The Introduction of Mandatory Corporate Sustainability Reporting in the EU and the Question of Enforcement

Abstract

Directive (EU) 2022/2464 introduces mandatory sustainability reporting for all large undertakings in the European Union, as well as third-country undertakings active in the Union. The new rules were mandated by the increase in investor needs, as well as the interest of civil society actors. The present article discusses the relationship of corporate social responsibility with law and the shift from voluntary to mandatory sustainability reporting. It first presents the main novelties of the Directive with regard to scope of application, issuance of uniform European reporting standards and introduction of mandatory external assurance. It then turns to the question of public and private enforcement of the new sustainability reporting obligations. Public enforcement is, to a certain degree, guaranteed by the amendment of existing rules. The new Directive is silent on private enforcement issues, although it may trigger private litigation, predominantly by shareholders. Other interested groups, such as consumers and civil society actors, will not be able to directly challenge breaches of the new rules, despite the intention of the legislator to foster sustainability reporting and responsible corporate behaviour to the benefit of civil societies.

1 Introduction

In its 2011 definition of corporate social responsibility, the European Commission perceived CSR as ‘a concept whereby companies integrate social and environmental concerns in their business operations and in their interaction with their stakeholders on a voluntary basis’.¹ Since then, a rapid change in context and focus has occurred. The Non-Financial Reporting Directive was passed in 2014.² Landmark international agreements on climate change have touched upon the issues of corporate behaviour and sustainability in the financial sector. The related concept of ESG (environment, sustainability, governance) has come into play, as the process of taking environmental, social and governance considerations into account when making investment decisions in the financial sector. After a long process of public consultation, Directive (EU) 2022/2464 on corporate sustainability reporting (CSRD) was adopted in December 2022, introducing mandatory sustainability reporting for a significant number of companies at the European level.³

The present article first discusses the transition from voluntary to mandatory sustainability reporting, the reasons behind the adoption of the Corporate Sustainability Reporting Directive and the main novelties of the Directive. It then focuses on the issue of enforcement of the new reporting obligations, seeking to answer the questions of what public law sanctions are available for breaches of the Directive and whether private parties with an active interest in sustainability reporting have any means of enforcement.

The paper is structured as follows: Section 2 discusses the relationship between the concept of corporate social responsibility and the law. Section 3 presents the principal provisions of the new Directive. Section 4 focuses on public enforcement by national supervising authorities. Section 5 discusses whether there is any potential of enforcement by private parties, such as the company’s shareholders, consumers and competitors, and civil society actors. The article concludes with some final remarks on the new Directive.

2 Corporate Social Responsibility and the Case for Mandatory Reporting

2.1 The Contested Relationship Between Corporate Social Responsibility and the Law

Although corporate social responsibility (CSR) has been a well-developed concept in business studies since the 1950s, its relationship with the law is highly contested. In the past decades, CSR was clearly depicted as a corporate duty ‘beyond the law’, a process of self-regulation⁴ or even a substitute of regulation of business conduct.⁵

CSR is not a clearly defined concept; its scope has gradually evolved and expanded, becoming almost a synonym to the notion of ‘sustainability’.⁶ In legal literature, CSR is described as a mixture of hard law and soft law requirements.⁷ More specifically, a company embracing CSR is thought to be following all relevant legally binding instruments, such as legislation on environmental protection, human rights and anti-bribery, but at the same time it goes beyond binding rules and adheres to non-binding international standards and self-elaborated or collective codes of conduct. ‘Soft law’ sources of corporate social responsibility are typically recommendations of international organisations for multinational enterprises,⁸ the most prominent of which being the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises.⁹

From a company law perspective, CSR is seen as an obligation of companies to integrate sustainability concerns in their management decisions. In this respect, the need to reconsider the company purpose beyond the profit of shareholders is often highlighted in literature;¹⁰ several national company law provisions on corporate governance already point to this direction.¹¹

Interestingly, many legal scholars have pointed to the futility of thinking CSR as a voluntary practice¹² and argue that it is legally enforceable, exploring its relation to existing legal frameworks on liability¹³ as well as the effect that indirect state pressure and market forces have on its enforcement.¹⁴ However, as others argue, creating liability out of soft law frameworks raises significant doubts as regards constitutional law.¹⁵ Furthermore, it should not be disregarded that EU law and international public law do not introduce a general liability regime for human rights violations by companies.¹⁶

2.2 The Effects of Rendering CSR Reporting Mandatory

In the above-mentioned context, the result of regulating corporate social responsibility disclosures is equally debated. It is argued that mandatory reporting may trigger a positive change in corporate behaviour¹⁷ and also that lax regulation is ineffective in disciplining businesses.¹⁸ Despite the growing amount of literature on CSR reporting, stakeholders are still questioning the reliability and authenticity of sustainability disclosures, whether mandatory or voluntary.¹⁹ From a private law perspective, it is asserted that changes in law may improve self-regulation, but only if an analogous corporate culture is present.²⁰

