Human Rights Due Diligence for Arms Companies: Lessons from Supply Chain Regulations

Abstract

In comparison to other high-risk industrial sectors, human rights due diligence (HRDD) in the arms sector remains unclear and underdeveloped. This article elucidates how supply chain regulations can provide pertinent guidance for clarifying and elaborating the standards and requirements of the HRDD obligations of arms companies. Part I reaffirms the importance of independent HRDD obligations for arms companies due to the significant human rights risks posed by arms exports. Part II contextualises the limitations in the development of HRDD in the arms industry by examining the corporate policies of major arms companies. Part III explicates why supply chain regulations for conflict minerals are suitable guidance for clarifying and elaborating the HRDD obligations of arms companies. Part IV details five elements of an HRDD framework for arms companies that are essential for comprehensively identifying, evaluating and addressing the human rights risks of arms exports. Part V offers concluding remarks.

I. Introduction

The arms trade represents a complex intersection of security, business and human rights. Numerous studies and reports have confirmed that commercial arms sales and military aid (referred to collectively as “arms exports”) can have significant direct and indirect impacts on the human rights of individuals and communities, especially those in volatile and conflict-prone regions where there is increased demand for weapons but often tenuous respect for human rights and international humanitarian law. ¹ In Yemen, for example, the United Nations (UN) Human Rights Council confirmed that exported weapons have been used by Houthi armed fighters and coalition forces to cause harm to civilians and to commit human rights violations, including murder, torture, cruel and inhuman treatment, rape, outrages upon personal dignity, denial of fair trials, and enlisting of child soldiers. ² Arms exports can also hinder development in post-conflict states, with the excessive availability of arms being linked to other long-term consequences such as declines in population health, food insecurity, forced migration, and the destruction of cultural property. ³ Despite the vast amounts of documented human rights violations, conflicts such as Yemen continue to be flooded with arms, ⁴ as business opportunities and national security goals are advanced to the detriment of human rights protection.

Monumental changes in arms control have occurred during the twenty-first century, including the adoption of the Arms Trade Treaty, the first global arms treaty to establish international standards for assessing the human rights risks of conventional weapons. ⁵ However, these regulatory developments have predominantly focussed on the responsibilities of states due to the intimate links between arms exports and national security, resulting in a presumption that state responsibilities wholly subsume the obligations of all other actors involved in the negotiation, production, financing, and delivery of arms exports. Recently there has been greater acknowledgement that, alongside states, arms manufacturing and exporting companies (“arms companies”) sit at the top of the full value chain of the arms sector, which also includes actors such as arms brokers, arms dealers, banks, and shipping agents. ⁶ Arms companies are indispensable players in the arms export process, responsible for manufacturing weapons for government-to-government sales and military aid, initiating commercial sales for arms, and negotiating arms deals. Arms companies possess significant geopolitical and economic power, and are influential in the arms export decision-making process and in the military–industrial complex more generally, which enables them to drive decisions, for instance, on the availability and price of weapons. ⁷ In addition to intimate ties to their home states, arms companies also maintain close relationships with foreign governments, for example, BAE Systems is directly contracted by the British government to act on its behalf in arms deals with Saudi Arabia. ⁸ Through their industry lobbies, these companies also exercise their influence in the international arena, hindering regulatory developments that may weaken their positions commercially or politically. ⁹

For decades, in spite of the powerful positions arms companies hold in this sector, the arms industry (which consists of arms companies and their interest groups) contended that the imposition of discrete and additional due diligence obligations for arms companies could potentially undermine business confidence in states’ export licensing regimes. ¹⁰ With the spotlight brightening on their integral roles in the arms trade, expectations have increased in recent years for arms companies to conduct independent human rights due diligence (HRDD), with the failure to do so potentially resulting in public protests, negative press coverage, shareholder and investor backlash, and reputational and financial damage. ¹¹ The adverse human rights impacts of arms exports are key consequences that arms companies must address, and not merely a supplementary issue, because their core business activities involve manufacturing and delivering inherently lethal products that pose significant risks to human rights. However, there has been a distinct lack of political will across jurisdictions to update domestic export control regimes or adopt sector-specific HRDD legislation, even as arms companies themselves assert that practical HRDD guidance is necessary and desirable. ¹² Furthermore, while non-legislative efforts such as the American Bar Association’s Defense Industry Human Rights Due Diligence Guidance have provided a list of recommendations on elements to be included in a comprehensive HRDD regime – namely, risk assessments, prevention and mitigation measures, end use monitoring, and investigation of human rights violations – there is a notable lack of detailed guidance on how these measures should be implemented. ¹³

