Due diligence: the risky risk management tool in international law

As a standard bridging law and other spheres of normativity, due diligence is pervasive across numerous areas of international law. This paper defines the features and functions of due diligence, illustrating how the concept's development reflects structural changes in the international legal order. Concerning their content, due diligence obligations can be separated into two overlapping types: procedural obligations and obligations relating to States' institutional capacity. Thus, due diligence serves to manage risks, compensate for States' freedoms being circumscribed through legalisation, expand State accountability and possibly stabilise the international order through ‘proceduralisation’. However, it is argued that due diligence cannot be characterised as a general principle of international law due to its diverse content in different fields of international law and its dependence on accompanying primary rules. Finally, it is contended that due diligence introduces certain risks, particularly by diluting States' substantive obligations and contributing to the rise of ‘informal’ international law.


INTRODUCTION
Can China (or any other State) be held responsible under international law for a failure to exercise due diligence in managing the global health risks arising from the emergence and spread of the novel COVID-19 virus? This question exposes both the importance and weakness of due diligence. Probably some States, beginning with China, where the virus was first documented, have been violating their due diligence obligations enshrined in the International Health Regulations. 1 To all appearances, China informed the World Health Organization (WHO) fairly late about the virus, and some governments have reacted slowly and hesitantly or even counter-productively. 2 But it is highly unlikely that any government will formally invoke a violation of public international law. The reasons are not only strategic considerations but also the complexity of assessing the damage caused and the softness and vagueness of the due diligence standard which barely lends itself to create 'hard' State responsibility. 3 This episode is just one illustration of the ambiguous, even dubious role played by due diligence in current international law. 4 This paper sets out to examine some key features and functions of due diligence and concludes that the rise of this concept mirrors the deeply antagonist legal trends of our time.

A BRIEF OVERVIEW OF DUE DILIGENCE OBLIGATIONS IN INTERNATIONAL LAW
The examination of functions, features, benefits and drawbacks of due diligence should start with the meaning of the term. Diligence comes from 'diligentia', which is Latin for circumspection. The opposite of diligence is negligence. Importantly, diligence is a modality of behaviour with a positive connotation. The word 'due' gives this modality an even more obvious normative colouring. As a norm or standard, due diligence is a requirement to behave diligently. And this standard of due diligence is, in law, necessarily ancillary to some (other) legal obligation and no free-floating obligation itself. The content of the standard is moreover co-shaped by non-legal considerations: what is due is at least partly defined by business practice and morals. However, in this regard, due diligence does not differ from other legal concepts, such as 'good faith', 'legitimate expectations' and 'ordre public'. Due diligence is thus a bridge principle between law and other spheres of normativity.
Where does due diligence figure in international law and what does it require? Due diligence first appeared in the law of neutrality and in the law of aliens. 5 In the post-1945 international legal order, the concept is most common in environmental law. Since 1972, numerous environmental conventions have obliged the Contracting Parties to take 'appropriate' measures in the respective fields. 6 'Appropriate' is here understood as acting with due diligence. Besides such implicit environmental due diligence obligations, international courts and tribunals have spelled out due diligence obligations specifically with regard to the terrestrial, fluvial or marine environment. 7 Due diligence made a more recent appearance in international human rights law. For example, it features prominently in the 2011 Istanbul Convention Against Domestic Violence. 8 Also, the 2020 open-ended inter-governmental working group draft instrument on business and human rights sets out that States Parties shall adopt measures necessary to ensure that all persons conducting business activities, including those of transnational character, undertake a human rights due diligence. 9 5. Giulio Bartolini In the youngest subfields of international law, due diligence has become quite pervasive. The World Bank requires due diligence by its clients, and is arguably itself committed to due diligence in project financing. 10 Cyber law, 11 anti-terrorism law, 12 tax law 13 and (as already mentioned) international health law also set up due diligence obligations in various instruments.
In these fields, the due diligence obligations can be divided into two types: some of the international legal instruments contain obligations which might be qualified as mainly of a procedural type: 14 we see obligations to notify or report certain events and to warn other States. 15 An example is tax reporting in the Organisation for Economic Co-operation and Development (OECD) framework. Other instruments oblige States to consult with other States or actors 16 and cooperate with them, or to conduct risk assessments (notably environmental impact assessments 17 and human rights impact assessments 18 ). Similar procedural obligations are those to monitor situations and/or to take feasible precautions against the materialisation of a specific risk. Finally, States may be obliged to publicly explain their own conduct. 19 The second, overlapping, type of due diligence obligation relates to the States' institutional capacity. 20 States may be obliged to take legislative or administrative safeguard measures, for example, by enacting criminal law provisions as sanctions, establishing quasi-judicial procedures for concerned persons 21 in administrative processes, or they may be required to install suitable monitoring mechanisms (eg periodic inspection measures with regard to hazardous activities). 22 The next section examines the functions of these dispersed due diligence obligations in more detail.