Empirical studies provide valuable insights on the effect of introducing mandatory sustainability reporting. For example, Jackson et al. argue that mandatory disclosures lead to more firms engaging in CSR, but also to a reduction in variance: more reporting does not minimise corporate irresponsibility.²¹ On the contrary, in a widely recognised study, Ioannou and Serafeim find that the introduction of reporting regulations in various countries led to firms increasing their voluntary commitment to standards and external assurance.²² Discussing the impact of the Non-Financial Reporting Directive in the EU, Cuomo et al. argue that it has led to an increase in CSR transparency and performance.²³ Similarly, Fiechter et al. assert that the European Directive has triggered reliable reporting and enhanced CSR performance.²⁴ Finally, although various studies have examined the effect of sustainability reporting on the company’s performance and reputation, little is known about the relation between sustainability reporting and risk governance, i.e., the process of identifying and handling non-financial risks for the company.²⁵

The European legislator has opted for the introduction of mandatory sustainability reporting for specific undertakings, for reasons that will be explained in the next sections.

3 The Preceding Non-Financial Reporting Directive and Its Limitations

Directive 2014/95/EU on disclosure of non-financial and diversity information (NFRD)²⁶ introduced mandatory disclosure of non-financial information for large undertakings and groups of more than 500 employees. According to the Directive, companies had to provide a briefing on non-financial matters, which included ‘environmental, social and employee matters, respect for human rights, anti-corruption and bribery’.²⁷ The information had to be disclosed in a statement included in the management report or in a separate document. The exact content and format of the information was not defined in the Directive; in fact, companies were free to follow any national or international framework.²⁸ The Directive adopted a ‘comply or explain’ principle, meaning that the undertaking could refrain from disclosing CSR information if it provided an explanation for doing so. External assurance was not mandatory, a fact that constituted an obvious limitation of the Directive.²⁹

The Directive was accompanied by European Commission Guidelines on reporting methodology and key performance indicators. The Guidelines were issued in 2017,³⁰ with a separate set of Guidelines specifically focused on environmental information issued in 2019.³¹ The latter introduced, for the first time, the concept of ‘double materiality’, in order to clarify what information companies should report: the decision on what to report should be made under an ‘outside-in’ perspective, which means after evaluation of how environmental and human rights issues affect the company, as well as under the established ‘inside-out’ perspective of assessing the impacts of the company on people and the environment.³²

No particular reference to enforcement measures or sanctions for non-compliance was made in the NFRD. Nonetheless, some Member States have introduced specialised fines, while others apply their national provisions on breach of financial reporting obligations.³³

It is common ground that the effect of the NFRD on the improvement of CSR reporting and the overall sustainability performance of companies has been limited. The Directive did not include detailed rules on the content and the format of the reports, apart from the general reference to non-financial matters, nor did it introduce compulsory metrics and standards, a fact that undermined its efficiency. Information did not seem to reach all interested parties, such as local communities and consumers, in contrast to the intention of the legislator.³⁴ The adoption of the ‘comply and explain’ regime provided room for generic statements with little value as well as a disincentive for stakeholder engagement.³⁵ The absence of enforcement tools and external assurance, as well as the lack of reliability and credibility of information did not allow reporting obligations to affect the tendency of shareholders to conduct ‘business as usual’ and maximise their profits.³⁶ The flexibility of the Directive, although mirroring the concurrent fluid state of sustainability reporting, appeared to be its most significant shortcoming.³⁷

The Guidelines of the European Commission have not been very successful in introducing a uniform reporting framework; a 2021 report by the European Financial Reporting Advisory Group (EFRAG) indicated that only 5% of European companies followed them.³⁸ Empirical evidence also suggests that, although EU undertakings in general comply with their legal obligations, there are dramatic differences in the way that these obligations materialise.³⁹ On the other hand, it has been argued that, although no single legal document could be expected to make companies accountable for their social and environmental impact, increased disclosure obligations may strengthen market forces and civil societies in further disciplining corporate behaviour.⁴⁰

Reports prepared for European institutions also reached the conclusion that the NFRD had not accomplished its targets. A study for the European Commission in 2020 found that changes in companies’ perceptions of CSR were not driven by their legal obligations, but by the pressures of business partners and changing societal preferences.⁴¹ Another study, for the European Parliament, concluded that the NFRD had not been transposed in a uniform manner across the EU, disrupting the level playing field for European companies and enabling a number of Member States to introduce more stringent legislation on corporate social responsibility and due diligence obligations.⁴²

