And other traps of treating due diligence merely as legal compliance
For years, human rights and sustainability due diligence was voluntary. And the strength of its voluntary nature was creativity: no legal rule told you where to stop, so energy could go where it mattered most for the people the work was actually about. The best practices came from insight, not legal checklists, and they were rarely built alone. They were built together with the people affected and others that could meaningfully contribute.
Now the same work is becoming law. The amended EU Corporate Sustainability Due Diligence Directive (CSDDD) now applies to a narrow band of the very largest companies, with application phased in from July 2029. The EU Commission opened a public consultation on the implementing Guidelines that runs to 24 July 2026, with the Guidelines expected in July 2027. Here is the underlying trap: the moment something becomes a legal duty, even a duty still to be finally outlined in detail, a quiet voice starts to build inside many organisations that say, “we will meet the requirement – and not one step more”. The floor quietly becomes the ceiling. And the room for innovative, value-adding work starts to close.
The paradox is that it is precisely that room – the practical, ground-level and collaborative work – that actually reduces legal exposure and benefits business. That is where the effective measures happen, and where outcomes for real people actually change. The creative work and the legally safe work are, at bottom, the same work.
There is a second paradox, familiar to anyone who has paid a legal bill recently. Limiting yourself to the strictly legal minimum should save money – but risks doing the opposite. To be sure you have done exactly what the law requires, and not one step more, you first have to know precisely where the line sits. Establishing that line is expensive. More and more often, I hear companies say they have spent large legal fees to identify the exact line between what they must do and not, and that a fraction of that money could have significantly improved the situations of vulnerable people affected by their business – and reduced the legal risk.
The same (dis)logic applies in the face of allegations of human rights harm: in the Dyson case, where 23 migrant workers and the estate of one deceased worker from Nepal and Bangladesh sued the company over alleged forced labour at factories in Malaysia, the court was critical to the excessive costs levels claimed by both parties in relation to the disproportionality to the actual claims of the vulnerable workers involved. Money spent on remediating workers directly instead would have done more for people, and significantly reduced Dyson’ exposure and cost.
Both paradoxes point the same way. The voluntary expectations in the UNGPs and the legal requirements in the CSDDD do not only ask whether you undertook a measure. They ask whether your measures actually work – whether they deliver real outcomes for the rights-holders concerned. The CSDDD defines “appropriate measures” as “measures that are capable of achieving the objectives of due diligence by effectively addressing adverse impacts in a manner commensurate to the degree of severity and the likelihood of the adverse impact, ….”. Together with the obligation to measure the effectiveness of their efforts, this is the pivot that turns legal duty back into a reason to continue with the innovative, grounded and collaborative work.
These paradoxes are twin-faced. The first is under-compliance: due diligence run to the floor, where engaging affected stakeholders stops being about understanding root causes and building the kind of relationship that lets a company act on what it hears, and becomes instead a way of extracting the information needed to close the issue. Rightsholders become an information source to be mined, not people to be engaged. This runs directly against the UNGPs’ expectation reflected in the CSDDD Article 13: the requirement to conduct meaningful consultation with potentially affected groups and other relevant stakeholders. The purpose is to help the company understand affected people’s concerns accurately and what appropriate measures look like – not simply to gather information for its own use.
The second is over-compliance: effort and cost poured into measures that do not address actual risk, and therefore do not meaningfully improve outcomes for anyone, including the company. The clearest recurring example is the supplier questionnaire sent out uniformly across an entire supply base, regardless of risk level. These questionnaires are a familiar due diligence artefact that generates paperwork rather than prevention, and that runs against the risk-based prioritisation at the core of both the UNGPs and the CSDDD.
So where does the lawyer actually fit in? Three patterns recur.
Three ways to navigate human rights risk, and only one that works
The first instinct is to manage the legal risk in isolation: shaping policy and efforts from a strictly legal risk perspective, incurring high costs without effect on the ground, ending business relationships without regard for the consequences for people and the environment, minimising engagement that tends to raise rather than lower conflict levels.
The other extreme is not involving the lawyer at all – which can go well for a long time, but whose consequences tend to arrive late and land hard: careless handling of information, weak governance, and clinging to harmful business relationships that continue just because the legal analysis was never done. Also, human rights is law. International law. Lawyers with expertise in human rights law are therefore best placed to objectively assess what different human rights standards actually mean in a corporate context. Too often, however, this is left to subjective views of non-legal experts even as an objective, legal analysis is crucial for the company’s risk understanding and obligations.
In between sits what actually works: an effective risk focus, where lawyers and sustainability teams both use their skills with mutual recognition of each other’s expertise and necessary contribution to the creative, grounded measures that improve outcomes for people while also meeting adequate governance standards, data sharing requirements and effective legal risk management.
