The German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, or LkSG) requires companies with at least 1,000 employees in Germany to identify and address human rights and environmental risks throughout their operations and supply chains, with penalties reaching 8 million euros or, for large companies, up to 2% of worldwide annual turnover. It has been in force since January 2023, and the lower employee threshold has applied since January 2024.
Which Companies Are Covered
The law applies to any company with its headquarters, principal place of business, or a branch office in Germany that employs 1,000 or more workers there. When the LkSG first took effect in January 2023, it reached only companies with 3,000 or more employees. The threshold dropped to 1,000 in January 2024, roughly tripling the number of businesses in scope.1Federal Ministry for Economic Affairs and Climate Action. FAQ on the Supply Chain Act
Foreign companies are not exempt. A non-German business that operates a branch office in Germany and meets the employee count locally is covered on the same terms as a domestic firm.
Smaller suppliers feel the law even when it does not apply to them directly. A regulated buyer has to vet its supply chain, and that obligation flows down through contracts and questionnaires to every supplier it works with. A parts manufacturer with 200 employees will never trigger the LkSG on its own, but it will still need to demonstrate compliance to keep selling to a covered customer.
What the Law Requires You to Do
The core obligation is a risk management system that identifies and addresses human rights and environmental problems across the company’s own operations and its supply chain. Covered harms are drawn from international agreements and include forced labor, child labor, unsafe working conditions, wage theft, land seizures, and environmental damage from mercury, hazardous waste, and persistent organic pollutants.1Federal Ministry for Economic Affairs and Climate Action. FAQ on the Supply Chain Act
Annual and Ad-Hoc Risk Analysis
Companies must conduct a formal risk analysis at least once a year. Additional analyses are required on an ad-hoc basis when the company receives credible information about potential violations, such as reports of forced labor at an indirect supplier, or when the business model changes significantly.2Federal Office for Economic Affairs and Export Control. Risk Analysis
The analysis must evaluate the company’s own operations and those of its direct suppliers. For indirect suppliers further down the chain, due diligence obligations kick in when the company gains substantiated knowledge of a possible violation. Based on the findings, the company drafts a policy statement outlining its strategy for respecting human rights and protecting the environment. Senior management must approve the statement and communicate it to employees and business partners.
Prevention and Remediation
Once risks are identified, the company must take concrete steps to keep them from materializing. That might mean requiring a supplier in a high-risk region to implement worker safety training, upgrade equipment, or revise employment contracts. Regular audits and on-site inspections verify that preventive measures are being followed.3Federal Office for Economic Affairs and Export Control. Guidance on Conducting a Risk Analysis as Required by the German Supply Chain Due Diligence Act
When a violation is discovered rather than merely anticipated, the obligations shift from prevention to remediation. The company must act immediately to stop the harm and develop a corrective action plan to prevent recurrence. If a direct supplier is responsible and the company cannot end the violation through negotiation, the law expects escalation, potentially terminating the business relationship as a last resort. Simply cutting ties is not enough if it leaves affected workers worse off; the goal is to fix the problem.
A Complaint Mechanism Anyone Affected Can Use
Every covered company must establish a complaint mechanism that lets affected individuals, including workers at supplier facilities, report human rights or environmental violations. The law requires precautions to guarantee the confidentiality of the reporting person’s identity. Anonymity is recommended but not strictly mandated. Companies must also protect complainants from retaliation, including retaliatory measures by suppliers, and communicate those protections clearly.4Federal Office for Economic Affairs and Export Control. Guidance on Organising, Implementing and Evaluating Complaints Procedures
The mechanism functions as an early warning system. A complaint from a factory floor worker about unsafe chemical storage can surface a problem months before a scheduled audit would catch it. Each complaint must be investigated and the outcome documented.