This article explores how, in the absence of clear regulatory HRDD requirements for arms companies, existing regulations for supply chains can deliver a blueprint for filling this gap and ascertaining the standard and scope of HRDD obligations for arms companies, while also improving transparency and accountability in the arms sector more generally. Part II contextualises the limited development of HRDD in the arms industry by examining the extent to which major arms companies have incorporated HRDD into their corporate policies. Part III explicates why supply chain regulations for conflict minerals, specifically, the Organisation for Economic Co-operation and Development’s (OECD) Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas (2016), the European Union’s (EU) Conflict Minerals Regulation (2017), and Switzerland’s Ordinance on Due Diligence and Transparency in relation to Minerals and Metals from Conflict-Affected Areas and Child Labour (2021), are pertinent guidance for clarifying and elaborating the HRDD obligations of arms companies. Part IV, drawing on the measures developed by these instruments, details five elements of an HRDD framework for arms companies that are essential for comprehensively identifying, evaluating and addressing the human rights risks of arms exports. Part V provides concluding remarks.

II. The development of HRDD in the arms industry

HRDD is premised on actors identifying, evaluating and addressing the human rights risks of their activities. Notable soft law instruments such as the UN Guiding Principles on Business and Human Rights (“UNGPs”) ¹⁴ and the OECD Due Diligence Guidance for Responsible Business Conduct (“OECD Due Diligence Guidance”) ¹⁵ have developed baseline standards for HRDD and general recommendations on the processes that should be implemented by companies. The UNGPs were adopted in 2011, three years before the Arms Trade Treaty entered into force, but it was only in 2022 that the implications of the UNGPs for this treaty were formally considered. ¹⁶ Comprehensive HRDD guidance, which details specific standards and tailored processes for arms companies, continues to be lacking, in part because arms sector-specific HRDD regulations have so far not been adopted in any jurisdiction. Consequently, in comparison to other high-risk industrial sectors, the HRDD obligations of arms companies remain unclear and underdeveloped. To contextualise the limited development of HRDD in the arms industry, this section reviews the corporate policies of ten major arms companies and assesses the current HRDD landscape.

Major arms companies have been at the forefront of developments in the arms industry because their considerable means and capacities have enabled them to adopt and implement policies that set industry-wide standards. Ten such companies were examined to gauge the current state of HRDD developments, selected based on the following criteria: (1) their appearance on the Stockholm International Peace Research Institute’s (SIPRI) 2022 list of the top arms-producing and military services companies; (2) their revenue from arms deals representing more than 50 per cent of total company revenue in 2022; and (3) their registration in the EU, the United Kingdom (UK) or the United States (US), jurisdictions which have regularly been top arms exporters (with a maximum of five selected from any jurisdiction to maintain some parity). ¹⁷ Although a detailed empirical study of arms companies’ policies would require broader geographical diversity, this review focused on companies from top arms-exporting jurisdictions that have led regulatory developments in export controls and HRDD legislation, due to the emphasis on recent policy advancements. ¹⁸ The EU Common Position on Arms Exports details the minimum standards that member states must incorporate into their domestic legislation, including export criteria requiring the assessment of human rights risks. ¹⁹ As a former EU member state, the UK has similar domestic export control regulations. ²⁰ The US export control system is touted as the “gold standard,” and provided the basis for provisions in the ATT. ²¹ In addition, HRDD legislation addressing human rights abuses in supply chains has been adopted by the EU (and its member states), the UK, and the US. ²² Table 1 summarises the companies and their policies on human rights, corporate social responsibility (CSR) and/or export controls which were reviewed.

Table 1. Summary of arms companies’ corporate policies.

