Last week, European Union governments reached a fragile deal on the proposed directive on corporate sustainability. The initial aim of this measure was ambitious—to prevent abuse and provide a remedy to victims for harms such as forced labour or oil spills.

The Council of the EU did close some of the gaps in the European Commission’s proposal. But it signed off on a draft law whose loopholes will allow many powerful companies to evade responsibility for clearcut wrongdoing and undermine the potential to enforce responsible business conduct.

‘Chain of activities’

After much hard negotiation about how far obligations should reach into the value chains of companies, the vague concept of a ‘chain of activities’ emerged. This does not extend to the full spectrum of downstream activities: there will be waivers for companies that sell such products and services as pesticides, other chemicals, security equipment and surveillance technologies. Nor will businesses have to worry at all about how their products or services are used—that includes the finance sector.

Companies will thus still be able to sell dangerous digital tools, such as Pegasus, to repressive governments, without carrying out human-rights due diligence—they will not be held accountable for the harm to journalists or activists caused by their spyware. Firms could continue to supply to business partners which were implicated in international crimes or work with distributors violating workers’ rights.