I. Introduction
The 2022 Russian full-scale invasion of Ukraine triggered a profound risk landscape, characterised by extreme uncertainty and the systemic breakdown of state functions and market logistics. A primary manifestation of this was the emergence of acute food insecurity, posing a critical risk to the health and dignity of millions. The first months of the war were particularly dramatic, as Ukrainian cities went almost overnight from peaceful places to experiencing massive shelling, with more than 20 per cent of the Ukrainian territory becoming occupied in the first week.Footnote 1 Access to food became most challenging. Cities with hundreds of thousands of people found themselves in situations where many grocery stores suddenly did not operate, and supply chains for delivering food to stores were disrupted. The right to food of hundreds of thousands of individuals, including vulnerable people such as older people, people with disabilities, and children, was not guaranteed.
This environment altered the state’s capacity to protect citizens and regulate markets was severely weakened. In this vacuum, private corporations, particularly food retailers, transitioned from mere market participants to crucial actors in the governance of risk, with their operational decisions directly determining the population’s access to essential goods.
Access to adequate food, and other basic needs such as drinking water, housing, healthcare and medicine, are key to human dignity and well-being.Footnote 2 International human rights law calls for ensuring such access, even during an armed conflict, a pandemic, or other emergency situations. But the state-centric nature of international human rights law offers limited guidance for corporate conduct when state authority falters. Soft law instruments like the UN Guiding Principles (UNGPs) articulate a baseline corporate responsibility to respect human rights, but the practical contours of this responsibility in a full-scale war – where companies become providers of essential goods – remain underexplored. While the UNGPs posit a baseline responsibility to respect rights, through a human rights due diligence process, we show that in prolonged emergencies, stakeholders demand that companies fulfill systemic risk governance roles, thus revealing an expanded scope and intensity of due diligence.
This paper explores this phenomenon of corporate-led human rights risk management in a high-uncertainty context. In wartime Ukraine, a powerful system of informal social regulation emerges, compelling corporate actors to become de facto governors of critical risk. Drawing on interviews and social media analysis, this paper examines how dynamic and often contradictory social expectations shape corporate conduct. We find that stakeholders expect companies not only to mitigate their own operational impacts but also to actively address the systemic human rights risks generated by the conflict itself. Based on these findings, we propose an empirically grounded model of “heightened human rights due diligence” (hHRDD) that moves beyond a firm-centric view to encompass the management of systemic societal risks.
Using food retailers in Ukraine as a case study, we develop an empirically grounded framework for hHRDD that conceptualiises it as an adaptive risk regulation tool. Our analysis is built on thirty-six in-depth interviews with Ukrainian residents and a large-scale content analysis of public social media discourse. We argue that hHRDD must encompass not only a company’s impact on human rights (the traditional view) but also its role in mitigating the human rights risks created by the conflict. This reframing has significant policy implications, particularly for the implementation of the EU’s Corporate Sustainability Due Diligence Directive (CSDDD),Footnote 3 offering a substantive model for what corporate risk regulation should entail in the world’s most fragile contexts.
We proceed as follows. Section 2 clarifies concepts of relevance for the paper that shape the corporate responsibility to respect human rights, and its application in situations of armed conflict. Section 3 describes our methodology. Section 4 presents our results, based on interviews conducted with residents of territories directly affected by the war in Ukraine and a large-scale content analysis of public social media discourse. Section 5 discusses the role of businesses in times of emergency, with a focus on situations of armed conflict, and proposes a new reading of the hHRDD concept based on our findings. Section 6 briefly concludes.
II. Conceptual framework: corporate risk regulation in conflict zones
This section outlines the key concepts that form the basis of our analysis, reframing BHR principles through the lens of risk regulation and governance.
