Which companies does LkSG apply to?

Since January 2024, LkSG applies to companies with their registered office, principal place of business or administrative headquarters in Germany that employ at least 1,000 people there, counting agency workers deployed for more than six months. Foreign companies with a German branch that meets the same employee threshold are also covered.

What's the relationship between LkSG and the EU CSDDD?

Germany plans to replace the LkSG with a law transposing the EU Corporate Sustainability Due Diligence Directive (CSDDD), due by July 26, 2028; until then the LkSG's core duties apply. As narrowed by Omnibus I in 2026, the CSDDD applies from July 2029 to companies with more than 5,000 employees and €1.5 billion in turnover.

Does LkSG require action on indirect suppliers?

LkSG primarily requires due diligence for direct (tier 1) suppliers with risk-based due diligence for indirect suppliers. However, when a company obtains 'substantiated knowledge' of human rights or environmental violations at indirect suppliers, it must take appropriate action — including investigating, developing a remediation plan, and potentially suspending or terminating the business relationship.

German Supply Chain Due Diligence Act (LkSG)

Status, September 2026: A government bill (adopted by the cabinet on September 3, 2025; first Bundestag reading in January 2026) would remove the LkSG's annual reporting duty retroactively and limit fines to serious violations. The enforcement agency BAFA stopped reviewing company reports on October 1, 2025, and already imposes fines only for serious violations. The core due diligence duties remain until the revised EU CSDDD replaces the law (transposition due by July 2028). Source: KPMG Law.

What Is the LkSG?

The German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, LkSG), effective since January 2023, requires large companies in Germany to establish due diligence processes to prevent human rights and environmental violations in their supply chains.

Germany was one of the first major economies to enact mandatory supply chain due diligence legislation, following France's Duty of Vigilance Law (2017). The LkSG reflects growing global expectations that companies are responsible for conditions throughout their value chains.

Who It Applies To

From January 2023: Companies with 3,000+ employees in Germany
From January 2024: Companies with 1,000+ employees in Germany
Applies to companies with registered office, principal place of business, or administrative headquarters in Germany
Foreign companies with a German branch meeting the employee threshold are also covered
Employee count includes agency workers deployed for more than six months

Key Requirements

Due diligence obligations (based on UN Guiding Principles):

Risk management system: Establish a risk management process integrated into business functions
Risk analysis: Conduct regular and ad hoc risk assessments for your own operations and direct suppliers
Preventive measures: Implement policies, training, procurement practices, and contractual assurances to prevent violations
Remedial action: Take corrective measures when violations are identified — from requiring corrective action plans to suspending or terminating supplier relationships
Grievance mechanism: Establish an accessible complaints procedure for affected persons and whistleblowers
Documentation: Document due diligence activities and keep the records for at least seven years. BAFA (the Federal Office for Economic Affairs and Export Control) stopped reviewing the annual reports on October 1, 2025, and a pending amendment would abolish the reporting duty retroactively

Covered risks:

Human rights: forced labor, child labor, slavery, discrimination, unsafe working conditions, freedom of association, living wages, land rights
Environmental: mercury, POPs, hazardous waste (specifically referenced conventions), plus environmental violations that lead to human rights impacts

Scope of obligations:

Own operations: Full due diligence obligations
Direct suppliers: Full due diligence obligations including contractual assurances
Indirect suppliers: Risk-based due diligence when "substantiated knowledge" of violations exists

Timeline

January 2023: Law took effect for companies with 3,000+ employees
January 2024: Extended to companies with 1,000+ employees
October 2025: BAFA stops reviewing company reports, ahead of a pending amendment that would remove the annual reporting duty retroactively to 2023 and limit fines to serious violations
Ongoing: BAFA can initiate investigations based on complaints or its own initiative
July 2028: Deadline for EU member states to transpose the revised CSDDD, which Germany plans to use to replace the LkSG

Compliance Steps

Appoint a human rights officer: Designate a responsible person for supply chain due diligence
Establish risk management: Integrate supply chain due diligence into existing risk management processes
Conduct risk analysis: Map direct suppliers, assess country and sector risks, prioritize high-risk relationships
Develop policy statement: Publish a human rights policy covering your own operations and supply chain
Implement preventive measures: Training, procurement guidelines, contractual clauses, supplier audits
Set up grievance mechanism: Accessible, confidential, and effective complaints procedure
Develop remedial action processes: Clear procedures for responding when violations are identified
Document: Maintain records of your due diligence for at least seven years (BAFA no longer reviews the annual reports, and a pending amendment would drop them)

Penalties

Fines: Up to €8 million or up to 2% of average annual worldwide turnover (for companies with more than €400 million in turnover). BAFA already limits fines to serious violations in practice, and the pending amendment would write that into law, covering violations such as failing to take preventive or remedial measures or to set up a complaints procedure
Exclusion from public procurement: Companies can be excluded from public contracts for up to 3 years
BAFA enforcement: BAFA can order specific measures, conduct inspections, and impose coercive fines
No civil liability: LkSG explicitly does not create a new basis for civil liability. The CSDDD's own EU-wide liability regime was removed by Omnibus I in 2026, leaving liability to national law, though member states must ensure full compensation when a company is held liable for damage

How Council Fire Can Help

Council Fire supports companies in implementing LkSG-compliant supply chain due diligence systems — from risk analysis and supplier assessment through grievance mechanisms and documentation. Contact us for LkSG compliance support.