Business and human rights: new challenges, new rules?

Caspar Leighton: Welcome to Ground Truth, the podcast from Control Risks. I'm your host, Caspar Leighton. In this episode, we're going to talk business and human rights. And yes, it's getting political, geopolitical in fact. There's a change afoot in the realm of business and human rights that is taking the field in its modern form, from the 1990s birth of corporate social responsibility, into something very different. 

To discuss this, I'm joined by two Control Risks colleagues: Dr James Sinclair, who is our Head of Business and Human Rights, based in Abu Dhabi, and also Claudine Fry, a Geostrategic Advisory partner based here in London. 

James, if you peer back into the long history of the relationship between business and human rights, it's a massive topic. I mean, you could look at the transatlantic slave traders, the high watermark of ghastliness, and everything that's gone from there onwards. But at what point did business and human rights become a thing where professionals like you actually turned your full attention to it and addressed it as a serious topic that businesses need to get across? 

James Sinclair: It's a really good question, and you could spend hours going right the way back into the long history of the relationship between business interests and human rights. It's many, many hundreds of years old, at least, as you've alluded to. I think the answer, in terms of the modern interpretation of what we think of as business and human rights, is that it probably began in the 90s. 

And in an important respect, today's discussion isn't really about human rights at all. It's about geostrategy and geopolitics and nationalism and protectionism and outsourcing and globalisation, in many ways. And that's where the story begins, because, as you'll know, from the late 80s onwards, US, European and UK manufacturers outsourced a lot of their production to South Asia, Southeast Asia and other parts of the world. 

They were doing that for a very particular reason. They were looking for cheaper workers, workers who were less well protected than they were in their own jurisdictions, in order to make more money per unit on what they were selling. And this, of course, was hugely beneficial to those companies and also to consumers in the West. We got a big dividend from that. 

But it only took a few years after that process began for more progressive consumers in the West, if you want to call them that, to become aware of some of the more egregious abuses that were becoming manifest. We talk about sweatshop labour and that sort of thing, and that became quite a high-profile news story in about the mid-90s. You had books like No Logo by Naomi Klein. You had my PhD examiner, Kevin Bales, who wrote a book called Disposable People in 1999, which was nominated for the Pulitzer. So you started to get a lot of people interested in this subject, but businesses were responding in quite a light-touch way. 

It was very much codes of conduct. It was companies coming together to form associations to try to put pressure on factory owners, and some of that had an effect, but it was very much in the corporate social responsibility space, as you've alluded to. It wasn't until much later that it started to become codified, and we can get into that. 

Caspar Leighton: At a certain point, I guess, guidelines started to come out, frameworks started to come in, and companies started, at least, to try to show that they were doing something about it. But at what point did governments and society realise that this wasn't really cutting it? And what was the change that happened? 

James Sinclair: Well, I talk about three eras of business and human rights. The first era, as we've touched on, is the corporate social responsibility piece, where companies were essentially marking their own homework. They were trying to raise the issue on the margins, but essentially justifying their existing business models, with some improvements. 

Then we had a second era, which, well, actually, I think the first era bleeds off from corporate social responsibility into the development of frameworks. In 2002, the UN started a process called the Norms on Business and Human Rights. But that was a process largely dominated by academics, by NGOs, by Global South representatives, and it was perceived as being quite anti-capitalist, quite punitive towards companies. For that reason it didn't get much buy-in, and it was quietly dropped in about 2005. 

Then you had the process that produced the United Nations Guiding Principles on Business and Human Rights, which were developed by John Ruggie and his team. John was a professor at Harvard University, and he was very clever because he approached the subject from a slightly different angle. Rather than thinking about this as a group of angry consumers against companies, he thought about how we use the existing architecture of the rules-based order: partly international law, but also the rule of law itself. He borrowed from corporate law the concept of due diligence, which until then had almost exclusively been used for mergers and acquisitions, and applied it to human rights. That's what we now call human rights due diligence, which is the process of methodically asking the right questions, getting answers, and acting on those answers. 

