Nine years after Law no. 2017-399 of 27 March 2017, the duty of vigilance of parent companies still has no implementing decree and no official standard, and the European directive that was meant to absorb it was stripped of its substance by the Omnibus Directive of 24 February 2026. What now gives the obligation its actual content is a single chamber of the Paris judicial court, ruling by ruling: the TotalEnergies interim order of 28 February 2023, the La Poste judgment of 5 December 2023 upheld on appeal on 17 June 2025, the Yves Rocher judgment of 12 March 2026, the TotalEnergies judgment of 25 June 2026. For a group subject to the duty, legal certainty no longer depends on the text but on its ability to demonstrate the method it followed. Six points determine whether your vigilance plan survives a formal notice.
1. The risk map is the document everything turns on
The plan comprises five measures listed in Article L. 225-102-1, I of the Commercial Code: a risk map, procedures for regularly assessing subsidiaries, subcontractors and suppliers, appropriate mitigation actions, a concerted alert mechanism and a monitoring system. Case law has made the first the key to the other four. The Paris Court of Appeal describes it as the foundational step whose results condition the later steps (CA Paris, pôle 5 ch. 12, 17 June 2025, no. RG 24/05193). Three requirements follow. The map must cover gross risks, before any mitigation measure, otherwise neither analysis nor prioritisation is possible. It must be targeted and categorised by activity, geographic area and exposed persons: the court criticised La Poste for describing risks in overly general terms (TJ Paris, 5 December 2023, no. RG 21/15827). It must be ranked by severity, with traceability between each risk and the measures that address it. Every conviction handed down since 2023 has turned on this document, never on an industrial strategy.
2. A map limited to high-risk purchasing is lost from the start
The scope of the plan covers three circles: the company itself, the companies it controls within the meaning of Article L. 233-16, II, and the subcontractors or suppliers with which it maintains an established commercial relationship. The Rocher group was convicted on 12 March 2026 precisely on the second circle: its 2017 and 2018 plans contained no analysis of the risks specific to its subsidiaries and remained limited to suppliers and high-risk purchasing, even though the parent company had sufficient information to identify and assess the severity of the risk of infringement of freedom of association at its Turkish subsidiary (TJ Paris, 34e ch., 12 March 2026, no. RG 22/04017). The TotalEnergies judgment added a dimension no plan had anticipated: scope 3 emissions, resulting from the use of the products sold, form part of the activity’s risks and must appear in the map once the company has levers of direct influence over its end customers (TJ Paris, 34e ch., 25 June 2026, no. RG 22/03403). The ruling is under appeal, but it signals the direction of judicial review.
3. The court checks the method and refuses to dictate strategy
Every ruling on the merits carries the same reservation: the law cannot lead the court to substitute itself for the company and its stakeholders in demanding specific, detailed measures from them. In the La Poste case, the court held that whether it is more virtuous to terminate a contract at the first breach or more effective to provide for penalties is a strategic discussion beyond its remit (TJ Paris, 5 December 2023, cited above). In the TotalEnergies case, it ordered the plan to be completed but dismissed claims seeking to ban new projects and reduce production, since it is not for the court to set the target the company must reach (TJ Paris, 25 June 2026, cited above). The obligation is one of means, continuous, and is assessed by comparison with what a diligent company holding the same information would have done (CA Paris, pôle 5 ch. 12, 18 June 2024, no. RG 23/10583). The corollary concerns evidence: since the court does not dictate the measures, it requires the company to justify the ones it chose, and it has ordered the forced disclosure of internal audits and human-rights committee minutes (TJ Paris, 18 September 2025, Tilenga and EACOP case). The company is checked on its method; it is not under control on its strategy.
4. The formal notice opens a three-month working period, not a waiting period
An injunction may only be sought once a company placed on formal notice has failed to meet its obligations within three months (Article L. 225-102-1, II). The Court of Appeal held that this formal notice is a mandatory prerequisite, required on pain of inadmissibility, which must contain grievances clear enough to allow compliance, without requiring perfect identity between the formal notice and the writ, or that both address the same vintage of the plan, the obligation being a continuing one (CA Paris, pôle 5 ch. 12, 18 June 2024, three rulings: TotalEnergies, EDF and Vigie Groupe). Defences based on lack of standing or absence of any obligation have failed every time; the action need only be directed against the head of the group, the natural debtor of the obligation, failing which it is inadmissible. The response to the formal notice is therefore the first submission of the coming trial: it addresses each grievance, sets out what exists, what has been decided and what is refused, and why. A response that merely recalls the group’s historical commitment is a lost response.
5. The parent company’s liability is quantified and follows its subsidiaries abroad
A breach of the plan’s obligations engages the liability of its author under the conditions of Articles 1240 and 1241 of the Civil Code and requires it to make good the harm that performance of those obligations would have avoided (Article L. 225-102-2, first paragraph). The Yves Rocher judgment is the first to trace the whole chain: a map silent on the subsidiary amounts to a breach; knowledge of the risk, established by the parent company’s own audits and internal documents, amounts to fault; foreseeability of the harm amounts to causation. The awards are modest, 8,000 euros to each of the nine former employees who did not settle and 40,000 euros to the union, but the precedent is considerable. The court further characterised Article L. 225-102-2 as a mandatory provision applicable to harm suffered in France or abroad and set aside the Turkish limitation period (TJ Paris, 34e ch., 12 March 2026, cited above). A strategy of confining the risk to the local law of subsidiaries is futile before the Paris court. Conversely, where the harm is global and diffuse, such as climate harm, the court confined itself to the injunction and dismissed the damages claims against TotalEnergies.
6. The European directive changes nothing before 2029, and public procurement already penalises non-compliance
Directive (EU) 2024/1760 imposed a duty of vigilance on companies with more than a thousand employees, with a harmonised civil-liability regime and a climate transition plan. The Omnibus Directive (EU) 2026/470, in force since 18 March 2026, raised the thresholds to five thousand employees and 1.5 billion euros in turnover, removed Article 22 on the transition plan, dismantled the harmonised civil-liability regime and the overriding-mandatory-rule characterisation, and postponed application to 26 July 2029, with transposition due by 26 July 2028 at the latest. Until then, the positive law for French groups remains the 2017 law as read by the Paris judicial court, more demanding than the directive on almost every point. Two internal developments, however, are already settled. Since 1 January 2025, the plan falls under Articles L. 225-102-1 and L. 225-102-2 of the Commercial Code, no longer Articles L. 225-102-4 and L. 225-102-5: a plan that still cites the old numbering signals a lapse in monitoring. Since 1 January 2026, a public purchaser may exclude from a contract a company that has not drawn up a compliant plan for the year preceding the call for tenders (Public Procurement Code, Articles L. 2141-7-1 and L. 3123-7-1). The risk is no longer just the injunction; it is market access.
These matters fall within the firm’s business law practice; for a contradictory review of your plan, conducted the way the 34th chamber would conduct it, tell us about your situation.
Previous: Defects of consent: the six points that decide whether your contract survives a nullity action.
On this specific point, see our page on shareholder disputes.