1. Social expectations as a form of social regulation
This article uses the Business and Human Rights (BHR) framework. The BHR framework holds companies accountable for their impact on people and communities.Footnote 4 It argues that businesses have a responsibility to avoid infringing on the human rights of others, regardless of whether it is mandated by national law.Footnote 5
In 2011, the UN Guiding Principles (UNGPs) on Business and Human Rights were unanimously endorsed by the UN Human Rights Council. The UNGPs articulate a global expectation that companies respect human rights.Footnote 6 The corporate responsibility to respect human rights is described as “the basic expectation society has of business” and “the baseline expectation for all companies in all situations.”Footnote 7
The UNGPs are not legally binding. However, they represent a global consensus on the human rights duties of companies.Footnote 8 International organiisations, governments and businesses now use them as an authoritative standard.Footnote 9 For example, the OECD incorporated the UNGPs’ language into its Guidelines for Multinational Enterprises.Footnote 10
Principle 12 of the UNGPs states that “the responsibility of business enterprises to respect human rights refers to internationally recognised human rights – understood, at a minimum, as those expressed in the International Bill of Human Rights and the principles concerning fundamental rights set out in the International Labour Organization’s Declaration on Fundamental Principles and Rights at Work.” So, although the UNGPs do not explicitly mention the right to food, businesses have a responsibility to respect “internationally recognized human rights,” including socio-economic rights such as the right to food.Footnote 11
Our analysis relies on three key concepts: social expectations, social license to operate and stakeholder engagement. While sometimes used interchangeably, these terms have distinct meanings. We clarify them here to establish our conceptual boundaries. Social expectations refer to normative demands made by society on corporate actors, grounded in human rights, ethical norms or context-specific needs; they function as informal standards of conduct that guide corporate behaviour even in the absence of legal obligations.Footnote 12 In contrast, the social license to operate describes the tacit approval that companies receive from affected communities to continue their operations – a form of legitimacy that can be withdrawn if expectations are unmet.Footnote 13 While the social licence is primarily concerned with securing ongoing local legitimacy, it is not necessarily grounded in human rights discourse. Finally, stakeholder engagement is a procedural mechanism through which companies identify, assess and respond to stakeholder concerns; it serves as a key means of uncovering and interpreting social expectations.Footnote 14 Our analysis focuses specifically on social expectations as a normative lens for understanding corporate responsibility in fragile and conflict-affected contexts, where formal legal frameworks are often ineffective or absent, and where community demands exert a powerful form of informal regulation.
2. Human rights due diligence as a risk management tool
If social expectations function as a form of regulation, then Human Rights Due Diligence HRDD is the primary governance mechanism through which companies are expected to respond. HRDD is an iterative, ongoing process to identify, prevent, mitigate and account for human rights risks that a business may cause or contribute to through its own activities, or to which it may be directly linked through its operations, products or services via its business relationships.Footnote 15 From a regulatory perspective, it is a governance mechanism through which a company internalises external norms to manage legal, reputational and operational risks. The proliferation of mandatory HRDD laws, such as the EU CSDDD, signals a shift from voluntary self-regulation to co-regulation, where states mandate the process, but companies retain discretion over its implementation.
Since their adoption, the UNGPs have inspired legislation aiming to strengthen corporate accountability for human rights and creating binding due diligence requirements, such as the French Duty of Vigilance Law, the German Supply Chain Due Diligence Act, and the Norwegian Transparency Act. They also inspired the development of the EU CSDDD (Directive (EU) 2024/1760).Footnote 16 On 25 July 2024, the CSDDD entered into force. While each piece of legislation varies in terms of scope and contents, they all incorporate a basic idea about human rights diligence which is that companies should know about, show, and address their human rights impacts.
3. The limits of standard HRDD: high-risk environments and regulatory gaps
Emergency situations, particularly armed conflict, fundamentally alter the operating context.
Under international human rights law, states are allowed to derogate from certain human rights when facing situations of emergency.Footnote 17 Such situations are defined as situations in which the ability of the state to perform its functions in order to ensure the common good (“the life of the nation”;Footnote 18 “the independence or security of the state”Footnote 19 ) is significantly limited.
However, derogation does not change the scope or content of the human right, and respect for human dignity does not lose its relevance. On the contrary, in situations of war (or other emergencies), the dependence of individuals (rightsholders) on the ability to realise particular human rights can increase and become critical. Under these conditions of limited ability of the state to ensure human rights and the critical importance of this right for a person, the social expectation that non-state actors have responsibility for human rights may increase. As O’Neil argued:
“…once we look at the realities of life where states are weak, any simple division between primary and secondary agents of justice blurs. Justice has to be built by a diversity of agents and agencies that possess and lack varying ranges of capabilities, and that can contribute to justice – or to injustice”.Footnote 20
In this context, non-state actors, particularly corporate actors, can be considered secondary agents of justice. This interpretation accounts for the existence of dependency relations between rightsholders and corporate actors as addressees of human rights obligations. It also implies the existence of corporate power defined by Birchall as “the power that a corporation has to shape directly the human rights possibilities of individuals.”Footnote 21 Situations of emergency, for example armed conflict, can significantly increase this dependence.
