Skip to main content

Regulatory Framework · Germany

Germany's Supply Chain Act, from the receiving end

The LkSG puts due-diligence duties on large German companies — not on their suppliers. But it is their suppliers who get the questionnaire. Here is who is actually in scope, what the law asks of them, and what that turns into when it lands in your inbox.

Last updated:

Answer the questionnaire onceSee a German supplier's Passport

Summary for orientation only, current at the review date above. Thresholds, duties and reporting requirements are set by legislation and have been under active revision — confirm anything load-bearing with BAFA guidance or a qualified adviser.

The short version
  • The LkSG binds large companies, counted by employees in Germany. Since 2024 the line is 1,000 employees.
  • Your business is almost certainly not in scope and cannot breach the Act. You are not an addressee of it.
  • What reaches you is a customer questionnaire, because in-scope companies must do due diligence on their direct suppliers — and you are one.
  • It is a human rights law. Its environmental duties are narrow and convention-specific. There is no emissions-reporting duty in the LkSG.
  • A Passport answers the workforce, safety, policies and worker representation parts — VSME B8, B9, B10, B12. It does not contain a forced-labour risk assessment.

What the LkSG is

The Lieferkettensorgfaltspflichtengesetz — the Act on Corporate Due Diligence Obligations in Supply Chains — requires large companies to identify, prevent and remedy human rights risks, and a narrow set of environmental risks, in their own operations and among their direct suppliers. It has applied since 1 January 2023 and is overseen by BAFA, the Federal Office for Economic Affairs and Export Control.

It is a law about effort and process, not outcome. An in-scope company is not required to guarantee that nothing bad happens anywhere in its supply chain. It is required to have looked, to have acted proportionately on what it found, and to be able to show its working. That distinction explains almost everything about how the questionnaires are written: they are evidence-gathering, not an exam.

Who is in scope

Two stages, and the count is of employees in Germany — which is why foreign groups with sizeable German subsidiaries are caught, and why a large company with a small German presence may not be.

In force fromThresholdWhat changed
1 January 20233,000+ employees in GermanyThe first wave. Large industrial groups, retail chains and automotive manufacturers.
1 January 20241,000+ employees in GermanyThe wave that made this everyone's problem — it roughly tripled the population in scope, and with it the number of supplier questionnaires in circulation.

If your business is below those numbers, the Act does not address you. You cannot be fined under it and you cannot be found in breach of it. Anyone telling you that your company must “become LkSG compliant” is describing a commercial expectation, not a legal one — which does not make it less real, but does change who you are negotiating with.

What an in-scope company has to do

Their duty list is what generates your paperwork, so it is worth knowing. In-scope companies must establish a risk management system and assign responsibility for it; carry out a risk analysis periodically and again when circumstances change; publish a policy statement; take preventive measures in their own operations and towards direct suppliers; take remedial action when they find a violation; operate a complaints procedure that is accessible to people affected, including at suppliers; and document what they did.

Indirect suppliers sit outside the routine duty. An in-scope company generally has to act on them only when it gains substantiated knowledge of a possible violation. That asymmetry is why the questionnaire usually stops with you — and why it sometimes asks what you know about your own suppliers.

Enforcement runs through BAFA, with administrative fines available up to €8 million or up to 2% of average annual global turnover for the largest companies, and exclusion from German public procurement for up to three years above a fine threshold. In practice the procurement exclusion is the sharper instrument. Note that the Act states it establishes no additional civil liability — liability under other law is untouched, but the LkSG itself does not create a new route to sue a supplier.

A moving part, flagged deliberately

The reporting element of the LkSG — the routine report to BAFA — has been the most heavily revised part of the regime, in the direction of reducing it, and it interacts with the EU's CSDDD transposition. The due-diligence duties themselves are the durable part, and they are what generates supplier questionnaires. If you are making a decision that turns on the current reporting position, check BAFA's own guidance rather than this page — it was last reviewed on August 24, 2026.

It is not a climate law

This is the misreading we see most often, and it sends suppliers hunting for the wrong data. The LkSG's core is human rights: forced labour, child labour, workplace safety, freedom of association, discrimination, fair wages, unlawful eviction and the use of security forces. Its environmental duties are deliberately narrow and hang off specific conventions — the Minamata Convention on mercury, the POPs Convention on persistent organic pollutants and the Basel Convention on hazardous waste movement — together with environmental harm that damages human health.

There is no general emissions-reporting duty in the LkSG. If a German customer is asking you for Scope 1 and Scope 2 figures, that request is coming from somewhere else — most often the customer's own CSRD reporting (which, for a smaller supplier, is normally answered through the separate, voluntary VSME standard), the ISSB baseline, or simply their own reduction target. Those are different asks, and it is worth knowing which one you are answering.

What they actually ask you for

Strip away the covering letter and an LkSG-driven supplier questionnaire is largely asking four things, and a Passport already holds all four.

