SolariAdvisory

Explainer

Human rights due diligence (HRDD)

Human rights due diligence is the ongoing process through which a company identifies, prevents, mitigates, and accounts for its actual and potential adverse impacts on human rights, across its own operations and its value chain. The standard is set by the UN Guiding Principles on Business and Human Rights and the OECD Due Diligence Guidance. In the EU, the Corporate Sustainability Due Diligence Directive (CSDDD) makes a version of it mandatory for the largest companies from 2029.

Last updated

HRDD advisory

Definition

What HRDD means

HRDD is a standard of conduct rather than a certification. It asks whether a company has taken the steps a reasonable enterprise of its size, sector, and operating context would take to know and address its human rights impacts. The measure is the risk to people, not the risk to the company, which is what distinguishes it from conventional legal or commercial due diligence.

Three refinements recur. Due diligence is ongoing, because risks change with operations and context. It is risk-based, so attention goes first to the most severe and most likely impacts. And in conflict-affected and high-risk areas it becomes heightened, extending to the dynamics of the conflict itself. Where the law requires it, as under the CSDDD, HRDD becomes mandatory, and the record of the process becomes evidence.

The process

How to conduct human rights due diligence

The OECD Due Diligence Guidance sets out six steps that track Principles 16 to 22 of the UN Guiding Principles. They operate as a cycle rather than a sequence completed once.

  1. 01Embed responsible business conductAdopt a human rights policy approved at the highest level, and build it into management systems, contracts, and incentives.
  2. 02Identify and assess adverse impactsMap operations and business relationships, identify salient risks, and assess them with input from affected rights-holders.
  3. 03Cease, prevent, or mitigateAct on what the assessment finds, using leverage over business partners where the company contributes to or is linked with the impact.
  4. 04Track implementation and resultsVerify that measures work, using indicators that measure outcomes for people rather than activity.
  5. 05Communicate how impacts are addressedReport in a form that affected stakeholders, investors, and regulators can follow and test.
  6. 06Provide for or cooperate in remediationWhere the company has caused or contributed to harm, provide remedy, including through grievance mechanisms people can actually use.

Primary sources: UN Guiding Principles on Business and Human Rights (PDF) · OECD Due Diligence Guidance for Responsible Business Conduct (2018)

European Union

The CSDDD after the Omnibus: requirements and timeline

The Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760, was substantially amended by the Omnibus I package, which the Council adopted on 24 February 2026 and which was published as Directive (EU) 2026/470. The core duty to conduct risk-based human rights and environmental due diligence survives, in a narrower form and on a later timetable.

Scope
EU companies with more than 5,000 employees and more than EUR 1.5 billion in global net turnover, and non-EU companies with more than EUR 1.5 billion in EU net turnover. The previous thresholds were 1,000 employees and EUR 450 million.
Timeline
Member States transpose by 26 July 2028. Companies comply from 26 July 2029, with first reports covering financial years beginning on or after 1 January 2030. Commission guidelines are due in July 2027.
The duty
Initial scoping relies on information already reasonably available. Companies then assess the most likely and most severe impacts, prioritizing direct business partners. Requests for information to smaller partners are a last resort and must be targeted and proportionate.
Removed
The EU-wide civil liability regime, now left to Member States; the obligation to adopt a climate transition plan; and the obligation to terminate business relationships.
Penalties
A maximum of 3% of net worldwide turnover.

CSDDD and CSRD

The two are often confused. The CSRD is a reporting obligation: it requires companies to disclose sustainability information. The CSDDD is a conduct obligation: it requires companies to carry out due diligence. A company can comply with the first while failing the second.

How the CSDDD affects US businesses

A US company with more than EUR 1.5 billion in EU turnover is directly in scope. Many more are reached indirectly, as suppliers and business partners of in-scope companies, through contractual assurances and information requests. The Omnibus narrowed those requests; it did not eliminate them.

Primary source: Directive (EU) 2024/1760, as amended by Directive (EU) 2026/470 (Omnibus I)

Extractive sector

Human rights due diligence in mining

Mining concentrates the most severe categories of impact in a single operating footprint, and the difference between a policy and a program is visible on site. Solari's HRDD work includes implementation at an operating mine in Africa, where due diligence had to function inside the operation rather than above it.

Downstream, mineral supply chains carry their own expectations under the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas, which buyers and regulators increasingly treat as the reference standard.

Salient risks

Where site-level diligence concentrates

  • Land acquisition and resettlement
  • The rights of Indigenous peoples, including free, prior, and informed consent
  • Security and human rights, under the Voluntary Principles on Security and Human Rights
  • Artisanal and small-scale mining, including child labour
  • Water, health, and the environment as they affect communities
  • Workers' health, safety, and conditions, including contractors

Adjacent fields

Where HRDD meets AI, legal practice, and the Gulf

Human rights due diligence of AI systems

AI systems raise human rights impacts in their deployment, through discrimination, surveillance, and decisions about access to work, credit, and services, and in their supply chains, through the labour that labels and moderates training data. The EU AI Act requires certain deployers of high-risk systems to assess impacts on fundamental rights. AI governance and HRDD increasingly share a single method.

HRDD for law firms

The UN Guiding Principles apply to law firms as business enterprises, in their own operations and in the work they take on. The International Bar Association has issued practical guidance for business lawyers on applying them. Firms advising on transactions in high-risk sectors are increasingly asked how their own diligence accounts for human rights.

The GCC

In the Gulf, salient risks concentrate in labour recruitment and the conditions of migrant workers, particularly in construction and services. Companies supplying EU-regulated buyers carry those risks into the scope of the buyer's CSDDD diligence.

Common questions

Human rights due diligence, explained

What is human rights due diligence?

The ongoing process through which a company identifies, prevents, mitigates, and accounts for its actual and potential adverse impacts on human rights, across its own operations and its value chain, as set out in the UN Guiding Principles on Business and Human Rights.

What does HRDD mean?

HRDD stands for human rights due diligence. It is a standard of conduct measured by the risk to people rather than the risk to the company.

What are the steps of human rights due diligence?

Under the OECD Due Diligence Guidance: embed responsible business conduct in policy and management systems; identify and assess adverse impacts; cease, prevent, or mitigate them; track implementation and results; communicate how impacts are addressed; and provide for or cooperate in remediation.

Is human rights due diligence mandatory?

Increasingly. The EU's CSDDD makes it mandatory for the largest companies from 26 July 2029, and national laws in several European countries already impose due diligence or reporting duties. Outside those regimes, the UN Guiding Principles and the OECD Guidelines set the expected standard.

What are the requirements of the CSDDD?

After Omnibus I, companies in scope must conduct risk-based human rights and environmental due diligence, prioritizing the most likely and most severe impacts and their direct business partners. Scope is limited to companies with more than 5,000 employees and EUR 1.5 billion in turnover, or EUR 1.5 billion in EU turnover for non-EU companies.

What is the difference between the CSDDD and the CSRD?

The CSRD requires companies to report sustainability information. The CSDDD requires them to carry out due diligence. One is an obligation to disclose; the other is an obligation to act.

How does the CSDDD affect US businesses?

US companies with more than EUR 1.5 billion in EU turnover are directly in scope. Others are affected as suppliers and partners of in-scope companies, through contractual assurances and targeted information requests.

What does HRDD involve for a mining company?

Site-level assessment of the most severe risks, typically land and resettlement, Indigenous peoples' rights, security, artisanal mining, community health and water, and worker safety, together with supply-chain diligence under the OECD minerals guidance.

Related

Solari Institute · State Bar of California MCLE provider 21051 · Dubai Legal Affairs Department accredited provider TC-2026-825