4 The Corporate Sustainability Reporting Directive

4.1 Context of the New Directive

The review of the NFRD in order to meet the needs of investors for sustainability information on investment products was explicitly included in the European Green Deal.⁴³ The new Directive aims to ensure that there is adequate, publicly available information on the impact of companies on people and the environment and to ultimately help reduce systemic risks to the economy. Non-financial reporting has become ‘corporate sustainability’ reporting in order to adhere to recent trends and also to reflect the fact that sustainability reporting actually has concrete financial implications.⁴⁴

The Commission acknowledges that under the previous legal framework, the needs of the main recipients of sustainability information were not met, as companies were free to use any existing reporting framework or not to use a framework at all.⁴⁵ The consultation that preceded the Proposal for the new Directive showed a wide consensus (over 80%) among stakeholders towards mandatory sustainability reporting standards. In line with the previous NFRD, the new rules are incorporated in Directive 2013/34/EU (Accounting Directive),⁴⁶ which regulates annual financial statements and consolidated financial statements at the European level.

Apart from the general increase in information needs, the main driver of enhanced reporting is the new legislative framework on sustainable finance, namely Regulation 2019/2088 on sustainability-related disclosures in the financial services sector (Sustainable Finance Disclosures Regulation – SFDR)⁴⁷ and Regulation 2020/852 on a framework for sustainable investment (Taxonomy Regulation).⁴⁸ The SFDR introduces obligations for financial advisers to incorporate sustainability considerations in their products and has the potential to establish the EU as the global standard setter in financial reporting. Nonetheless, three years after its implementation, the phenomenon of ‘greenwashing’ is more than apparent in financial markets.⁴⁹ In this respect, the CSRD is critical to the provision of credible and transparent information.

4.2 Scope of Application, Recipients of Information and Time Frames

The new Directive has a substantially extended scope of application compared to the NFRD, since it applies to all large undertakings,⁵⁰ regardless of whether they are listed in regulated markets, as well as to all companies listed in regulated markets, except for micro-enterprises.⁵¹ Credit institutions and insurance undertakings above a certain size are also captured. Subsidiary undertakings may be exempt from reporting obligations, as long as their parent company provides all required sustainability information regarding the subsidiary in its own report and the subsidiary includes a limited amount of information in its report.⁵² The Directive also applies to third-country undertakings with a subsidiary or branch in the EU that generates a net turnover of more than EUR 150 million in the EU.⁵³ It is expected that the new rules will capture approximately 49,000 undertakings, compared to the 11,600 undertakings that are now subject to the NFRD.⁵⁴

Undertakings that are already subject to the NFRD are expected to publish their first reports under the new regime starting from financial year 2024. Other categories of undertakings will have to comply as of the financial year 2025. Small and medium enterprises that are public interest entities will apply the rules starting from the financial year 2026; separate standards will be developed for SMEs, while they are also granted an opt-out option until 2028.⁵⁵ Although it is reasonable that the new rules will place a considerable administrative and financial burden on SMEs, the eventual inclusion of listed SMEs in the reporting regime is laudable, as they will often be part of a larger enterprise’s supply chain. The absolute exception of micro-enterprises is not surprising, although it may negatively affect their access to financing.⁵⁶

The Directive identifies two key categories of recipients of sustainability information: first, investors, including asset managers, and second, ‘civil society actors, including non-governmental organisations and social partners, which wish to better hold undertakings to account for their impacts on people and the environment’. According to the Directive, ‘other stakeholders’ might also use the information, such as business partners, including customers, policy makers, individual citizens and consumers.⁵⁷ A departure from the approach of the NFRD is obvious at this point: the need to enhance consumer trust and ‘provide consumers with easy access to information on the impact of business on society’⁵⁸ is no longer an aim of the Directive, indicating the shift towards the needs of investors and financial markets participants.

4.3 Sustainability Matters and Reporting Standards

Undertakings should report ‘information necessary to understand the undertaking’s impacts on sustainability matters’ as well as ‘information necessary to understand how sustainability matters affect the undertaking’s development, performance and position’.⁵⁹ The double materiality principle is therefore adopted as a binding legal rule.

