BMW AG

Key Recommendations: "The scope of the legal framework should cover all companies independent on their size or turnover taking a risk-based approach for sustainability due diligence into account." ... In relation to Article 2 (scope): "Nevertheless, we see the limitation of the scope based on the size (number of employees) or turnover of a company critical. Based on our experience, we know that there is no correlation between the risk for human rights and environmental adverse impacts and the size or turnover of a company. In contrary, we know that especially in high-risk sectors small and medium companies are face high risks for adverse impact. Furthermore, businesses under the scope of the directive need a legal basis for collecting sustainability information in their value chain across the EU border. Fading out companies in relation to their size or turnover, will make it nearly impossible getting any sustainability information from these companies. Thus, we strongly recommend eliminating the defined thresholds and to take more a risk-based approach for sustainability due diligence."

Q3, " All businesses located in the EU or participating in the EU market should be covered in the same way by a new regulatory framework to maintain the competitive ability of EU businesses." Q15, "The BMW Group is in favor of a horizontal approach comprising all sectors." Q16. "It is crucial to be risk-based. It is not the size of the company that is decisive, but the role in the supplier network. Dealers, for example, play an important role in terms of traceability and transparency, as well as in the execution of due diligence activities during supplier selection and commissioning. The majority of these companies have more than 50 employees. Nevertheless size doesn’t matter to avoid any blind spots and to perform risk based due diligence successfully in practice."

Q17, "If foreign companies are identified as part of a high-risk supply chain, these companies should be covered by any due diligence regulation independent of their size, location or relationship to the final business in the supply chain. "

Article 19 (Substantiated concerns): "We see the need for setting the conditions under which an interested person should be enabled to submit a substantiated concern, have unhindered access to a court, or how to be represented to enforce its rights. Nevertheless article 19 should be limited to cases where a person can provide substantiated evidence that the rights of the person are infringed by the actual adverse impact of a company. ... We're absolutely refusing to open the substantiated concerns procedure for all kind of due diligence failures without considering if the failure has led to an actual adverse impact of a company." Article 20 (Sanctions): "According to article 20 paragraph 4 member states shall ensure that any decision of the supervisory authorities containing sanctions related to the breach of the provisions of this directive is published. Respecting the protection of data privacy, we're refusing the public disclosure of sanctions."

In response to Q19a on enforcement of the CSDDD, BMW Group selected, "Supervision by competent national authorities based on complaints (and/or reporting, where relevant) about non-compliance with setting up and implementing due diligence measures, etc. with effective sanctions (such as for example fines) ... with a mechanism of EU cooperation/coordination to ensure consistency throughout the EU."

Article 8 (Bringing actual adverse impacts to an end): "Article 8 also states that companies shall pay damages and enable financial compensation for adverse impacts in their value chain. We don't see payments or financial compensation as appropriate measures to bring adverse impacts to an end. These measures are more an issue of civil liability and therefore should be regulated under article 22."

Article 22 (Civil liability): "According to article 22 companies shall be held liable for all damages in the entire value chain, which have been caused by failing to comply with the due diligence obligations. Only in the case of indirect business relationships a company shall not be held liable for damages caused by an adverse impact arising as a result of the activities of an indirect partner, if the company verifies, that it has complied with its due diligence obligations.We consider article 22 contradicting to the obligation of means, what is intended to be the core principle of the CSDD. In contrary companies will be held liable for all kind of damages in relation to direct business partnerships, even if they have complied with their due diligence obligations. In principle companies should only be held liable for damages caused by actual human rights and environmental adverse impacts, which are directly linked to the business conduct of the company and which are a result of acting deliberately or grossly negligent. In cases where companies haven't caused actual adverse impacts deliberately or grossly negligent (e.g. processing errors) there should be full exemption from civil liability. In addition, we strongly recommend implementing a stepwise evaluation of the civil liability of companies. In general, the national responsible supervisory authority shall assess submitted substantiated concerns in line with article 19. Only if the supervisory authority comes to the result that a company has caused an actual human rights or environmental adverse impact deliberately or grossly negligent companies shall be held liable for their infringement. Access to a court shall be permitted in these cases to file a suit for payment of damages to the affected persons or for financial compensation."Key Recommendations: "Regarding civil liability companies should only be held liable for damages caused by actual human rights and environmental adverse impacts, which are directly linked to the business conduct of the company and which are a result of acting deliberately or grossly negligent."In relation to Article 5 (Integrating due diligence into companies' policies): "Based on our own experience it's impossible to be held liable for adverse impact occurring beyond direct business relationships where a company cannot exert influence proactively and directly with appropriate measures."