There's more to it, but essentially that's the process. It was going with the grain of something that businesses instinctively understood, that employers understood, that governments understood. And for that reason, he got much more buy-in. So, there was a moment in time around 2010, when the UN Guiding Principles were initially published and the OECD guidance was updated, where there was a coming together of all those key stakeholder groups around this core concept: that businesses needed to take more seriously their obligations to check what was happening in their supply chains and to remediate problems where they found them, and that states had an obligation to protect human rights. 

Caspar Leighton: I've heard the word "obligation" twice there. Is that the big shift we're seeing here? It's, yeah, rubber hitting the road now. 

James Sinclair: Yeah, it is. But what's interesting about the UN and OECD guidance is that they're very aspirational. They're not putting a ceiling on where you can go. They're effectively providing a hard floor, but then saying it's up to companies to go on an iterative improvement journey, so that they're not just stuck in a rut of very small incremental improvement but looking to improve significantly over time. That's quite a unique process. 

What happens next gets us into the second era, which is the hard law era, where we do start to talk about obligations from a legal perspective. That's everything from the UK Modern Slavery Act in 2015, and the French Duty of Vigilance Law, which was the first proper due diligence law (the Modern Slavery Act being a reporting law), and then the German act and the Norwegian Transparency Act, all of these national-level obligations, which were then overlaid with the European CSDDD, the CSRD and other Green Deal-type regulations. 

This second era was characterised not necessarily by the ambition of a framework design, but by the idea that we need to hold people's feet to the fire more acutely, by putting in place hard law that will ultimately backstop this with penalties in the event of failure. But it was still very much a facilitative environment, if you like, from a legal perspective. We have now, I think, entered a third age, which perhaps we'll get on to. 

Caspar Leighton: I'm going to stop you there, because key to this third age is something that is in Claudine's area of expertise. What's been happening to geopolitics during this time that James has been covering? 

Claudine Fry: So, in a nutshell, the values-based, Western-led world order which birthed this legal era, the period over the 2000s and 2010s when frameworks, legislation and guidelines were being codified and formulated, setting very clear obligations on the part of business with respect to human rights, that world order is being increasingly challenged by states which have very different values and priorities. That's the new "rules, no rules" world we've been talking about as one of our top risks for 2026, isn't it, Caspar? 

We've seen geopolitics, essentially competition between states for power, influence and resources, eroding the legitimacy and supremacy of the institutions and concepts that had seemed to be universally accepted over the last 80 years. All of these institutions and concepts have become, or are vulnerable to becoming, increasingly politicised. And I think it's important to note that this isn't just about different views emerging about human rights between different parts of the world. This isn't straightforwardly east versus west or north versus south. It's an issue that is now contentious even within countries, between more democratic and more authoritarian countries, and between the left and right wings of the political spectrum as well. 

If we look at the debate over the last few years about the situation in Israel and what's happened in Gaza, and particularly the use of the word "genocide" to describe what's happened in Gaza, that's a really good illustration of the fact that the debate about human rights is one that divides even communities within countries. 

We've also had, just in the last few days, the controversy about the Nobel Peace Prize award this year to Navi Pillay, the South African former judge of the International Criminal Court, condemned by the US president, Donald Trump, who described it as an indelible... What did he say? 

Caspar Leighton: It's an indelible stain on Norway. 

Claudine Fry: So here we have a human rights issue dividing members of NATO, and it's one of many issues which put the transatlantic alliance under strain in ways that will have very real consequences for business. I think it just highlights the fact that it is values that are at the core of a number of different geopolitical fault lines. 

Caspar Leighton: So the practice of business and human rights is experiencing some seriously heavy weather right now, isn't it? 

James Sinclair: Yeah, I think that's fair to say. And that cuts across in many ways, because what I call the weaponisation of human rights by various different actors across the political spectrum puts business and human rights practitioners in a difficult spot. We are no longer seen as people acting in good faith for the rights and interests of people, helping companies leave a lighter footprint on the planet. We're now seen as agents of a foreign agenda. And this follows on from the ESG backlash that came a few years ago, with a very politically motivated idea of undermining the whole sustainability agenda. We know where that came from. All of this has put business and human rights practitioners in a difficult spot. 

