Website designed by SA / Build by MMD

On 5 December, a Paris Court found French postal service La Poste in violation of the French Duty of Vigilance law. The Judgment provides insight into the specific level of detail and consistency needed to comply with risk mapping requirements under the law. This is the first time a court has decided on the merits of a case and ordered a company to amend its vigilance plan.


  • The French telecommunications trade union Sud PTT began a legal action against French postal service La Poste in 2020 on grounds that it violated the French Duty of Vigilance law by failing to sufficiently address human rights risks, particularly with respect to subcontractors within its own operations in France.
  • On 5 December 2023, a Paris court issued its decision in the case. This judgment has direct implications for companies conducting a risk assessment as required under French law and is also important to note for companies covered by the EU Corporate Sustainability Due Diligence Directive (CSDDD), which also requires companies to conduct a risk assessment.

Key findings

  • The Judgment was based on a detailed analysis of La Poste’s 2021 Vigilance Plan. The following is a summary of the key findings:
    • La Poste’s risk map lacked sufficient detail on where risks were actually occurring and in what context. The Court determined that La Poste’s risk map described risks at a very high level but failed to provide sufficient detail. For example, La Poste reported that its risks related to discrimination included gender, race, health, etc. but it did not provide details on what the specific risks were and where they were occurring in its activities and operations.
    • La Poste’s risk prioritisation was inaccurate, as it was based on mitigated risks (net risks), rather than severity (gross risks). The Court determined that the prioritisation process was not based solely on severity but incorporated La Poste’s mitigation of risks. It stated “La Poste has decided to prioritise risks according to their severity, as they remain after the application of the measures already applied by the group”. This means that the risk prioritisation was inaccurate and not aligned with international standards and national legislation (French Code of Commerce).
    • The Court could not evaluate therefore whether the mitigation efforts being made by La Poste were appropriate to the risks. The Court found that La Poste’s vigilance plan did not sufficiently identify and document which risks associated with subcontractors were being prioritised. Accordingly, the Court could not evaluate whether the measures being taken to address those risks were appropriate. For example, La Poste reportedly performed onsite checks of driving licences and blood alcohol levels. However, the risk mapping did not include specific risks related to driver health and safety to determine whether this was an appropriate risk management strategy.
    • The Court found that La Poste had not shown that it had consulted trade unions when establishing its reporting (grievance) mechanism. The law requires companies to consult trade unions on developing the alert and reporting mechanism.
    • The Court found that the 2021 vigilance plan did not provide a useful analysis of the effectiveness of the measures taken or serve as a useful assessment to guide action in terms of vigilance. The law requires companies to establish “a system for monitoring the measures implemented and evaluating their effectiveness”. This is also required under the CSDDD.


  • The Court decided not to impose a penalty on La Poste because it has published a vigilance plan annually since the Duty of Vigilance Law entered into force and continually improved it. It ordered La Poste to strengthen its vigilance plan through the following actions
    • “supplement the vigilance plan with a risk map designed to identify, analyse and prioritise risks”
    • “establish procedures for assessing subcontractors on the basis of the specific risks identified by risk mapping”
    • “supplement its vigilance plan with a mechanism for alerting and collecting reports, after consulting representative trade unions”
    • “publish a real system for monitoring vigilance measures”.
  • No deadline was imposed for these steps.

Next steps

  • Sud PTT said that it was satisfied with the Court’s decision and its implications for subcontracted workers in France.
  • All other cases brought under the Duty of Vigilance Law have been unsuccessful to date. In two recent decisions concerning Total Energies and Suez, French courts ruled that the plaintiffs had not met the formal procedural requirements to bring a case, without even addressing the substantial requirements that companies must meet.


  • In light of the Judgment, companies conducting a risk assessment as required under the French Duty of Vigilance Law should ensure that they do so in sufficient and specific detail, establish a reporting mechanism in consultation with trade unions, and implement means to monitor and assess the vigilance measures in place.
  • Risk prioritisation in particular is a critical aspect to note when conducting such assessments. The severe risks in the risk assessment that are subsequently prioritised must be the gross risks, i.e. the risks prior to mitigation efforts.
  • Please note that our analysis is based on an unofficial translation of the Judgment.
If you have a project you would like to discuss