Supply Chain Due Diligence Act (LkSG): Current Status and Implementation

Abstract

The Supply Chain Due Diligence Act (LkSG) has been in effect since January 1, 2023, and incorporates the UN Guiding Principles on Business and Human Rights into German law in a binding manner. It requires companies to identify risks to human rights and certain environmental standards in their supply chains, prevent them, and remedy violations. To do so, they need effective risk management, regular risk analyses, preventive and remedial measures, a grievance procedure, and ongoing documentation: the due diligence obligations under Section 3 of the LkSG.

Since 2024, companies with headquarters or branches in Germany and, as a rule, at least 1,000 employees in the country have been directly affected. Many suppliers are indirectly involved because companies subject to the regulation pass on their requirements through contracts. Violations may result in fines of up to 800,000 euros; for companies with annual revenue exceeding 400 million euros, fines may amount to up to 2 percent of global annual revenue, as well as exclusion from public contracts.

As of 2026: Since October 2025, the BAFA has stopped reviewing reports and now only investigates serious violations. The reporting requirement is set to be retroactively repealed by an amendment bill that is still pending in the Bundestag. In addition, the federal government has announced plans to raise the threshold to 5,000 employees and 1.5 billion euros in revenue. Neither of these changes has been finalized yet. Starting in 2029, the CSDDD will establish an EU-wide framework. Until then, the due diligence obligations themselves will remain unchanged.

Supply Chain Act: Current Status as of 2026—What Applies, What’s Changing?

In 2026, the LkSG will continue to apply unchanged to companies with 1,000 or more employees in Germany. The main changes have been in the BAFA’s administrative practices. Several legislative amendments are planned or have been announced but have not yet been enacted. To help you keep track, we distinguish between three levels.

What's Happening in the Legislative Process

On September 3, 2025, the Federal Cabinet approved a draft bill to amend the Supply Chain Due Diligence Act (BT-Drs. 21/2474). The Bundesrat issued its opinion on October 17, 2025, and called for further relief measures. The Bundestag debated the bill in its first reading on January 16, 2026, and referred it to the committees (Bundestag). It has not yet been enacted.

The draft provides for the following:

• the complete and retroactive elimination of the reporting requirement under § 10, paragraphs 2 through 4, of the LkSG, with respect to all reporting periods beginning in January 2023
• the elimination of the official review of reports pursuant to Sections 12 and 13 of the LkSG
• A reduction in the number of offenses subject to fines to four serious breaches of duty, each related to human rights risks:
  • Lack of preventive measures (Section 6(1))
  • Failure to take corrective measures (Section 7(1))
  • a missing or unimplemented corrective action plan (Section 7(2), Section 9(3))
  • the absence of an appeals process (Section 8(1))
• a uniform range of fines of up to 800,000 euros; for companies with annual revenue exceeding 400 million euros, fines may still amount to up to 2 percent of average annual revenue

The due diligence obligations themselves and the internal documentation requirement under Section 10 of the LkSG remain unchanged.

What has only been announced politically

On July 2, 2026, the coalition committee of the CDU, CSU, and SPD approved a reform package. Under the terms of the package, the scope of the LkSG is to be narrowed as early as fall 2026:

• Higher threshold: only companies with at least 5,000 employees and more than 1.5 billion euros in annual net revenue worldwide
• More Risk-Based: Due Diligence Requirements Focus on Actual Risk Areas
• Fewer Requests to Smaller Suppliers: Information from business partners with fewer than 5,000 employees will only be requested if it cannot be obtained elsewhere

A draft bill on this matter had not been submitted by the time of this publication. Until a corresponding law is enacted, the threshold of 1,000 employees remains in effect.

Will the Supply Chain Act be repealed?

No, at least not without a replacement. The coalition agreement calls for replacing the LkSG with a “Law on International Corporate Responsibility” that implements the EU Supply Chain Directive (CSDDD). Until this law takes effect, the LkSG remains in force.

LkSG Reporting Requirement: Will Reporting Still Be Required in 2026?

No, you are not currently able to—or required to—submit a report to the BAFA. Formally, however, the reporting requirement under § 10, paras. 2–4 of the LkSG remains in effect until the amending law is promulgated. Originally, companies were required to report annually,

• what risks they have identified,
• what measures they have taken,
• how they assess their effectiveness and
• what conclusions they draw for the future.

