International duty of vigilance

Duty of vigilance: the first conviction of a parent company opens a new era for international groups

Introduction: a major turning point in the case law

Since the adoption of Law No. 2017-399 of 27 March 2017, the duty of vigilance of parent companies had remained, in its practical effects, largely theoretical. The decisions handed down until now concerned almost exclusively questions of procedure – admissibility, formal notice (mise en demeure), jurisdiction – without ever reaching the substance of the scheme: liability.

The judgment given by the Paris Judicial Court (Tribunal judiciaire) in the Yves Rocher case marks a decisive break. For the first time, a French court finds a parent company civilly liable for breach of its duty of vigilance, in respect of harm suffered abroad as a result of the conduct of a foreign subsidiary. This decision directly concerns all French companies with more than 5,000 employees in France, or 10,000 employees worldwide, subject to the obligations of Article L. 225-102-1 of the French Commercial Code – and, beyond them, all groups that organise their activities internationally.

The stakes are considerable: liability for acts committed thousands of kilometres away, by a legally distinct entity, in a country whose law would normally be expected to apply. The judgment answers each of these questions with remarkable rigour and legal ambition.

The previous framework: a statute without case law on the merits

The architecture of the 2017 law

The law of 27 March 2017 requires large French companies to draw up, publish and implement an annual vigilance plan. Under Article L. 225-102-1 of the French Commercial Code, this plan must include a risk map, procedures for assessing the situation of subsidiaries and subcontractors, risk mitigation actions, an alert mechanism and a monitoring system. The text is explicit: the scope of the plan covers not only the company's own activities but also those of the companies it controls. How the 2017 law and the CSDDD directive fit together, as well as the timetable of forthcoming obligations, are set out in our article on these two regimes.

In the event of a breach, Article L. 225-102-2 opens two routes: an injunction to comply (injonction de faire) – obtaining an order from the judge requiring compliance – and an action in liability, with a reference to Articles 1240 and 1241 of the French Civil Code for compensation of the harm caused.

Case law until now confined to procedure

Before this judgment, the decisions given in vigilance disputes – in particular in the TotalÉnergies, Casino and La Poste cases – had essentially decided questions of admissibility: the sufficient content of the prior formal notice, the standing of associations to bring proceedings, the formal requirements of the summons. Only the La Poste case (Paris Judicial Court, 5 December 2023, No. 21/15827; Paris Court of Appeal, 17 June 2025, No. 24/05193) had given rise to a decision on the merits, but one limited to an injunction to complete the plan, without any order to compensate harm.

The central question – can a parent company be ordered to compensate victims whose harm arose abroad, through the act of a foreign subsidiary, because of the inadequacy of its vigilance plan? – remained open.

The contribution of the Yves Rocher judgment: three decisive points

1. The vigilance law characterised as an overriding mandatory provision

The first difficulty concerned the applicable law. The harm – the dismissal of 132 employees for trade union membership in Turkish subsidiaries – had occurred in Turkey. Under Article 4(1) of Regulation (EC) No. 864/2007, known as "Rome II", the law applicable to a non-contractual obligation is in principle that of the country where the damage occurs. Turkish law should therefore normally have governed the dispute.

The court sets aside this designation by characterising the law of 27 March 2017 as an overriding mandatory provision (loi de police) within the meaning of Article 16 of the Rome II Regulation, whose application is mandatory whatever law is designated by the conflict-of-laws rules. To reach this characterisation, the court relies on the three criteria set out by the Court of Justice of the European Union (CJEU, 31 January 2019, Da Silva Martins, Case C-149/18; CJEU, 5 September 2024, Huk Coburg, Case C-86/23): the proximity between the law of the forum and the situation in dispute – the parent company is French and subject to the text; the necessity of applying French law, Turkish law not guaranteeing an equivalent level of protection; and the purpose of protecting essential public interests – human rights, prevention of industrial disasters, on the model of Rana Plaza.

This characterisation has a decisive consequence: French law governs not only the merits but also limitation, in accordance with Article 15(h) of the Rome II Regulation.

2. Objections to admissibility set aside, with one notable exception

The judgment provides several important clarifications on admissibility.

On limitation, the court sets the starting point of the five-year period under Article 2224 of the French Civil Code not at the date of the dismissals (March 2018) but at the date of effective publication of the vigilance plan (June 2020). As long as the plan had not been published, the victims could not have knowledge of the triggering event – the inadequacy of the plan – enabling them to bring their action. This solution has a clear deterrent effect: a company that is late in publishing its plan mechanically prolongs its own exposure to litigation.

On the prior formal notice, the court decides a long-debated question: the requirement of a prior formal notice, laid down by the law for the action for an injunction, does not apply to the action in liability based on Article L. 225-102-2. An action for compensation is therefore more accessible – and potentially more formidable – than an injunction to comply.

On settlements, the court holds, for the 72 employees who signed a settlement agreement with the Turkish subsidiary, that the harm relied on before it is not distinct from that already compensated under that agreement. This solution relies less on the strict enforceability of the settlement than on the principle of full compensation, which prohibits the victim from being enriched beyond the actual harm suffered. On drafting a settlement agreement intended genuinely to put an end to the dispute, see our analysis of how to secure such an agreement.