Risk management
In all mentioned legal fields, due diligence obligations serve to manage risks. These risks sometimes emanate from private actors, ranging from pirates over terrorists to businesses and aggressive husbands. Other risks emanate from natural or technical phenomena, extending from germs to radioactive waves. Concomitantly, the risks run from mere accidents to crimes, and they may threaten persons, property or territory, or all together. In all constellations and across the various areas of law, risk management is challenged by a limited knowledge about the nature and scope of risk, with the difficulty of actually proving the presence and degree of the risk, doubts about causes and effects, and the necessity to deal with numerous contributing factors and actors.
In order to deal with these problems, the precautionary principle has been designed as a legal tool. That principle gives States a licence to forego, in some contexts, specific international legal obligations in precaution against risks even if scientific uncertainty persists about them. 23 For example, the precautionary principle might justify travel restrictions prima facie running against open border obligations in the face of a spreading virus. As a tool to manage risk in conditions of high incertitude, due diligence appears as a companion of the precautionary principle, in that it demands States to establish institutions and/or go through procedures for averting the materialisation of these hazards.
Due diligence notably facilitates dealing with uncertainty in the face of a plurality of actors which are diverse (States, business, scientists, activists and so on) and highly connected, where several actors are likely in a position to avert the harm. What matters for the legal response is here not direct causality between action and damage but the proximity of an actor to a risk. For example, in international climate law, risk proximity is contingent both on States' resources for action and on their past contributions to climate harm. In international environmental law, one relevant factor for defining Due diligence: the risky risk management tool in international law 125 the risk management capacity of a State is its 'economic level'. 24 And in the Bosnian Genocide case of 2007, the International Court of Justice (ICJ) concentrated on the 'capacity to influence' as the relevant criterion that triggers the (due diligence) obligation to prevent genocide. 25 The due diligence standard is flexible enough to allow ongoing adaptation of the assessment of risks. Due diligence also takes into account the varied situatedness and capacities of actors. It finally permits the grading of legal obligations and concomitant legal responsibility based on distinct degrees of risk proximity. Overall, due diligence works against a too summarial and formalist allocation of duties among international actors which are increasingly connected and highly diverse. This adds an element of material justice which can be seen as a core component of the (international) rule of law.

A compensation for curtailing sovereign freedoms
The flexibility conveyed by asking (only) for due diligence should also be appreciated in the context of the specific structure of international law which is decentralised and displays only isolated elements of hierarchy and coercion. Within this overall set-up, due diligence has become one of the legal tools granting the leeway needed by States for pursuing legitimate or legally recognised interests. This scheme first of all shows in law-making. The normative openness of the due diligence standard facilitates treaty negotiations because at least some of the antagonist interests can remain hidden and unreconciled. In the treaty text, contravening interests may be mentioned, for example, in the preamble or in programmatic articles, but their accommodation is transferred to a later point in the process of implementing and applying a treaty. In other words, the use of the term due diligence facilitates law-making through constructive ambiguity. For example, Article 4(1) of the Paris Agreement on Climate Change lays down the objectives and goals of the regime. It refers, inter alia, to 'efforts to eradicate poverty' while Article 2(2) permits States to consider 'different national circumstances'. 26 This gives developing States more leeway for setting national policy priorities by weighing interests in poverty eradication and development against concerns of climate protection. The balancing process informs the parameters which will then define the due diligence standard in the concrete instance of implementation only.
A benign assessment of this role is that due diligence thus exemplifies the paradigmatic shift from the 'state of nature' among States to a legally regulated sphere. The States' freedom of action has been transformed from a pre-legal concept into a legally circumscribed and curtailed form of discretion. At the same time, due diligence reintroduces wriggle room which prima facie operates as a compensation for losses of 'natural' sovereign freedom. This might be the price to pay for legalisation but at the same time risks undermining the benefits of such formalisation.