All of the companies examined had at least one policy relevant to HRDD; however, some were only available in summary form or were merely referenced in other documents. ³³ Lack of transparency is an overarching challenge with the arms trade, and by restricting the public availability of their full policies, arms companies contribute to this issue and limit opportunities for scrutiny and accountability. ³⁴ Nevertheless, the general availability of relevant policies on HRDD indicates that major arms companies have taken steps towards implementing HRDD processes for arms deals, either in response to changing societal expectations or as a result of their involvement in illegal and controversial export practices being exposed. For example, Rheinmetall’s policy asserts that all companies of the Rheinmetall Group have a “special responsibility” to comply with the strict German and EU export controls, which require human rights risk assessments. ³⁵ This is particularly noteworthy as the company had previously threatened to sue the German government over the ban on arms sales to Saudi Arabia and attempted to circumvent this ban by using its Italy-based subsidiary RWM Italia. ³⁶ Other companies also acknowledge that non-compliance with domestic export licensing regimes represents a reputational risk for the company, which may be accompanied by loss of business and perception as an unreliable export partner. ³⁷

Furthermore, three commonalities stand out from the policies examined. First, in general, companies reference their implementation of risk assessment processes in accordance with regulatory requirements for export licences. ³⁸ Some companies specifically refer to the need for “enhanced” or “reinforced” due diligence because of the heightened risks of the arms sector, ³⁹ demonstrating an increased recognition of the need for discrete HRDD measures which are separate and additional to the efforts undertaken by states during the export licensing process. The integration of risk assessments throughout the business enterprise, as required by the UNGPs and OECD Due Diligence Guidance, varies, with many companies only assessing human rights risks for activities falling under their full and direct control, thereby limiting the risk assessments to their supply chains and not extending these to other business relationships including potential recipients of arms exports. ⁴⁰

Second, while several companies include the identification and mitigation of human rights risks as part of their risk assessments, ⁴¹ the criteria and processes used in risk assessments are only detailed by a few. General Dynamics asserts that it uses “a variety of tools, techniques, and analyses”, which may include site visits and meetings, open source and web searches for adverse media, and specialised database searches, among other methods. ⁴² Leonardo states that its risk assessment includes risk identification, qualitative and quantitative analyses of risk, a risk treatment action plan to reduce the impact of risks on a project, contingency management, and risk monitoring and review, which includes quarterly reporting on risk trends. ⁴³ RTX notably has its own Human Rights Council which “is responsible for assisting the businesses in their assessment of specific sales opportunities that may present heightened human rights risks,” reflecting the requirements of UNGP Principle 18. ⁴⁴ For the most part, however, the steps taken by arms companies to identify, evaluate and address human rights risks are not specified in their public policies and there is limited reference to the HRDD measures outlined in the UNGPs and OECD Due Diligence Guidance. Consequently, though there has been growing acknowledgement of the need for HRDD for arms exports, there is limited elaboration of the standards and processes involved.

Third, all companies issued a stand-alone human rights policy or statement (in some cases referred to as a CSR policy or statement) recognising the human rights impacts of their business activities and indicating how these impacts will be addressed. Leonardo’s policy on human rights provides the most comprehensive incorporation of human rights considerations, explicitly referencing the standards elaborated in the UN Universal Declaration on Human Rights and OECD Guidelines for Multinational Enterprises on Responsible Business Conduct. ⁴⁵ Some policies also detail how the company specifically addresses human rights risks, including maintaining a “List of Sensitive Countries” that are excluded as recipients of arms exports, ⁴⁶ or declining a potential arms deal where the risk to human rights or company reputation is unacceptable irrespective of whether that export would be legally permissible. ⁴⁷ L3Harris includes an option to terminate a business relationship if its policy is breached, though this option focuses only on the termination of relationships with suppliers and does not include customers, despite the latter being referenced as posing the “most salient risks.” ⁴⁸ Overall, although these measures represent positive steps toward developing HRDD for the arms industry, the policies and practices of arms companies in implementing HRDD remain unclear and undeveloped.