In response to Q2, "In relation to the accountability of businesses any legal framework should be established on the principle of effort and not on the principle of result. As long as businesses are able to provide evidence, that they have implemented an effective and global compliance system, claims for accountability subject to private law should only be limited to cases, where authorities have identified abuses caused deliberately or through gross negligence. Implementing commonly accepted standards of due diligence should give businesses the possibility to limit their accountability subject to private law to abuses caused deliberately or through gross negligence (safe harbor rule)." Q19a, in response to possible enforcement mechanisms for the CSDDD, BMW Group did not select judicial enforcement with liability and compensation in case of harm. The company stated, "As a first step, any review should be carried out by national authorities. A civil action should only be possible after an infringement/ fine has been determined by a national authority. The process should be defined in a similar way as laid out in the EU antitrust law."

Article 3 (definitions): "The definition of "company" as set out in Art. 3a seems to indicate that the due diligence obligations are set at entity level but not at group level. We strongly support setting the due diligence obligations at group level to minimize the administrative and cost burden for groups falling under the scope of Directive. Large multinational groups usually set up their compliance, risk and due diligence functions at group level with group-wide responsibility. Subsidiaries usually do not have their own due diligence processes. Requiring subsidiaries to set up own due diligence processes and systems would lead to unnecessary costs and creates overlaps between different entities of the same group." In relation to Article 6 (Identifying actual and potential adverse impact): "From our point of view article 6 goes far beyond what companies can deliver or even to implement by using the latest technologies. ... For achieving the main objective of the highly appreciated due diligence legislation we strongly recommend taking an occasion-based approach. Businesses should evaluate their highest potential risks arising from their own operations and their value chain and take appropriate measures to identify actual risks." According to article 7 companies shall take appropriate measures to prevent or mitigate potential adverse human rights and environmental impacts.... Here as well it has to be differentiated between direct and indirect business relationships. Regarding direct business relationships it's possible to develop and implement proactive prevention measures what is impossible to do in the case of indirect business relationships where the individual members of the whole value chain are unknown in most cases.... Furthermore article 7 should take a more risk-based approach. It only increases the administrative burden for companies excessively to apply measures to prevent or mitigate all potential adverse impacts, even if there is only a very small probability of becoming actual." We welcome the clarification in article 8 that actions to neutralize or minimize the extent of adverse impact should be proportionate to the significance and scale of the adverse impact and to the contribution of the company's conduct to the adverse impact. ... companies in most cases don't know their value chain beyond their direct business relationships. In consequence companies are not able to conduct due diligence regarding indirect business relationships proactively. Thus, we strongly recommend adapting article 8 in a way to establish proactive due diligence for direct business relationships and occasion-based due diligence for indirect business relationships.

In response to Q14, "We do agree to the definition of due diligence duty and supply chain. For implementing human rights and sustainability standards successfully in the supply chain of businesses it should be avoided to exclude certain businesses of the supply chain from the application of a common regulatory framework due to their size, their number of employees or their location. For mitigating the administrative effort for businesses to the appropriate extent the scope of due diligence should be limited to high risk supply chains. Therefore choke points should be defined, where a common set of rules have to be implemented. In that case it is of utmost importance, that there is the obligation for all members of a high-risk supply chain to disclose all due diligence related information to up- and downstream members of the supply chain." Q2, "For successful risk management respective members of the supply chain shouldn’t be waived by any obligations due to their size or location. To minimize administrative efforts for businesses, due diligence should be limited to high risk areas, where all participants independent of their size or location are covered."

In relation to Article 7 (Preventing potential adverse impact): "Regarding direct business relationships it's possible to develop and implement proactive prevention measures what is impossible to do in the case of indirect business relationships where the individual members of the whole value chain are unknown in most cases. This existing gap can be closed by obliging direct business partners to oblige their direct business partners implementing minimum safeguard standards and an appropriate prevention action plan on human rights and sustainability via contractual cascading.""According to article 7 paragraph 5 companies shall temporarily suspend or terminate their business relationships or shall refrain from entering into new or extending existing business relationships with partners not able of preventing or mitigating potential adverse impacts. BMW Group is refusing to make these measures, which should be considered as measure of last resort, obligatory for cases where partners are not able to prevent or mitigate potential adverse impacts. This measure should be only considered as measure of last resort for bringing actual adverse impacts to an end."Article 8 (Bringing actual adverse impacts to an end): "We welcome the possibility for contracting indirect business relationships directly as set out in article 8 paragraph 4. Nevertheless, it should be considered that direct contracting of indirect business relationships can only be done targeted and occasion based. Direct proactive contracting of the whole value chain to achieve compliance with the company's code of conduct or a corrective action plan is not feasible. Here as well a risk-based approach should be taken for direct contracting.""In cases where actual adverse impacts could not be brought to an end or the extent of which could not be minimized by appropriate measures suspending commercial relationships temporary, terminating business relationships, refraining from entering in to new or extending existing relations can be the measure of last resort.... We absolutely refuse to make the measures as mentioned above obligatory for companies. Alternatively, the measures should be applied voluntarily as measure of last resort considering the severeness of the actual adverse impact. Additionally, it should be clarified that these measures can only be applied to direct business relationships."