Expanding accountability
The traditional function of due diligence has been to downsize State obligations and thus to restrict the responsibility of States in the context of the no harm rule (neminem laedere) (Section 3.3.1). In a series of environment-related cases, the ICJ has held States responsible for violating additional procedural duties, detached from the occurrence of harm (Section 3.3.2). Such a 'proceduralisation' of due diligence requirements which (in the end) results in increased accountability is adequate in some constellations (Section 3.3.3).

Downsizing the no harm rule to a due diligence obligation
The no harm rule obliges States to act diligently so as not to cause transboundary harm. The international leading case establishing this obligation is the Trail Smelter arbitral award of 1941. 27 Although that decision did not use the term 'due diligence', this was surely its undercurrent, especially against the background that the concept was already established in prior arbitral awards in the law of neutrality and law of aliens. 28 The classic no harm rule is breached only when conduct is negligent (lacking due diligence) and when the unwanted results have materialised. 29 Inversely, harm alone is not sufficient to trigger State responsibility. If harm has occurred despite the State's diligence, the State will not be held responsible for that harm. This means that, functionally speaking, the due diligence standard as part and parcel of the no harm rule leads to a narrowing down of the State's responsibility. It allows a State to fend off assertions of State responsibility and claims for damages arising from harm emanating from its sphere by showing that its behaviour had been diligent (as opposed to negligent, inappropriate or without circumspection).
This scheme not only governs international environmental law but is likewise at work in various other fields of international law where notably humans are construed as risks. For example, States must take appropriate measures to protect the premises of a diplomatic mission from protesters. 30 States must also take appropriate steps to prevent hostile guerrilla, criminal and terrorist activities spreading from its territory. 31 International anti-corruption treaties and anti-money-laundering law have introduced a cascading system of obligations of supervision which requires States Parties to diligently oversee legal entities which in turn have to oversee associated natural and legal persons. 32 The same applies in international tax law. 33 Finally, due diligence towards 'risky' and potentially criminal humans is also demanded by international humanitarian law and international criminal law. For example, the International Committee of the Red Cross interprets common Article 1 of the Geneva Conventions (the obligation to 'respect and ensure respect') as a 'general duty of due diligence'. 34 In all these legal regimes, due diligence dials down or limits the States' obligations from the outset (already on the level of primary norms) and therefore, functionally speaking, ends up limiting State responsibility.

The ICJ's separation of 'no harm' and procedures to prevent harm
A more recent function of due diligence is to create additional preventative (mainly procedural) obligations detached from the occurrence of harm. This shift towards prevention ultimately has the potential to expand responsibility. Both in Pulp Mills and in Costa Rica v Nicaragua, the ICJ kept apart two different primary duties: a harm prevention duty 35 and a duty to diligently not cause harm. 36 The former duty of prevention was apparently seen as a more 'procedural' one, demanding mainly or exclusively procedural measures (such as conducting an impact assessment, planning, monitoring, and notifying or warning adjacent States), while the latter duty to refrain from doing harm was conceptualised more as an obligation of substance (to manage soil and woodland so as not to impair water quality, and the like).
The ICJ also held that two types of dutiesthe substantive duties and the procedural dutiesare independent from each other and can be independently breached or complied with. 37 In Costa Rica v Nicaragua, the ICJ then found a violation of the States' procedural obligations, but no breach of the substantive duty not to cause harm because in the end no significant transboundary harm had occurred. A lack of diligence was (in the absence of material environmental harm) not sufficient for finding a violation of the traditional no harm rule. 38 The Court's separation between the 'classic' duty not to cause harm and the preventative obligations, accompanied by a distinction between substance and procedure seems artificial. Looking at the historical sequence and at the rules' functions, it is more plausible to conceptualise the newer harm prevention rule as an offspring and further evolution of the no harm rule rather than as a second, independent duty. 39 This legal evolution reflects the societal shift of focus from harm to risk.