III. HRDD guidance from Supply Chain Regulations

In the past decade, HRDD in high-risk sectors has evolved significantly. The introduction of third-generation due diligence legislation imposing mandatory HRDD obligations marked an important shift in corporate responsibility. ⁴⁹ The political will necessary for the adoption of such regulations for the arms sector continues to be severely lacking, with national security being persistently deployed as a justification for ignoring the function of the arms trade as a business. While the adoption of arms sector-specific legislation remains unlikely in the near future, regulations and guidance adopted by other high-risk sectors offer models for clarifying and elaborating the standards and scope of the HRDD obligations of arms companies. In particular, supply chain instruments developed specifically for the mining of conflict minerals consider similar risk factors associated with arms exports, providing a blueprint for developing the HRDD policies and practices of arms companies. Supply chain management is vital in the arms sector because of the intricate networks of actors involved at various stages of production and export, as evidenced by some arms companies introducing standalone policies or sections in their human rights policies for supply chain management. ⁵⁰ The mining of conflict minerals, like the arms trade, involves complex, globalised supply chains and similar operational challenges, particularly with regard to the conduct of business activities in conflict-affected areas where the risks of prolonged cycles of violence and human rights abuses are exacerbated. ⁵¹ Both of these high-risk industries also evoke analogous moral dilemmas about their exploitation of conflict-affected regions and communities that are often very far removed from the decision-making arenas. ⁵²

The rigorous HRDD measures from the conflict minerals industry can therefore provide robust guidance for arms companies and supplement gaps in the regulatory framework for the arms trade. In particular, the OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas (2016), the EU Conflict Minerals Regulation (2017), and Switzerland’s Ordinance on Due Diligence and Transparency in relation to Minerals and Metals from Conflict-Affected Areas and Child Labour (2021) offer practical guidance for determining the standard of conduct and the scope of HRDD obligations required by arms companies, introducing processes essential for addressing human rights risks, and improving transparency and accountability. ⁵³ While Section 1502 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (2010) was one of the earliest regulations mandating disclosure and supply chain due diligence requirements for conflict minerals, it does not elaborate HRDD obligations in as much detail as the other instruments, and is therefore not extensively examined. ⁵⁴

The OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High Risk Areas (“OECD Supply Chain Guidance”) provides apposite HRDD guidance for supply chains in conflict mineral extraction, which has been integrated into domestic and regional laws, highlighting its growing normative force in this sector. ⁵⁵ The Guidance develops a five-step framework for identifying and evaluating risks in conflict mineral supply chains that requires companies to: (1) adopt an HRDD policy that is publicly communicated; (2) identify and assess risks; (3) design and implement a strategy for managing risks; (4) carry out third-party audits of the HRDD practices; and 5) publicly report HRDD policies and practices. ⁵⁶ The first three steps detail specific processes that can be adopted by arms companies, including developing HRDD policies, assessing human rights risks, and devising risk management strategies to address identified risks such as the temporary suspension of trade while pursuing risk mitigation or termination of a supplier relationship. Mechanisms such as traceability systems are especially relevant for risk management and oversight of arms exports. The reporting and independent auditing requirements in the latter two steps further enhance the former HRDD requirements and are essential for improving transparency in the arms industry as arms companies routinely utilise national security and commercial secrets justifications to limit the availability of information and data on arms exports. ⁵⁷

The EU Conflict Minerals Regulation 2017/821 (“EU Regulation”), in force since 1 January 2021, imposes HRDD obligations on EU importers of tin, tantalum, tungsten, and gold in their raw forms or as part of finished goods, which have possible origins in conflict-affected areas. The EU Regulation aims to ensure the responsible sourcing of these minerals and break the link between mineral extraction, human rights abuses, and armed conflict. ⁵⁸ The regulation incorporates models from the OECD Supply Chain Guidance and details a number of HRDD processes that can be utilised to clarify the scope and requirements of the HRDD obligations of arms companies. For example, Article 4 outlines obligations for EU importers to establish and maintain a supply chain due diligence system in compliance with the OECD Supply Chain Guidance’s framework. ⁵⁹ This includes requirements for risk assessments, risk management, traceability, and oversight, which are all features essential for evaluating and mitigating the human rights risks of arms exports. The EU Regulation also requires reporting on HRDD policies and third-party audits of HRDD practices, which are important complements for promoting transparency and accountability in arms companies’ HRDD policies and practices. ⁶⁰