In response to Q5 on interests that are relevent to the long-term success of the company, BMW Group selected "employees", "persons and communities affected by the operations of the company", and "persons and communities affected by company's supply chain" as "relevant". However, the company added, "The fact that the interests named above are relevant for sustainable success of a company does not mean that there is a need for legislation in this regard. Many companies and investors nowadays agree, that such interests need to be taken into account, when taking corporate decisions. There is no need for regulation in this regard which almost necessarily would result in bureaucratic exercises with limited value for stakeholders and society." In response to Q6, which asks, " Do you consider that corporate directors should be required by law to identify the company´s stakeholders and their interests" the company responded, "I disagree to some extent" - "Identifying stakeholders and implementing a functioning and comprehensive risk management are preconditions for the successful management of a company and therefore in the own best interest of the corporate directors in charge. In some cases a common regulatory framework may support corporate directors in their internal decision making process. Nevertheless we do not think, that additional regulatory action is required to set an incentive here. ... there are various ways to identify stakeholders, and that stakeholders can differ from one company to the other. A one size fits all approach is thus not warranted and it should remain the decision of the company to define its relevant stakeholders."

In response to Q20a, which asks, "Do you believe that the EU should require directors to establish and apply mechanisms or, where they already exist for employees for example, use existing information and consultation channels for engaging with stakeholders in this area?", BMW Group responds, "I strongly disagree" - "On the one hand the consideration of stakeholders in business decision processes may be beneficial as long as the stakeholders engagement is objective and based on facts. In this case external expertise and different perspective regarding sustainability aspects may have a positive impact to decision making processes. On the other hand there is a high risk of subjective stakeholder engagement, which may block the decision making process of businesses and may harm the sustainable improvement of businesses. ... We do therefore not believe, that a single organizational approach can effectively ensure stakeholder input."

In response to Article 6 (Identifying actual and potential adverse impact): "Where relevant, carrying out external stakeholder consultations is important from our point of view. BMW Group regularly reflects its own business conduct by external stakeholder engagement. In this case it is important to provide flexibility to a company to choose the right and appropriate external stakeholders, which can contribute to sustainable development of a company."

In response to Q6, "Identifying stakeholders and implementing a functioning and comprehensive risk management are preconditions for the successful management of a company and therefore in the own best interest of the corporate directors in charge. In some cases a common regulatory framework may support corporate directors in their internal decision making process. Nevertheless we do not think, that additional regulatory action is required to set an incentive here. ... there are various ways to identify stakeholders, and that stakeholders can differ from one company to the other. A one size fits all approach is thus not warranted and it should remain the decision of the company to define its relevant stakeholders."

In relation to Article 7 (Preventing potential adverse impact): "We consider the consultation of external stakeholders in the development of a prevention action plan useful, but companies should be free to choose their appropriate external stakeholders."Article 8 (Bringing actual adverse impacts to an end): "In cases where adverse impact cannot be immediately brought to an end companies shall develop and implement a corrective action plan in consultation with external stakeholders. Here as well it has to be considered that a corrective action plan can only be enforced in relation to direct business relationships. Regarding the external stakeholder consultation, it should be clearly pointed out that companies should be free to choose the appropriate stakeholders in relation to the specific adverse impact."

Article 26 (Setting up and overseeing due diligence): "According to article 26 directors of companies shall be responsible for putting in place and overseeing due diligence actions and the due diligence policy with due consideration for relevant input from stakeholders and civil society organizations. BMW Group already today reflects its sustainability strategy with external stakeholders and civil society organizations via external stakeholder engagement on a regular basis. We absolutely welcome the suggested proposal of leaving the decision of the extent of external stakeholder engagement to the companies and to enable companies to freely choose the appropriate and most competent stakeholders for their individual belongings."

In response to Q6, which asks, "Do you consider that corporate directors should be required by law to manage the risks for the company in relation to stakeholders and their interests, including on the long run", the company responded "I strongly disagree" - "Identifying stakeholders and implementing a functioning and comprehensive risk management are preconditions for the successful management of a company and therefore in the own best interest of the corporate directors in charge. In some cases a common regulatory framework may support corporate directors in their internal decision making process. Nevertheless we do not think, that additional regulatory action is required to set an incentive here. ... there are various ways to identify stakeholders, and that stakeholders can differ from one company to the other. A one size fits all approach is thus not warranted and it should remain the decision of the company to define its relevant stakeholders."