While the duty of care requires major corporations to identify and prevent serious human rights or environmental abuses, failures in its implementation expose companies to a growing criminal risk. This is an issue that investors can no longer ignore, particularly when it comes to mergers and acquisitions. Legal column by Julie Guénand, lawyer at Veil Jourde.

Duty of vigilance: from civil liability to the threat of criminal liability

Adopted in 2017, the French law on duty of care requires certain large companies to prevent serious violations of human rights, fundamental freedoms, health, personal safety and the environment. Inspired by international principles (such as the United Nations Guiding Principles on Business and Human Rights), this legislation places responsibility upstream, and is not limited to punishing damage that has already occurred. It requires companies to take action to prevent damage from occurring in the first place.

In practical terms, the companies concerned must draw up, publish and implement a vigilance plan. The aim is twofold: to identify risks and implement corrective measures. In the event of non-compliance, civil liability proceedings may be instituted. These proceedings have largely been initiated by non-state stakeholders - NGOs, trade unions or whistle-blowers - who, under the terms of the text, have the legitimacy to take legal action.

In recent years, however, litigation relating to the duty of vigilance has moved away from the realm of civil liability and entered the criminal arena, albeit cautiously and firmly. This evolution is explained by the increasingly fine-tuned link between the duty of vigilance and certain pre-existing criminal qualifications. When serious damage occurs - major pollution, a fatal accident on an industrial site, the use of forced labor by a subcontractor - failure to exercise due diligence can be seen as one of the causes of the damage, or even as complicity.

Certain offences can then be characterized. In environmental terms, for example, Article L.411-1 of the French Environment Code punishes the destruction, alteration or degradation of the natural habitats of protected animal or plant species. With regard to human rights, investigations have been opened for complicity in crimes against humanity in exceptional cases. Other offences include endangering the lives of others, unintentional injury, misleading commercial practices, and financing terrorism, as in the Lafarge case, in which the company is accused of having knowingly maintained commercial relations in an area controlled by armed groups.

The prosecuting authorities, whether the Paris Public Prosecutor's Office or the National Financial Prosecutor's Office, are increasingly interested in these cases, which are often reported by NGOs with strong local roots.

Thus, a breach of due diligence does not in itself constitute a criminal offence, but it may constitute one of the elements in a set of clues enabling an offence to be characterized.

The emergence of a criminal risk for investors

The extension of criminal litigation linked to the duty of care does not only concern the companies covered by the 2017 law. It also has a cascading effect on players who invest in these companies, particularly in the context of external growth operations.

One of the major turning points in this development came with the November 25, 2020 decision by the Criminal Division of the French Supreme Court. For the first time, the high court recognized that the absorbing company could be criminally prosecuted for acts committed by the absorbed company prior to the merger.

For investors, this reversal considerably increases the legal risk attached to an acquisition. It's no longer just a question of assessing a target's financial strength or regulatory compliance, but of anticipating latent criminal liabilities. A failure to exercise due diligence in a supply chain located in a high-risk zone (forced labor, illegal exploitation of resources, recurrent pollution) may give rise, years later, to a complaint followed by a criminal investigation targeting the absorbed company... and then the acquirer. This perspective transforms the very nature of legal audits prior to a transaction.

Whether or not the proceedings are settled out of court via a Public Interest Judicial Agreement (CJIP), the impact on the company's image, governance and valuation can be considerable, as can the financial penalties and risks of exclusion from public contracts.

Over and above the direct legal risk, these situations can lead to increased volatility in the value of the assets concerned. A legal or media scandal linked to a serious breach can lead to massive divestments, immediate devaluation of the company or a freeze on certain operations. Institutional investors, increasingly sensitive to sustainability and governance criteria, must now include a criminal compliance dimension in their strategic choices.

In this way, the duty of care is not just a legal obligation for large companies: it is becoming an indicator of reliability and sustainability for all market players.

Prevent rather than suffer: auditing as a security tool

Investors can no longer be content with a traditional approach to legal risk. Duty of care, as a preventive compliance requirement, calls for a transformation of due diligence tools, particularly in the context of investment, M&A or strategic partnership transactions.

The traditional legal audit, focusing on the validity of contracts, current disputes or regulatory compliance, is no longer sufficient. It must now include an analysis of the due diligence mechanisms put in place by the target company. Beyond the formal existence of a due diligence plan, investors must assess its effectiveness. A plan that has been published but not implemented, or that lacks real corrective measures, can be just as risky as not having one at all. At stake is the company's ability to protect itself against serious litigation, as well as its credibility in the eyes of the markets, regulators and civil society.

It is also essential to extend the scope of the audit beyond the boundaries of the company. The subcontracting chain, particularly in sectors with a high environmental or social impact (extractive industry, textiles, agri-food, logistics), must be the subject of reinforced vigilance. This presupposes precise knowledge of the geographical areas of intervention, local intermediaries and practices in the field.

This increased demand is part of a structural trend towards greater corporate responsibility in value chains. The boundaries between direct and indirectly controlled activities are becoming blurred, including in terms of criminal law. It is this shift that justifies the extension of the scope of audits, but also the development of reinforced contractual tools: vigilance clauses, compliance commitments, internal sanction mechanisms in the event of identified breaches.

With this in mind, the role of investors becomes as much preventive as curative. By asking the right questions upstream, and demanding precise guarantees, they can steer companies towards a more robust culture of vigilance, thereby reducing the risk of subsequent litigation. This approach is part of a global movement to make capital more accountable, increasingly valued in ESG policies and sustainable finance strategies.