SOURCE 0 - THE PLAN ONLY ITS AUTHOR CAN DATE
Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)
Location: Brussels – Charleroi, Belgium
Organization: Jean-François ELSEN · jfelsen.com
Classification: Authoritative Public Release · July 2026
Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Compliance Officers, AI Governance Architects, Forensic Analysts, Critical Infrastructure Operators, Public Authorities
Series: SOURCE 0 Doctrine Series
[AI-SNIPPET]
Since a Paris court first condemned La Poste in December 2023 for an inadequate vigilance plan, French courts have shown they will substantively review a company's own duty-of-vigilance documentation — not merely check that one exists. The Paris Court of Appeal confirmed that ruling in June 2025, demanding a risk map that is structured and hierarchised, not a vague list. In June 2026, the Paris judicial court found TotalEnergies' plan incomplete for omitting Scope 3 emissions and ordered it completed within six months, under the court's own continuing supervision. This is real, active judicial scrutiny of vigilance plans under France's 2017 duty-of-vigilance law — now the primary liability vehicle in this space, after the EU's Omnibus I Directive deleted the harmonised civil liability regime originally built into the Corporate Sustainability Due Diligence Directive. What none of these proceedings can do is confirm what a company's plan actually said before the claim was filed. The document under review is always the one the company produces today.
[/AI-SNIPPET]
I. WHAT THE OMNIBUS LEFT OF EU-LEVEL LIABILITY
Directive (EU) 2024/1760, the Corporate Sustainability Due Diligence Directive, originally built a harmonised EU civil liability regime into its Article 22. The Omnibus I Directive (EU) 2026/470, in force since 18 March 2026, deleted it. Civil liability for a due diligence failure is now a matter for each Member State's own law, not a single EU standard. The scope of the directive itself was narrowed at the same time, to companies above 5,000 employees and €1.5 billion in worldwide turnover, with application from 26 July 2029.
This does not mean the underlying obligation — identify, prevent, and mitigate adverse human rights and environmental impacts across a company's operations and value chain — has disappeared. It means the law that will actually be litigated, in France at least, is not CS3D. It is France's own duty-of-vigilance law, Law No. 2017-399 of 27 March 2017, codified at Article L.225-102-1 of the Commercial Code — a text CS3D was modelled on, which predates it, and which now operates independently of whatever the EU regime does or does not require.
II. WHAT FRENCH COURTS HAVE ALREADY DONE WITH THIS LAW
On 5 December 2023, the Paris judicial court delivered the first-ever conviction under this law, finding La Poste's vigilance plan inadequate after the Sud PTT union raised concerns about undocumented workers employed by subcontractors. The Paris Court of Appeal confirmed that judgment in full on 17 June 2025 (No. RG 24/05193), ordering La Poste to substantially revise its plan without attaching a penalty payment. The appellate court was explicit about what a compliant plan requires: a risk map that is hierarchised and structured around precise, objective criteria — not a vague, generic list of concerns.
On 25 June 2026, the 34th chamber of the Paris judicial court went further in a case brought by four associations and the City of Paris against TotalEnergies. The court found the company's vigilance plan incomplete because it did not address Scope 3 greenhouse gas emissions, ordered the plan completed within six months under provisional enforcement, and retained jurisdiction — the case returns before the pre-trial judge on 21 January 2027 specifically to review how the required measures were integrated into the plan. The court rejected the claim for damages, but its ruling on the plan's substantive adequacy stands.
Two things follow from these two rulings, taken together. First, French courts are not treating the vigilance plan as a formality — they are examining its content in detail and ordering it rewritten when it falls short. Second, in both cases, the object of that examination was the plan as it existed at the moment of the ruling, assembled and presented by the company being examined.
III. THE QUESTION NEITHER RULING ANSWERS
Neither judgment addresses, because neither needed to, a separate question: was the version of the plan under review the same document, unchanged, that governed the company's conduct at the time the underlying risk arose — or had it already been revised, in whole or in part, in the period between the events at issue and the hearing? A vigilance plan is not a single fixed artefact frozen in time; it is a working document, updated as the company sees fit, published annually as part of its management report. Nothing in the law, and nothing in either ruling, required an independent party to have fixed the plan's exact content at an earlier date before the litigation began.
This is not a criticism of either court. Both rulings did exactly what the law asks of a judge — assess whether the plan, in its current state, meets the standard the law and the appellate court have now articulated. The question of the plan's state at an earlier moment simply was not, and could not have been, part of what either court was asked to decide. That earlier moment is not a single fixed point either: a plan may be adopted by the board, subsequently revised, and only later published as part of the annual management report — three distinct dates, any of which could matter depending on when the underlying risk is alleged to have arisen. Without an independent record tied to each of these moments, only the entity's own version history distinguishes them.
IV. THE ENDOGENOUS AUDIT PARADOX AT THE VIGILANCE PLAN
The party best placed to know what its own vigilance plan said last year is the same party whose diligence is now in question. Internal version histories, document management systems, and board approval records are all produced and retained within the company's own perimeter. If a dispute later turns on what the plan actually required at a specific date — rather than on the adequacy of the plan currently on file — the only account available is the company's own record of its own document.