The UNGPs address these special situations and recognise that “the context within which a business is working will have a bearing on the action it can and should take in response to adverse human rights impacts” (UNGPs 14, UNGPs 17(b)). Under the UNGPs companies are expected to take into consideration the operational context, and sudden changes in this context. The corporate responsibility to respect human rights, as articulated in the UNGPs, includes the idea that companies should react to changes in a responsible way and should be ready to correct and adapt their HRDD processes if the context changes.
This shifts the role of companies from purely economic actors to providers of essential services, making them de facto governors of societal well-being.Footnote 22 Corporate power to shape the human rights possibilities of individuals is magnified, demanding a more robust governance framework.
4. Towards heightened due diligence: a framework for adaptive risk governance
Given the inadequacy of standard HRDD in conflict zones, the concept of “heightened” human rights due diligence (hHRDD) has emerged to address these unique challenges.Footnote 23 It calls for a deeper, conflict-sensitive analysis, recogniising that businesses are not neutral actors and can impact conflict dynamics.
In 2020, the UN Working Group on the issue of human rights and transnational corporations and other business enterprises (UNWG) published a report titled “Business, human rights and conflict-affected regions: towards heightened action”. Based on the report, in 2022, the UN Development Programme (UNDP) and the UNWG developed a practical roadmap for action titled “Heightened Human Rights Due Diligence for Business in Conflict-Affected Contexts: A Guide.” The document states that “heightened human rights due diligence means identifying potential and actual impacts on people (human rights) as well as on the context (conflict)”. It further mentions that “traditional human rights due diligence helps businesses to know and show how to avoid or minimise human rights risks to people. Heightened human rights due diligence strengthens the understanding of the context where businesses operate and ensures that their activities do not contribute to violence by identifying flash points, potential triggers or the forces that are driving the conflict.”Footnote 24 The guidance adds a critically important issue: “causing, contributing or being directly linked to armed conflict and other situations of widespread violence always means causing, contributing or being directly linked to human rights abuses.”Footnote 25 Conducting hHRDD implies analysing conflict drivers, dynamics, and their connections to business activities to ensure the company is equipped to prevent or mitigate its negative impacts.Footnote 26 This guidance frames hHRDD primarily as a tool to ensure companies do not exacerbate the conflict.
In light of the Russian invasion of Ukraine in 2022, the OECD has adopted a different, wider approach to how companies should conduct themselves in such situations. The OECD published Policy Responses on the Impacts of the War in Ukraine in which they argue that “RBC [Responsible Business Conduct] can guide and enable businesses to stay engaged in Ukraine responsibly, in order to safeguard jobs, economic activity and essential goods for Ukraine; RBC principles and standards set out the expectations for how businesses should prevent and address adverse impacts of their operations and supply chains, while also contributing to sustainable development in the countries where they operate.”Footnote 27 Thus, their approach is not simply that companies should refrain from impacting the conflict, but that companies should also keep the SDGs in mind.
The same week as the start of the Russian invasion of Ukraine, the European Commission published a proposal for mandatory human rights due diligence legislation – the Corporate Sustainability Due Diligence Directive – to require companies to identify and mitigate risks for human rights connected to their global operations and business relations. In August 2022, a group of fifty-one civil society organisations and academics active in the field of business and human rights issued a joint statement calling upon EU policymakers to include specific provisions on responsible business conduct in conflict-affected areas in the Corporate Sustainability Due Diligence Directive.Footnote 28 This statement was based on the research by the Business & Human Rights Resource Centre on companies’ due diligence response to the escalating conflict in Ukraine, which has shown that a large majority of companies struggle with managing the situation responsibly.Footnote 29 In June 2023, the European Parliament proposed an amendment to the EU Commission’s text calling for hHRDD in conflict affected and high-risk areas. In July 2024, the EU CSDDD entered into force.Footnote 30 The text mentions hHRDD in the Recitals but not in the operative articles of the directive. The directive will now have to be transposed into the domestic law of twenty-seven member states.
