Anti-corruption, subcontracting and CSR

🚫 Sapin II Law - Anti-corruption

For companies with 500+ employees and over €100M revenue:

• Supplier code of conduct
• Supplier due diligence (Know Your Supplier - KYS)
• Anti-corruption audit clause in contracts
• Supplier representations and warranties
• Right to immediate termination in case of violation

🌱 Duty of Vigilance Law, CSR & Emerging European framework

For companies with 5,000+ employees in France (or 10,000+ including worldwide subsidiaries):

• Mandatory vigilance plan
• Covers: human rights, fundamental freedoms, health/safety, environment
• Liability extended to the supply chain

🇪🇺 CSDDD (Corporate Sustainability Due Diligence Directive)

The CSDDD (adopted in 2024, then substantially scaled back by the "Omnibus I" directive published in the OJEU on 26 February 2026) extends the duty of vigilance at the European level. Post-Omnibus, it will only cover very large companies: 5,000+ employees and €1.5Bn+ worldwide revenue. Member-state transposition by 26 July 2028, application to companies from 26 July 2029. They will need to:

• Identify and prevent negative impacts on human rights and the environment, following a risk-based approach focused on direct suppliers
• Adopt a climate transition plan (the obligation to "put it into effect" in line with the Paris Agreement was removed by Omnibus)
• Put in place grievance mechanisms for stakeholders

Impact for the buyer: The supplier contract becomes a major strategic lever to require and document your suppliers' commitments. At the time of contract negotiation, the buyer has considerable leverage - this is the time to secure concrete and measurable commitments.

📊 Certifications and assessments to include in your contracts

To concretely strengthen ethical commitments, require or encourage your suppliers to obtain:

• EcoVadis: Supplier CSR rating platform (environment, social, ethics, responsible procurement). Score from 0 to 100, Bronze/Silver/Gold/Platinum medals. Integrate a minimum EcoVadis score into your selection criteria.
• ISO 14001: Environmental management system
• ISO 45001: Occupational health and safety - reduces duty of vigilance violation risks
• ISO 27001: Information security - essential for IT and cloud suppliers (complements GDPR)
• SA 8000: Social accountability - decent working conditions throughout the supply chain
• CDP (Carbon Disclosure Project): Carbon reporting - for suppliers with a large environmental footprint

🔗 Subcontracting

Law No. 75-1334 of 31 December 1975:

• Prior written consent of the buyer required
• The supplier remains fully liable for subcontracted services
• Flow-down of obligations: confidentiality, GDPR, compliance
• The subcontractor may have a right to direct payment in certain cases