The Supply Chain Due Diligence Act (LkSG) at a glance

Abstract

The Supply Chain Due Diligence Act (LkSG) was passed in June 2021 and has been in force since January 1, 2023. It obliges companies to protect human rights and certain environmental standards along their entire supply chain and thus implements the UN Guiding Principles on Business and Human Rights in a binding manner. Companies must set up an effective risk management system, carry out regular risk analyses and establish preventive and remedial measures, a complaints procedure and document implementation. The statutory reporting obligation is currently suspended and an amendment to the law is in the process of being made.

Companies with at least 3,000 employees have been directly affected since 2023 and companies with at least 1,000 employees in Germany since 2024, provided they have their registered office or a branch office in Germany. In practice, many suppliers are also indirectly involved, as obligated companies contractually pass on requirements along the supply chain. Violations can result in fines of up to 8 million euros or up to 2 percent of annual global turnover, exclusion from public contracts and the reclaiming of subsidies; planned amendments to the law provide for a stronger focus on serious violations.

Updates to the LkSG (as of January 30, 2026)

With the planned amendment to the LkSG, the federal government wants to simplify key points without abolishing the law as such. The focus is primarily on two changes:

• Abolition of reporting obligations (planned): The draft bill (BT-Drs. 21/2474) provides for the reporting obligation currently enshrined in the law to be abolished without replacement and with retroactive effect. In practice, the issue has already been significantly mitigated: BAFA has no longer been reviewing reports since 01.10.2025. It has no longer been possible to submit reports via BAFA access since 07.11.2025.
• Restriction of sanctions (planned): In future, only serious basic violations are to be sanctioned (e.g. lack of risk management, no effective risk analysis, no functioning complaints procedure)

It remains important: Due diligence obligations continue to apply. Companies should continue to properly set up risk management, risk analysis and preventive and remedial measures. If external reporting obligations no longer apply, internal documentation becomes all the more important, for example for customer requirements and critical questions from stakeholders.

What is the LkSG? Definition, background, legal framework

Goal & basic logic of the LkSG

The German Supply Chain Due Diligence Act (LkSG ) obliges companies to take risks to human rights and certain environmental aspects in their supply chain seriously. This is not a guarantee of "zero risk". It is crucial that companies identify risks at an early stage, prioritize them correctly and take appropriate measures to reduce them effectively.

Companies do not have to check every part of the supply chain with equal intensity. Instead, they should concentrate on the areas where risks are particularly likely or particularly serious. In practice, the focus is therefore more on countries, sectors or product groups with a high risk situation than areas with lower risks.

Two key benchmarks for implementation are appropriateness and effectiveness.

• Appropriateness means that measures must be appropriate to the respective risk situation, i.e. plausible, proportionate and well-founded. The more serious a potential breach is and the closer it is to the company's own business area or important suppliers, the more specific and comprehensive the preventive and remedial measures must be.
• Effectiveness means that not only guidelines or declarations of intent exist, but that they actually work in everyday life. A code of conduct or a questionnaire alone is therefore not enough if there is no follow-up, no escalation and no measurable improvements.

Origin and legal framework

The German Supply Chain Act was introduced because voluntary commitments were often not enough to effectively prevent human rights violations and environmental damage in complex global supply chains. It therefore obliges companies to systematically identify and assess risks and take appropriate measures.

Fixed, permanently functioning processes are required: risk management with regular risk analysis, preventive and corrective measures, a complaints procedure and comprehensible documentation. The initial focus is on the company's own business area and direct suppliers. Indirect suppliers must be checked in particular if there are concrete indications of risks. A risk-based approach applies here: not everything has to be checked at all times, but in greater depth where actual risks exist.

The law in Germany has led to the introduction of a similar law in Europe called the Corporate Sustainability Due Diligence Directive (CSDDD).

Reference to UN Guiding Principles & OECD Guidelines: The German Supply Chain Act is based on international standards, in particular the UN Guiding Principles on Business and Human Rights. These require companies to respect human rights, identify risks at an early stage and take remedial action in the event of problems. This is precisely what the LkSG addresses, for example through a declaration of principles, risk analysis, preventive and remedial measures and a complaints procedure.

In addition, the OECD Guidelines and OECD Due Diligence Guidance provide practical orientation for implementation, for example on prioritizing risks, anchoring expectations in supplier relationships and effectiveness testing. The LkSG is therefore essentially the binding national formulation of what is considered good international due diligence practice.