The internal documentation requirement under Section 10(1) of the LkSG remains in full force. In fact, it becomes even more important: Without a report, it serves as the primary evidence during ad hoc BAFA inspections, client audits, and competitive bidding processes. It must be able to demonstrate when a supplier was last evaluated, what measures were taken as a result, how the company responded to feedback, and how the effectiveness of those measures was verified.

What does this mean for your company?

• 5,000 employees or more: The changes affecting you will be minimal. You will likely remain subject to the requirements and will fall under the CSDDD starting in 2029. You can set aside the BAFA report for now, but not the processes behind it.
• 1,000 to 5,000 employees: You are currently required to comply, but you might no longer be required to do so following a change in the law. Nevertheless, don’t rush to dismantle your processes: Your obligations remain in effect until the law is officially enacted, major clients will continue to require proof of compliance, and rebuilding them later will cost more than maintaining a streamlined system.
• Suppliers and SMEs: You will continue to receive questionnaires and requests for supporting documentation. If the announced cap becomes law, certificates, contract clauses, and existing information are likely to become more important. Keep this documentation up to date and readily available.

What is the Supply Chain Act?

The Supply Chain Act, officially titled the “Act on Corporate Due Diligence to Prevent Human Rights Violations in Supply Chains” (Supply Chain Due Diligence Act, LkSG), is a German federal law enacted on July 16, 2021. It requires large companies to respect human rights and certain environmental standards within their own operations and among their suppliers. It has been in effect since January 1, 2023.

Proportionality and Effectiveness: The Two Criteria of the LkSG

Proportionality means that measures must be appropriate to the risk situation. According to Section 3(2) of the LkSG, this depends on:

• Nature and Scope of Business Activities
• Ability to influence the direct source of a risk
• the expected severity, reversibility, and likelihood of an injury
• Nature of One's Own Contribution to the Cause

Effectiveness means that measures must work in everyday practice. A signed Code of Conduct alone is not enough if it is not followed up on, if issues are not escalated, and if there is no measurable improvement. This is precisely where “paper compliance” differs from implementation that can withstand critical scrutiny.

Why was the German Supply Chain Act enacted?

Voluntary commitments made as part of corporate social responsibility (CSR) have often proven insufficient in global supply chains. The National Action Plan on Business and Human Rights (NAP) initially called on companies to implement due diligence measures on a voluntary basis starting in 2016. Accompanying surveys showed that only a small fraction met the requirements. Incidents such as the collapse of the Rana Plaza factory building in Bangladesh in 2013, which claimed over 1,100 lives, and the Brumadinho dam collapse in Brazil in 2019, which resulted in more than 250 deaths, sparked the public debate.

In terms of content, the LkSG mandates the implementation of international standards:

• UN Guiding Principles on Business and Human Rights (2011): The Statement of Principles, risk assessment, prevention, remedy, and grievance procedures follow this logic.
• OECD Guidelines for Multinational Enterprises: They provide practical guidance on prioritization, supplier relationships, and monitoring effectiveness.
• BAFA Guidelines: These explain how the agency interprets specific requirements, such as risk analysis, complaint procedures, and proportionality.

Timeline for the Supply Chain Act

• June 2021: The Bundestag passes the LkSG.
• July 16, 2021: Enactment and publication in the Federal Law Gazette (BGBl. I, p. 2959)
• January 1, 2023: Effective date for companies with 3,000 or more employees
• January 1, 2024: Expansion to companies with 1,000 or more employees
• September 3, 2025: Cabinet decision on the amendment bill
• October 1, 2025: The BAFA discontinues its review of reports.
• January 16, 2026: First reading of the amendment bill in the Bundestag
• July 2, 2026: The coalition committee announces that the threshold will be raised to 5,000 employees.
• July 26, 2029: The EU Supply Chain Directive (CSDDD) takes effect.

What does the Supply Chain Act protect?

The LkSG protects human rights and certain environmental interests, which are exhaustively listed in § 2 of the LkSG and the annex to the Act. It is based on eleven international conventions, including the ILO’s core labor standards and UN human rights covenants.