According to the Directive, ‘sustainability matters’ include ‘environmental, social and human rights, and governance factors’.⁶⁰ The Directive also refers to the notion of ‘sustainability factors’ as defined in Article 2, point 24 of the SFDR. The only notable addition to the SFDR is the inclusion of governance factors in the matters that have to be reported.⁶¹

The general description of the information is included in Article 19a(2): companies will have to provide an overview of their business model and strategy, including a description of: the resilience of their business model to sustainability risks; their plans to align with the targets of limiting global warming to 1.5°C⁶² and climate neutrality by 2050;⁶³ how they take account of their stakeholders and their impacts on sustainability matters; and how they have implemented their sustainability strategy. Moreover, they should report on their time-bound sustainability targets, the role of its administrative bodies, their policies, their due diligence processes and their principal risks. Undertakings should also describe the process they used to identify what information to disclose. Information should cover not only the company’s own operation but also its value chain.⁶⁴

Uniformity and clarity of disclosures is guaranteed by the introduction of the new uniform European Sustainability Reporting Standards (ESRS). The standards are being developed with the technical advice of EFRAG⁶⁵ and are adopted by the European Commission with delegated acts. Standards should take account of internationally accepted soft law documents on corporate responsibility, such as the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises.⁶⁶ The first delegated regulation with the European Sustainability Reporting Standards was adopted by the Commission in July 2023.⁶⁷

Article 29b CSRD provides further guidance on the nature of the information to be reported for each matter, setting the framework for the standards. For example, information on environmental factors will include information about climate change mitigation and adaptation, water and marine resources, resource use and circular economy, pollution, biodiversity and ecosystems. In any case, the standards shall ensure that reported information is ‘understandable, relevant, representative, verifiable, comparable’ and ‘represented in a faithful manner’. In addition, information should be forward-looking, retrospective, qualitative and quantitative.

To date, several public and private organisations have published standards for sustainability reporting. The standards of the Global Reporting Initiative (GRI) are the most widely acclaimed.⁶⁸ The 2017 recommendations of the Task Force on Climate-related Financial Disclosures (TCFD) of the Financial Stability Board (FSB) form another framework that is being increasingly incorporated into companies’ reports.⁶⁹ A widely used framework were the standards of the Sustainability Accounting Standards Board (SASB). The SASB standards are now under the oversight of the International Sustainability Standards Board (ISSB), a body established in 2021 by the International Financial Reporting Standards Foundation (IFRS). The ISSB is developing new global general and climate-related standards (ISSB standards), scheduled to be effective as of January 2024.

The ISSB standards are currently at the centre of global attention as they are capable of introducing a uniform international reporting framework. For example, the Basel Committee for Banking Supervision supports the ISSB initiative and recently announced that it will develop a new climate-related disclosure framework, interoperable with the ISSB standards.⁷⁰ The International Organization of Securities Commissions (IOSCO) also supports the ISSB standards and has taken on a leading role in ensuring global consistency in the assurance of sustainability disclosures.⁷¹

The CSRD states that EU standards shall ‘take account’ of the above-mentioned frameworks, including the ISSB standards, to the extent that they are ‘consistent with the Union’s legal framework and the objectives of the Green Deal’.⁷² Given the detailed mandate given to EFRAG regarding the content of the standards and the explicit commitment to the Union’s climate objectives, there is a foreseeable risk that significant differences will exist between the EU and ISSB standards, a fact that will place a considerable burden on European companies and multinational corporations to simultaneously comply with two distinct sets of sustainability reporting standards.

The detailed description of sustainability information in the CSRD is a major step towards ensuring that sustainability reports are clear and comparable. It should be noted, though, that, taking into account the published drafts, the new standards will be extremely complex, and understanding them will require a high degree of technical expertise on behalf of reporting companies as well as recipients of information.

4.4 Publication and External Assurance

In contrast to the lax provisions of the NFRD regarding publication, the newly adopted CSRD stipulates that corporate sustainability disclosures must be published through a dedicated section of the management report, which is part of the annual financial statements regulated by the Accounting Directive. Sustainability reports should be issued in a single electronic reporting format and published no later than 12 months after the balance sheet date.⁷³ According to Article 30, para. 1, Member states have the discretion to require that the management report be publicly available on the company’s website. The inclusion of the sustainability report in the management report will solve the current problem of fragmented publication.⁷⁴ However, a general requirement that the sustainability report be published free of charge on the company’s website would better ensure accessibility for all interested parties.⁷⁵

The CSRD introduces a ‘limited assurance’ requirement for sustainability reporting, which may be provided by a statutory auditor or another accredited sustainability assurance provider.⁷⁶ This means that an external auditor will have to provide an opinion with regard to the compliance of the report with the Directive and the reporting standards, as well as the reporting requirements of the SFDR.⁷⁷ The requirement will escalate to ‘reasonable assurance’ after 2028⁷⁸ in order to ensure uniformity between financial and sustainability statements. The opinion of the assurance services provider has to be published along with the report. Provisions on the duties and qualifications of statutory auditors have been amended to ensure that auditors on sustainability matters have received specialised training and perform their duties in an independent and professional way.⁷⁹

External assurance is a major step towards credibility and comparability of CSR reports. Nonetheless, it is argued that submission of CSR reports to statutory auditors may deprive them of their nature as a means of interaction between the company and its stakeholders and result in a ‘tick-the-box’ approach.⁸⁰