Additional procedural due diligence obligations
For the purposes of our analysis, it is less important whether the mentioned procedural duties should be seen, with the ICJ, as distinct from the no harm rule or as its modern extension. 40 The main question in the context of due diligence is whether and in which constellations the detachment of a due diligence obligation from the result, in other words the complete 'proceduralisation' of the due diligence obligation, is adequate.
Adequacy hinges, we claim, on the possibility of identifying and pinpointing the result, and whether this result is good or bad. If the result is easy to identify, then the procedural and preventive obligations should not be completely detached from that result. For example, with regard to the obligation to prevent genocide, the ICJ had held that 'a State can be held responsible for breaching the obligation to prevent genocide only if genocide was actually committed'. 41 Conditioning the breach of the obligation to prevent on the occurrence of the (bad) event is adequate here, given that it is fairly easy to determine (factually) whether the event did take place or not. If, however, the due diligence obligation consists of reaching or maintaining a complex situation which is difficult to quantify (eg a certain level of education or a low level of corruption) and which moreover extends over time (and is not a one-off event), then the 'success' is difficult to measure. Here, the preventive and other procedural obligations (eg under anti-corruption law or under human rights law) should indeed be detached from the result.
This then means, firstly, that a State violates its obligations if it fails to act diligently, even if the level of corruption is low or the level of literacy high (despite the laxity of the State). Conversely (and as a flip-side), a State is released from international responsibility if it takes reasonable (diligent) measures, even if the desired outcome is not reached. In our example, this is the case even when a State is not entirely 'clean' from corruption, or when full literacy is not reached in the population.
Secondly, the State cannot avoid responsibility simply by showing that (in our example: corruption or children missing school) would persist despite all of its efforts to prevent it. 42 Thus, although diligent preventive action would presumably not have eliminated the problems, the lack of diligence still counts. If a breach of international 39. See in this sense Brunnée (n 28) 116 for whom prevention and no harm are 'two sides of the same coin'. But see for the conceptualisation as an independent rule: Leslie-Anne Duvic-Paoli, The Prevention Principle in International Environmental Law (CUP, Cambridge 2018). 40. See in the latter sense Brunnée (n 28) 148-150, making the case for a 'conduct-focused' no harm rule. The no harm principle can be violated independently of any resulting harm. In other words, the occurrence of the harm is no element of the primary rule. But its occurrence matters for the remedies. For Brunnée, procedural obligations are simultaneously independent from the no harm rule, and are also relevant for defining when the no harm rule has been violated: ibid 101. 41. Bosnian Genocide (n 25) [431]. 42. In the Bosnian Genocide case, the ICJ found that an obligation to prevent genocide exists even if the State cannot be certain whether the preventive measures will be successful or not. In that case, success would have been the prevention of genocide. See Bosnian Genocide (n 25) [461].
Due diligence: the risky risk management tool in international law 129 law were denied here, the State would be able to avoid responsibility too easily. 43 At this point the gist of the due diligence obligation consists of the means and processes that the State must employ.
When a State is held responsible for the breach of purely procedural due diligence duties, the question is what the content of State responsibility can be in such a case. Reparation hardly fits, but cessation and satisfaction would be an option.
Because, as argued in this section, due diligence should not always be detached from the materialisation of the risk which it seeks to manage, it seems simplistic to qualify due diligence as an obligation of conduct (as opposed to result). 44 Due diligence may sometimes but not always be both: an obligation of conduct and an obligation to guarantee a result. For example, due diligence in international human rights law requires a State to conduct a proper investigation of alleged police violence (conduct) and to sanction officers (result).
In those constellations where due diligence should be understood as creating additional procedural obligations which can be breached independently of the materialisation of environmental or other forms of harm, the result is an expansion of the legal responsibility of international actors, notably of States. Such an expansion is especially warranted, as argued, in all contexts where 'harm' is protracted and difficult to measure. In those contexts, a procedural due diligence helps to close the otherwise glaring accountability gap.