Ensuring corporate responsibility to respect human rights by companies operating in situations of armed conflict or other contexts of widespread violence has been a key focus for BHR researchers and practitioners for the last few decades. Beyond due diligence processes, scholars have examined the broader responsibilities of corporations and states in conflict settings. R. Mares explores the complex interplay between corporate and state responsibilities, arguing that both actors have a duty to protect human rights and contribute to peacebuilding efforts.Footnote 31 C. L. Sriram, O. Martin-Ortega and J. Herman offer a comprehensive analysis of the theoretical and practical dimensions of war, conflict, and human rights, providing a framework for understanding the multifaceted challenges of operating in conflict-affected environments.Footnote 32 The concept of hHRDD gradually formed, as a process that complements the standard human rights due diligence.
While existing guidance frames hHRDD primarily as a tool for conflict sensitivity,Footnote 33 our contribution extends this by reconceptualising hHRDD as a model of adaptive risk governance. In this view, companies are not only responsible for avoiding harm, but they must also anticipate and respond to systemic human rights risks generated by the conflict itself. This reframing is particularly urgent in sectors, such as food retail, that shape survival-level outcomes in fragile environments.
III. Methodology
This study adopts a mixed-method research design to examine how social expectations shape corporate conduct in conflict-affected environments. We employ triangulation, combining document analysis, semi-structured interviews, and social media analysis to build a robust understanding of the de facto regulatory landscape in wartime Ukraine. This triangulation allows us to capture both the normative claims made by companies and the societal responses to them, providing a basis for theorising hHRDD as an adaptive risk governance framework.
1. Data collection
a. Corporate communications
To identify what food retailers did to meet these expectations, we decided to ask them about their strategies on how to behave in a situation of war. The twenty biggest food retailers were identified using the 2021 list of taxpayers in Ukraine.Footnote 34 We emailed a total of twenty companies and asked them to provide us with relevant information. We also reached out to the Retail Association of Ukraine to ask them to share our request for information among its members.Footnote 35 In the end, six companies responded to our request. The questions to food retailers included questions about how companies identified human rights risks when the war started and how companies saw their role in ensuring access to food for local residents; how companies understand responsible conduct in the war situation; and whether expectations and needs impact companies’ strategy regarding their operations in such context. Additionally, we screened food retailers’ websites (twenty biggest taxpayers) and the website of the Retail Association of Ukraine to check how they publicly communicate about their human rights commitments during the war.
b. Semi-structured resident interviews
We conducted thirty-six semi-structured interviews via Zoom in March–April 2022. Respondents (twenty women, sixteen men, aged 20–75) were residents of eleven Ukrainian oblasts (including areas under occupation or frequent shelling):
Participants were recruited through a public Google Form disseminated via Instagram and Telegram by the first author’s university and Ukrainian civil society networks. From 136 responses, thirty-six were selected for follow-up interviews focused specifically on access to food during the first months of the war.
Interviews followed a structured guide covering (i) barriers to food access, (ii) perceived roles of different actors (state, private, civil society), and (iii) expectations of responsible corporate conduct. Interviewees were asked about their views on large versus small food retailers, national versus international companies, and how companies balanced staff safety with customer needs. Anonymity was ensured by excluding identifying information beyond oblast and war-time location. All interviewees provided informed verbal consent. Interviews were anonymised, transcribed and stored securely.
The interview guide was developed in advance and included open-ended questions to allow participants to share their experiences and perspectives. The questions for interviews focused on the expectations local residents held regarding the conduct of food retailers in the current situation of war, how food retailers responded to these expectations, and what factors impacted corporate conduct. The interview questions, translated into English, are presented in Table 1.
Table 1. List of interview questions
While thematic saturation is a common benchmark,Footnote 36 the extreme volatility and diverse regional experiences during the first months of the war in Ukraine meant that achieving traditional saturation across the entire population was not a feasible goal for this study. Instead, our thirty-six interviews provide rich, illustrative evidence from a range of affected areas. They serve not for statistical generalisation, but as a crucial empirical grounding to explore and theorise the dynamics of social expectations in a crisis. This “proof of concept” approach allows us to build a contextually rooted model, which can then be tested and adapted in other settings.
