France: the 2017 duty-of-vigilance law created a plan and implementation duty
France’s Law 2017-399 required certain large companies to establish and implement a vigilance plan covering risks connected with subsidiaries and business relationships. The law provided an injunction route and ordinary civil liability, but no automatic guarantee against harm.
- Development
- 27 March 2017
- Published
- 29 October 2026
- Sources checked
- 29 October 2026
This newly written historical account concerns the dated record above. It is not a recovered article or document from the former publisher. Later developments are identified separately.
A statutory duty for large groups
France promulgated Law 2017-399 on 27 March 2017, establishing a corporate duty of vigilance for covered large groups. The threshold was at least 5,000 employees in France or 10,000 worldwide, counting the relevant company and its direct or indirect subsidiaries. The law required publication and effective implementation of a vigilance plan. Its scope reached risks associated with subsidiaries and with subcontractors or suppliers in an established commercial relationship. Law 2017-399 French Treasury explanation
Our analysis: The law’s structure tied the obligation to group size and a defined business network. It required a plan directed at risks connected with the company’s operations and relationships; it did not make a parent automatically liable for every act by every supplier. Nor did the duty promise that all harm would be eliminated. The legal obligation concerned the plan and its effective implementation.
Five components of the plan
The law specified five elements: risk mapping; regular assessment procedures for subsidiaries, subcontractors and suppliers in the relevant commercial relationships; measures to mitigate risks or prevent serious harm; an alert mechanism established in consultation with representative trade unions; and a system to monitor implementation and assess effectiveness. These elements combined identification, prevention, reporting and follow-up rather than treating publication of a plan as the whole duty. Law 2017-399
Our analysis: Read together, the components create a cycle. Mapping identifies where risks may arise; assessment examines entities and relationships; mitigation and prevention address the identified risks; the alert mechanism can bring concerns forward; and monitoring tests implementation. That sequence makes effective implementation a distinct statutory requirement. A document that merely listed risks would not, by itself, describe the full set of duties enacted in 2017.
Notice, injunction and civil liability
The statute provided a route to seek an injunction after formal notice when a company failed to meet its vigilance obligations. Ordinary civil liability remained a separate route where its requirements were established. The Constitutional Council removed proposed civil fines, while leaving the plan and implementation duties in place. Law 2017-399 French Treasury explanation
Our analysis: These mechanisms should not be conflated. The injunction route addressed compliance with the statutory duty after notice; civil liability concerned responsibility under ordinary principles and was not a fine automatically triggered by a deficient plan. The removal of the proposed fines did not erase the underlying vigilance obligations. This describes the law as enacted in 2017, without implying either automatic liability for harm or a guarantee of harm-free supply chains.