Due diligence beyond attribution and complicity
The expansion of accountability is not only realised by the creation of additional procedural obligations, but also (overlapping) by the acknowledgment of specific preventative obligations. Such obligations allow us to hold States to account beyond attribution and complicity. 45 Due diligence fills an accountability gap in situations where a State cannot be held responsible either as a perpetrator of a wrongful act or as an accomplice to it. This was the situation in the Bosnian Genocide case. 46 43. Cf. art 8(8) of the OEWG Draft (n 9). In the Bosnian Genocide case, the ICJ examined this question solely for the scope of responsibility, that is, in order to determine whether Serbia owed reparations. Only at this point did the ICJ examine whether genocide would have occurred despite efforts to prevent it, see ibid [462]. Because this could not be shown, the ICJ did not believe financial compensation by Serbia to be appropriate.  48 In other words, the Court could not find a wrongful State act legally derived from or linked to the crimes of the non-State actor with the legal tools available. Therefore, as a kind of last resort, the Court developed the duty to prevent under Article 1 of the Genocide Convention as an autonomous obligation of the State. Importantly, this is a due diligence obligation. 49 The ICJ thereby sought to strike a balance between avoiding impunity on the one hand and overburdening third States in the face of atrocities committed outside their effective (territorial) control on the other hand.
In this case, as in other areas of international law, the due diligence mechanism focuses only on the own action or inaction of State. While harm (even crime) stems from another actor (State or non-State) or from forces of nature, the standards governing the due diligence obligation may be independent from those governing the other actors. Especially, unlike in the case of complicity, no exact knowledge of the circumstances is needed, and there is no requirement of parallelism (that the act would be internationally wrongful if committed by that State, as requested in the regime of complicity under Article 16(b) of ARSIWA). As explained above, due diligence can (sometimes) even be breached independently of whether a risk materialised or not and whether harm occurred or not. Again, the concept of due diligence here allows other actors to hold a State to account where other legal avenues fail.

Stabilising the international order through proceduralisation
The 'proceduralisation' discussed in the preceding sections (Sections 3.3.2 and 3.3.3) is only one dimension of a larger trend of proceduralisation of international law. By proceduralisation, we mean the extension and refinement of rules on procedures (ie about steps and ways to proceed) as opposed to substantive rights, obligations, commands, prohibitions or guarantees. 50 Although substance and procedure may be seen as intertwined and mutually constitutive, probably all legal systems, including the international legal system, treat substantive rules and procedural rules as two distinct legal categories that fulfil different purposes. And while due diligence may relate both to procedural and substantive obligations, 51 the main contribution of the concept concerns procedures: procedural duties associated with or stemming from the due diligence standard have mushroomed. They concern hearings, participation, obligations to explain and give reasons, voting-modes, monitoring and verification, all of which constitute and shape the processes of law-making and law enforcement.
These procedures fulfil important tasks. First of all, and as a general matter, procedures protect the weaker participants in any given relationship, because they prevent powerful players from changing the rules of the game at their whim. Importantly, procedures thus outbalance power disparities, for example by giving equally long speech slots to all sides, asking for written justifications by all sides, and the like. The antidote to sheer power play is especially important in international relations where the disparities of strength and influence are huge.
Secondly, processes and procedures within long-term treaty regimes build consensus about how to assess and deal with the risk addressed in the treaties. Thus, broadly framed, due diligence obligations and related procedural obligations may work as a starting point for creating more specific substantive obligations under a particular treaty regime over time. 52 Thirdly, procedures tend to increase accountability, because they create, compile and publicise knowledge and thus allow outsiders to hold actors to account.
An important driver of the said trend towards proceduralisation is the disagreement among the members of a pluralist and even deeply divided international society about proper outcomes. The impossibility of reaching consensus about substantive outcomes is exacerbated by the complexity of problems and lack of knowledge about their nature and scope, let alone about ways to solve them. In this constellation, negotiators may find it easier to agree on procedures, because these are less burdened with ideology, and are to some extent open-ended. The underlying idea is that fair procedures will also lead to normatively acceptable and in fact accepted results. Thus, the elements of deliberation inherent in the procedural approach complement more traditional forms of justifying international law. Seen as a new key procedure, due diligence might bolster the legitimacy of international law. Although the trend of proceduralisation is not unambiguously beneficial (see for drawbacks Section 5), proceduralisation overall has the potential to stabilise the international order. As one component, due diligence contributes to such stabilisation.