5 Enforcement Issues in the CSR Directive

5.1 Public Enforcement

The question of public law sanctions for incorrect and incomplete CSR reporting is a vital one, as enforcement will contribute to the effectiveness of the new rules. The CSRD legislative proposal included an amendment to Article 51 of the Accounting Directive, according to which Member States would be obliged to introduce effective, proportionate and dissuasive penalties, including specific measures for cases of non-compliance, such as a public statement on the person responsible for the disclosures and a cease-and-desist order.⁸¹

Surprisingly, the above-mentioned provision is absent from the final text of the Directive; the CSRD makes no particular reference to public enforcement issues and sanctions. As a result, the options of enforcement for breaches of sustainability reporting obligations will have to be sought in the general provisions concerning annual financial statements and periodic disclosure obligations.

The Accounting Directive regulates annual financial statements for limited liability companies. In its current form, Article 51 provides for the introduction of penalties applicable in the case of infringements of the national provisions implementing the Directive, which are effective, proportionate and dissuasive. In the absence of concrete provisions in the CSRD and given that sustainability reporting is incorporated into financial reporting, national provisions on infringements of financial reporting under the Accounting Directive will also apply to sustainability reporting.

However, the requirements of the Accounting Directive with regard to national enforcement mechanisms are very generic, leaving room for insufficient and divergent implementation among Member States. It should be noted in this respect that, as far as the implementation of the NFRD was concerned, evidence suggests that, although penalties for non-compliance were in place in 25 out of 28 Member States, national policies varied significantly, as a number of Member States chose to introduce specific administrative fines while others incorporated the provisions on non-financial reporting into their company law.⁸² More detailed provisions on sanctions for breaches of the Accounting Directive would therefore better ensure the consistent application of the CSRD.

The Transparency Directive applies to undertakings whose securities are admitted to regulated markets, introducing enhanced disclosure obligations. It includes detailed provisions on competent national authorities and administrative sanctions, especially in the case of failure of publication, and also ensures that natural persons may be held liable for breaches of disclosure obligations. The rules of the Transparency Directive introduce a sufficiently harmonised regime in the area of administrative sanctions for breaches of periodic disclosure obligations.⁸³

The CSRD amends the Transparency Directive in order to ensure that the requirement for transparency and the respective enforcement mechanism will also apply to sustainability reporting.⁸⁴ So far, enforcement by public authorities in the field of sustainability reporting has been problematic due to the lack of an explicit reference to sustainability reporting in the Transparency Directive.⁸⁵

The public enforcement mechanism of the Transparency Directive will therefore serve as the enforcement option for sustainability reporting obligations. Notwithstanding, it appears that recourse to the Transparency Directive creates a paradox: companies within the scope of the Transparency Directive may be subject to different types of sanctions in relation to companies which are outside the scope of the Transparency Directive but are, however, obliged to perform sustainability reporting according to the CSRD. Apart from the difference in treatment that may arise, one may wonder how the aim of effective sustainability reporting will be achieved to the benefit of civil society actors.

5.2 The Potential of Private Enforcement

5.2.1 Shareholders’ Enforcement

The issue of whether inaccurate or incomplete sustainability reporting can be challenged by private parties and may create civil liability for the company or its management board is one of particular relevance. A number of stakeholders may have an interest in pursuing civil liability claims for incorrect disclosures, such as shareholders, customers and business partners as well as civil society actors, such as NGOs with an interest in environmental and human rights matters. It appears that the issue of civil liability has not troubled national courts in Europe, a fact that may attributed to the lack of binding provisions in the NFRD.⁸⁶

In the absence of concrete provisions in the CSRD, shareholders will most probably resort to company law for rules on liability for incorrect or misleading reporting. The Transparency Directive includes a provision according to which the responsibility for the reported information ‘lies at least with the issuer or its administrative, management or supervisory bodies’.⁸⁷ The CSRD stipulates that the new standards should require that the information to be reported is ‘understandable, relevant, representative, verifiable, comparable, and is represented in a faithful manner’ and also that the directors’ statement on the truthfulness and fairness of financial reporting equally captures sustainability reporting.

