ESG and Supply Chain Due Diligence: Documentation Under Germany's LkSG (Supply Chain Act)
Germany's LkSG requires companies with 1,000+ employees to document human rights and environmental due diligence throughout their supply chains. Here's what's required and how to review.
Germany's Lieferkettensorgfaltspflichtengesetz (LkSG) — the Supply Chain Due Diligence Act — is one of Europe's most comprehensive supply chain compliance laws. Since January 2024, it applies to all companies with 1,000 or more employees in Germany, creating documentation obligations that extend far beyond the company's own operations into its entire supply chain.
The LkSG requires companies to identify, prevent, and mitigate human rights and environmental risks in their own operations and those of their direct suppliers — and to take action regarding indirect suppliers when they have substantiated knowledge of violations. BAFA (the Federal Office for Economic Affairs and Export Control) enforces the law, with penalties of up to 2% of average annual global turnover.
LkSG Scope and Obligations
Who Must Comply
| Threshold | Effective Date | Scope |
|---|---|---|
| 3,000+ employees | 1 January 2023 | Companies with registered office, principal place of business, or administrative headquarters in Germany |
| 1,000+ employees | 1 January 2024 | Same as above |
Employee count includes: all employees in Germany (including temporary workers employed for more than 6 months) and employees posted abroad by the company.
Protected Rights and Environmental Standards
The LkSG covers specific human rights and environmental risks:
Human rights risks (§2(2)):
- Prohibition of child labour
- Prohibition of forced labour and slavery
- Prohibition of discrimination
- Freedom of association and collective bargaining
- Fair wages (at least local minimum wage)
- Occupational health and safety
- Prohibition of unlawful land eviction
- Prohibition of hiring private security that violates human rights
- Prohibition of acts causing harmful environmental damage that affects health, access to food/water, or livelihoods
Environmental risks (§2(3)):
- Prohibition of mercury use/production violating the Minamata Convention
- Prohibition of persistent organic pollutants violating the Stockholm Convention
- Prohibition of hazardous waste import/export violating the Basel Convention
Required Documentation
1. Risk Analysis (§5)
The foundation of LkSG compliance — must be conducted annually and on an ad hoc basis when significant changes occur.
| Element | Requirement |
|---|---|
| Own operations risk assessment | Systematic identification of human rights and environmental risks in all company operations |
| Direct supplier risk assessment | Risk assessment for all direct suppliers, prioritised by risk level |
| Risk prioritisation | Methodology for prioritising identified risks (severity, likelihood, company influence) |
| Abstract risk analysis | Industry-level and country-level risk mapping |
| Concrete risk analysis | Specific risk assessment for identified high-risk areas |
| Annual update | Documented annual review and update of the risk analysis |
| Ad hoc update | Updated risk analysis when the company becomes aware of new risk indicators |
Documentation standard: The risk analysis must be documented in sufficient detail that BAFA can assess its adequacy. Generic risk statements are insufficient — the analysis must be specific to the company's operations and supply chain.
2. Policy Statement (§6(2))
A board-level policy statement documenting the company's human rights strategy:
| Element | Requirement |
|---|---|
| Board commitment | Explicit statement of commitment to respect human rights and environmental standards |
| Priority risks | Identified priority human rights and environmental risks |
| Expectations of employees | What the company expects from its own employees |
| Expectations of suppliers | What the company expects from its suppliers |
| Procedures | Description of due diligence procedures |
| Review commitment | Commitment to regular review and update |
3. Preventive Measures — Own Operations (§6(1)-(4))
| Document | Requirement |
|---|---|
| Code of conduct | Human rights and environmental standards for the company's own operations |
| Procurement strategy | How procurement decisions consider human rights and environmental risks |
| Training programme | Training for relevant employees on human rights due diligence |
| Risk-based control measures | Internal controls for identified risks in own operations |
| Integration evidence | How due diligence is integrated into business processes and decision-making |
4. Preventive Measures — Supply Chain (§6(4))
| Document | Requirement |
|---|---|
| Supplier code of conduct | Human rights and environmental expectations for suppliers |
| Contractual assurances | Suppliers' contractual commitment to comply with standards and pass requirements to their own suppliers |
| Training and capacity building | Support provided to suppliers for compliance |
| Audit and monitoring | Risk-based audits and monitoring of supplier compliance |
| Balanced purchasing practices | Documentation that purchasing practices don't undermine suppliers' ability to comply |
5. Remedial Actions (§7)
When a violation is identified or is imminent:
| Document | Requirement |
|---|---|
| Remediation plan | Concrete plan with timeline for ending the violation |
| Immediate measures | Actions taken to minimise or end the violation |
| Concept for ending violation | Strategy for long-term resolution |
| Escalation documentation | If direct supplier cannot resolve — escalation steps including potential termination |
| Termination as last resort | Documentation showing termination was considered as a last resort after other measures failed |
6. Complaints Procedure (§8)
A publicly accessible complaints mechanism:
| Element | Requirement |
|---|---|
| Procedure documentation | Written complaints procedure accessible to affected persons |
| Accessibility | Available to potentially affected persons, including in the supply chain |
| Independence | Persons handling complaints are independent and not subject to instructions |
| Confidentiality | Identity protection for complainants |
| Protection against retaliation | Documented protections for complainants |
| Transparency | Information about how complaints are processed and resolved |
| Annual review | Documented effectiveness review of the complaints mechanism |
7. Annual Report to BAFA (§10)
Due within 4 months of the end of the fiscal year:
| Element | Requirement |
|---|---|
| Risk identification | Risks identified through the risk analysis |
| Risk assessment | How the company assessed and prioritised risks |
| Preventive measures | Measures taken to prevent violations |
| Remedial actions | Actions taken in response to identified violations |
| Complaints | Complaints received and how they were handled |
| Effectiveness assessment | Assessment of the effectiveness of due diligence measures |
| Conclusions | Conclusions drawn for future due diligence |
The report must be published on the company's website for 7 years.