NO GENERAL PRINCIPLE OF DUE DILIGENCE
Given the pervasiveness of due diligence in numerous areas of international law and in the domestic law of many States, the question imposes itself whether due diligence can and should be qualified as a general norm (either as a customary rule or as a general principle in the sense of Article 38(1)(c) of the ICJ Statute). The ICJ stated that due diligence is the 'origin' of the principle of prevention and thus implied (maybe inadvertently) that due diligence is itself (like the latter) a customary rule. 53 We submit that such a qualification is not warranted. One reason is that the role and functions of due diligence differ from regime to regime.
Despite the superficial similarity of the role of the due diligence norms in various fields of international law, a closer look reveals diversity. In human rights law, the minimum requirements and the exact contours of the positive obligations of States to protect humans, for example women against domestic violence, are identified in a balancing process, governed by the principle of proportionality. This type of identification has been shaped in a large amount of case-law and is therefore more fine-grained than a rough due diligence requirement, although a family resemblance of course exists.
The meaning and function of due diligence is again different in international economic law. The term is here borrowed from private corporate law in relation to business transactions and corporate finance. In that sphere, we might speak of 'doing due diligence' as opposed to 'acting with due diligence'. 54 Doing due diligence is an exercise of risk mitigation by conducting a legal, environmental and/or social audit before envisaged projects and other (legal) undertakings in order to avoid a bad outcome. The bad outcomes to be fended off include not only potential breaches of the law but encompass all kinds of negative results. Therefore, 'doing due diligence' is partly outside the realm of the law. Still, from the perspective of a business corporation, the diligence exercise serves to avoid its legal liability or other legal problems. For example, an investor is expected to assess the present and possible future legal framework of the State where the investment shall take place. An investor who did not conduct due diligence in that sense will lose its protection under a bilateral investment treaty. 55 Thus, in investment law, due diligence actually secures the investors' claims for damages. Here, due diligence is primarily exercised to protect the actor itself, and not, as in the constellations described before, other actors' interests. In sum, the work performed by the audits under the heading of 'due diligence' starkly differs from the functions of 'due diligence' as a standard of behaviour in the context of the no harm rule and its emanations.
A second and related point is that anyone who wants to identify and circumscribe, in a more exacting way, the due diligence obligations (both procedural and substantive) must always look at the substantive standards of the specific regime. This is what the ICJ opined in the Bosnian Genocide case, with regard to the related obligation of prevention. Here the Court cautioned against a generalisation of due-diligence-based prevention duties: 'The content of the duty to prevent varies from one instrument to another, according to the wording of the relevant provisions, and depending on the nature of the acts to be prevented'. 56 The context and regime dependency also applies to due diligence. Therefore, formulating due diligence as a general principle would not add much but would simply restate an unspecified duty of good behaviour.
A third, more normative consideration against qualifying due diligence as a general principle is that it would not be adequate as a fallback rule. Turning the due diligence standard into an overarching obligation to behave diligently in international relations would imply that due diligence is normatively more desirable than other standards (such as absolute harm prevention on the one side or mere avoidance of gross recklessness on the other side). This would create an additional legal argumentative burden for States when they intend to apply a different liability standard. It would also restrict the States' freedom to work out the most appropriate allocation of accountability.
The ongoing negotiations on autonomous weapons are a case in point. States and academics are recommending various mechanisms for creating accountability here. Proposals range from a complete ban to a broad permission and include strict liability, Due diligence: the risky risk management tool in international law 133 a presumption of liability, and prevention or harm mitigation duties based on the due diligence standard. 57 But none of these standards is per se normatively more desirable than any other.
In view of the widely diverging functions of due diligence and its dependence on the primary rules which it accompanies, due diligence should not be conceived of as a general principle of international law. 58 Rather, due diligence should be seen as an emanation or sibling of other structural principles, such as good neighbourliness and good faith. But independently of how we qualify due diligence in doctrinal terms, we need to examine the risks coming with the growing reliance on due diligence, risks for the international rule of law and global governance to which we now turn.