The legislative process at a glance

1. January 16, 2026: First consultation/1st reading on the draft bill to amend the LkSG (BT-Drs. 21/2474), referral to the committees.
2. November 07, 2025: Submission of LkSG reports via BAFA access no longer possible.
3. October 17, 2025: Statement on the draft bill (including on the suspension/abolition of the reporting obligation).
4. October 01, 2025: Implementation notice simplifications (including discontinued report review, more restrictive enforcement/fine practice; reference to cabinet decision).
5. September 03, 2025: Decision on the amendment (expressly mentioned in the BAFA notice).
6. January 2024: The law is extended to companies that employ at least 1,000 people in Germany.
7. January 2023: The German Supply Chain Due Diligence Act comes into force.
8. July 2021: The law was signed by the Federal President and published in the Federal Law Gazette. The legislative process has been formally completed and will enter into force on January 1, 2023.
9. June 2021: The Committee on Labor and Social Affairs made amendments to the draft law on corporate due diligence in supply chains. The Federal Government's draft was subsequently adopted by the Bundestag. In the vote, 412 MPs voted in favor of the bill, 159 voted against and 59 abstained.
10. March 2021: The European Parliament adopted the "Legislative report on corporate human rights and environmental due diligence" with a broad majority of 504 out of 695 votes. A legislative report is a recommendation to the EU Commission to introduce a law.
11. April 2021: The Bundestag discussed the draft law on corporate due diligence obligations in supply chains in the first reading.

The Corporate Sustainability Due Diligence Directive (CSDDD) exists in parallel at EU level. As part of the latest EU simplifications, the obligations will primarily affect very large companies (including >5,000 employees and >€1.5 billion turnover) in future; application is planned from July 2029. The exact structure remains dependent on the final legislative process in the European Union.

LkSG in context: EU and international regulations - why are supply chain laws necessary?

Many German companies have been directly or indirectly involved in disasters in other countries in the past. For example, in 2019 when a dam burst in Brazil, killing more than 250 people, or in 2012 when a fire broke out in a textile factory in Pakistan.

According to the law, German companies will also have to take responsibility for incidents of this kind in future. This primarily affects companies in the textile, electronics and automotive industries. The same applies to the pharmaceutical and food industries, as Germany imports many foodstuffs, chemicals and medicines from abroad.

Differences between German supply chain law and EU supply chain law

The LkSG obliges affected companies to systematically assess risks to human rights and certain environmental aspects in their own operations and those of their direct suppliers and to manage them with preventive and remedial measures.

The EU Directive on Corporate Sustainability Due Diligence (CSDDD, Directive (EU) 2024/1760) pursues the same goal, but sets a uniform framework for the entire EU. It came into force on July 25, 2024.

At the same time, the EU is working on simplifications ("omnibus"). Although the framework is in place, individual details may still change. Companies should therefore not wait until everything has been finalized. It makes more sense to establish stable basic processes now - for example for risk analysis, supplier management, remediation, complaints procedures and documentation.

Supply chain laws in other countries

Germany is not alone with the LkSG. Other countries have also had regulations in place for years that make companies more responsible for human rights and the environment in their supply chains. Although the approaches differ in detail, they follow the same basic idea: companies should not only be aware of risks, but also actively manage them and effectively address violations.

France is a frequently cited example. For some years now, France has had regulations in place that oblige large companies to draw up and implement a structured due diligence plan. Similar to the LkSG, the focus is on topics such as risk analysis, prevention, remediation and the question of whether measures actually work. The practical effect is similar: due diligence obligations are being transformed from a "voluntary CSR issue" into a fixed component of governance and supplier management.

Other countries have also introduced or further developed supply chain or due diligence obligations - sometimes with a stronger focus on transparency and reporting obligations, sometimes with special priorities or enforcement mechanisms. The decisive consequence for companies with international procurement is that individual national regulations can quickly become a patchwork quilt. This is precisely why the EU is focusing on a harmonized framework with the CSDDD.

Which companies are affected?

The LkSG does not apply "to everyone", but is aimed at companies that have a clear connection to Germany and meet certain threshold values. It is important to note that even if a company does not formally fall under the law, it can still be very specifically affected as a supplier because larger customers pass on the requirements in purchasing conditions, contracts and audit processes.

Thresholds & registered office in Germany

Whether a company falls directly under the LkSG depends on two questions: Does it have a relevant connection to Germany and does it meet the employee threshold?

This means that "large" in the context of the LkSG is not defined by turnover or balance sheet total, but quite practically by the number of employees. Companies with fewer than 1,000 employees typically do not fall directly within the scope of the law, but can still be heavily affected indirectly (see SME section below).

Reference to Germany (when the LkSG applies):

The law covers companies if they are anchored in Germany, e.g. through:

• Head office
• Head office
• Administrative headquarters
• statutory seat
• in Germany.