Human rights risks under Section 2(2) of the LkSG include, among others:

• Child Labor, Forced Labor, and Slavery
• Failure to Comply with Occupational Safety and Health Regulations
• Violation of the Freedom of Association
• Unequal treatment in employment, such as on the basis of origin, gender, religion, or health status
• Denial of fair wages, at least the local minimum wage
• harmful soil, water, or air pollution that harms people
• Unlawful eviction and unlawful land expropriation
• Deployment of security forces that mistreat people

Environmental risks under Section 2(3) of the LkSG primarily concern the prohibited handling of mercury (Minamata Convention), persistent organic pollutants (Stockholm Convention), and hazardous wastes (Basel Convention). To learn how the EU will prosecute serious environmental offenses in the future, read the article on the Ecocide Directive.

Who is affected by the LkSG?

A company is directly affected if it has a connection to Germany and meets the employee threshold. Legal form and industry are irrelevant (Section 1 of the LkSG). To date, the LkSG does not include a revenue criterion.

How many employees must a company have for the Supply Chain Act to apply?

• Effective January 1, 2023: generally at least 3,000 employees in Germany
• Effective January 1, 2024: generally, at least 1,000 employees in Germany
• Announced for fall 2026: at least 5,000 employees and more than 1.5 billion euros in revenue (not yet finalized)

Employees posted abroad are included. Temporary agency workers are included if their assignment lasts longer than six months.

When is there a connection to Germany?

The LkSG applies to companies with their head office, principal place of business, administrative headquarters, or statutory seat in Germany. Foreign companies are subject to the law if they have a branch office in Germany pursuant to Section 13d of the German Commercial Code (HGB) that generally employs at least 1,000 people. Companies headquartered abroad often underestimate the significance of this connecting factor.

Group, Subsidiary, Branch: Typical Borderline Cases

According to Section 1(3) of the LkSG, the number of employees in Germany at all companies belonging to the group is counted as part of the parent company’s total. A holding company with few employees of its own may therefore be subject to this requirement. Central standards, such as policy statements or complaint procedures, are often established group-wide, but their implementation must be effective at the individual unit level.

Are suppliers and small and medium-sized enterprises (SMEs) affected by the Supply Chain Act?

Not directly, but in practice, often quite significantly. Companies subject to these requirements pass them on through contracts. A typical result is a cascade effect:

1. A company subject to the LkSG establishes expectations for its direct suppliers, for example through a Supplier Code of Conduct, questionnaires, audit rights, or action plans.
2. These suppliers pass on the requirements to their own suppliers.
3. As a result, the Supply Chain Act will also be relevant to many small and medium-sized businesses, even though they themselves are not subject to its requirements.

Companies that cannot provide the necessary documentation will be rated lower in bids for major clients or may not be included in the supplier panel at all. Conversely, thorough documentation provides a competitive advantage.

What due diligence obligations apply under the LkSG?

Section 3(1) of the LkSG lists nine due diligence obligations. They apply to a company’s own business operations and direct suppliers; in the case of indirect suppliers, they apply on a case-by-case basis. Together, they form a comprehensive system: identifying risks, preventing them, mitigating them, recording reports, and documenting them.

1. Establish a risk management system (Section 4, para. 1): appropriate, effective, and integrated into all relevant business processes, particularly in purchasing and supplier selection
2. Establish internal responsibility within the company (Section 4(3)): for example, through a human rights officer. Management must be briefed on the officer’s work at least once a year.
3. Conduct regular risk analyses (Section 5): once a year and as needed, such as when introducing a new product line or sourcing from a new country
4. Issue a policy statement (Section 6(2)): a statement by management on the human rights strategy
5. Embed prevention measures within one’s own business area (Section 6, paragraphs 1 and 3): for example, procurement strategies, training, and risk-based controls
6. Establish preventive measures with respect to direct suppliers (Section 6(4)): such as selection criteria, contractual assurances, training, and inspections
7. Take corrective measures (Section 7, paragraphs 1 through 3): Prevent, stop, or minimize injuries
8. Establish a grievance procedure (Section 8): accessible to internal and external individuals, including employees of suppliers.
9. Implement due diligence obligations with respect to indirect suppliers (Section 9): in cases of substantiated knowledge of a possible violation

