may cause or contribute to. It also contradicts the UNGPs that require companies to address impacts throughout their entire value chain, leaving many workers and communities vulnerable to unaddressed human rights abuses. UNGP 24 specifies that in their prioritisation efforts, ‘enterprises should first seek to prevent and mitigate those that are most severe or where delayed response would make them irremediable’ [40] See footnote 3.
. Thus, a risk-based approach mandates that it is the nature and scale of the risk, not its occurrence in the value chain, that should determine a company’s approach.
Many severe human rights abuses and impacts occur at lower tiers of the value chain across many sectors, both downstream and upstream. Examples include deaths and injuries caused by hazardous working conditions in factories within the garment sector supply chain; the torture and killing of individuals by security forces hired by companies to help resolve disputes related to business operations, especially in the forestry and mining sectors; the killing of human rights and environmental defenders; and child labour on farms from which European agrifood companies source their products (e.g. cocoa) [41]
Alleweldt, F., Baeza-Breinbauer, D. Bauer, M., Bright, C., Deinger, H., Kara, S., Salinier, C., Tejero Tobed, H. and Torres-Cortés, F., Study on due diligence requirements through the supply chain – Final report, Publications Office of the European Union, 2020, pp. 214–217.
OECD, ‘Complaints database’, OECD Watch website, accessed 17 October 2025.
Business & Human Rights Resource Centre, ‘Latest News’, Business and Human Rights Resource Centre website, accessed 17 October 2025.
.
While these cases are well-known, systematic and complete data on human rights adverse impacts across the value chains of companies are lacking and cases are vastly underreported, not least because of the lack of due diligence and monitoring frameworks until recently and limited access to justice in business and human rights cases, especially transnationally [42]
FRA, Business and Human Rights – Access to remedy, Publications Office of the European Union, Luxembourg, 2020.
. For example, a study using network model estimation indicates that ‘about 8.5 % of EU companies are at risk of having child or forced labour in the first tier of their supply chains, about 82.4 % are likely to have such [abuses] at the second tier and more than 99.1 % have such [abuses] at the third tier‘. Among the 285 allegations against German companies made between 2020 and 2021 (before the German Supply Act came into effect in 2023) according to the analysis of the Business & Human Rights Resource Centre, only 32 % pertained to company’s own or first-tier operations [43]
Business & Human Rights Resource Centre, Beyond tier 1: Exploring “substantiated knowledge” in the German Supply Chain Act, Business and Human Rights Resource Centre website, accessed 20 October 2025.
. As emphasised by the Tribunal de Paris in the context of risk mapping under the French Duty of Vigilance Law in the case of La Poste, the vigilance plan must precisely identify and rank risks at the subcontractor level, as without a specific assessment of subcontractors based on detailed risk mapping it cannot effectively address or mitigate serious risks [44]
Judgment of the Tribunal Judiciaire de Paris of 5 December 2023, Fédération des Syndicats solidaires, Unitaires et Democratiques des Activities Postales et de Telecommunications (SUD PTT) v S.A. La PosteFédération des Syndicats solidaires, Unitaires et Democratiques des Activities Postales et de Telecommunications (SUD PTT) v S.A. La Poste, RG 21/15827.
Latham & Watkins Litigation & Trial Practice, ‘French court reaches precedent decision on the duty of vigilance law’, Latham & Watkins, 2024.
Da Graça Pires, C., ‘La Poste Case: The first decision on the merits by the Paris Court of Appeal’s special chamber, a methodological milestone structuring duty of vigilance jurisprudence’, 8 September 2025.
.
It is therefore vital to ensure that companies identify and assess adverse impacts across their entire value chains using a risk-based approach in order to be able to effectively address the most severe ones. To do this effectively, companies should have the flexibility to tailor their identification and assessment process to their specific sector, value chain and other circumstances, and should direct their attention and resources to where the human rights and environmental risks are most salient, irrespective of where they occur in the value chain.
In terms of the nature of the harm captured by HRDD, a comprehensive approach is necessary. HRDD has traditionally focused primarily on identifying and mitigating adverse human rights impacts. However, while the UNGPs do not explicitly specifically address the environment, they recognise that HRDD must encompass both actual and potential adverse impacts on all human rights, including those caused by environmental harm [45] UNDP, Human Rights Due Diligence and the Environment: A practical tool for business, New York, 2024; Filmer-Wilson, E. and Anderson, M., ‘Integrating human rights into energy and environment programming: A reference paper’, UNDP, 2005.
. Environmental degradation and human rights violations are inextricably linked, as evidenced in recent international jurisprudence, confirming the importance of a holistic approach to corporate responsibility that encompasses both human rights and environmental risk [46]
Danish Institute for Human Rights: Ruiz Liard Krysa, M. and Ploug Petersen, M., Human Rights Obligations and Adaptation to Climate Change: An analysis of recommendations to states from international human rights mechanisms, Danish Institute for Human Rights, Copenhagen, 2024.
, with the OECD Guidelines [47] See footnote 11.
being a prime example.
In line with international standards, a company’s level of involvement in the adverse impact and its ability to influence the situation are relevant in determining appropriate measures in the due diligence process. At the same time, companies with sufficient leverage should use it to contribute to the fulfilment of human rights – whether by influencing their business partners or directly by their own actions, including purchasing practices.