3. Liability established: fault, harm and causation

Fault is established by the total exclusion of the subsidiaries from the scope of the risk map. The court recalls that the duty of vigilance is an obligation of means – and not of result – but stresses that no subsidiary appeared in the plans for 2017 and 2018, which were published two years late. An audit firm had itself noted that the plan had not been formalised across the group. In the face of this finding, the company's arguments – prioritisation of salient risks, an internal system communicated to the subsidiaries, concealment of the facts by local managers – are rejected. The court holds that corrective measures taken after the harm occurred can never make up for the absence of a compliant plan from the outset (ab initio).

The harm is established: 132 employees were dismissed because of their trade union membership, in circumstances that the court characterises as a serious infringement of freedom of association. Acts of harassment and discrimination are also found in respect of certain female employees.

Causation is assessed broadly. The court accepts hypothetical causation: if the parent company had properly mapped the risks linked to its Turkish subsidiaries – risks that it could not have been unaware of in view of the available social audits and the publications of the International Labour Organization – it could have used its power of control to put an end to the infringements of freedom of association. The argument that the harm resulted from decisions concealed by local managers is held not to be credible.

This approach to causation is harsher than businesses had hoped: the court does not accept a mere loss of a chance of avoiding the harm, but a direct causal link between the inadequacy of the plan and the harm suffered.

Practical consequences for the businesses concerned

For parent companies subject to the 2017 law

The judgment calls for an urgent review of the scope of vigilance plans. Excluding subsidiaries – even foreign ones, even those held at 51% – from the scope of the risk map is a clear fault. The map must cover all the controlled entities, in accordance with Article L. 225-102-1, paragraph 3.

Moreover, late publication of the plan works against the company: it postpones the starting point of limitation and mechanically lengthens the window of exposure to claims.

For subsidiaries and their managers

Invoking an alleged management autonomy or the concealment of facts by local managers is not an effective defence. The parent company's liability is engaged precisely because it did not put in place the control mechanisms making it possible to identify and prevent these risks.

For associations, trade unions and potential victims

An action in liability may be brought without prior formal notice. The limitation period runs, at the earliest, from the publication of the vigilance plan. Victims who have entered into settlements with subsidiaries will have to show a distinct harm in order to obtain compensation from the parent company.

Litigation risks identified

Several areas of tension deserve heightened vigilance in the light of this judgment.

The risk of broad causation: the court adopts a hypothetical logic – the plan would have made it possible to avoid the harm – which places on the parent company almost total liability as soon as the plan is inadequate. This approach could be qualified in cases where reasonable measures would not have sufficed to prevent the harm, but the case law has not yet decided this point.

The risk of a phantom plan: the judgment seems to accept that a plan that is unpublished but annexed to the management reports may have legal existence. This opening is problematic: it risks encouraging some businesses to keep plans strictly internal, counting on a reduction of their liability while avoiding the transparency required by the law.

The risk of residual conflicts of laws: the characterisation as an overriding mandatory provision is robust, but it will necessarily be debated in the TotalÉnergies case, where the question arises whether the Paris Agreement falls within the scope of the 2017 law. The Yves Rocher judgment is a precedent favourable to a broad reading of the scheme.

The risk of liability for advisers: lawyers and advisers who have assisted groups in drafting deficient vigilance plans are exposed to claims if their clients are held liable on the basis of failings that prior legal analysis should have identified.

Strategies and recommendations

Immediately audit the scope of the vigilance plan: check that all controlled subsidiaries, in France and abroad, are included in the risk map. The exclusion of certain entities – even for reasons of practicality – is a fault capable of engaging the parent company's liability.

Publish the plan on time: late publication is not merely a formal breach. It postpones the starting point of limitation and exposes the company to a prolonged litigation window. A rigorous publication timetable must be put in place.

Document the measures taken in advance: the court clearly held that corrective measures adopted after the harm occurred cannot compensate for the absence of a preventive plan. The traceability of the actions taken – audits, training, alert procedures – must be ensured from the time the plan is drawn up.

Anticipate insolvency proceedings of subsidiaries: the compulsory liquidation (liquidation judiciaire) of a subsidiary does not close the matter. The parent company remains exposed to the victims' action in liability, who may proceed directly against it without having to exhaust their remedies against the defaulting subsidiary.

Prepare the defence on causation: in cases where a plan existed but proved inadequate, the argument will have to show that reasonable measures had been identified and that their absence is not the direct cause of the alleged harm. Loss of a chance remains a relevant ground of discussion in cases where the causal link is less direct.

Conclusion

The Yves Rocher judgment marks the entry of the duty of vigilance into the era of litigation on the merits. The 2017 law, characterised as an overriding mandatory provision of universal scope, can now found the conviction of a French parent company for human rights violations committed on the other side of the world by a subsidiary whose strategic direction it nonetheless controls. Businesses that have not yet seriously integrated this constraint into their governance have one last window in which to do so – before the TotalÉnergies case, in which judgment is awaited, definitively closes the window of wait-and-see.

‍