Supply Chain Due Diligence (LkSG, CSDDD)

Supply chain due diligence in Germany: where things stand

Supply chain due diligence in Germany is governed by the Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, LkSG), which has applied since 1 January 2023 and, since 1 January 2024, covers companies with their head office, principal place of business, administrative seat or statutory seat in Germany, or a registered branch, that usually employ at least 1,000 employees in Germany (§ 1 LkSG). Employees of all German group companies count towards the parent's threshold. These companies must observe human rights and environmental due diligence obligations in an appropriate manner in their own business area and towards their suppliers.

The legal landscape is changing. The federal government wants to replace the LkSG with a new statute implementing the EU Corporate Sustainability Due Diligence Directive (EU) 2024/1760 (CSDDD) and, in the meantime, to abolish the LkSG reporting obligation and limit fines to serious breaches. At EU level, the Omnibus I Directive (EU) 2026/470 of 24 February 2026 has narrowed the CSDDD's scope and postponed its application to 26 July 2029. At the same time, product-based regimes, the EU Deforestation Regulation (EUDR) and the Forced Labour Regulation, add obligations that apply regardless of company size.

For companies, this means maintaining a functioning due diligence system while legal requirements are in flux. Customers, banks and investors continue to ask for supply chain information, and the core LkSG duties remain in force. This page explains the current LkSG obligations and enforcement, the planned reform, the CSDDD after Omnibus I and the product regimes, and offers a practical approach. For the wider ESG context, see our overview of compliance and ESG.

The LkSG duties in practice

The LkSG lists nine due diligence obligations (§ 3(1) LkSG): establishing risk management, defining internal responsibility (for example a human rights officer), carrying out regular risk analyses, issuing a policy statement, embedding preventive measures in the company's own business area and towards direct suppliers, taking remedial action, establishing a complaints procedure, implementing due diligence with regard to risks at indirect suppliers, and documentation and reporting.

The obligations are duties of effort, not of result: what is appropriate depends on the nature and scope of the business, the company's ability to influence the party causing the risk, the severity and likelihood of the violation and the nature of the company's contribution (§ 3(2) LkSG).

The risk analysis covers the company's own business area and its direct suppliers and must be carried out annually and on an ad hoc basis when the risk situation changes significantly (§ 5 LkSG).

The protected interests are defined by reference to international conventions and include prohibitions of child labour, forced labour, slavery, disregard of occupational safety, freedom of association, unequal treatment, withholding of adequate wages, harmful environmental pollution, unlawful land eviction and certain environmental prohibitions concerning mercury, persistent organic pollutants and hazardous waste (§ 2 LkSG).

For indirect suppliers, obligations are triggered when the company has substantiated knowledge, meaning actual indications that make a violation appear possible; it must then carry out a risk analysis and take preventive measures without undue delay (§ 9(3) LkSG).

Governance is part of the obligations. The company must define who is responsible for monitoring risk management, for example by appointing a human rights officer, and management must inform itself regularly, at least once a year, about the work of the responsible person (§ 4(3) LkSG). The policy statement adopted by management describes the procedure, the priority risks identified and the expectations towards employees and suppliers.

In groups, the parent's own business area includes group companies over which it exercises a decisive influence, so subsidiaries in Germany and abroad have to be integrated into the parent's risk management, risk analysis and preventive measures. Board minutes should show that these reports were received and discussed.

The complaints procedure must allow people to report human rights and environmental risks and violations arising from the company's activities or those of its direct suppliers (§ 8 LkSG) and, through § 9(1), also at indirect suppliers. It can be combined with the whistleblowing channel under the HinSchG, but it must be accessible to external persons, including workers at suppliers abroad, and its rules of procedure must be published. The company must document its compliance continuously and keep the documentation for at least seven years (§ 10(1) LkSG).

BAFA enforcement and the planned reform

The Federal Office for Economic Affairs and Export Control (BAFA) supervises compliance with the LkSG. It can act on its own initiative or on application by a person who claims to be affected, request information and documents, enter business premises and order specific measures.

Fines are graduated by breach: up to EUR 800,000 for failures such as not taking preventive or remedial measures or not establishing a complaints procedure, up to EUR 500,000 or EUR 100,000 for other breaches; for companies with average annual turnover above EUR 400 million, certain breaches can be fined up to 2% of average worldwide annual turnover (§ 24 LkSG).

Companies fined at least EUR 175,000 should be excluded from public contracts for up to three years (§ 22 LkSG). The LkSG itself does not create civil liability (§ 3(3) LkSG), but trade unions and NGOs can be authorised to bring claims for affected persons (§ 11 LkSG).

On 29 October 2025 the federal government introduced a bill to amend the LkSG (BT-Drs. 21/2474). According to the bill, the reporting obligation will be abolished, the due diligence obligations themselves will continue to apply, and breaches will be sanctioned only where they are serious, pending a new law on international corporate responsibility that will transpose the CSDDD and replace the LkSG.

BAFA announced on 1 October 2025 that it had stopped reviewing company reports and would, in pending and future proceedings, impose fines only for serious breaches. As of November 2026, the consolidated LkSG published on gesetze-im-internet.de still shows the reporting obligation and the full catalogue of fines, so companies should confirm the status of the amending act before treating the changes as law.