LkSG Risk Analysis: The Core Component

Risk analysis forms the basis for all further actions. Without it, you cannot determine which suppliers to scrutinize more closely, nor which measures are appropriate. In practice, the process consists of four steps:

1. Abstract Risk Assessment: Classifying Suppliers Based on Country and Industry Risks
2. Specific Risk Assessment: In cases of increased risk, obtain self-disclosures, certificates, or audit reports
3. Weighting and Prioritization: Based on Severity, Probability, Impact, and Degree of Contribution to the Cause
4. Communication and Actions: Share findings with management and the purchasing department; develop action plans

LkSG Appeal Procedure: Requirements Under Section 8

The complaint procedure is a fundamental requirement and is often the first point of scrutiny for customers, auditors, and the BAFA, because the absence of a reporting channel is easy to detect. An effective procedure meets the following requirements:

• Accessibility: accessible to internal and external whistleblowers, including employees of overseas suppliers; ideally multilingual
• Confidentiality: Protection of identity; anonymous reports should be possible
• Protection Against Retaliation: No Discrimination Against Whistleblowers
• Public Rules of Procedure: The Process in Written Form, Publicly Available
• Impartial Processing: The responsible individuals are independent and bound by a duty of confidentiality
• Confirmation of receipt and discussion: Whistleblowers receive confirmation, and the facts of the matter are discussed with them
• Annual effectiveness review: at least once a year and as needed

Many companies combine the LkSG complaint procedure with the internal reporting channel established under the Whistleblower Protection Act (HinSchG) into a single digital whistleblower system. This saves effort, but requires that the channel also be open to external parties in the supply chain.

Case Study: Implementation of the LkSG in the Mechanical Engineering Industry

A mechanical engineering company with 1,200 employees has been subject to the LkSG since January 2024. It sources components from approximately 80 suppliers in 15 countries, including suppliers in South and Southeast Asia.

• Responsibilities: The Head of Purchasing will serve as the LkSG representative and report directly to management.
• Risk Analysis: 12 of the 80 suppliers are considered high-risk. They will receive self-assessment questionnaires, and on-site audits will be scheduled for two of them.
• Prevention: All supplier contracts include a code of conduct clause. Three high-risk suppliers are being trained in collaboration with a local NGO partner.
• Complaint Procedures: A multilingual digital whistleblower system is promoted via a QR code included in contracts and training materials.
• Remedy: Violations of working hour regulations are identified at a supplier in India. The supplier is provided with an action plan with a 90-day deadline and support from a local consultant.
• Documentation: The entire process is fully documented, from the identification of the issue to the confirmed resolution.

Supplier Management: What's Enough, and What Isn't?

A Code of Conduct and a questionnaire are a good starting point, but they do not constitute a comprehensive supplier management system. For low-risk suppliers, basic requirements are often sufficient; for high-risk suppliers, additional documentation, audits, and clear escalation rules are needed. Typical components include:

• Onboarding: Self-Assessment and Acceptance of Minimum Standards When Onboarding New Suppliers
• Contractual Safeguards: Rights to Information, Documentation, and Audits, as well as Obligations to Remedy
• Monitoring: Verification checks, risk-based audits, and key metrics such as the resolution rate of findings or time to resolution
• Escalation Levels: Reminder, Action Plan, Management Escalation, Termination as a Last Resort
• Supplier Development: Action Plans, Training, Regular Reviews, and Incentives Such as Preferred Supplier Status

To learn how to permanently integrate due diligence requirements into your procurement processes, read the article on sustainable procurement.

Supply Chain Violation: What Should Be Done?

If a company discovers a violation or if a violation is imminent, it must take immediate corrective action (Section 7 LkSG):

• Within one's own domestic business operations: The measure must put an end to the infringement.
• In its own business units abroad and at Group companies: As a rule, it must terminate them.
• For direct suppliers: If a quick resolution is not possible, a plan with a specific timeline must be developed immediately.
• For indirect suppliers: If there is substantiated knowledge, a situation-specific risk analysis and appropriate measures will follow.

