What is the corporate duty of vigilance?

Origin and legal framework of the duty of vigilance

The duty of vigilance stems from France's law of March 27, 2017, the first in the world to impose a legal obligation on certain companies to prevent serious harm to human rights and the environment. This law inspired European frameworks (the Corporate Sustainability Due Diligence Directive) and international ones (UN Guiding Principles, Global Compact).

It follows the same logic as CSR and ESG criteria: embedding the management of social and environmental risks into corporate governance. The goal is to turn non-financial vigilance into a legal requirement, with documented and verifiable obligations.

Which companies are concerned and what is the scope

The law primarily targets large French companies:

• More than 5,000 employees in France, or
• More than 10,000 employees worldwide (subsidiaries included).

Its reach goes well beyond that circle. SMEs that act as subcontractors or suppliers to these groups are directly affected, since they must document their practices to meet their buyers' requirements.

The duty of vigilance therefore spreads across the entire value chain through a cascading effect, raising ESG compliance expectations even for players not directly subject to the law.

The building blocks of a vigilance plan

The vigilance plan brings together all the measures a company deploys to identify, prevent, mitigate and monitor the risks tied to its own activities and those of its partners. At a minimum, it must include:

1. Risk mapping: analysis of serious risks to human rights, health and the environment across all activities and supply chains.
2. Assessment procedures: regular evaluation of subsidiaries, subcontractors and suppliers.
3. Prevention and mitigation actions: corrective plans, training, contractual clauses and audits.
4. Alert and reporting mechanisms: channels accessible to any internal or external stakeholder.
5. Monitoring and reporting: annual review of the measures' effectiveness, with results included in the management report.

Building and implementing the vigilance plan

The vigilance process follows a continuous-improvement logic close to an ESG or ISO management system (Plan-Do-Check-Act).

1. Initial diagnosis: identify priority risk areas through risk mapping and a materiality analysis.
2. Formalization: draft a documented vigilance plan, approved by governance and shared with stakeholders.
3. Operational rollout: embed the requirements into business processes (procurement, HR, production).
4. Evidence collection and control: regularly audit suppliers and subsidiaries, and track key indicators (audit rates, reported incidents).
5. Reporting: publish and revise the plan at regular intervals based on feedback and observed results.

For partner SMEs, these obligations can be translated into simplified compliance policies: codes of conduct, vigilance training or specific contractual clauses.

Sanctions and liability for non-compliance

Failing to establish or apply a vigilance plan can lead to:

• A formal notice from any legitimate stakeholder (NGOs, unions, victims, etc.);
• Civil litigation before French civil courts;
• Damages where harm is proven to be linked to a lack of vigilance.

Beyond the financial risk, inaction or a plan deemed insufficient can seriously damage a company's reputation and ESG credibility.

Challenges and best practices for an effective duty of vigilance

Implementing a credible duty of vigilance means going beyond minimal compliance. The most advanced companies rely on management tools drawn from ESG frameworks:

• CSR assessments to validate the robustness of policies and indicators.
• Double materiality to prioritize the most critical issues.
• Supplier codes of conduct and training to spread a risk-aware culture.
• Digital ESG management tools to centralize data and automate compliance evidence.

The corporate duty of vigilance: key takeaways