National company law provisions on directors’ duties and civil liability for incorrect reporting differ significantly among Member States.⁸⁸ In Germany, for example, the rules on directors’ duties may undoubtedly be used as a ground for civil liability claims in case of false or incorrect sustainability reporting.⁸⁹ In addition, CSR frameworks may affect the interpretation of the director’s ‘duty of care’.⁹⁰ However, it is also argued that the result of such an action is highly uncertain, as the provisions require proof of damage and causation between the actions and damage, two conditions which will be extremely difficult to fulfil before courts.⁹¹ The binding effect of statements pertaining to future actions and targets is equally doubted in German law.⁹² On the other hand, two cases in which courts invalidated the shareholder approval of directors’ actions on grounds of a false or misleading governance statement are mentioned as an example of available sanctions for shareholders in case of incorrect reporting.⁹³

In France, the Vigilance Law of 2017 introduces substantive due diligence obligations, in addition to already existing national reporting obligations, and provides that any person with an interest can require the company to provide a vigilance plan and also sue for damages based on tort provisions.⁹⁴ Furthermore, in light of the PACTE law of 2019 that introduced a further duty for managers to take into consideration social and environmental issues related to the company’s activity, a liability claim for incorrect and incomplete reporting should be considered highly probable under French law,⁹⁵ although it appears that no such action has been brought to date. It should be noted though that, as would be the case in other jurisdictions, recourse to general tort law provisions barely constitutes a sufficient means of private enforcement of CSR reporting obligations on behalf of shareholders, as tort liability normally requires actual damage, proof of causation between the conduct and damage, and, in some cases, separate proof of fault.

On the other hand, a considerable amount of case law on civil liability for false or misleading reporting may already be found in the US, where shareholders have based their actions on securities law.⁹⁶ US courts appear more eager to consider cases in which the company’s statements are concrete and measurable, but, still, instances of successful litigation are rare.⁹⁷ The proof that the omitted or false sustainability information was material to shareholders and their reliance on that information is the most significant obstacle to this type of actions under US law.⁹⁸

It is often argued that corporate law in general is short-term oriented and more changes are needed to integrate sustainability.⁹⁹ The revised Shareholders’ Rights Directive does not seem to add much to the promotion of sustainability either.¹⁰⁰ Nonetheless, reforms in national company laws and theories such as the ‘Enlightened Shareholder Value’ provide for a duty of directors to reflect on sustainability matters beyond their purely financial benefits.¹⁰¹ The newly adopted requirements that CSR reports be faithful, relevant and correspond to specific standards are able to enhance the above-mentioned new approach to corporate management and facilitate shareholder enforcement under national company law provisions. Shareholders will still have to prove the damage sustained, but an additional legal basis may be national provisions on non-pecuniary or moral damages, as incorrect reporting would cause damage to the company’s reputation.

5.2.2 Consumers and Competitors

Consumers have an increasing concern for credible CSR reporting by companies and may have an active interest in enforcing it. Private enforcement by consumers would most probably take the form of judicial action to cease deceptive reporting or civil liability claims. The most prominent example of successful litigation against CSR-related claims made to consumers may again be found in the US: in Kasky v. Nike, Nike was found to publish false and misleading statements regarding the labour conditions in its factories.¹⁰²

In European law, the main legal instrument regulating misleading corporate communications to consumers is the Unfair Commercial Practices Directive (UCPD). The role of the UCPD in the enforcement of CSR-related claims has been discussed in literature, particularly after the emergence of the VW emissions scandal in 2016.¹⁰³ The UCPD may be used by competitors in a similar vein to challenge false and misleading CSR reports as an unfair commercial practice,¹⁰⁴ since the Directive provides Member States with the option to include competitors in the groups of persons that may seek enforcement of its substantive provisions.¹⁰⁵

The scope of the UCPD is very broad, as it applies to ‘any act, omission, course of conduct or representation ... by a trader, directly connected with the promotion, sale or supply of a product to consumers’. Consequently, in principle, CSR reports or related claims that are publicly communicated may be assessed under the UCPD.¹⁰⁶

However, according to the Preamble of the UCPD, the Directive does not cover ‘commercial practices carried out primarily for other purposes, including for example commercial communication aimed at investors, such as annual reports and corporate promotional literature’.¹⁰⁷ Application becomes possible only when the reports or the information contained in the reports is communicated to consumers, and becomes connected with the promotion or sale of a product; in other words, only when an undertaking ‘actively brings forward CSR in order to create a favourable image’.¹⁰⁸

According to the CSRD, sustainability disclosures will be included in the management report; therefore, in principle, sustainability reports will be excluded from the scope of application of the UCPD and consumers will only be able to challenge them if the company uses the information in its public communications, such as in advertising. In any case, as already mentioned, the Directive does not consider consumers to be among the main recipients of CSR information.¹⁰⁹

The case where the management reports are published on the company’s website entails some difficulties. As already mentioned, Member States retain the option to require publication of the management report (and related sustainability disclosures) online, free of charge.¹¹⁰ It appears that such a case would in principle fall within the scope of the UCPD. However, taking into consideration the principal aims of the CSRD, it would be more consistent to exclude sustainability reports from the UCPD entirely, even when they are published on the company’s website.