Under Section 7(3) of the LkSG, terminating a business relationship is permitted only as a last resort: in the event of a very serious violation, if the remedial measures have not been effective after the deadline has expired, and no less severe measures remain. The LkSG does not establish civil liability (Section 3(3)). However, existing liability rules remain unaffected, and affected parties may authorize labor unions or NGOs to assert their rights in German courts (Section 11).

LkSG Fines and BAFA Inspections

The statutory range of fines under § 24 LkSG remains unchanged until the amendment is enacted:

• up to 800,000 euros for serious breaches of duty, such as when a identified violation is not remedied
• up to 2 percent of average annual global revenue for companies with annual revenue exceeding 400 million euros
• up to 500,000 euros or 100,000 euros for additional breaches of duty
• Penalties of up to 50,000 euros to enforce official orders
• Exclusion from public contracts for up to three years pursuant to Section 22 of the LkSG, generally in the case of a final fine of 175,000 euros or more, with an entry in the competition register

In practice, the BAFA currently imposes fines only for serious violations. Ad hoc inspections rarely focus on a “perfect” supply chain, but rather on traceability. In addition to fines, there is the risk to reputation: Companies that promise sustainability to the outside world but cannot demonstrate it internally quickly expose themselves to accusations of greenwashing.

LkSG and CSDDD: How do they differ from the EU Supply Chain Act?

The CSDDD (Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760) is the EU supply chain law. It pursues the same objective as the LkSG, but applies EU-wide and must first be transposed into national law. Its scope was significantly narrowed by the Omnibus I Package. The amending Directive (EU) 2026/470 has been in effect since March 18, 2026.

In addition to the CSDDD, other EU regulations expand responsibility for the supply chain. The EU Forced Labor Regulation prohibits products made with forced labor from being sold on the EU internal market. The NIS 2 Directive requires companies to manage cybersecurity risks, including those associated with suppliers. And with the PPWR, packaging requirements along the supply chain are becoming increasingly important.

The CSDDD's Current Schedule

• July 25, 2024: The CSDDD takes effect.
• March 18, 2026: The Omnibus Amendment Directive enters into force.
• July 26, 2028: Deadline for transposition into national law
• July 26, 2029: The requirements will apply uniformly; the previously planned phased implementation has been eliminated.

The Main Differences

• Scope of Application: The LkSG applies to companies with 1,000 or more employees in Germany, regardless of revenue. The CSDDD covers only EU companies with more than 5,000 employees and more than 1.5 billion euros in net revenue, as well as non-EU companies with corresponding EU revenue. It thus covers fewer companies than the current LkSG.
• Scope within the chain: The LkSG categorizes suppliers by their own business area, as well as direct and indirect suppliers. The CSDDD takes a risk-based approach to the “activity chain” and focuses on where negative impacts are most likely and most severe.
• Supervision: Under the LkSG, the BAFA; under the CSDDD, national authorities operating within an EU-wide harmonized framework
• Climate Obligations and Liability: The originally proposed requirement for a climate transition plan and EU-wide harmonized civil liability were either removed from the omnibus bill or left to the discretion of the member states.

Essentially, both require the same things: risk analysis, prevention, remedial action, complaint procedures, and documentation. The federal government intends to replace the LkSG with a “Law on International Corporate Responsibility” that implements the CSDDD verbatim.

Supply Chain Laws in Other Countries

• France: The 2017 “Loi de vigilance” requires large companies to have a due diligence plan in place and establishes civil liability.
• United Kingdom: The Modern Slavery Act of 2015 requires an annual statement on measures taken to combat modern slavery.
• Netherlands: The Due Diligence Act on Child Labor specifically targets child labor.
• Norway: The Transparency Act of 2022 combines due diligence obligations with the public's right to information.

For companies that source internationally, this means that a risk-based, traceable, and effective system meets the requirements of multiple countries at once, rather than requiring separate processes for each market.

Conclusion

The Supply Chain Act will not be repealed in 2026, but is undergoing significant changes. The reporting requirement is no longer being enforced, fines are limited to serious cases, and a higher threshold has been announced. However, the substantive due diligence obligations remain unchanged, and with the CSDDD, the same basic processes will become mandatory throughout Europe starting in 2029.