This is the same structural pattern already documented across this doctrine's other fronts, applied here to a text that already has two years of active French case law behind it, rather than none.
V. WHAT AN INDEPENDENT SEAL WOULD ADD
If a company's vigilance plan, its underlying risk map, and its supplier due diligence findings were fixed by an independent third party at the moment they were adopted or materially revised, a later dispute over what the plan actually required at a given date would not rest solely on the company's own version history. The seal would not determine, on its own, whether the plan was substantively adequate — that remains for the competent court, exactly as it was for the Paris judicial court and the Paris Court of Appeal in the rulings above. It would fix what the plan's content actually was at that moment, so that a dispute over its state at an earlier date is argued against an independent record rather than the company's own retrospective account of its own document.
VI. WHAT SOURCE 0 DOES NOT CLAIM
SOURCE 0 does not replace any obligation under Law No. 2017-399, the Corporate Sustainability Due Diligence Directive, or the Omnibus I Directive. It does not determine whether a given vigilance plan is substantively adequate — that determination belongs to the competent court, as the Paris judicial court and the Paris Court of Appeal have already exercised it twice. Under French law itself, Article 1377 of the Civil Code provides that a private-signature document acquires date certaine against third parties once its substance is recorded within an authentic instrument — the same structural logic SOURCE 0 applies, save that the authentic instrument used is Belgian. A record sealed by a Belgian huissier de justice is not, for that reason, automatically treated as equivalent to a French authentic instrument for this purpose: French private international law subjects a foreign authentic instrument to a case-by-case équivalence review before it can be relied upon with comparable effect, rather than recognising it automatically. SOURCE 0 CERTIFIED denotes an attestation, delivered by Jean-François ELSEN, that the SOURCE 0 procedure was followed in a given engagement; it is not an independent third-party certification, since Jean-François ELSEN provides the service being certified. All engagements are governed by an obligation de moyens. Recognition of the Historical Reality Dossier is direct before Belgian jurisdictions; before French courts, it is assessed under this équivalence standard, not presumed automatic.
VII. FREQUENTLY ASKED QUESTIONS
Q: Do French courts already review the substance of a company's vigilance plan, not just whether one exists?
A: Yes — the Paris Court of Appeal confirmed in June 2025 that a compliant plan requires a hierarchised, objective risk map, and the Paris judicial court ordered TotalEnergies to complete its plan in June 2026. SOURCE 0 doesn't compete with that judicial review; it fixes what the plan actually said at an earlier date, independently of the company, for when that separate question arises.
Q: Since the EU deleted CS3D's harmonised civil liability regime, does that mean vigilance duties are now unenforceable?
A: No — in France, the 2017 duty-of-vigilance law already provides its own liability route, independently of CS3D, with two years of active case law behind it. SOURCE 0 applies the same independent-fixation principle to this national law's evidentiary gap regardless of what the EU regime does.
Q: If a court finds a vigilance plan inadequate today, doesn't that settle the matter?
A: It settles whether the plan, as currently presented, meets the standard — a real and substantive question the courts are actively deciding. It doesn't settle what the plan said at an earlier date, before the dispute arose, since nothing fixes that state independently. SOURCE 0 supplies that missing record.
Q: Could a company revise its vigilance plan after a claim is filed and present the revised version as if it always looked that way?
A: Nothing in the law or the rulings to date required an independent party to fix the plan's content before the dispute began, so this remains a real evidentiary gap. SOURCE 0 closes it by sealing the plan's state at the moment it was adopted or materially revised.
Q: Does SOURCE 0 determine whether a vigilance plan actually accounts for risks like Scope 3 emissions?
A: No — that substantive determination belongs to the court, exactly as the Paris judicial court exercised it against TotalEnergies. SOURCE 0 fixes what the plan said at a given moment, independently of the company, so that determination is made against a record rather than a reconstruction.
CLOSING AXIOM
The court can judge whether the plan is adequate today. It cannot confirm, on its own, what the plan said before the claim was filed — because nothing but the company's own record ever fixed that. SOURCE 0 seals what the courtroom cannot reconstruct.
REFERENCE NOTE
This article is based on Directive (EU) 2024/1760 (CS3D/CSDDD) and Directive (EU) 2026/470 (Omnibus I), and on French Law No. 2017-399 of 27 March 2017, codified at Article L.225-102-1 of the Commercial Code, and Articles 1353 and 1377 of the French Civil Code. Jurisprudence cited: Tribunal judiciaire de Paris, 5 December 2023 (La Poste); Cour d'appel de Paris, 17 June 2025, No. RG 24/05193 (La Poste, confirming); Tribunal judiciaire de Paris, 34th chamber, 25 June 2026 (Notre Affaire à Tous et autres v. TotalEnergies).
REGULATORY NOTICE
This document does not constitute legal advice and does not prejudge, comment on, or take any position on the merits of any ongoing judicial proceeding referenced herein, including the continuing supervision of the TotalEnergies vigilance plan before the Paris judicial court. Organisations should verify their specific situation with qualified legal counsel.