Indirect Supplier Obligations (§9)
For indirect suppliers, obligations are triggered by "substantiated knowledge" of a violation:
| Trigger | Required Action | Documentation |
|---|---|---|
| Substantiated knowledge of violation | Conduct risk analysis for the indirect supplier | Ad hoc risk analysis documentation |
| Risk confirmed | Implement preventive measures | Prevention plan documentation |
| Violation ongoing | Develop remediation concept | Remediation concept with timeline |
| Update complaints mechanism | Ensure indirect supplier violations can be reported | Updated complaints procedure |
BAFA Enforcement
| Enforcement Tool | Detail |
|---|---|
| Information requests | BAFA can request documentation at any time |
| On-site inspections | Announced and unannounced inspections |
| Corrective orders | Orders to implement specific measures |
| Administrative fines | Up to €8 million or 2% of average annual global turnover (for companies with >€400M turnover) |
| Public procurement exclusion | Companies fined ≥€175,000 can be excluded from public contracts for up to 3 years |
Common LkSG Documentation Gaps
Gap 1: Risk Analysis Not Specific Enough
Risk analyses that identify generic risks ("child labour exists in the textile industry") without connecting them to the company's specific supply chain. BAFA expects company-specific and supply-chain-specific risk identification.
Gap 2: Preventive Measures Not Proportionate
Preventive measures that don't match the severity and likelihood of identified risks. High-priority risks require more intensive prevention than low-priority risks — and this proportionality must be documented.
Gap 3: Complaints Mechanism Not Accessible
Complaints procedures that exist on paper but are not practically accessible to affected persons in the supply chain — particularly workers in supplier factories who may not have internet access or speak German/English.
Gap 4: Purchasing Practices Not Addressed
Documentation of supplier requirements without addressing whether the company's own purchasing practices (price pressure, short lead times, last-minute order changes) undermine suppliers' ability to comply.
Gap 5: Annual Report Incomplete
BAFA reports that don't cover all required elements, or that describe policies without reporting on actual implementation, effectiveness, and outcomes.
Reviewing LkSG Documentation
Risk Analysis Review Criteria
| Criterion | Weight | What to Check |
|---|---|---|
| Specificity | 3 | Risks linked to the company's actual supply chain, not generic industry risks |
| Methodology | 3 | Clear prioritisation methodology documented |
| Coverage | 2 | Own operations and all direct suppliers assessed |
| Currency | 2 | Annual update completed, ad hoc updates where triggered |
| Proportionality | 2 | Depth of analysis proportionate to identified risk levels |
Annual Report Review Criteria
| Criterion | Weight | What to Check |
|---|---|---|
| Completeness | 3 | All §10 required elements addressed |
| Implementation evidence | 3 | Reports on actual measures taken, not just policies |
| Effectiveness assessment | 2 | Genuine assessment of whether measures are working |
| Complaints reporting | 2 | Complaints received and outcomes documented |
| Conclusions | 1 | Forward-looking conclusions for next reporting period |
Frequently Asked Questions
Does the LkSG apply to non-German companies?
The LkSG applies to companies with their registered office, principal place of business, or administrative headquarters in Germany. Non-German companies with a German branch office may fall within scope if the employee threshold is met including German-based employees.
How does the LkSG relate to the EU CSDDD?
The EU Corporate Sustainability Due Diligence Directive (CSDDD) will create EU-wide supply chain due diligence obligations similar to the LkSG. Once implemented, the CSDDD may extend obligations (e.g., to cover the full value chain including downstream) and create civil liability provisions not present in the LkSG. Companies should build LkSG documentation with future CSDDD alignment in mind.
What counts as "substantiated knowledge" for indirect suppliers?
BAFA interprets this as credible information from reliable sources — media reports, NGO investigations, complaints through the company's mechanism, or audit findings that indicate a specific violation at an identifiable indirect supplier. Generic industry reports alone typically don't constitute substantiated knowledge.
Can AI review help with LkSG documentation?
AI review can check risk analyses for specificity and completeness, verify annual reports contain all required elements, assess preventive measures documentation for proportionality, and check complaints procedure documentation for accessibility requirements. Assessment of due diligence adequacy and legal compliance requires qualified human rights and compliance professionals.
Key Takeaways
- The LkSG applies to companies with 1,000+ employees in Germany — creating obligations covering own operations and the entire supply chain.
- Annual risk analysis must be specific to the company's actual supply chain — generic industry risk statements are insufficient.
- Seven documentation areas: risk analysis, policy statement, preventive measures (own + supply chain), remedial actions, complaints procedure, and annual report.
- The complaints mechanism must be practically accessible to affected persons in the supply chain — not just a webpage in German.
- Purchasing practices must be addressed — companies cannot require supplier compliance while undermining it through pricing pressure.
- BAFA can fine up to 2% of global turnover and exclude companies from public procurement.
- Build documentation with EU CSDDD alignment in mind — broader obligations are coming.
This article is for informational purposes only. LkSG requirements are subject to interpretation by BAFA and evolving guidance. Consult a qualified compliance professional or legal adviser for guidance specific to your company's supply chain and operations.