The CSDDD enshrines a shared responsibility across the chain of activities [48] In the context of the Business & Human Rights Resource Centre, ‘shared responsibility’ is also used more broadly to highlight the role of private actors in upholding human rights, next to States’ obligation in this regard. This paper considers shared responsibility between companies and actors in the value chains, as typically used in the context of global value chain contracting and purchasing practices.
: it requires companies to cooperate and support their business partners when implementing due diligence and use leverage as appropriate [49] As outlined in Articles 10 and 11 and recitals 19, 45, 46 and 53. Furthermore, support for SMEs (Article 10(2) (e), Article 10(5), Article 11(2)(f) and Article 11(6)), and collaboration with other entities (Article 10(2)(f)) offer potential pathways for increasing impact on the ground.
. Contracts are a vital governance tool in corporate value chains that can be leveraged to ensure the timely identification and addressing of adverse impacts. According to the CSDDD, appropriate measures should be put in place to verify compliance with them [50] Article 10(2)(b), Articles 10(4) and 10(5), Article 11(3)(c) and Articles 11(5) and 11(6) of the CSDDD. The European Commission is bound to provide a set of model contractual clauses, as per Article 18 of the CSDDD.
.
Contracts can and should be devised in a way that embeds shared responsibility among the company and its business partners [51]
Rutger’s Centre for Corporate Law and Governance, ‘The Responsible Contracting Project’, Responsible Contracting Project website, accessed 17 October 2025.
. However, contractual assurances alone are not sufficient to fully address the risks, and cannot replace effective risk-based HRDD process. Moreover, contractual cascading should not be used as a form of ‘tick box’ compliance, which would de facto result in the outsourcing of due diligence obligations to business partners [52]
European Commission: Directorate-General for International Partnerships, International Trade Centre, ‘Making mandatory human rights and environmental due diligence work for all: Guidance on designing effective and inclusive accompanying support to due diligence legislation’, 2022, pp. 16–17; Elliott, J., Pietropaoli, I. and Gonzalez de Aguinaga, S., Towards new human rights and environment due diligence laws: Reflections on changes in corporate practice, British Institute of International and Comparative Law, London, 2024, pp. 21–26.
.
Companies should use contracting to leverage their potential to make positive contributions to the protection of human rights and identify effective pathways for achieving this goal. In this context, the improvement of purchasing practices is an important avenue, encompassing companies’ impacts on living wages and employment practices, along with the environmental impacts of their operations and products in their value chains.
HRDD is a continuous process in which identification and assessment of adverse impacts, monitoring and timely adjustments are key.
For example, the CSDDD obliges companies to conduct a periodic assessment of the implementation of due diligence and monitor the adequacy and effectiveness of mitigation and remediation measures undertaken in their operations and throughout the chain of activities, at least every 12 months and every time a significant change occurs [53] Article 15 of the CSDDD.
.This assessment should be based on both qualitative and quantitative indicators and take into due consideration the information from stakeholders.
In a dynamic global business context, regular periodic and responsive ad hoc assessments are key to identifying risks in a timely manner and to reinforcing companies’ capacity to prevent and mitigate adverse impacts.
The established international framework, including both the UNGPs and the OECD Guidelines, foresee responsible disengagement from business partners as a last resort [54]
UNGP 19 – commentary.
OECD Due Diligence Guidance for Responsible Business Conduct, practical action 3.2 h).
. This should only be considered in case of severe adverse impacts and subject to the appropriate safeguards: in line with a risk-based approach, preventing and mitigating adverse human rights should be a primary consideration.
The CSDDD establishes an obligation of responsible disengagement as a last resort: companies should terminate the relationship with the partner if severe impacts occur and if other measures failed to address these impacts, unless the consequences of withdrawal are likely to be more severe than the impacts related to continued activity.
The CSDDD outlines the steps that companies should take if adverse impacts could not be prevented or mitigated with other measures foreseen by the directive [55] Recitals 46, 47 and 54 of the CSDDD.
. Companies should engage and prevent or mitigate adverse impacts whenever possible and use their leverage, including via enhanced, time-bound preventive and corrective action plans and temporary suspensions (with termination of existing relationships or refraining from entering new relationships considered a last-resort measure). Before suspending or terminating the business relationship, companies should also evaluate the potential negative consequences of doing so. If these consequences are likely to be significantly more severe than the initial adverse impact, companies are not obliged to end the relationship.
In considering responsible disengagement, companies may consider also other factors – for example, in situations where they do not have viable business alternatives. The international standards provide for such of circumstances: Where a relationship is ‘crucial’ to the enterprise, meaning it provides an essential product or service with no reasonable alternative, ending it becomes more complex. In line with the international standards, companies should prioritise using their leverage – increasing it as necessary – and only resort to ending the relationship if this is not possible and ‘taking into account credible assessments of potential adverse human rights impacts of doing so’ [56]
UNGP 19 – commentary.
. The severity of the human rights abuse must be considered: more severe impacts demand quicker action.
The possibility to temporarily suspend or terminate the business relationship as a last resort is important so that companies can exercise leverage over their business partners to address identified adverse impacts. Companies must have the option to terminate a business relationship.
International standards suggest that, as long as the abuse continues, the company must demonstrate ongoing efforts to mitigate harm and be prepared to face reputational, financial or legal consequences from maintaining the relationship. This encompasses providing remediation to the victims of abuse [57]
UNGP 19 – commentary.
.