The Swiss Ordinance on Due Diligence and Transparency in relation to Minerals and Metals from Conflict-Affected Areas and Child Labour (2021) (“Swiss Ordinance”), in force since 1 January 2022, imposes similar and complementary HRDD obligations to the EU Regulation. The Swiss Ordinance applies to companies “whose seat, domicile, head office or principal place of business is in Switzerland.” ⁶¹ This regulation’s scope of applicability is particularly notable as Switzerland is the base for over 900 companies in the commodities trading industry, which shares commonalities with the arms sector in terms of supply chain complexity and geopolitical risks. The Ordinance imposes HRDD obligations to prevent companies from contributing to conflict financing through procurement practices and details practical measures. ⁶² Companies are required to establish a supply chain policy that identifies, assesses, eliminates or mitigates “the risks of potential adverse impacts in its supply chain” through measures such as risk assessments, risk management plans, traceability systems, and oversight mechanisms. ⁶³ These measures are highly relevant for managing both human rights and diversion risks posed by arms exports, which are addressed separately by arms control instruments. ⁶⁴ Although security implications are emphasised as the primary reason for preventing the diversion of arms to unintended recipients or to illicit markets, weapons diversion also affects human rights as the actors acquiring arms through illicit means are usually those unable to legally purchase them, such as embargoed states or non-state armed groups with records of human rights abuses. Strengthening the link between risks of diversion and human rights in HRDD by arms companies is therefore necessary for enhancing transparency and accountability in arms exports, preventing the risk of arms being acquired by unauthorised users, and limiting the potential of exported arms being used in human rights violations or for other criminal purposes. ⁶⁵

IV. HRDD fundamentals for arms companies

Drawing on the instruments for conflict minerals and general guidance from the UNGPs and OECD Due Diligence Guidance, this section outlines five HRDD features for arms companies that are essential for identifying, evaluating and addressing human rights risks related to conflict dynamics, weapons diversion, and complex supply chain networks. The first two features – standard of conduct and foreseeability of risks – are key to clarifying the standard of conduct for HRDD obligations. The other three elements – risk management plans, traceability measures, and oversight mechanisms – are integral to the effective management of human rights risks. Additionally, as transparency is an ongoing challenge in the arms trade and requires integration throughout an HRDD framework to enable scrutiny and accountability of policies and practices, measures linked to improving transparency are discussed in relation to these five features, rather than as a discrete measure.

1. Standard of conduct

The standard of conduct required for HRDD in the arms sector remains unclarified in the existing regulatory framework. Ascertaining the standard of conduct is a necessary prerequisite for evaluating risks emanating from a company’s activities and business relationships, and for determining the “reasonable steps” that should be taken to prevent or mitigate these risks. ⁶⁶ HRDD is based on a standard of reasonableness that requires the balancing of human rights risks and other contextual interests. ⁶⁷ The UNGPs and OECD Due Diligence Guidance specify that HRDD should be conducted to a standard that is commensurate with the severity of the human rights risks and the likelihood of those risks materialising. ⁶⁸ For arms exports, this requires the severity of the risks related to the exported product, the potential recipient, and the proposed destination to all be taken into account. ⁶⁹ The severity of human rights risks is especially high in the arms sector because the exported products are designed for the purposes of killing and causing injury. These risks are exemplified by the factual circumstances surrounding the recipient party and destination. For example, a recipient party may have a history of using weapons to commit or facilitate violations of human rights or international humanitarian law. Destinations such as conflict zones amplify the risks of exported arms being diverted and misused due to conflict dynamics and practical difficulties in monitoring arms use and stockpile security. Principle 7 of the UNGPs places special obligations on states where corporations operate in conflict zones because of the exacerbated risks in these areas. ⁷⁰ Such requirements underscore the importance of arms companies also exercising additional caution and vigilance when exporting arms to conflict zones or to parties involved in armed conflicts, such as the coalition states engaged in the Yemen conflict. At a minimum, a high standard of conduct is required to reflect the lethality of the exported products and the increased risks presented by a recipient or destination.