But that's not the biggest problem. The problem is that the rights holders, who ultimately rely on companies doing the right thing and governments doing the right thing, are increasingly being let down. It also puts companies in a very difficult position, because they are sometimes put in an impossible situation, where you've got a government here saying, "We require you to do the following things, under pain of penalty," at least nominally because of a human rights concern, and another country over there saying, "If you do any of these things, we will punish you for it." 

That puts general counsel and board members, particularly of large publicly traded companies, in a very hard position, because they're not allowed to go around breaking the law. That's not part of what they do, but they're put in a position where they have to break one law or the other. So I think the practical consequences of this weaponisation of human rights, and the retreat back to nationalism, can be quite profound. 

If we think about things like minerals and mining, the entire supply chain of a lot of companies is bound up with geopolitical questions: questions of supply chain, sustainability, human rights issues, or hard trade issues. There's a lot going on there, and it is becoming increasingly difficult to navigate these waters, particularly when you throw hard law into the mix. Whilst that can be a very effective weapon for changing behaviour, it can also provide perverse incentives, and it can undermine companies' willingness to be open about what they do and to act effectively. 

Caspar Leighton: Claudine, the companies you advise on geostrategy, what's their take on where business and human rights stands in the whole range of things they're having to consider as they plot their strategy for the next six months, a year or two years? 

Claudine Fry: Well, I think the awareness of human rights as a strategic business risk issue varies significantly across sectors. Companies that are in any way linked to mining or manufacturing or sourcing food, it's always been a thing, and I think they are very familiar with the evolving regulatory landscape. But James, I don't know if you'd agree with this: I would suggest that the sleepless nights are probably concentrated in particular teams, the procurement team, the sustainability or human rights team. I'm not sure how often it's considered a strategic risk issue by the board, for example, until it suddenly jumps up and becomes one. 

James Sinclair: Well, that can be for several reasons. I think it is becoming more of an issue in the C-suite, partly because of the laws being passed which are demanding attention. But reputation issues continue to be a driver. In our practice, if you asked me honestly what the number one driver is of companies that come to us, I would say it probably still is reputation concerns, as it has been for 30 years. Regulatory concerns are definitely coming up on the rail. Issues around investment and insurance are definitely there. So we're seeing a wider range of stakeholders getting involved in the discussion: legal counsel, the sustainability departments, to the extent that they exist. And boards are increasingly under pressure to consider this. You often have independent board members who come in with their own views and may have seen stories in the press. 

We deal with clients who have had serious reputational damage as a result of an exposé by an investigative journalist or an NGO, and that can be a driving factor at times. That then has a knock-on effect on other companies. But the conversation is wider, and it's also becoming more fragmented and more complex as you get these geopolitical questions, legal questions, ethical questions, insurance questions, all of these things coming in. The problem with that is it creates a muddiness and a cloudiness about what should be quite a straightforward discussion. And my fear is that our attention is being diverted away from the key issues. 

Caspar Leighton: And yet it's anything but straightforward to be facing a situation where complying with rule A in one country means violating rule B in another country. 

James Sinclair: Exactly. This conflict-of-law question: conflicts of law are not new in and of themselves, but having a directly and intentionally contradictory law is quite rare. All countries around the world have different laws, and sometimes they intersect with one another in unfortunate ways. But it's quite rare for one country to pass a specific law designed to block a very specific piece of legislation in another country. The position that puts companies in the middle, who are operating in both places, is really tough, because they're having to make judgements. Can we continue to operate in these jurisdictions? Which jurisdiction is more important to us? Are we prepared to take penalties from one and not the other? Do we have other options? 

Sometimes those options are quite seismic or existential: removing entire supply chains, setting up different divisions of companies, having a division that just does this or just does that, or taking goods and services out of particular places. So these are becoming really profound questions about what the company is for, what it does, how it operates, where it operates. They're not entirely novel, but they're becoming more relevant. 