In addition, companies that have a branch office in Germany (e.g. in accordance with Section 13d of the German Commercial Code (HGB)) and conduct business through it, even if their head office is abroad, may also be affected.

In practice, this means

• Anyone who falls within the direct scope of application must systematically implement the due diligence obligations in their own business area and in the relevant parts of the supply chain.
• If you are just below the thresholds, you should check how quickly this can change - for example due to growth, reorganization or intra-group staff transfers. As soon as the threshold is reached, the supervisory authority does not expect a "start from scratch", but comprehensible processes.

Suppliers: Who is directly affected and who indirectly?

It is important to distinguish between legal obligation and de facto involvement:

• Direct suppliers are therefore not automatically legally obliged themselves. In practice, however, they are often included via contracts because companies that fall under the LkSG pass on their requirements along the supply chain.
• Indirect suppliers become particularly relevant when there are concrete indications of risks or violations. For example, through complaints, media reports, audits or information from the authorities. In such cases, companies must react and check more closely.

Why should smaller companies also deal with the LkSG?

Small and medium-sized enterprises are often part of larger supply chains. Even if they do not export directly, they can act as suppliers for large corporations. Dealing with the law not only protects against legal consequences, but also strengthens the company's image and enables more sustainable and ethical business practices.

Small and medium-sized companies with fewer than 3,000 or 1,000 employees should also get to grips with the law in good time. Companies that act early have the opportunity to set standards and gain a head start.

1. Major customers expect compliance with supply chain requirements.
2. Contractual general terms and conditions of major customers oblige smaller suppliers and vendors to adhere to compliance requirements.
3. Without compliance and, in particular, proof of compliance with the law, new suppliers will no longer be able to access the panel of customers. As a result, they will no longer receive new orders.
4. Adherence to compliance requirements creates trust and transparency and strengthens your company.

The duties of care under the LkSG

9 Due diligence obligations in accordance with Section 3 of the Supply Chain Due Diligence Act

The following 9 due diligence obligations are defined therein and must be observed by companies both in their own business area and by their suppliers:

1. Establishment of risk management: Effective risk management must be introduced to identify, minimize and prevent violations of human rights.
2. Definition of internal responsibilities: Clear and transparent division of work can optimize processes, increase efficiency and avoid misunderstandings.
3. Carry out regular risk analyses: These analyses help to identify risks to human rights and the environment. The analyses should be carried out both within the company and at suppliers. This ensures that companies act proactively and identify human rights risks at the lower levels of their supply chains.
4. Issue a policy statement: A policy statement on the internal human rights strategy should be issued.
5. Establishment of preventive measures: Preventive measures should be introduced both in the company's own business area and in relation to direct and indirect suppliers.
6. Taking remedial action: It makes sense to take active measures to improve the situation.
7. Establishment of a complaints procedure: A functioning complaints procedure should also be set up within the company.
8. Implementation of due diligence obligations: Due diligence obligations in relation to risks should be implemented for both direct and indirect suppliers.
9. Documentation and reporting: The measures taken should be regularly documented and reports published.

The human rights due diligence obligations require companies to introduce a complaints procedure and risk management. If they identify violations in their business or supply chain, remedial action must be taken. With this law, companies must now themselves ensure that international human rights are respected both in their own business operations and throughout their supply chain.

The German Supply Chain Act is not a completely new idea. It builds on international standards and existing guidelines, for example the UN Guiding Principles on Business and Human Rights, the OECD Guidelines for Multinational Enterprises and BAFA handouts and guidelines.

The debate was primarily triggered by scandals and serious incidents in which companies were linked to human rights violations or environmental damage. In addition, pressure from civil society and NGOs as well as global developments contributed to the introduction of the law.

To ensure that these requirements do not become individual decisions on a day-to-day basis, you need clean supply chain management: clear responsibilities, reliable data flows, defined escalation channels and supplier management that tracks measures. Read our article on supply chain management to find out how to set up these structures and which processes have proven themselves in practice.

Supplier management & purchasing processes

Contracts, code of conduct, onboarding, questionnaires - what is enough, what is not?

To ensure that due diligence obligations are not only imposed on suppliers "retrospectively", the topic should be incorporated into the supplier relationship as early as possible, ideally during onboarding. A code of conduct or self-disclosure can be a good start. However, this alone is often not enough, especially if the risk situation is elevated or if customers or inspection bodies expect verifiable evidence.

A staged approach has proven itself in practice: For suppliers with a low risk situation, basic requirements and a plausibility check can be sufficient. For higher risks, additional information and clear rules on how to deal with deviations are required. It is important to note that a signed code of conduct is only reliable if it is linked to specific expectations, responsibilities and control mechanisms.

