German Supply Chain Act and EU CSDDD

Graduated responsibility: own business area, direct and indirect suppliers

The LkSG differentiates the level of obligation according to proximity to the risk. Within one’s own business area – which, within a group of companies, may also include subsidiaries – a remedial measure taken in response to a breach occurring within Germany must result in the cessation of that breach. In the case of direct suppliers, i.e. the company’s own contractual partners, the full obligations regarding prevention and remedial action apply. If a serious breach cannot be brought to an end within the foreseeable future, Section 7(2) of the LkSG requires a plan with a specific timetable. Termination of the business relationship is intended as a last resort, for example where implementation of the plan fails to remedy the situation and no less severe measures are available.

In relation to indirect suppliers with whom no contractual relationship exists, the obligations under Section 9(3) of the LkSG apply only on a case-by-case basis. This means that if the company gains substantiated knowledge of a possible violation, it must carry out a risk analysis, put in place preventive measures against the perpetrator and draw up a plan to prevent, terminate or minimise the violation. ‘Substantiated knowledge’ exists where factual indications suggest that a violation is possible. Reports from non-governmental organisations concerning a sourcing region or media reports about a sub-supplier are generally sufficient for this purpose. It is worth noting that the law treats circumvention arrangements, in which a direct supplier is merely used as an intermediary, as a direct supply relationship.

What penalties apply in the event of non-compliance?

The BAFA carries out risk-based inspections and investigates complaints. It may request information, enter business premises and order specific measures to ensure compliance with obligations, the enforcement of which may be backed by a penalty payment of up to 50,000 euros (Section 23 LkSG). Section 24 of the LkSG imposes graduated fines for administrative offences, which, depending on the obligation breached, may amount to up to 100,000, 500,000 or 800,000 euros. For companies with an average annual turnover of more than 400 million euros, the fine may also amount to up to two per cent of the average global annual turnover in the case of certain serious infringements.

For many companies, the consequence of Section 22 of the LkSG is more severe than the fine itself: once a fine of 175,000 euros has been legally confirmed, they are to be excluded from public procurement for up to three years. For suppliers that do relevant business with the public sector, this risk of exclusion is the real leverage of the Act. The LkSG does not, however, give rise to civil liability: Section 3(3) of the LkSG makes it clear that a breach of the obligations under the Act does not give rise to independent civil liability. Liability arising independently of this, for example under tort law, remains in force. Section 11 of the LkSG also allows affected parties to authorise domestic trade unions and non-governmental organisations to bring legal proceedings on their behalf.

Reporting obligation abolished: What the LkSG amendment changes

Originally, Section 10(2) of the LkSG required an annual report on compliance with due diligence obligations, which had to be submitted to the BAFA no later than four months after the end of the financial year. This reporting obligation is the subject of the relief amendment, which was adopted by the Federal Cabinet on 3 September 2025 and debated by the Bundestag at first reading in January 2026. Accordingly, paragraphs 2 to 4 of Section 10 of the LkSG are to be repealed with retroactive effect for reporting periods from January 2023, and fines are to be imposed in future only in the event of serious breaches of the due diligence obligations that remain in force. As early as October 2025, the BAFA announced that it would cease the audit of corporate reports.

This relaxation should not be overinterpreted. Whilst the external reporting obligation is being abolished, the due diligence obligations remain in place: risk analysis, prevention, remedial action, complaint procedures and internal documentation pursuant to Section 10(1) of the LkSG continue to apply unchanged, and the BAFA retains the authority to carry out checks. Anyone who takes the amendment as an opportunity to scale back their risk management is confusing the removal of a form with the removal of the obligation. In the event of a fine, it is precisely this documentation that would serve as the key defence. As the legislative process had not yet been finalised at the time of going to press, affected companies should check the exact wording of the provisions on sanctions in the published law.

What changes will the EU Supply Chain Directive (CSDDD) bring?

The European Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760) was intended to harmonise due diligence legislation across the Union and was originally set to apply to companies with more than 1,000 employees and a global net turnover in excess of 450 million euros. However, with the first omnibus package, the EU legislator has fundamentally restructured the Directive. The corresponding amending Directive (EU) 2026/470 was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026.

Three changes stand out. Firstly, the scope of application: in future, only companies with more than 5,000 employees and a global net turnover of over 1.5 billion euros will be covered. The phased implementation periods have been scrapped, and the obligations will apply uniformly from 26 July 2029. Secondly, liability: the planned, EU-wide harmonised civil liability regime has been scrapped. National law in the Member States will continue to apply. Thirdly, the methodology: key due diligence obligations, including the now two-stage risk analysis comprising scoping and an in-depth individual assessment, are fully harmonised. Member States may not provide for either stricter or more lenient rules in this respect. The Directive’s fine range is up to three per cent of global net turnover. The German limit of currently two per cent must therefore be adjusted. The climate transition plan originally envisaged has been completely dropped.

There are two deadlines for implementation: the substantive amendments must be transposed into national law by 19 March 2027, whilst the provisions on the date of application must be in place by 26 July 2028. In Germany, it has been announced that the LkSG will be replaced by a law on international corporate responsibility as part of the implementation of the Corporate Sustainability Due Diligence Directive (CSDDD). Until then, the LkSG, with its 1,000-employee threshold, remains in force. Consequently, German companies falling below the new EU threshold are likely to be subject to regulation for longer and under stricter rules than their European competitors, unless the German legislature raises the thresholds. A review of the Directive, including the thresholds, is scheduled to take place by 26 July 2031.

What companies should do now

For those directly subject to the requirements, the task is clear: consolidation rather than starting from scratch. The existing LkSG structures will continue to form the basis. It is necessary to assess the extent to which they deviate from the fully harmonised CSDDD requirements, particularly with regard to risk analysis methodology and the handling of escalating supplier cases. This is because the Directive replaces termination as a last resort with the suspension of the business relationship, accompanied by an action plan. A gap analysis with a view to the deadlines of 2027 to 2029 can be integrated into regular compliance planning without time pressure.

For suppliers indirectly affected, contract law remains the decisive factor. Supplier codes of conduct and data disclosure clauses should not be signed without scrutiny, but should be negotiated in accordance with the law. The supplier is not obliged to guarantee anything that the purchaser itself is not obliged to provide. Our analysis of the LkSG contractual clauses in supply contracts highlights the respective scope for negotiation in detail. Foreign corporate groups with a German branch should carefully assess the extent to which they are affected before establishing duplicate compliance structures. For guidance on the appropriate structure for business in Germany, see our article on the choice between a branch and a subsidiary.

Legal status: July 2026 The LkSG amendment and the German implementation of the CSDDD are still undergoing the legislative process; the published text of the law shall prevail in each case.