3. Public social media discourse
We conducted a thematic content analysis of 280 public posts and comments from Ukrainian-language Facebook and Telegram channels between February 2022 and December 2024. Keywords included “food in stores,” “prices,” “queues” and specific retailer names (e.g., ATB, Auchan). This dataset enabled tracking public sentiment and validating themes from the interviews. In parallel, we conducted desk-based research, reviewing third-party surveys on food access, civil society reports, webinars with retail executives, and employee feedback shared on online platforms.
4. Analytic strategy and triangulation
The interview transcripts and social media data were analyzed using an inductive coding process.Footnote 37 First-order codes were derived directly from participant language (e.g., “stores should limit purchases,” “prices are too high”). These were aggregated into second-order themes (e.g., “demand for fair pricing,” “balancing employee/customer safety”). The triangulation of interview data (depth), social media analysis (breadth), and corporate communications (stated policy) allowed us to build a robust, empirically grounded understanding of the interplay between social expectations and corporate risk responses. Figure 1 illustrates this analytical process.
Figure 1. Developed by the first author of the article.
5. Limitations
Recruitment via digital platforms privileged younger and urban respondents, underrepresenting older populations and those without stable internet. We also need to note temporal asymmetry: interview data reflect the war’s first 70 days, while corporate documents span 22 months.
Given the modest sample and volatile context, interviews are used to enrich – not generalise – findings from the corporate dataset. While the sample remained modest, the first author noted that the last eight to ten interviews conducted provided no new insights. The decision was then made to stop interviewing, and to move to coding and data analysis. The goal of the interviews was not statistical representativeness, but in-depth exploration of the lived experiences and social expectations of individuals in diverse circumstances across different regions of Ukraine. Therefore, we did not aim for a sample that perfectly mirrors the demographic distribution of the Ukrainian population in terms of age, gender, income or pre-war occupation.
Crucially, this study’s findings and the resulting hHRDD framework are derived specifically from the food-retail sector in wartime Ukraine. This sector is unique due to its direct link to the fundamental right to food, making it a focal point of societal expectation in a crisis. The applicability of our expanded hHRDD model to other sectors – such as telecommunications, finance, or technology – or to different types of conflicts (e.g., long-term, low-intensity conflicts vs. full-scale invasions) requires further research. Our model should therefore be seen as an empirically grounded starting point for a broader conversation, rather than a universally applicable blueprint.
Despite these constraints, the multi-source design allows us to construct a robust, empirically grounded understanding of how social expectations operate as a form of informal regulation in conflict zones, and how companies respond through heightened due diligence practices.
IV. Results: the de facto regulation of food security risk
Our findings reveal a dynamic system of informal social regulation in wartime Ukraine, where the population’s expectations and corporate responses shaped the governance of three core risk areas. In this time of crisis, the public looked directly to private retailers, not the state, to manage the crisis. As we will demonstrate, for companies, this involved a series of complex balancing acts between accessibility, safety, and legitimacy.
1. Food accessibility in situation of armed conflict: increasing the role of food retailers
All interviewees mentioned that they considered access to food critical in the war situation. The feeling of critical importance stems from limited access to food. However, the nature of the answers differed depending on the region of residence (in some cases, even the area in which the respondents lived in the same city played a role) and also depending on whether the family had small children or included people who, for health reasons, needed a special diet. Respondents who were in settlements on the contact line, where regular shelling took place, noted that food portions were significantly limited; many stores stopped working from the first day of the war, primarily, stores belonging to international supermarket chains. The conduct of international supermarket chains attracted special attention because traditionally, in Ukraine, people expect more responsible conduct from them than from other types of business.Footnote 38 Such higher expectations are linked to the practice of making human rights commitments which is much more common for international companies than local ones.Footnote 39 National food supermarkets have remained open but have significantly reduced their opening hours. We have selected and translated into English key quotes from respondents.
The food situation depended on the neighborhood in which people were hiding. If you could find an open store in the center of the city, then on the outskirts of the city they were all closed due to very heavy shelling. I live in a neighborhood far from the center and it was only sometimes possible to buy bread during the first two months of the war. – respondent from Kyiv.
It was difficult during February–March 2022, when no food products were delivered at all. Everything that was in the stores was slowly running out. It is certain that since April [2022], food retailers began to deliver some food products more or less regularly. – respondent from Kyiv.
I was in Kharkiv from the beginning of the war until April 1, 2022. At that time, most grocery stores were either closed or opened for limited hours, and they operated in conditions of long queues and lack of a number of products. It was difficult to find baby food. – respondent from Kharkiv.
