Companies must apply due diligence across their entire “chain of activities,” which includes their own operations, subsidiaries, and both direct and indirect business partners involved in upstream and relevant downstream activities.
The directive is built around a risk-based scoping exercise, meaning companies first use reasonably available information to identify where the most likely and most severe human rights and environmental risks may occur, across both direct and indirect business partners, and then focus more detailed assessment and action on those priority areas.
To avoid placing unnecessary burdens on smaller suppliers, the revised rules limit information requests to what is truly necessary, encourage companies to seek data where risks are most likely to appear, and include safeguards to ensure smaller partners are not overwhelmed with reporting demands.