Caspar Leighton: So, James, are we going back, perhaps, to a time when human rights due diligence could make a bit of a comeback in addressing this issue? 

James Sinclair: Well, I think yes and no is the answer to that. I'll start with the no. The no is because if we look at laws like the Forced Labour Regulation, which is due to come fully into force at the end of next year, in '27... 

Caspar Leighton: That's an EU one. 

James Sinclair: That's an EU one, yeah. In some ways it mirrors, but in other ways it expands on, the Uyghur Forced Labor Prevention Act passed by the United States in 2022. And the reason I'm saying no to the due diligence point is that this is specifically not a due diligence law. It says so. It is an obligation of outcome, not of effort. The touchstone of due diligence laws is that they're process-driven and effort-led. And this actually has echoes in section 7 of the UK Bribery Act, which says that if you've got reasonable measures in place, then the fact that bribery has been found in your supply chain won't necessarily be fatal, but you need to have demonstrated that you took all reasonable measures to prevent it. This is sometimes known as the safe harbour type of defence. 

The EU Forced Labour Regulation is an obligation of outcome, but with no safe harbour. There is no "Oh, you tried very hard here, so we're going to give you a pass." It just says that if you have any taint of forced labour in any part of anything you have in your product, with no de minimis rule, it is not coming into the EU. So what this is doing is fundamentally cutting across the question of due diligence. For 30 years now we've been telling companies: do your best, resource effectively, take a risk-based approach, prioritise your concerns, and make sure you're making positive, iterative progress. That's due diligence in a nutshell. Outcomes-based laws are not that. You need to achieve a certain standard, and if you don't achieve it, you are not coming into this jurisdiction. 

And that standard, I would suggest in this case, is practically impossible in many cases, because you're talking about any company that has any dealings with cotton or polysilicon or lithium or cobalt. By the way, that's a large chunk of the modern economy. Any such company is going to find it almost impossible to comply with that law taken at face value. This is one of my problems with it. I'm putting my legal hat back on here: law has to be transparent, it needs to be effective, it needs to be enforceable, and it needs to be understood by everyone. And it shouldn't be at the whim of politicians to turn the dial up and down depending on what they want. 

Caspar Leighton: So are companies being pushed to meddle with the law a bit, make it work for them, get away with what they can, to put it in blunt terms? 

James Sinclair: Well, what we've learned from the Uyghur Forced Labor Prevention Act in the US, which is essentially a trade ban dressed up as a human rights provision, is that, let's be clear, it's not designed to be complied with. It's designed to drive behaviour in a very particular way. In other words, to prevent companies from operating in a particular area. 

Caspar Leighton: The weaponisation of human rights. 

James Sinclair: Exactly. Now, what we've seen in relation to that is a number of commercial strategies starting to emerge. You have some companies doing their very best to document their way out of it. They're going really deep into their supply chain and getting as many proving documents as they can to show either that they're not operating in that particular region, or that there is no forced labour in the supply chain. Proving a negative is very difficult, by the way, but I'll leave that to one side. So that's one strategy: let's try to comply with something that's not really meant to be complied with. 

The second is avoidance: let's ship things through another jurisdiction and pretend they came from there all along. The US government has become quite wise to that in recent years. There's the nuclear option of taking your entire supply chain away and reformulating your whole business so that you're not faced with that particular jurisdiction. And then there's what I call the hidden hope: just keep your head down and hope you're not going to be enforced against. I think quite a lot of companies are in that camp. 

In my view, that's not how the law should be used. The law is there to be complied with properly, and companies should be able to have a fair run at it. They shouldn't be saying, "Well, I've seen shoplifters in London, so we're just going to keep doing it until we get nicked." That's not how the law should work. 