Disruptions in logistics led to the fact that supermarkets ran out of products within a very short period of time. – respondent from Poltava.
The bread factory continued to work to provide the population with bread. Due to constant danger and interruptions in the supply of electricity and water, bakers were able to bake only white bread, which takes less time to prepare than rye-wheat bread. – respondent from Chernigiv.
Our desk research confirmed this data. Rudolfsen et al. conducted a survey of 800 Ukrainians to ask them whether they were experiencing food insecurity.Footnote 40 The results, published online by the local survey agency Info Sapiens, show that 36 per cent of respondents in Ukraine reported not having enough food to eat; and 52 per cent were limiting portions. The findings of BCG provide evidence that “25% of Ukrainian families are in need of food.”Footnote 41 The UN FAO report that during this period of time, around 1.1 million were in need of food and livelihood assistance, and about 400,000 of them had needs related to food insecurity.Footnote 42
In this context, a core social expectation emerged: companies had a responsibility to maintain operational continuity as a form of risk mitigation. Residents expected retailers to solve complex logistical problems, from sourcing bread amid power outages to finding new local suppliers when national chains broke down. Interestingly, there was a perception that smaller, local retailers were often more resilient and responsive.
In the first month of the war, the local chain of supermarkets had a significantly larger range of food products compared to the all-Ukrainian chain. Apparently the former focuses on local suppliers, due to which supply chains were not disrupted by the war. – respondent from Dnipro.
This expectation for adaptive management extended to pricing and availability. In calmer territories, where panic buying became the main issue, respondents expressed frustration at massive overpricing and expected retailers to proactively manage demand by limiting the purchase of critical goods to ensure fair access for all.
2. Balancing competing risks: employee safety vs. community access
A key dilemma emerged around balancing the risk to employee safety against the risk of the community losing food access. In a warzone, a simple queue for bread becomes a potential military target.
There were always the longest queues for bread, sometimes up to 300 people. So, on the morning of March 16 2022, in one of the city’s neighborhoods, about 100 people were waiting to buy bread at a kiosk, when the Russian army struck a nearby house. People who had been suffering from a lack of food for several weeks did not leave the queue and continued to stand on the street. A few minutes later, the second hit from the “Grad” fire system already hit the queue. Then 14 people died and another 40 were injured. – respondent from Chernihiv.
The same case was shared by a respondent from Kharkiv.
While respondents universally understood store closures for safety reasons – affirming that the decision to work must rest with the employee – the overarching expectation was that companies find a risk-based compromise. This reflects a sophisticated public understanding of risk trade-offs. Rather than simply ceasing operations, companies were expected to actively manage a portfolio of competing risks. Successful strategies, according to respondents and corporate communications, included: shortening operating hours to avoid curfews; using social media to provide real-time information on stock and opening times, reducing dangerous search times for residents; in extreme cases, such as when abandoning a location in an occupied territory, distributing the remaining food for free to the local population.
As one food retailer noted:
Even the fact that the store was open had a great psychological impact on people: they saw that there were products, people were working. People watched all this and calmed down.
3. Managing legitimacy risk: consumer boycotts as social regulation
The most powerful form of informal social regulation centered on the origin of products. A strong, widely shared expectation emerged, evident in both interviews and numerous social media posts, that retailers must manage their legitimacy risk by refusing to sell goods produced in or linked to Russia and Belarus. As one respondent poignantly stated, “Every hryvnia [Ukrainian currency unit] spent on Russian goods is a bullet in the back of Ukraine.” This sentiment reflects a profound moral conviction that transcends immediate personal needs.
This expectation of a political and moral stance often superseded the immediate need for affordable food. Sourcing decisions were framed as a key test of corporate loyalty and values. Failure to align with this expectation was met with swift public condemnation, functioning as a direct regulatory sanction on corporate legitimacy. This demonstrates that for the Ukrainian public, the role of food retailers extended beyond mere provision of goods; they were expected to be actors aligned with the national cause, a crucial element of their responsibility in a time of war.
