Demonstrate due diligence in purchasing under the LkSG. Keep supplier contracts under control.

The LkSG has been directly applicable since January 1, 2024, to companies with headquarters or a branch in Germany and at least 1,000 employees in the country; temporary agency workers are counted after six months. Indirectly, significantly more companies are affected, as large clients pass on their obligations contractually through codes of conduct, audit rights, and documentation requirements. For many small and medium-sized enterprises, this requirement thus arises from the customer contract, not from the law.

Not yet. On September 3, 2025, the Federal Cabinet approved a draft bill intended to eliminate the annual reporting requirement entirely and limit fines to serious violations. The Bundestag debated the bill in its first reading on January 16, 2026. Until the bill is enacted, the LkSG remains in effect unchanged. However, the BAFA has not been reviewing company reports since fall 2025. Due diligence obligations remain in place and must be documented internally.

Common provisions include a code of conduct as part of the contract, obligations to provide information and disclosure, audit and monitoring rights, the requirement to pass on these requirements to subcontractors, training commitments, and the right to terminate the contract and impose sanctions in the event of serious violations. What is appropriate in each individual case depends on the risk analysis and the product category, and blanket clauses are subject to review under the law governing standard terms and conditions. This should be included in the legal review.

“Substantiated knowledge” refers to reliable evidence of a potential violation by an indirect supplier, such as information from government agencies, reports on conditions in the production region, or the supplier’s involvement in a high-risk industry. Once such evidence is identified, a risk analysis must be conducted immediately, and a plan to minimize risk must be implemented. The key factor at this point is how quickly the relevant contracts can be located.

The Supply Chain Act does not require a guarantee, but rather appropriate measures. Four criteria determine the extent of these measures: the nature and scope of business activities, the ability to influence the party responsible, the likelihood of a violation, and the severity of the potential harm. What this means in concrete terms has not been definitively clarified. This makes it all the more important to maintain transparent documentation of one’s own assessment.

The CSDDD is intended to replace the national supply chain law. Under the Omnibus I package, it applies to EU companies with more than 5,000 employees and global net revenue exceeding 1.5 billion euros; it must be implemented by July 26, 2028, and take effect on July 26, 2029. Fines are capped at 3 percent of global net revenue. In Germany, a law on international corporate responsibility is expected to follow. (As of September 2026)