Reporting and Recordkeeping
Covered companies submit an annual report to the Federal Office for Economic Affairs and Export Control (BAFA) through an online portal. The report covers the risks identified, the preventive and remedial steps taken, and how the complaint mechanism functioned during the reporting period.3Federal Office for Economic Affairs and Export Control. Guidance on Conducting a Risk Analysis as Required by the German Supply Chain Due Diligence Act BAFA has announced it will begin reviewing submissions and publishing LkSG reports on January 1, 2026, and has said it will not sanction companies for late submissions provided reports were filed by December 31, 2025.5Federal Office for Economic Affairs and Export Control. Overview
Beyond the government filing, companies must publish their reports on their corporate website and keep them publicly available for at least seven years. The same seven-year retention period applies to all underlying documentation, including risk analyses, corrective action records, and audit results. BAFA can inspect these records at any time to verify what the company reported. Thorough recordkeeping is the practical defense during an investigation; it is the evidence that good-faith efforts were made.
Penalties for Noncompliance
Fines under the LkSG can reach up to 8 million euros, depending on the type and severity of the violation. Different obligations carry different maximum penalties. Failing to conduct a proper risk analysis triggers a lower cap than failing to take remedial action after a known violation. For companies with an average annual turnover exceeding 400 million euros, the calculation changes: fines can reach up to 2% of worldwide annual turnover.6Federal Ministry for Economic Affairs and Climate Action. German Supply Chain Act (LkSG) For a company generating 10 billion euros in revenue, that is a potential fine of 200 million euros, which makes the 8 million euro cap look modest by comparison.
Financial penalties are not the only lever. Companies hit with fines above a certain threshold can be excluded from public procurement contracts for up to three years. Losing the ability to bid on government projects is a serious blow to companies in infrastructure, defense, and IT services, where public contracts represent a major revenue stream.
How the EU Directive Will Affect the LkSG
The European Union adopted the Corporate Sustainability Due Diligence Directive (CSDDD) in June 2024 to create a unified due diligence standard across the bloc. As originally enacted, the directive targeted EU companies with more than 1,000 employees and net worldwide turnover exceeding 450 million euros, along with non-EU companies generating more than 450 million euros in net turnover within the EU.7European Commission. Corporate Sustainability Due Diligence
In 2025, the EU agreed to an Omnibus simplification package that scaled the CSDDD back before most companies had to comply. The revised thresholds now require only companies with more than 5,000 employees and 1.5 billion euros in net turnover to conduct supply chain due diligence, with application pushed back to 2029. The harmonized EU-wide civil liability regime was removed, climate change transition plans are no longer mandatory, and the maximum penalty was capped at 3% of net worldwide turnover. The simplification also replaced detailed adverse-impact mapping with a scoping approach focused on areas where harm is most likely to occur.
For now, the LkSG remains fully in force. German companies currently subject to it will continue to comply, and the German government will eventually either amend the LkSG or enact a new statute aligning with the directive’s final form. Because the Omnibus revisions raised the CSDDD’s thresholds well above the LkSG’s 1,000-employee floor, the transition raises an open question: whether Germany will maintain its stricter national standard or align with the EU’s narrower scope. That decision has not been made.
What Compliance Actually Costs
Mapping a supply chain beyond direct suppliers is the hardest part of the work. Most large manufacturers know who their tier-one suppliers are, but visibility drops off sharply after that. A clothing brand may know which factory stitched its shirts and have no idea where the cotton was grown or who ginned it. Building that visibility requires supplier questionnaires, third-party audits, and often on-the-ground investigation.
The compliance infrastructure is not cheap. Covered companies typically need dedicated staff or external consultants for risk analysis, audit coordination, report preparation, and complaint mechanism management. Professional ESG and supply chain compliance consultants charge roughly $40 to $60 per hour at the lower end, with rates climbing significantly for specialized expertise or complex engagements. For a company with hundreds of suppliers across multiple countries, annual compliance costs can easily reach six or seven figures.
One mistake companies make consistently is treating supply chain due diligence as a legal compliance exercise rather than an operational one. The companies that struggle most are the ones that hand the problem to their legal department and expect a policy document to suffice. The ones that get it right embed due diligence into procurement decisions: supplier selection, contract terms, pricing negotiations, and ongoing relationship management. If the procurement team has never heard of the company’s human rights policy, that policy is not doing its job.