While our findings are specific to the context of food retailers in Ukraine, the framework for analysing social expectations and developing context-sensitive HRDD processes has broader implications for other sectors operating in conflict-affected environments. In all situations of armed conflict, businesses face complex ethical dilemmas regarding consumer boycotts, product origin, and ethical product sourcing. Retailers must engage meaningfully with local communities, and understand the concerns that will help create business legitimacy, trust in brand and sustainability of the business. Addressing these challenges requires a commitment to transparency, accountability and a genuine desire to align business practices with human rights standards and ethical principles.
V. Discussion: a new model for corporate risk regulation in high-uncertainty contexts
Our findings from the Ukrainian food retail sector suggest that in the regulatory vacuum of an armed conflict, a polycentric system of risk governance can emerge, driven by dynamic social expectations and corporate responses. This has profound implications for how we conceptualise and operationalise corporate due diligence, demanding a shift from a compliance-based mindset to one of adaptive governance.
1. Navigating contradictory demands through adaptive governance
The Ukrainian case highlights that effective risk management in conflict zones is not about following a simple set of rules, but about navigating a series of profound and contradictory demands. As our results show, the expectation to keep stores open directly conflicts with the duty to ensure employee safety; the demand for affordable food can conflict with the moral and political imperative to boycott cheaper, but ethically unacceptable, products.
A simple, rules-based compliance approach is insufficient to resolve these dilemmas. Instead, companies require ongoing, dynamic adaptive governance processes. To “get it right,” they must engage in a constant balancing act, making legitimate trade-offs that are stakeholder-inclusive and context-aware. This moves beyond procedural due diligence to a more substantive engagement with the ethical complexities of the operating environment.
2. Expanding hHRDD: a systemic risk regulation framework
This need for adaptive governance requires an evolution in our understanding of hHRDD.
The UNGPs address individual companies’ human rights impacts and propose a risk management system, namely the human rights due diligence (HRDD) process, to address those impacts. As seen in Section 2.4, the heightened human rights due diligence (hHRDD) concept has broadened this responsibility by including also the possible impact of businesses on the conflict dynamics. The UN Working Group on Business and Human Rights (2020) highlights that businesses “are not neutral actors; their presence is not without impact. Even if [they do] not take a side in the conflict, the impact of their operations will necessarily influence conflict dynamics”. In a similar vein, the UNDP’s Guide mentioned in Section 2 reads as follows:
traditional human rights due diligence helps businesses to know and show how to avoid or minimize human rights risks to people; hHRDD strengthens the understanding of the context in which businesses operate and ensures that their activities do not contribute to violence by identifying flash points, potential triggers, and/or the forces that are driving the conflict.Footnote 43
The OECD released Guidelines for Multinational Enterprises on Responsible Business Conduct, which refer to situations of armed conflict, as well as situations of “heightened risk of gross abuses.” According to the Guidelines, in such situations, “enterprises should conduct enhanced due diligence in relation to adverse impacts, including violations of international humanitarian law.”Footnote 44
Thus, so far current conceptions of hHRDD primarily focus on preventing a company’s negative impacts on the conflict (i.e., avoiding exacerbating violence).
Our findings demand a broader view. The primary expectation of Ukrainian citizens was not just that retailers “do no harm,” but that they actively use their capabilities to mitigate the systemic harms created by the war – specifically, the risk of food insecurity. When retailers kept stores open, managed supply chains, and even gave away food for free, they were not merely addressing their own impacts; they were performing a public function and responding to a societal crisis.
We therefore propose an expanded model of hHRDD as a systemic risk regulation framework (see Figure 2). This model moves beyond traditional, firm-centric HRDD to include two additional, crucial dimensions:
Figure 2. illustrates a proposed adaptation of the Human Rights Due Diligence (HRDD) process for situations of armed conflict. The conventional HRDD framework (Box 2), focuses primarily on human rights risks in business operations (company’s impact on human rights). In addition, the hHRDD framework incorporates the risk of Box 3 – company’s impact on the conflict (risks of violations of humanitarian law) and Box 4 (risks of impact on human rights by the conflict).
Figure 2, by authors.
This model reframes hHRDD into a holistic governance mechanism for managing systemic risk, one that acknowledges the expanded public role companies are forced to play in a crisis.
3. Policy implications: filling the regulatory ambiguity of the CSDDD
Our empirically grounded framework has urgent policy implications, particularly for the implementation of the EU’s Corporate Sustainability Due Diligence Directive. The CSDDD acknowledges the need for “enhanced” or “heightened” due diligence in conflict-affected areas in its recitals but fails to provide a clear operative definition in its articles. This creates a regulatory ambiguity that could render the provision ineffective.