Monitoring: audits, evidence, KPIs, effectiveness monitoring

The LkSG not only looks at whether rules are written down, but whether they work in practice. Monitoring is therefore an important part of implementation. Companies must be able to show how they check supplier requirements and what they do if there are indications of risks or violations. This does not mean "audits everywhere", but a risk-based approach, with appropriate evidence, spot checks, assessments and consistent follow-up.

It is crucial that responses and evidence are not only collected but also evaluated and that deviations lead to concrete measures. This is precisely where "paper compliance" separates itself from implementation that also stands up to critical scrutiny.

Supplier development & long-term risk minimization

Not every risk can be resolved by replacing suppliers immediately. In many cases, breaking off the business relationship only makes sense as a last resort. Supplier development is therefore a key lever in the LkSG: risks are reduced in the long term by companies demanding, supporting and following up on improvements.

Above all, supplier development means agreeing specific measures with suppliers, including clear responsibilities, fixed deadlines and clear follow-up. Depending on the situation, this may also include training, joint standards or improvement programs. It is important that the measures are measurable and that they are regularly checked to see if they are really working.

This transforms supplier management from "querying standards" to a system that actually minimizes risks and at the same time strengthens the supply capability and stability of the supply chain.

Human rights and environmental aspects: What is specifically protected?

Child labor, forced labor, discrimination

The LkSG protects fundamental human rights. This is particularly important in countries or sectors where controls are weak or there is strong price pressure. Child labor and forced labor are among the most serious risks and are therefore monitored particularly closely. This does not only apply to clearly visible cases. There are also risks if workers are recruited through dubious intermediaries, have to pay high fees or hand in their ID cards. Discrimination also plays a role, for example when certain groups are systematically paid less or disadvantaged.

This means for companies: They should pay attention to typical warning signals in the risk analysis. These include, for example, high-risk sectors, country profiles, indications from audits or complaints and anomalies in the recruitment or employment of workers. Companies can take preventative measures by having clear rules for recruitment, proper documentation of employment relationships, training and an easily accessible complaints channel. If there are indications of violations, they must investigate them and initiate concrete measures, not just take note of them.

Occupational health and safety, wages, freedom of association

In many supply chains, it is not only the major "scandalous issues" that are a problem, but above all the day-to-day working conditions. This is why the LkSG also covers occupational health and safety, health protection, fair wages and basic employee rights. This is particularly important in sectors with a high risk of accidents, very long working hours or many subcontractors. Typical weak points are a lack of protective measures, poor accommodation, too much overtime or wage deductions that can make employees dependent.

It is important to note that these topics are not just "nice to have", but are part of what companies must check for plausibility as part of their due diligence obligations. In practice, this means that verification and controls should not only focus on paper documents, but also on the question of whether minimum standards are actually being implemented. This is particularly effective if requirements are anchored in purchasing and supplier management - e.g. through clear minimum requirements, risk-based verification checks, action plans and consistent follow-up.

Environmental risks

The LkSG applies not only to human rights, but also to certain environmental issues. This primarily refers to cases in which environmental problems directly harm people. For example, when pollution makes people ill, there is a lack of clean water or people lose their livelihoods. Typical risks include polluted air or water, incorrectly disposed waste and the use of hazardous chemicals, especially in countries where environmental regulations are hardly monitored.

It is crucial for companies to take a risk-based approach to environmental aspects: Not every supply relationship is automatically an environmental risk, but depending on the raw material, production process or location, environmental factors can very quickly become a key compliance issue. Clear expectations of suppliers, evidence of relevant procedures and approvals as well as monitoring that identifies anomalies and investigates them in depth if necessary can help with implementation. Here, too, it is not the existence of a policy that counts, but the ability to identify risks, derive measures and provide verifiable evidence of their effectiveness.

Monitoring, enforcement & sanctions

Responsibilities: Who has to ensure what?

Clear responsibilities are needed to ensure that due diligence obligations do not become individual decisions. The LkSG is therefore not just a "purchasing issue", but a question of management within the company.

Duties and responsibilities within the company

• Management level: The management must ensure that the company systematically implements its obligations. This includes clear rules, defined responsibilities and a functioning risk management system.
• specialist departments (e.g. Purchasing, Compliance, Sustainability, HR): In practice, the requirements are implemented via processes - in particular via supplier management, risk analysis, escalation, remediation and documentation.
• Relationship with suppliers: Companies need to manage their supply chain on a risk-based basis, i.e. sharpen up especially where risks are higher. This applies to requirements, evidence, action plans and the tracking of improvements. You should bear this in mind when selecting and evaluating suppliers.

