Supply Chain Due Diligence: How to Build a Compliant Programme
What does supply chain due diligence require under European and French law?
Supply chain due diligence is the structured process through which a company identifies, prevents, and mitigates human rights, environmental, and governance risks across its entire value chain. Two legal frameworks now make this a binding obligation for large companies in Europe: the French Duty of Vigilance Law (Law no. 2017-399 of 27 March 2017) and the EU Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760, CSDDD). Both require a written plan, published annually, covering risk mapping, preventive and corrective measures, an alert mechanism, and a monitoring system.
This article covers how to structure each component of the vigilance plan, how to organise third-party assessment across a large supplier base, and what annual reporting must contain. It is addressed to sustainability officers, procurement directors, legal counsels, and the executive officers who sign off on the published plan. It complements the vendor risk management programme (TPRM) that structures supplier assessment and conflict-of-interest declarations involving suppliers.
Vigilance plan: mapping and measures
The vigilance plan is the central document of the duty-of-care framework. Under the French Vigilance Law, it must contain a risk map identifying and prioritising risks to human rights, fundamental freedoms, health, safety, and the environment, covering direct activities, controlled subsidiaries, and the activities of subcontractors and suppliers with whom the company maintains an established commercial relationship.
The plan must also specify the measures adopted to prevent and mitigate identified risks. These measures range from supplier codes of conduct and contractual clauses, through training programmes for procurement staff, to on-site audits and third-party assessments. The EU CSDDD adds obligations related to the value chain and requires companies to give priority to addressing the most severe and widespread actual and potential adverse impacts first. All measures must be proportionate to the severity and probability of the risk identified in the mapping exercise.
Third-party assessment: criteria and frequency
Assessing suppliers against the vigilance plan requires a tiered approach calibrated to inherent risk. Suppliers are not all equal: a strategic supplier in a high-risk geography for forced labour requires a different level of scrutiny than a domestic office-supplies provider. The assessment criteria typically cover the supplier's own due-diligence practices, their environmental and social performance, any sanctions or adverse media findings, and the nature of the goods or services provided.
Frequency depends on the risk profile and on changes in the supplier's context: a geopolitical event, a new ownership structure, or a public controversy are all triggers for a reassessment outside the regular cycle. Under the EU CSDDD, companies must also engage suppliers when adverse impacts are identified, with a view to adopting a corrective action plan. Traceability of each assessment, including the evidence on which the risk rating is based, is the practical requirement that drives organisations towards dedicated software once the supplier base exceeds a manageable threshold.
Annual reporting: content and publication
Both the French Vigilance Law and the EU CSDDD require annual public reporting on the implementation of the vigilance plan. The French law requires the plan to be included in the annual management report; the EU CSDDD introduces corporate sustainability reporting obligations aligned with the European Sustainability Reporting Standards (ESRS) under the CSRD framework.
The report must cover what was planned, what was implemented, the results obtained, and the measures taken to address identified adverse impacts. It must describe how the alert mechanism operates and how many alerts were received and processed during the year. Generic statements unsupported by evidence expose the company to legal challenge under the French Vigilance Law, where interested parties may seek injunctive relief and damages if the plan is absent or manifestly inadequate. Substantiation is therefore not optional: every claim in the report must be traceable to documented evidence.
How software covers each obligation
Duty-of-care software does not generate the vigilance plan; it provides the workflow and evidence repository that makes the plan auditable. Optivalue.ai provides a platform that guides teams through risk mapping, supplier assessment, alert intake, corrective action tracking, and the production of the annual reporting evidence.
The risk mapping module structures the identification of value-chain risks by category and geography, records the prioritisation rationale, and links each identified risk to the corresponding preventive or corrective measure. The supplier assessment module manages questionnaire distribution, response collection, and risk-rating calculation, keeping a timestamped record of each cycle. The alert module logs incoming notifications from employees, suppliers, or third parties, tracks investigation status, and records the outcome. Together, these modules produce the documented evidence that auditors, shareholder activists, and courts expect to see when they examine whether the plan was genuinely implemented.
FAQ
What is the difference between the French Vigilance Law and the EU CSDDD? The French Duty of Vigilance Law (Law no. 2017-399) applies to large French companies and has been in force since 2017. The EU Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760) extends similar obligations to large companies operating in the EU and introduces a staged transposition timetable. The two texts differ in scope, thresholds, and civil liability mechanisms, but share the same structural requirements: a plan, a risk map, preventive measures, an alert mechanism, and annual reporting.
Which companies are subject to the French Vigilance Law? The French Vigilance Law applies to companies incorporated in France that, at the end of two consecutive financial years, employ a threshold of employees set by the law (in France and in their subsidiaries), as specified in Law no. 2017-399 of 27 March 2017.
What must a vigilance plan contain? Under the French Vigilance Law, the plan must contain a risk map, procedures for regular assessment of subsidiaries, subcontractors and suppliers, appropriate measures to mitigate risks, an alert mechanism for collecting reports of serious risks, and a system for monitoring the implementation and effectiveness of the measures taken.
How do you demonstrate that the vigilance plan was genuinely implemented? Implementation is demonstrated through the audit trail: signed supplier assessments, documented risk decisions, records of corrective actions taken, logs of alert intake and resolution, and evidence of training delivered to procurement staff. Software that centralises this evidence reduces the time needed to respond to court requests or shareholder scrutiny.
Does the duty of vigilance extend to the entire supply chain? Under the French Vigilance Law, the obligation extends to direct and indirect subsidiaries and to subcontractors and suppliers with whom the company maintains an established commercial relationship. The EU CSDDD introduces the concept of a "chain of activities" and requires proportionate engagement at each tier based on the severity of the risk.
Book a demonstration of Optivalue.ai
<!-- JSON-LD -->
Back to top