Defining internal areas of responsibility is part of risk management. Just as important as appointing the person responsible for risk management and ensuring that risk analyses are managed by that responsible person is knowing to whom within the company the responsible person must report on risks.
Expanding the compliance function and the reporting line
Expanding companies’ compliance departments in this respect and placing those who will manage supply chain due diligence within the oversight mechanisms is necessary for compliance with both the Law and the Directive. Ensuring that the results of the risk analysis are communicated within the company to those authorised to make decisions, such as the management board or the purchasing department, is also an obligation. The person who is to fulfil this obligation must be identified when the internal areas of responsibility are defined.
Article 23: conditions for appointing an authorised representative
Article 23 of the Directive requires non-Union third-country companies within its scope to designate an authorised representative established or domiciled in one of the Member States in which they operate; the representative is empowered to receive communications from the supervisory authorities. Representatives must be entered in a register by the relevant Member State. The conditions for the valid appointment of a representative are as follows:
- The representative may be a natural or legal person.
- The representative’s registered office or place of residence must be in one of the Member States.
- The representative must have accepted the appointment.
- The representative’s name and surname, address, email address, and telephone number must be recorded.
Notifying the supervisory authority
This representative must be notified to the country in which the greater part of the required turnover is generated. The notification must be made in the language of the Member State requesting it. Accordingly, companies from Türkiye that fall within the scope must notify a supervisory authority in the Member State in which the authorised representative is domiciled or established — and, where different, the competent supervisory authority determined under Article 24(3) — that the company is a company within the scope of Article 2(2) of the Directive (Article 23(3) of the Directive).
The scope of the representative’s authority
The authorisation must also expressly state that the representative is empowered to accept service of process or all notifications in dealings with the supervisory authority and to ensure compliance with, and the fulfilment of, the obligations arising from the Directive. Companies must equip their representatives with every power necessary to enable them to work together with the official supervisory authority.
A practical test for dividing responsibility
The practical test when responsibilities are allocated is this: for every obligation, the questions who does it, who approves it and who it is reported to have to be answered in a written schedule of duties. A structure in which the results of the risk analysis never reach purchasing and management does not satisfy the duty of care, however carefully responsibility has been assigned on paper. Coordination between the compliance, legal, purchasing and sustainability functions has to be run through regular meetings and a proper record of them.
Preparation for the companies in Türkiye that will fall in scope
For companies in Türkiye that will fall within scope, the most critical preparation is the appointment of the authorised representative required by Article 23 of Directive (EU) 2024/1760, as amended by Omnibus I: who the representative will be, which supervisory authority they are notified to and what powers they are given all have to be planned before the application date of 26 July 2029. Doing this institutional preparation within the supply chain due diligence practice area costs far less than a hurried appointment made later.