In addition, the standard of conduct must also correspond with the capacities of arms companies to perform HRDD obligations, as reaffirmed by Principle 15 of the UNGPs, which requires that “business enterprises should have in place policies and processes appropriate to their size and circumstances.” ⁷¹ Although originally applied to determine accountability and the attribution of consequences, Sistare’s approach to assessing the capacities of an actor is relevant for this purpose because it focuses on ascertaining whether an actor can undertake preventive actions. ⁷² According to Sistare’s model, the capacities to perform preventive actions require an actor to: (1) possess the ability to voluntarily perform or cause an action; (2) have the capacities and abilities to control their actions at the time of the conduct including the ability to act with reason and intent and the ability to know and understand “crucial facts”; and (3) have adequate opportunity to exercise those capacities and abilities. ⁷³ Arms companies possess significant institutional capabilities and resources to perform a high level of HRDD, which is evident from the size of their business enterprises, the substantial profits they accrue, and the influence they possess in their business relationships, particularly when weapons are in increased demand. Indeed, in the examined corporate policies, some arms companies acknowledge that they have the capacities to conduct a high standard of HRDD and that it is in their reputational and commercial interests to do so. ⁷⁴ Accordingly, to properly reflect the severity of the human rights risks and the capacities of arms companies, a high standard of conduct is required by arms companies that involves the comprehensive investigation, evaluation, and management of risks.

2. Risk foreseeability

In the UNGPs and the Arms Trade Treaty, risk assessments are highlighted as an integral mechanism for identifying, evaluating and addressing human rights risks. ⁷⁵ Risk assessments hinge on the foreseeability threshold, which the OECD Due Diligence Guidance defines as a company’s ability to anticipate adverse impacts. ⁷⁶ The OECD Supply Chain Guidance elaborates that foreseeability requires proactive risk analysis using available information and data to forecast risks based on the factual circumstances, with approaches to be tailored according to the complexity and risk level of a company’s operations. ⁷⁷ Courts have clarified aspects of foreseeability for HRDD. Notably, the European Court of Human Rights determined that there is a sliding scale for assessing the degree of foreseeability, reflecting how remote or close a risk may be, with risks that are more likely to occur and to have particularly adverse consequences requiring more rigorous due diligence. ⁷⁸

In the arms sector, the foreseeability threshold has been insufficiently developed and lacks clarity. Arms control instruments either do not include an objective standard for foreseeability or have set thresholds too high by requiring actual knowledge of human rights impacts rather than the reasonable anticipation of human rights risks. ⁷⁹ Domestic courts have adopted divergent approaches to interpreting the foreseeability threshold. For example, the Administrative Court of Paris rejected an attempt by civil society to block a Saudi ship carrying French arms, ruling that there was no imminent threat to human rights. ⁸⁰ Similarly, the British government justified arms exports to Saudi Arabia by narrowly interpreting foreseeability, focusing on possible immediate risks rather than considering medium- and long-term impacts of the use of the exported weapons in the Yemen conflict. ⁸¹ In contrast, Belgium’s Council of State recognised the ongoing risks posed by exporting arms to Saudi Arabia based on past human rights and international humanitarian law violations in Yemen, and thus suspended export licenses to Saudi Arabia, effectively halting 75 percent of Belgium’s arms exports. ⁸² The Council noted that adequate evidence to confirm the exported arms would not be used to commit further violations was not available and found that the government had not properly considered those risks. ⁸³

The Belgian court’s approach is preferable for HRDD by arms companies, as it frames foreseeability broadly and requires the evaluation of past practices and longer-term risks. As part of a robust approach to assessing risks, it is essential that arms companies treat patterns of past violations as significant indicators of future risk and exclude parties with documented histories of human rights abuses as potential recipients. ⁸⁴ To improve transparency and accountability, this approach must be complemented by the reporting obligations that, as required by the Swiss Ordinance, enable “all interested parties to raise reasonable concerns about the existence of a potential or actual adverse impact”. ⁸⁵ Providing external stakeholders with the opportunity to challenge the risk identification practices of companies is especially important for exports to parties to armed conflicts because the potential defeat of a recipient party exemplifies risks of diversion and misuse of arms by an acquiring party. Indeed, in situations where the defeat of a party is a reasonably foreseeable risk, then it is imperative that arms companies emphasise export restraint and, when necessary, terminate client relationships. ⁸⁶