If the hurdle of material scope is surmounted, the UCPD may be used to challenge false and misleading claims and omissions of information.¹¹¹ In the case of CSR-related claims, the claim will most probably take the form of a statement concerning the product or the trader, such as ‘environmentally friendly’, ‘carbon neutral’ or ‘sustainable’. The European Commission is aware of ‘greenwashing’ practices in consumer transactions and defines it as ‘the practice of suggesting or otherwise creating the impression … that a good or a service has a positive or no impact on the environment or is less damaging to the environment than competing goods or services’, when such a claim is not true or cannot be verified.¹¹² Nonetheless, no common definitions of sustainable products and activities exist, a fact that allows traders to use related terms at will¹¹³ and significantly impedes the effectiveness of the Directive for the protection of consumers.

A proposed amendment of the UCPD is set to ban the use of generic environmental claims regarding products and services, unless their excellent environmental performance can be demonstrated by recognised certification schemes.¹¹⁴ This proposal appears to have little relevance to sustainability reporting, as the introduction of specific metrics and standards in CSR disclosures will allow companies to evade the use of general terms.

5.2.3 Non-governmental Organisations and Social Partners

The literature on the role of civil society actors in the private enforcement of CSR reporting is very limited, as the discussion focuses on enforcement issues of environmental and human rights violations and more rarely on liability for misleading public communication. There is an increasing amount of literature on the possibilities of holding multinational enterprises accountable for their environmental and human rights impact.¹¹⁵ Interestingly, a few cases of judicial action against corporate disclosures on climate change have already been brought before supervising authorities and courts in the UK and Australia.¹¹⁶

In principle, the UCPD might serve as a legal basis for NGOs’ action against misleading sustainability reporting. In a recent case in France, the NGOs Sherpa and ActionAid challenged the ethical commitments of Samsung with regard to the working conditions in its factories, claiming that they amounted to deceptive commercial practices. However, the French Supreme Court (Cour de Cassation) dismissed their action due to lack of locus standi.¹¹⁷ It should be noted that the UCPD leaves two crucial matters of enforcement to be decided by national law: the persons with a legitimate interest to pursue a claim and the question of whether action may be taken without the occurrence of actual damage.¹¹⁸ Thus, in the absence of concrete national law provisions on legitimate interest, a national court dealing with a similar claim based on the UCPD will most probably take the same stance as the Cour de Cassation.

Nor does the use of general national law provisions on tort seem to be a suitable legal basis for NGOs’ action against false or incorrect sustainability reporting, since, as already mentioned above in Section 5.2.1, tort liability normally requires actual damage, proof of causation between the conduct and damage, as well as, in some cases, separate proof of fault. The fact that the burden of proof lies with the claimant has proven to be an insurmountable obstacle for NGOs in pursuing climate change and human rights-related claims against companies.¹¹⁹

The question of whether employees may count on CSR reports and codes of conduct to impose obligations on undertakings remains unanswered as well. It is argued that, most probably, employees, as third parties, will not be able to claim that CSR commitments are capable of transferring certain rights to them. This was exemplified in Doe v. Wal-mart, in which a US court did not accept that the company’s commitments to use responsible suppliers were capable of creating rights for the employees of the company’s suppliers in third countries.¹²⁰

In view of the above, the lack of civil liability provisions in the CSRD seriously hampers any action against false or incorrect sustainability reporting by social partners, despite the will of the legislator to satisfy the needs of ‘civil society actors … which wish to better hold undertakings to account for their impacts on people and the environment’.¹²¹ As in the case of sustainability disclosures for financial products, traditional private law mechanisms do not guarantee adequate private enforcement.¹²²

A solution may be the introduction of a consumer-type ‘class action’ in favour of NGOs or other social partners. However, apart from a ‘cease and desist’ order that could be rather easily introduced, the outcome of such an action would be limited, as it would be impossible to define the affected persons and the amount of damage sustained. Therefore, the introduction of an effective private enforcement mechanism for incorrect reporting on behalf of civil society actors poses a serious challenge to current private law perceptions.¹²³

Instead, the enhancement of public enforcement mechanisms could have served as a valuable substitute at this stage, with the introduction of clear rights for civil society actors to access sustainability reports, report misleading or false information and participate in administrative proceedings against companies. This opportunity has been missed in the CSRD, since, as explained in Section 5.1, it barely establishes an effective public enforcement mechanism.

5.3 The Interplay with the Proposed Directive on Corporate Sustainability Due Diligence

The concept of due diligence as the process of identifying, preventing, mitigating and terminating actual and potential impacts of an undertaking’s operation on human rights and the environment is closely related to corporate sustainability reporting. A proposal for a Directive on Corporate Sustainability Due Diligence (CSDD) was released in February 2022.¹²⁴ The aim of the Directive is to ensure that companies implement due diligence considerations and processes in their own operations, as well as at the level of their business relationships in their value chain. The scope of the CSDD is considerably narrower than that of the CSRD, since it will only affect enterprises of more than 500 employees and with a net worldwide turnover of over EUR 150 million.