Our model provides the substance needed to fill this gap. We propose that when EU member states transpose the CSDDD into national law, they should use the principles of our expanded hHRDD framework to legally define what “heightened” due diligence requires in practice. This would mean clarifying that for companies operating in high-risk zones, due diligence must include an assessment of, and a proportionate response to, the severe human rights risks generated by the context itself. This would transform the CSDDD from a directive focused only on a company’s own value chain impacts into a powerful tool of global risk regulation, ensuring corporations contribute to human security and resilience where it is most needed.
4. Practical challenges and pathways for implementation
While our proposed model offers a more robust framework for corporate responsibility in conflict zones, its integration into legal instruments like the EU CSDDD presents significant practical, legal, and political challenges. First, companies face considerable practical and methodological difficulties in operationalising this expanded model. Traditional HRDD focuses on a company’s direct impacts and those within its value chain – risks that are, at least in theory, mappable and manageable. Our model asks companies to go further by assessing “severe human rights risks generated by the context itself.” This requires a fundamentally different and more complex type of analysis. A company would need to conduct sophisticated political, social and conflict-sensitive risk assessments to understand how its presence interacts with pre-existing vulnerabilities, conflict drivers and the breakdown of state functions. This requires expertise in political science, conflict analysis, and sociology – skill sets not typically found in corporate compliance departments.
A key challenge lies in determining the appropriate nexus between a single corporate actor and a widespread, systemic harm. For example, as our findings show, food insecurity in wartime Ukraine was a systemic crisis caused by military aggression and logistical collapse. In such a scenario, how can a single food retailer’s “proportionate response” be defined and measured? Attributing causality for a failure to mitigate a systemic risk is legally and ethically fraught, creating ambiguity that makes it difficult for a company to know what is expected of it and for regulators to enforce the obligation fairly.
The proposal to expand corporate responsibility beyond the established UNGP framework of “cause, contribute to, or be directly linked to” an impact will likely face strong political resistance. Corporate lobbying groups may argue that it constitutes an unjustifiable expansion of corporate liability, making businesses responsible for governmental failures. Furthermore, EU member states may have varying appetites for imposing such a standard, with some fearing it could undermine the competitiveness of their national companies on the global stage.
Despite these challenges, there are pragmatic pathways to operationalise the core principles of our expanded hHRDD framework.
Rather than a single, universal standard, the EU Commission, in partnership with multi-stakeholder initiatives and civil society experts, should develop detailed, sector-specific guidance. This guidance would outline what heightened due diligence entails for industries that become critical in a crisis, such as food retail, telecommunications, finance and extractives. It would not be a one-size-fits-all checklist but a framework of key questions, risk indicators, and examples of best practices for assessing and responding to systemic risks in conflict-affected and high-risk areas.
VI. Conclusions
This paper set out to understand how critical societal risks are managed when formal state regulation collapses. By examining the role of food retailers in wartime Ukraine, we have shown that a powerful system of informal social regulation emerges, compelling corporate actors to become de facto governors of risk. Our findings demonstrate that local residents expect companies not merely to avoid causing harm, but to leverage their capabilities to mitigate the catastrophic risk of food insecurity created by the conflict itself.
The primary contribution of this paper is a new model of heightened HRDD, empirically grounded in the case of Ukrainian food retailers, and conceptualiised as a framework for adaptive risk governance. This model moves beyond firm-centric risk management to incorporate a company’s responsibility to address the systemic, contextual risks of the emergency. This has critical implications for policymakers, offering a clear and practical pathway for giving substance to the vague requirements for operating in high-risk areas within instruments like the EU CSDDD. In an era of increasing geopolitical instability, developing smarter, more adaptive, and polycentric regulatory frameworks of this kind is not an option, but a necessity.
This work also points to two important avenues for future research. First, further investigation is needed to explore the applicability of our proposed hHRDD framework to other sectors that become critical in a crisis, such as telecommunications, finance and technology. Second, more research is necessary to understand how the dynamics of power and dependency between corporations and vulnerable communities shape social expectations in different types of emergency situations. Exploring these dimensions will be crucial for building a more complete understanding of corporate responsibility in our increasingly fragile world.
Competing interests
The authors declare none.
Open access