3. Risk management

Due to the destructive nature of weapons and the foreseeability of significant human rights risks resulting from arms exports, rigorous risk management is required by arms companies. The scope of obligations for arms companies must accordingly be expansive and involve the ongoing performance of HRDD to continuously assess risks as they evolve. Some national export regulations require the revocation of an export permit if reasons for denying the permit, such as a danger of the exported arms being used for an act detrimental to peace, manifest after an export licence is granted. ⁸⁷ In addition to imposing reporting obligations, such provisions contemplate the continuous appraisal by arms companies of the possession and use of the exported arms. These requirements also reaffirm that the existence of a state’s export licensing regime does not exclude an arms company from performing independent HRDD, a point acknowledged by a number of the companies examined. ⁸⁸ Risk management plans are a practical tool for reinforcing ongoing HRDD obligations. The Swiss Ordinance mandates that companies establish and implement a risk management system that identifies and assesses risks, implement measures to prevent or mitigate these risks, and regularly review the effectiveness of those measures in achieving their purposes of prevention or mitigation. ⁸⁹ This is complemented by reporting obligations and third-party audits, which are central to improving transparency and assessing the effectiveness of the risk management plans. ⁹⁰ The OECD Supply Chain Guidance’s framework likewise requires companies to design and implement a strategy to respond to identified risks, which includes reporting findings to senior management, adopting a risk management plan, and devising risk management strategies such as the temporary suspension of trade while pursuing risk mitigation or the termination of a supplier relationship. ⁹¹

By extending HRDD obligations beyond initial pre-shipment risk assessments, these instruments demonstrate that risk management plans can be utilised by arms companies to verify and monitor whether recipients are using the weapons lawfully and have adequate security measures in place to prevent diversion. Although export controls impose post-shipment verification requirements such as on-site inspections to validate whether exported weapons remain within the possession of the authorised end-users, ⁹² verification mechanisms must also be integrated into HRDD to manage risks linked to the intended recipients, the use of intermediaries, and the security of storage facilities. The Swiss Ordinance requires a company’s supply chain policy to incorporate verification mechanisms into risk assessment and management processes, which can include on-site checks, consultations with experts, and review of information from public authorities, international organisations and civil society. ⁹³ These verification measures can likewise be used by arms companies to engage in proactive and continuous risk management, and be complemented by reporting requirements to strengthen transparency and accountability. ⁹⁴

4. Traceability

Risk management plans are closely tied to the establishment of traceability systems. For example, in addition to developing a supply chain policy, the Swiss Ordinance requires companies importing or processing minerals or metals originating from conflict-affected and high-risk areas to adopt a tracing system to identify and evaluate risks. ⁹⁵ Tracking the possession and use of weapons is integral to monitoring and addressing the diversion and human rights risks of arms exports. However, there is currently no global or even regional system for marking weapons, which complicates the task of tracking arms exports after their delivery. Without the creation of a standardised marking system, arms companies bear responsibility for establishing marking procedures for their weapons, which can be supplemented by a traceability system for tracking their export and use. This is especially necessary for small arms, which are highly susceptible to diversion and continue to lack an independent verification mechanism. ⁹⁶

Monitoring arms exports is critical for accountability efforts and breaking cycles of conflict, particularly in post-conflict situations where resurgences in violence remain possible. The implementation of a traceability system is a practical step for strengthening the HRDD processes of arms companies. Arms companies can adapt specific measures from the Swiss Ordinance, such as establishing a comprehensive documentation system, to track arms deliveries and verify that weapons reach their intended destinations. ⁹⁷ In fact, this would be a practical measure for linking diversion and human rights risks, which require coordinated evaluation rather than separate risk assessments, as diversion can directly contribute to weapons being used to commit or facilitate human rights violations. ⁹⁸ Traceability measures reaffirm the importance of HRDD obligations continuing throughout the lifecycle of weapons and being combined with efforts to remove and destroy old and obsolete weapons to comprehensively address these risks. ⁹⁹ In addition, a traceability system must include reporting obligations and independent third-party audits to reinforce its effectiveness, which in turn can contribute to increased cooperation and targeted enforcement strategies by the arms sector more broadly. By implementing continuous risk management processes and rigorous traceability systems, arms companies can overcome the practical challenges and regulatory gaps in preventing and mitigating risks of diversion and misuse of exported arms.