Supplier contracts and cascading obligations

Contracts are the main tool for implementing supply chain due diligence towards direct suppliers. Typical clauses oblige the supplier to comply with a supplier code of conduct, to pass equivalent requirements on to its own suppliers, to provide information and allow audits, to remedy violations under a corrective action plan, and accept termination as a last resort. The LkSG expects termination only where a very serious violation cannot be remedied, other measures have failed and no milder means are available.

Clauses that shift all risk to suppliers, or impose unlimited audit and liability obligations, can be invalid under the German law on standard terms and conditions and undermine cooperation. Our page on commercial contracts covers the general rules.

Links to reporting and transactions

Supply chain due diligence data also feeds into other obligations. Companies within the scope of the CSRD must report on impacts in their value chain under the European Sustainability Reporting Standards, so the risk analysis and the measures taken under the LkSG provide much of the content; see our page on sustainability reporting. In M&A, buyers review the target's due diligence system, complaints, BAFA correspondence and supplier risks, and include specific warranties where the target operates in high-risk sectors.

The CSDDD after Omnibus I

The CSDDD, adopted in 2024, sets EU-wide human rights and environmental due diligence obligations across companies' chains of activities. Omnibus I has substantially amended it (Directive (EU) 2026/470). The Directive now applies to EU companies with more than 5,000 employees on average and net worldwide turnover of more than EUR 1.5 billion, and to non-EU companies with EU net turnover above EUR 1.5 billion, as well as to certain parent companies and franchise structures. Member states must transpose it by 26 July 2028 and apply it from 26 July 2029.

The substance has also changed. Companies must carry out a scoping exercise based on reasonably available information to identify the areas where adverse impacts are most likely and most severe, and then an in-depth assessment only in those areas; where risks are equally likely or severe, they may prioritise direct business partners.

The obligation to adopt a climate transition plan has been deleted, the harmonised EU civil liability regime has been removed in favour of national rules on access to justice, and member states must set the maximum fine at 3% of net worldwide turnover.

In Germany, the CSDDD will be transposed by a new statute that replaces the LkSG; companies below the new thresholds but above the LkSG threshold of 1,000 employees should follow the legislative process closely, because the German scope may change.

Deforestation, forced labour and other product rules

Product-based regimes apply regardless of company size. The EU Deforestation Regulation (EU) 2023/1115 prohibits placing on the EU market, or exporting, cattle, cocoa, coffee, oil palm, rubber, soya and wood, and listed products made from them, unless they are deforestation-free, produced in accordance with the laws of the country of production and covered by a due diligence statement.

After a further amendment by Regulation (EU) 2025/2650, the main obligations apply from 30 December 2026, and from 30 June 2027 for micro and small undertakings, with simplifications for downstream operators and traders (Regulation (EU) 2025/2650). The Commission was required to present a simplification review by 30 April 2026, so further changes are possible.

The Forced Labour Regulation (EU) 2024/3015 prohibits placing products made with forced labour on the EU market, making them available or exporting them, and applies from 14 December 2027 (Regulation (EU) 2024/3015). Authorities can investigate and order the withdrawal and disposal of products, based on a risk-based approach and on information including a database of forced labour risks. Other regimes with supply chain elements include the Conflict Minerals Regulation, the Batteries Regulation and the Carbon Border Adjustment Mechanism. Supply chain due diligence systems should therefore be designed to cover both company-level obligations and product-level evidence requirements.

Building a resilient supply chain due diligence system

Given the changing rules, the most robust approach is a single supply chain due diligence system that meets the current LkSG, anticipates the CSDDD and supports product-level compliance. Its elements are a clear allocation of responsibility at board level and a responsible officer; a risk analysis that combines country, sector and commodity data with supplier-specific information; a code of conduct for suppliers with audit and termination rights; targeted measures for high-risk suppliers, such as audits, training and corrective action plans; a complaints channel accessible to external persons; and documentation that can be reused for customer requests, EUDR due diligence statements and, where applicable, sustainability reporting.

• Map direct suppliers by country, commodity and spend, and identify high-risk segments.
• Update supplier contracts with due diligence clauses, cooperation duties and remedies.
• Prioritise engagement where risks are most likely and most severe.
• Integrate the LkSG complaints procedure with the HinSchG channel while keeping it open to external persons.
• Track the LkSG amendment, the German CSDDD transposition and any EUDR changes.
• Report to the board at least annually on risks, measures and complaints.

Illustration: a German manufacturer with 1,400 employees sources cocoa-based ingredients and electronic components. It keeps its LkSG risk analysis, focuses on-site audits on two high-risk suppliers, adds EUDR geolocation data requirements to its cocoa contracts ahead of 30 December 2026, and screens its component suppliers for forced labour risks in anticipation of December 2027. It stops preparing a public LkSG report only after confirming that the amending act has entered into force.

How TRW & Co helps

We advise companies on supply chain due diligence in Germany and the EU. We assess whether the LkSG, the CSDDD, the EUDR and the Forced Labour Regulation apply, design risk analyses and due diligence processes, draft supplier codes of conduct and contract clauses, and set up complaints procedures. We represent companies in BAFA proceedings and in disputes with suppliers, NGOs and affected persons, and we review supply chain risks in M&A due diligence. We also monitor the legislative process for our clients and adapt their systems as the rules change. To discuss your supply chain obligations, please contact us.