The business case: the alternative cost is higher
This is not just a risk question, it is a business question, and the numbers are increasingly clear. According to the Morgan Stanley Institute for sustainable investing (2025), the top reason why asset owners plan to increase their sustainable investing is strong financial performance. According to a literary review on supply chain sustainability risk management under mandatory due diligence, sustainable supply chain practices reduce supply chain disruptions and shortens recovery time over the long run. Estimates indicate that occupational accidents and diseases cost roughly 4% of global GDP annually (ILO, 2025).
What is less widely understood is that in situations of armed conflict, including occupied territories, companies are expected to extend the scope of their due diligence to also include relevant standards of International Humanitarian Law. In other words, this is not a separate obligation layered on top of the UNGPs, but an extension of how they apply in conflict-affected contexts. Relevant parts of the Geneva Conventions, their Additional Protocols, and related International Humanitarian Law standards become part of the framework for companies’ human rights responsibility when they operate in or source from these areas.
Concretely: at a sugar mill in Nicaragua, seasonal workers were suffering acute kidney injury linked to heat stress during harvest. A programme of structured rest breaks, shade, drinking water and hygiene was built up gradually over five harvest seasons (2017–2022). The result: $1.60 returned for every dollar invested, break-even by year three, and a clear decline in both kidney injuries and sick leave. Respecting the right to life and health, and seeking increased productivity, turned out to point the same way.
The same pattern shows up in wages. According to recent figures published by the company, Nestlé’s climate and living-income programme for cocoa farmers has produced a 190 % increase in cocoa net income. The question Shift Project, Cambridge and Business Fights Poverty posed in 2022 still stands: can you afford not to make living wages part of your business strategy?
This is not a compliance cost. It is an investment – what the Stockholm Resilience Centre calls a triple dividend: lower cost when disruption hits, economic growth through stronger institutions and infrastructure, and social and environmental benefits that are, in the long run, a precondition for doing business at all. And because the whole company is in scope, including what group management and the board decide, this is a governance question, not just an operational one.
In practice: what it means for contracts
For lawyers, the shift from a compliance mindset to a due-diligence mindset is particularly clear in contract design.
For years, the default supplier contract has in simplified ways looked similar across industries: a representation that the supplier is, and will remain, in full compliance with the buyer’s code of conduct; a right to terminate for breach of that representation; strict liability regardless of either party’s actual influence over conditions on the ground; and, if something goes wrong, a remedy that runs to the buyer in the form of damages, but no contractual obligation to remedy those who were actually harmed.
These one-sided contract terms tend to produce oppositional rather than cooperative supplier relationships, adding commercial pressure that can increase human rights risk rather than reduce it – even as we know it is impossible for one supplier to single handedly address system issues on the ground. A representations-and-warranties model tends to reward a tick-box approach, since suppliers have little incentive to disclose problems that would put them in breach. And because these contracts typically stop at the first tier, they miss most of where the risk actually sits: far down the upstream supply chain.
The alternative treats human rights due diligence as a shared obligation of both parties, not a warranty imposed on one. Instead of one-sided liability and damages, it prioritises collaboration and remediation to the people harmed. Instead of an unqualified right to terminate, it builds in a defined process of engagement first, with responsible forms of disengagement as a last resort. And it is designed to flow through the supply chain, not stop at the first tier. In short: contracts that underpins instead of undermining the company’s due diligence efforts.
The logic is the same one that runs through this whole piece: a contract built to punish a supplier for admitting a problem will simply get fewer admissions. A contract built for joint problem-solving gets more of them. And that is what actually enables both company and supplier to mitigate the underlying risk, for themselves and for the people in their supply chains.
Back to the middle
Putting harm to people and the environment at the centre of this work is better legal practice. It is lower business risk. The legal frameworks, e.g., the UNGPs, the OECD Guidelines for Multinational Enterprises, the CSDDD and the EU Forced Labour Regulation are built on the same foundation. And, what numbers and experience suggest again and again, it is also the wisest business decision.
Key takeaway
The ground-level, practical work that actually reduces harm to people is the same work that reduces legal exposure and legal cost – and that is precisely what the CSDDD is designed to reward.
Malin Helgesen is the founder of Rights Advisory and a corporate lawyer specialising in sustainability governance and human rights due diligence. Before founding Rights Advisory, she spent years as lead counsel for human rights at Equinor, advising the board and senior leadership on human rights strategy and governance across the company’s global operations—focused on conflict-affected and high-risk areas. She works with large corporations on business and human rights strategy, CSDDD implementation, and governance integration.