Control instruments: How companies ensure compliance internally

The first and most important mechanism is self-regulation. Companies must be able to demonstrate that they are not only aware of risks in theory, but also manage them in practice.

Typical instruments of self-control are

• Guidelines and standards (e.g. Code of Conduct, declaration of principles, supplier requirements)
• Clear responsibilities and defined escalation channels
• Training and sensitization of relevant teams
• Internal controls (e.g. spot checks, reviews, internal audits)
• Follow-up of measures (action plans, deadlines, effectiveness check)

Role of BAFA: tasks of the authority and audit logic

In addition to internal control, there is also external supervision. BAFA monitors compliance with the LkSG, can carry out checks and respond to information or complaints. The focus here is on whether a company has established a plausible, risk-based and effective system.

What BAFA essentially wants to ensure

• Companies do not tolerate any unlawful practices within their sphere of influence.
• Risks are systematically identified and prioritized.
• Measures are implemented and fine-tuned where necessary.
• Decisions and procedures are documented in a comprehensible manner.

Sanctions & enforcement practice: What does this currently mean?

For the purposes of classification, it is helpful to briefly combine enforcement and legislative development: It may feel like "less is happening", but the core expectation of functioning processes remains.

Since October 1, 2025, the BAFA has been pursuing a more restrictive practice: Proceedings on offenses that are to be deleted in the draft are discontinued or not reopened; fines are only considered for serious violations and under high conditions.

The legislative process for the amendment is running in parallel; among other things, the draft provides for the deletion of the reporting obligation and focused sanctions, while inspections are to continue.

What is requested and checked in practice?

When inspections take place, it is rarely about "perfect supply chains", but rather about reliable traceability: Can the company show that it systematically fulfills its obligations and acts in the event of risks?

Typical topics that are asked in practice:

• Governance & responsibilities: Who is responsible? What roles are there? How is escalation handled?
• Risk management & risk analysis: methodology, results, priorities (annual + event-driven)
• Preventive measures: What standards apply? How are they anchored in purchasing/supplier management?
• Remedial measures & cases: How was specific advice responded to? What action plans were implemented?
• Complaints procedure: Access, protection, processing, lessons learned
• Effectiveness monitoring: What evidence/KPIs are there? How is the focus sharpened?
• Documentation: Are decisions, assessments and measures filed in a comprehensible manner?

What to do if an infringement occurs?

If a violation occurs in the company, whether at home or abroad, immediate action must be taken to end the violation. If a direct supplier or service provider commits a violation that cannot be stopped immediately, a plan must be drawn up immediately to stop or minimize the violation.

If legal violations are disclosed, business relationships do not have to be terminated immediately. In addition, solutions should be sought together with those affected in the supply chain. A corresponding action plan can help here.

The termination of a business relationship is the last resort. This would have to be a serious breach where no remedial measures have brought about a termination or where no more lenient means are available.

Section 3 (3) sentence 1 clarifies that there is no civil liability in the event of a breach of the duty of care. The applicability of the law depends on the registered office of the company. The LkSG does not establish any new liability under civil law, but does not affect existing liability rules and also introduces a special procedural status.

Pros and cons of the Supply Chain Act

Critics believe that the law does not go far enough. One point is that companies with fewer than 1,000 employees are currently not directly covered. In addition, environmental and human rights organizations criticize the fact that companies cannot automatically be held legally liable for problems in their supply chain.

Industry associations see it differently: a stricter law causes high costs for the economy. After the entire economy has already suffered enormously during the coronavirus pandemic, the strict implementation of the Supply Chain Due Diligence Act will only further damage Germany as a business location. In particular, it is hardly feasible for small and medium-sized companies to check the entire supply chain accordingly.

The BDI warns that the law could slow down German investment in Africa. The concern is that this could ultimately make Germany even more dependent on Asia. Others are therefore calling for a uniform EU regulation in order to avoid competitive disadvantages for individual countries. They are also calling for more support from politicians in auditing global supply chains - for example via the German Chambers of Commerce Abroad (AHK).

Conclusion

The LkSG requires companies to systematically identify, prioritize and effectively reduce human rights and certain environmental risks in their supply chain. This requires clear processes for risk analysis, prevention and remediation, a functioning complaints procedure and proper documentation. Responsibility lies not only with purchasing, but also with management and the relevant specialist departments, which must translate the requirements into day-to-day operations. Even if the effort involved increases, a robust due diligence system strengthens trust in the long term, reduces risks and makes supply chains more stable.