THE RISKS OF DUE DILIGENCE
The functions and policy benefits of due diligence can be brought to bear only when due diligence is indeed fleshed out as a procedure and is not only used as a buzzword. Where mere references to 'due diligence' in treaty texts and soft law do not encompass due diligence procedures, then powerful States might simply define what is 'due'. There is the danger that States and other international persons simply proclaim due diligence and then do what they want. A broad (indeterminate) normative standard, such as due diligence tout court, may undermine the capacity of the law to govern behaviour, because the vague and blurry terms of those norms give plenty of leeway to those interpreting and applying them. This undermines the international rule of law.
Moreover, when due diligence obligations are introduced (through secondary law or interpretation) into treaty regimes which had previously provided for substantive standards, due diligence may dilute the strictness of those regimes by reopening States' discretion. An example is the application of due diligence to cyberspace. Russia and China have focused on the risk of cyber terrorism in order to forge an international consensus to restrict freedom of expression on the internet. The International Code of Conduct for Information Security of September 2011 may be seen as such an attempt to legitimise restrictions of free speech that actually disregard international human rights obligations. 59 A duty to monitor and prevent harmful activities in cyberspace may also serve as a narrative to bolster further disproportionate surveillance measures. This may give room for more self-selected processes and self-biased national narratives and thereby contribute to an alienation and even disengagement of States from their international legal commitments.
Another potentially negative consequence of the rise of due diligence concerns private actors. We have seen that the traditional and probably still major field of application of due diligence relates to the risk-prone activities of private actors which have thereby been at least indirectly brought under the purview of international law. Thus, due diligence contributes to the rise of 'informal' international law, notably professional and industrial standards which are often issued by transnational non-State actors, such as professional associations and business interest groups, frequently in collaboration with non-governmental organisations, or with government agencies. Such standards are often crucial for determining which conduct is actually 'due' in a given issue area, and they heavily influence the interpretation of the relevant hard law. However, informal law-making processes cannot draw their legitimacy from State consent and must be justified by other factors such as transparency, participation and expertise, standards which are controversial and in flux.
To sum up, the spread of due diligence risks undermining the governance capacity of international law by diluting substantive obligations and potentially giving rise to managerialism and technocracy. Thereby it risks sapping both the effectiveness and the legitimacy of international law.

CONCLUSION: DUE DILIGENCE AS AN INDICATOR OF STRUCTURAL CHANGE IN OR EVEN OF THE INTERNATIONAL LEGAL ORDER
By way of conclusion, let us return to COVID-19. It will most likely be impossible to pin down and assign responsibility to one or several States for harm caused by the new virus. So in the end, due diligence (in this case in global health law) does not provide any clear 'solution' to a concrete problem. But on a more general level, as this paper has tried to show, the rise of due diligence across all areas of international law can be seen as a response to, as a manifestation of, and as a driver of structural change in the international legal order as a whole. The most notable structural change is proceduralisation, as we described. This change overlaps with new types of risk management in the face of complexity and diversification of actors.
Seen through the lens of global constitutionalism, the rise of due diligence, as a tort-law-and criminal-law-based institution, at first sight seems to suggest an undue 'privatisation' or 'de-constitutionalisation' of the international legal order. However, in the era of global capitalism, constitutionalisation cannot and should not be confined to States. The rise of due diligence both in inter-State constellations and in (so to speak) 'diagonal' State/non-State constellations, such as human rights, eg Sections (e) and (f): '(e) To reaffirm all the rights and responsibilities of States to protect, in accordance with relevant laws and regulations, their information space and critical information infrastructure from threats, disturbance, attack and sabotage; (f) To fully respect rights and freedom in information space, including rights and freedom to search for, acquire and disseminate information on the premise of complying with relevant national laws and regulations'.
Due diligence: the risky risk management tool in international law 135