Just to finish my earlier point, about when I said "yes and no": the "no" is inasmuch as these regulations place a duty of outcome. The "yes" is inasmuch as companies that understand their supply chains really well, right down to raw materials, and are able to make changes where they need to, are going to be more resilient organisations more generally. So investment in really good supply chain due diligence is still money well spent, because it's ultimately the only real way you're going to be able to manoeuvre your way around this, whatever decision you take, whether it's to try to document your way out of it or move your way out of it. You can't do any of those things unless you have a really clear picture of where your risks lie and you've drilled down into them. 

Unfortunately, it's still the case today that most companies I come across have not grasped the level of investment and commitment required to make that happen. It's possibly slightly controversial, but I come across companies who talk a good game on sustainability, and when you dig into it, it's a $5 billion company with two people in the sustainability department. To my mind, that is not taking the problem seriously. 

To get to the bottom of this, we need to treat human rights risks as resilience issues, and as serious issues that carry serious penalties and need to be resourced appropriately. Then you can say, "We understood where our risks really are, and we think we need to prioritise this, this and this," sometimes for legal compliance reasons, sometimes for sustainability and ethical reasons, sometimes to meet a certain stakeholder's obligation. But unless you know those things, you can't do anything. 

Caspar Leighton: So if business and human rights has been hijacked, essentially, by the geopolitical agenda, Claudine, can we put the genie back in the bottle? Could this get to a point where geopolitics is less influential in terms of business and human rights? Do we need a geopolitical shift? Any sign of that happening? 

Claudine Fry: Look, I think geopolitical turmoil is here to stay for the foreseeable future. At some point it will reach a climax and things will settle down again, one would imagine. I think we have to work on the assumption that into the next decade, at the very least, things will continue to be very fraught, because there is a lot at stake, and there is very little incentive on the part of the key states involved, who really have the strength and capacity to influence the overall geopolitical environment. The incentive is to continue the battle for supremacy in certain areas that are strategically significant. We've also seen the use of regulation as a tool in a continuing geo-economic war that's very well established. On human rights, what we've seen emerging in the human rights sphere in this third era that you're talking about, James, is just one part of a bigger conflict that's playing out. It's one part of the toolbox. 

It's not only well established, it's also, frankly, effective for countries to use regulation in this way to protect their interests and try to win influence over their adversaries. So, yes, I think we have to work on the assumption that the weaponisation of human rights, and conflict over value systems, will continue. Business is operating in a very contested space around what is legitimately considered an obligation on the part of companies with respect to the way they operate in different communities, and which laws they need to prioritise. I think that will be a contested space for the foreseeable future. 

But it's important, to the point James was making, to resource your human rights risk in recognition of the fact that it is a fundamental resilience issue. That plays into understanding your exposure at a very local level. It's one thing to be conscious of the geopolitical context and how it's driving the overall risk environment, but it's quite another to unpack what that means in the vicinity of a particular factory or mine. That requires really accurate intelligence to build a picture of what the actual human rights issues are, and what our capacity is both to comply with the law and to make sure we're operating in a responsible and sustainable way. So it's having a good sense of the strategic picture, but also an intelligence-led approach to understanding what's happening on the ground. 

Caspar Leighton: James, we've got a couple of questions for you. As an expert in this field, what's the playbook for companies that want to do the best job they can in this very difficult set of circumstances? And I'm also interested in the lobbying power of some companies, which is very great. What's the capacity for businesses to push back and say, to your point, this isn't really workable? We want to be able to comply, but we just can't. Can you help us out? Can we look at addressing this and shifting things back to a more pragmatic state of affairs? 

James Sinclair: I think it's important to pick up on Claudine's last answer, because it's really important. We're often asked by clients to go and do difficult things in difficult places. The Copperbelt is a really good example. 

Caspar Leighton: In Africa. 