Corporate reports on due diligence shall be published according to the requirements of the CSRD, as the CSRD already makes reference to due diligence in the issues to be reported.¹²⁵ The proposed CSDD includes detailed provisions on public enforcement, including the requirement to designate national supervising authorities and the obligation to introduce effective, proportionate and dissuasive sanctions.¹²⁶

The CSDD introduces new substantive obligations ˗ i.e., obligations to act ˗ for a proportion of companies that are also subject to the CSRD. In fact, it does not include rules on reporting in its binding provisions.¹²⁷ Consequently, suppose that a company has fulfilled its substantial due diligence obligations, but fails to report on them or includes false information in its report, the supervising authority will not be able to impose administrative sanctions based on the CSDD and the only solution will be recourse to the public enforcement provisions of the CSRD, as explained in Section 5.1.

The proposed Due Diligence Directive also includes a dedicated civil liability rule: according to Article 22, if the company fails to comply with its obligations to prevent and bring to an end actual and potential adverse impacts of its activities and, as a result of this failure, an adverse impact has occurred and has led to damage, the company should be liable for that damage. Despite leaving many issues to be decided by national law, a fact that severely undermines its effectiveness,¹²⁸ the liability rule establishes the possibility of private enforcement for infringement of due diligence obligations.

Nonetheless, the liability rule, similarly to the public enforcement rule, adds nothing to the potential of private enforcement of sustainability reporting per se; according to the CSDD, the company shall be liable for damages only if it failed to prevent and terminate the adverse impacts of its activity and damage actually occurred.¹²⁹ If the company unsuccessfully reported on its processes, included false data in its reports or even failed to identify the risks, the conditions of the CSDD will not be fulfilled.¹³⁰ Therefore, stakeholders or other affected parties will not be able to rely on the Due Diligence Directive for civil liability or other claims stemming from the breach of reporting obligations.

6 Conclusion

Directive 2022/2464 on Corporate Sustainability Reporting is expected to change the landscape of corporate sustainability reporting and affect a significant number of European companies. The new regime was mandated by the developments in EU environmental policy, the increasing needs of investors and the failures of the previous Non-Financial Reporting Directive.

The present article discusses the main provisions and the novelties of the Directive. The new Directive introduces for the first time mandatory sustainability reporting for all large undertakings in the EU as well as third-country undertakings active in the EU. Uniform rules on publication and mandatory external assurance will enhance the comparability and credibility of sustainability reports. The establishment of European reporting standards may also be expected to bring more transparency in the reports. In this respect, the Directive is a far-reaching instrument that is capable of solving most of the problems that are currently encountered in sustainability reporting. Nonetheless, other global reporting initiatives are being developed in parallel, a fact that may lay a considerable burden on European companies to comply with more than one set of sustainability reporting standards.

On the issue of enforcement, the Directive is almost entirely silent. With regard to public enforcement, it amends existing rules on financial disclosures in order to capture cases of insufficient sustainability reporting. However, public law sanctions for incorrect financial reporting are predominantly a matter of national law. The lack of concrete rules for breaches of sustainability reporting entails the risk of insufficient and divergent implementation among Member States. Given the market pressures for more sustainable activities, companies may be more eager to inaccurately report on their performance when a strict public enforcement mechanism is not in place.

As demonstrated in this study, the potential of private enforcement is substantially limited. The explicit reference of the Directive to fairness and transparency and the introduction of metrics and standards will facilitate proof of inadequate or false sustainability reporting. Therefore, the new rules leave considerable room for shareholder enforcement, which, however, will have to be based on national law provisions on civil liability and directors’ duties. Consumers will not be able to rely on the Unfair Commercial Practices Directive for enforcement, since sustainability reports are primarily aimed at investors and not directly associated with the promotion of products. Similarly, other social partners, such as non-governmental organisations and employees, do not have access to an effective civil liability regime that would guarantee their active involvement in sustainability reporting.

The Directive recognises civil society actors as one of the two main groups for which sustainability information is disclosed. This is consistent with current trends, as various stakeholders are becoming increasingly interested in sustainability reporting and the possibilities of private litigation. Nonetheless, it appears that the Directive is focused on the needs of investors and financial participants, for which the clarity and comparability of information will certainly be beneficial. As CSR literature mandates, one of the key elements of corporate social responsibility is stakeholder engagement. In this respect, although the shift to sustainability in corporate behaviour is evident in the Directive, there is still a need for more stakeholder engagement throughout the CSR reporting process.