One honest boundary first, because overstating it would be the worst thing this page could do. A questionnaire will often also ask you to attest to the absence of forced or child labour in your operations. That is a statement you make, not a metric a Passport computes — VSME B8 is headcount data, not a risk assessment. Answer it directly to your customer, and use the Passport for the parts below.

Who works for you

Headcount and composition — VSME B8, which every Passport carries. Note the boundary honestly: B8 is headcount data, not a forced-labour risk assessment. If a questionnaire asks that directly, it is asking for something beyond what a Passport collects.

Health and safety

Work-related accidents, and whether anyone was seriously harmed. VSME B9 — a number and a straight answer, not a safety-management essay.

Policies you already have

A code of ethics, an anti-corruption policy, an anti-harassment policy. VSME B12 records whether each exists. "No" is an answer; inventing one is not.

Worker representation

Whether your staff are covered by collective agreements, and to what extent. VSME B10 — relevant in Germany, where buyers read it as a proxy for labour standards.

German profiles carry an LkSG Disclosure Support badge alongside VSME. To be exact about what that means: it is a structured, self-reported disclosure that helps you answer the request — not independent assurance, not certification, and not a statement that anyone is compliant with the Act. Being precise about that is worth more to you than a stronger-sounding claim, because your customer's compliance team will check.

Common questions

The Lieferkettensorgfaltspflichtengesetz — the German Act on Corporate Due Diligence Obligations in Supply Chains — requires large companies to identify, prevent and remedy human rights and certain environmental risks in their own operations and among their direct suppliers. It has applied since 1 January 2023 and is overseen by BAFA, the Federal Office for Economic Affairs and Export Control. It is a due-diligence law about process and effort, not a certification scheme.

No. The Act's obligations fall on companies above the employee thresholds, counted in Germany. An SME is not an addressee of the law and cannot breach it. What reaches an SME is contractual: its in-scope customers must conduct due diligence on their direct suppliers, and they discharge that by asking questions, adding clauses to contracts and occasionally auditing. The obligation is the customer's; the questionnaire is yours.

Almost certainly because they are in scope and you are one of their direct suppliers. The Act requires an in-scope company to run a risk analysis across its direct suppliers, take preventive measures where it finds risk, and document what it did. Asking you is the cheapest way to do the first part. From their side, an unanswered questionnaire is an undocumented risk, which is why the follow-ups keep coming.

A party you have a contract with for the supply of goods or services necessary to produce the company's product or provide its service. Indirect suppliers — your suppliers — are treated differently: an in-scope company generally only has to act on them when it acquires substantiated knowledge of a possible violation. That is why the questionnaire usually stops at you, and why it sometimes asks what you know about the tier below you.

Mostly not, and this is the most common misreading. Its core is human rights. Its environmental duties are narrow and tied to specific international conventions — Minamata on mercury, the POPs Convention on persistent organic pollutants, and Basel on transboundary movement of hazardous waste — plus environmental harm that damages human health. There is no general emissions-reporting duty in the LkSG. If your German customer is asking for Scope 1 and Scope 2 figures, that request is coming from somewhere else, most likely CSRD, the ISSB baseline or their own targets.

BAFA can require action, and administrative fines are available — up to €8 million, or up to 2% of average annual global turnover for the largest companies. A company fined above a threshold can also be excluded from German public procurement for up to three years, which in practice concentrates minds more than the fine does. Note that §3(3) states the Act does not create additional civil liability, although existing liability under other law is unaffected.

CSDDD, the EU Corporate Sustainability Due Diligence Directive, covers similar ground at European level and is intended to harmonise national regimes like the LkSG. Germany's law came first and the two differ in scope, in how far down the value chain they reach and in their liability provisions. Both the German rules and the European transposition timetable have been subject to ongoing political revision, so treat any specific date you read — including on this page — as needing a fresh check.

A Passport carries the workforce, health-and-safety, collective-bargaining and policy data that LkSG-driven supplier questionnaires ask for, structured and at a permanent link you can send instead of filling in another spreadsheet. German profiles carry an LkSG Disclosure Support badge alongside VSME. To be precise about what that is: it is a structured, self-reported disclosure that helps you answer, and it is not independent assurance, certification, or a statement that anyone is compliant with the Act.

Thresholds, duties, penalties and reporting requirements summarised here were reviewed on August 24, 2026. They are set by legislation, the reporting element has been under active revision, and the interaction with the EU's CSDDD continues to develop. This page is orientation, not legal advice; confirm anything load-bearing with BAFA guidance or a qualified adviser. BAFA and the German federal ministries are independent of EcoDiligence.

EcoDiligence ESG Passports are self-reported summaries structured for ESG disclosure workflows. Content is not independently assured. Information aligned with EFRAG VSME and IFRS S2 (ISSB) frameworks does not constitute formal compliance or certification.

Answer it once, then send a link

Workforce, safety, policies and worker representation, structured at a permanent URL — so the next customer questionnaire is a reply rather than a project. Free to start.

Create free PassportEvery country and framework