James Sinclair: In Africa, so DRC, Zambia, and other parts of that area of Central Africa. At Control Risks we're known as an all-terrain company. We can go places and do things that perhaps other companies can't. We're used to getting on the ground very quickly and getting really good ground-level intelligence, signals in real time, from people who are there, embedded in the communities. That's absolute gold dust. So if you're a company that really needs and wants to know what's going on, that's where you start. Go to the local level as quickly as you can. We have a tendency, as we're doing here today, to talk at quite an abstract level, but the real business of business and human rights is done locally, in communities. It's labour rights, it's community rights, it's interactions with suppliers. It's how you make sure that your business, operating as it does in a local context, is leaving a light footprint. You're only going to know that if you're talking to people who are really there and really doing it. That, I think, is the critical thing. 

Then it's about building up your capacity internally as a company. I use this analogy with clients: imagine yourself sitting in a courtroom three years from now, facing a particularly aggressive lawyer asking you some very difficult questions that you'd prefer not to be answering. What documents, what procedures, what processes do you want in your metaphorical briefcase to be able to answer those questions? How do we put those documents in your briefcase today, over the next six weeks, or whatever the project timeline is, so that you can answer those questions and do so persuasively? That's the playbook we recommend, because it will get you out of a jam, whether it's a court of law, the court of public opinion, a regulator, or another stakeholder who comes along and says, "By the way, there's been a terrible accident at this site. Several people have lost their lives, tragically. What did you do? What did you know? How did you act? Show us your work." 

Caspar Leighton: Show us your work. 

James Sinclair: And this is the essence of due diligence. It's basically: I have thought hard about what these risks might look like, and I've come up with a way of meeting that challenge that's going to be effective and appropriate in the circumstances. That's the test. If you can't do that, you're going to be in trouble, whether that's in a court of law or the court of public opinion. 

The second question is really interesting. We talk about lobbying and about where companies run. It's tempting to see the winds of this geopolitical era blowing companies around, and for many that's true. But others are also shaping that wind a bit, of course, and they have power. We've seen that power used for good and ill over the last few years by companies looking to either boost or bring down legislation, depending on what suits their circumstances. So there's definitely an element of lobbying going on here, which we need to be cognisant of. 

We saw an interesting report by Mario Draghi a couple of years ago, where he talked about competitiveness and incentive systems within the EU, and how the EU, in his reading, had become overregulated and was stifling ambition and innovation. I think that touched a nerve with a lot of European companies, because there is a feeling that Europe has gone too far down that road. I personally think his analysis may well have been sound, a bit like Karl Marx, but his prescriptions, I think, were a little dodgy at times, because he was taking aim at due-diligence-type laws which hadn't even come into effect yet. It wasn't clear to me how they could have been responsible for the malaise he was diagnosing. But we'll leave that for another day. 

I do think incentives are really important, whether you're talking about taxation, regulation more generally, or geopolitical positioning. Companies need to understand that doing the right thing is also going to be the right business decision. If you're resorting to appealing to the better angels of corporate nature, then you're always going to be on to a losing wicket. You need to be able to talk the language of business, to persuade companies that this is in their interest, not necessarily their immediate financial interest, because often it isn't. Let's be honest about that. But it's in their interest in terms of how they position themselves for the future, whether that's to be on the right side of regulation, of stakeholder sentiment, of reputation management, whatever it is. You need to be able to demonstrate that this thing is worth doing. 

The problem with the geopolitical situation at the moment is that the winds are blowing quite hard against us. You have politicians, who you don't need me to name, around the world who treat human rights with contempt in various ways, and that message filters through to the boardroom. What we've seen over the last two and a half, three years is a lot of pulling back from what was actually quite a firm agenda. A lot of companies that were moving in this direction, wanting to understand their business and human rights risks much more effectively, are suddenly saying, "Well, now we can get away with not doing that. That looks like a cost to me, and I'd rather not take that cost. There's no penalty for me not doing it, so I'm not going to do it." So the political agenda and the geopolitical situation matter, because they percolate through to the decision makers in the boardroom. 

Caspar Leighton: Well, that feels like an excellent place to leave this conversation for the time being. I'd like to give my thanks to Dr James Sinclair and Claudine Fry, and thanks to you for listening, or watching, or however you consume this podcast. Stay tuned for our next edition in just under a month from now. Thanks for listening. Bye-bye.