Headline German Supply Chain Act and CSDDD at a Glance

The LkSG and the CSDDD are two different levels of legislation

The Supply Chain Due Diligence Act is German law which applies directly. It obliges covered companies to manage human rights and certain environmental risks in an appropriate manner. The obligations apply in stages to the company’s own business operations, its direct suppliers and, where there is substantiated knowledge, also to its indirect suppliers. However, the Act does not require that every violation in a global supply chain be prevented. Rather, it requires effective, risk-based due diligence management that is tailored to the extent of influence, the nature of the contribution and the severity of the risk.

The CSDDD is an EU directive that must first be transposed into national law. The original Directive (EU) 2024/1760 was substantially amended by Directive (EU) 2026/470, which entered into force on 18 March 2026. For companies established in the EU, the key threshold now stands at more than 5,000 employees and a global net turnover of over 1.5 billion euros. The ultimate parent companies of such groups, as well as certain franchise and licensing arrangements, may also be covered. For companies from third countries, separate criteria apply, which are linked to the turnover generated within the Union.

The two regimes are similar in their underlying risk-based approach, but do not overlap in terms of either their scope of application or their reach. Thus, a company may currently be subject to the LkSG without subsequently falling within the narrower personal scope of the CSDDD. Conversely, international groups may be covered by the CSDDD even though the German entity alone does not meet the LkSG threshold.

Who is directly or contractually affected by the LkSG

In accordance with Section 1 of the LkSG, the Act has, in principle, applied since 1 January 2024 to companies that have their head office, main branch, administrative headquarters, registered office or a branch in Germany and, as a rule, employ at least 1,000 staff in Germany. In the case of affiliated companies, the employees of the parent company working in Germany are included in the count, subject to the statutory conditions. Employees posted abroad may also be included. The exact calculation should therefore not be based solely on the local payroll.

The mere fact of supplying a covered company does not make smaller suppliers subject to the LkSG. In practice, however, the requirements have an impact on the contractual chain. In accordance with Section 6(4) of the LkSG, possible preventive measures in relation to direct suppliers include, amongst other things, contractual assurances, training and risk-based control mechanisms. Large customers therefore frequently require codes of conduct, information, audit rights and cooperation in taking remedial action.

This contractual involvement, however, has its limits. The obligated company must not shift its own legal responsibility wholesale onto the supplier. Nor is it sensible to impose an undifferentiated guarantee obliging a small supplier to ensure compliance with all human rights and environmental standards throughout its entire supply chain, without exception. Robust clauses are linked to specific risks, actual scope for influence and reasonable evidence. They govern cooperation and escalation procedures, rather than merely demanding comprehensive indemnification.

What will actually apply on 21 July 2026

The substantive due diligence obligations under the LkSG remain in force. These include, in particular, the establishment of a risk management system, the definition of internal responsibilities, regular and ad hoc risk analyses, a statement of principles, appropriate preventive and remedial measures, a complaints procedure and documentation. Annual reporting is also still enshrined in Section 10 of the LkSG.

However, enforcement practice has currently been significantly scaled back. On 1 October 2025, the BAFA announced that it was ceasing the examination of company reports under Sections 12 and 13 of the LkSG and would only pursue fines in particularly serious cases and under very restrictive discretionary powers. The reporting portal no longer accepts reports. The background to this is the government’s draft amendment to the LkSG, which is intended to retroactively abolish the reporting obligation and reduce the list of fines. The Bundestag debated this draft at first reading on 16 January 2026 and referred it to the relevant committees. However, until the legislative process is complete, the authorities’ decision not to carry out inspections should not be equated with a legislative amendment that has already come into force.

For businesses, this means that the reduced level of regulatory activity can be taken into account when prioritising and planning resources. However, it does not justify any scaling back of the due diligence system. Internal documentation remains necessary to manage measures, justify board decisions and fulfil contractual obligations to provide evidence to customers. Furthermore, complaints, specific indications of breaches and necessary remedial measures must not be left unaddressed simply because of the changed reporting practice.

What the amended CSDDD provides for from July 2029

Directive (EU) 2026/470 has not only postponed the temporal scope of the CSDDD but has also streamlined its content. Member States must implement the amended requirements by 26 July 2028, whilst companies within the remaining scope of application will, in principle, only be required to comply with national regulations from 26 July 2029 onwards. The previous phased inclusion of significantly smaller companies has been removed. The requirement for a climate transition plan has also been removed from the CSDDD, and a separate, EU-wide harmonised civil liability regime is no longer envisaged. National liability rules nevertheless remain relevant.

The duty of care remains risk-based. Companies are required to identify and assess actual and potential adverse impacts in the particularly high-risk areas of their value chain. The amended Directive allows for greater prioritisation and requires the use of information that is reasonably available. Among other things, this is intended to prevent large companies from burdening their smaller business partners with unlimited data requirements that are unrelated to the specific risk.

Until the German implementation, it is not yet clear how the LkSG and the CSDDD will be merged in detail. However, the Federal Government has already announced that it will replace the LkSG with an implementing act. Companies should therefore not set up parallel systems for each stage of the reform. It makes more sense to establish a robust core process for risk analysis, measures, complaints, documentation and supplier management, which can later be adapted to the final German scope of application.

Contractual clauses must reflect risk and influence

Contracts are an important tool for implementation, but they are no substitute for due diligence. A sound clause specifies which standards are relevant to the specific service, what information may be requested in which circumstances, and how an audit is to be prepared, carried out and treated confidentially. Where risks are identified, it should provide for a phased remedial process combining a root cause analysis, an action plan, appropriate deadlines and a review of effectiveness. The suspension or termination of the business relationship generally remains a last resort if serious risks persist and less severe measures prove insufficient.

Equally important is the appropriateness of standard terms and conditions under contract law. Section 307 of the German Civil Code (BGB) restricts standard clauses that are non-transparent or unilaterally excessive, even in commercial transactions. Blanket cost-passing clauses, unrestricted audit rights, indemnities irrespective of fault, or an immediate right of termination for even minor breaches can therefore create more uncertainty than they offer protection. Our article ‘The Supply Chain Act in Procurement: Contractual Clauses for Supply Contracts’ explains how human rights assurances, information and audit rights, as well as remedial and termination mechanisms, can be structured in practice.