5. Oversight

In combination with reporting and auditing obligations, oversight mechanisms are necessary for arms companies to monitor and address human rights risks within their own business enterprises and those linked to their business relationships, particularly with clients. Obligations for oversight of subsidiaries have become more pronounced in recent years. In 2021, the Dutch Court of Appeal affirmed that the duty of care of a parent company to prevent or mitigate foreseeable human rights risks includes oversight of the activities of its subsidiaries. ¹⁰⁰ The court found that the parent company, Royal Dutch Shell, owed a duty of care to affected villagers for the actions of its subsidiary and was liable for failing to prevent future oil spills. ¹⁰¹ As many major arms companies have subsidiaries registered in different states from the parent company, there is an increased need for oversight mechanisms as companies may circumvent legal responsibilities through the exploitation of loopholes or inconsistencies between jurisdictions. For example, Germany has some of the strictest export control laws in the EU which go beyond the requirements of the EU Common Position. To bypass these regulations and Germany’s ban on arms exports to the Yemen conflict, the German arms company Rheinmetall used its Italian subsidiary, RWM Italia, to sell weapons to Saudi Arabia that were subsequently used in airstrikes in Yemen. ¹⁰² The use of subsidiaries to exploit discrepancies in domestic export controls, and the complexities of the supply chains in the arms sector generally, necessitate the implementation of oversight mechanisms to monitor the performance of HRDD by arms companies.

Moreover, oversight for arms companies must extend beyond subsidiaries to include broader business relationships, including arms purchaser states, to assess and manage human rights risks. The UNGPs recognise that oversight is essential for HRDD, with Principle 17 recommending that HRDD cover the human rights risks of a company’s “own activities, or which may be directly linked to its operations, products or services by its business relationships”. ¹⁰³ RTX is noteworthy in this regard as the company has its own Human Rights Council, comprised of representatives from across its departments and business units, which provides oversight for its HRDD policies and “considers all potential human rights implications across the enterprise”. ¹⁰⁴ The EU Regulation offers relevant guidance for broadening such initiatives, requiring oversight duties to be assigned to senior management, who are also responsible for applying the risk management strategies. ¹⁰⁵ Oversight mechanisms imposing specific obligations on senior management are an effective way to ensure the effective implementation of comprehensive HRDD processes for subsidiaries, suppliers and clients. These obligations must be complemented by public reporting and independent third-party auditing of a company’s HRDD policies and practices to ensure compliance and promote transparency.

V. Concluding Remarks

The expectations for HRDD by arms companies have expanded substantially in recent years, including from arms companies themselves, who are increasingly acknowledging the need for independent HRDD irrespective of a state’s export licensing regime. The implementation of discrete and comprehensive HRDD by arms companies, which runs parallel to state responsibilities, provides important opportunities for minimising oversight and recklessness in arms exports by duplicating the efforts required to identify, evaluate and address risks. HRDD instruments adopted for the conflict minerals industry provide pertinent guidance for clarifying and elaborating the foundations of HRDD for arms companies, supplementing the existing regulatory framework, which currently does not include sector-specific HRDD legislation. Measures developed by instruments for conflict mineral supply chains, another high-risk sector with symbiotic risks and challenges, can be tailored to address the peculiarities of the arms trade, including the inherent lethality of weapons and the significant potential for their diversion and misuse.

Alongside general HRDD guidance, the sector-specific instruments for conflict mineral supply chains assist with the clarification and elaboration of five fundamental elements of the HRDD obligations of arms companies. First, HRDD by arms companies requires a high standard of conduct that is commensurate with their capacities and resources, their powerful positions within the arms sector, the inherent lethality of the weapons they produce, and the significant adverse human rights impacts of exporting those weapons, particularly to volatile and conflict-affected regions. Second, this high standard necessitates a broad approach to foreseeability that considers the past practices of recipients and longer-term consequences. Third, risk management plans are essential for continuously appraising risks identified by risk assessments and devising strategies to prevent or mitigate those risks. Fourth, traceability systems are an integral feature of risk management plans that must be utilised to track the possession and use of exported weapons, and provide a practical mechanism for linking diversion and human rights risks as two points on a continuum, rather than distinct categories of risks requiring separate obligations. Fifth, oversight mechanisms, such as oversight duties for senior management, are necessary to ensure the effective implementation of HRDD policies and practices. Finally, to improve transparency and accountability, these elements must be complemented by the publication of HRDD policies and reporting on risk assessment outcomes. In certain instances, however, HRDD will be insufficient due to the intractable challenges of performing these obligations, especially in conflict zones where physical access is restricted and opportunities for information collection are limited. In such cases, export restraint is crucial and must be implemented as the default response.