LkSG and CSDDD: who must comply and what it means for suppliers

The German Supply Chain Act (LkSG)

The Lieferkettensorgfaltspflichtengesetz, or LkSG, entered into force on 1 January 2023 for companies with at least 3,000 employees in Germany. Since 1 January 2024 it applies to companies with at least 1,000 employees in Germany. It covers companies with their head office, principal place of business, administrative seat or registered office in Germany, and foreign companies with a branch in Germany that reaches the threshold.

The threshold counts employees in Germany, including temporary workers employed for more than six months, and in a group the employees of German subsidiaries can count towards the parent company.

The Federal Office for Economic Affairs and Export Control (BAFA) supervises the law and publishes guidance and FAQs.

What the LkSG requires

Companies covered must set up a due diligence process for their own business and for their direct suppliers, and act on indirect suppliers when they have substantiated knowledge of possible violations. The main elements are:

• a risk management system and a person responsible for monitoring it;
• a regular risk analysis;
• a policy statement on the human rights strategy;
• preventive measures in their own business and towards suppliers;
• remedial action when a violation is found;
• a complaints procedure open to people affected;
• documentation of the due diligence obligations.

The risks covered include child labour, forced labour, unsafe working conditions, denial of freedom of association, unequal treatment, unlawful land eviction and certain environmental risks such as prohibited substances.

The EU directive (CSDDD)

The Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760, entered into force on 25 July 2024. It sets due diligence obligations on human rights and the environment for very large EU and non EU companies and extends them along the chain of activities.

The timetable has already changed. Directive (EU) 2025/794, part of the Omnibus simplification package, postponed the deadline for transposition into national law to 26 July 2027 and the first application to 26 July 2028. The EU institutions have also worked on changes to the scope and content of the directive within the same package. Before planning, check the consolidated text on EUR-Lex and the national law of the Member States where your customers are based.

What this means for suppliers

Most suppliers are not directly subject to these laws, but they feel them through their customers. Typical requests include:

1. a supplier code of conduct to accept and pass on to your own suppliers;
2. questionnaires on working conditions, environmental practices and subcontractors;
3. contract clauses with audit rights and remediation obligations;
4. information on where materials come from;
5. evidence that you screen your own customers and suppliers, including against sanctions lists.

Customers covered by these laws are expected to support their suppliers rather than simply pass on all the obligations. In practice, a supplier that can answer quickly and show documented checks is easier to keep on an approved list.

A practical way to prepare is to keep a short supplier file ready: company details, ownership, main sites, certifications, your own code of conduct and a description of how you check your suppliers and customers. Updating it once a year is far less work than answering every questionnaire from scratch, and it gives your customers consistent answers.

Where sanctions and forced labour checks come in

Due diligence laws are about human rights and the environment, not sanctions. Yet the two often meet: lists of companies linked to forced labour, such as the US UFLPA Entity List, and adverse news about labour practices are part of a credible risk analysis. Our guide on forced labour checks on suppliers covers this in detail.

Where Unicorn Intelligence fits

Unicorn Intelligence monitors suppliers daily against sanctions lists and public sources and keeps the record of each check; new accounts receive a $50 credit.

Frequently asked questions

Which companies must comply with the LkSG?

Since 1 January 2024, companies with at least 1,000 employees in Germany, including foreign companies with a German branch that reaches the threshold.

When does the CSDDD apply?

Directive (EU) 2025/794 postponed transposition to 26 July 2027 and first application to 26 July 2028. Scope and content were also reviewed, so check the current text on EUR-Lex.

Does the LkSG apply to small suppliers?

Not directly. But customers covered by the law ask their suppliers for codes of conduct, information and audit rights.

Who supervises the LkSG?

The Federal Office for Economic Affairs and Export Control (BAFA), which also publishes guidance for companies.

What should a supplier prepare?

A supplier file with company details, ownership, sites, certifications, a code of conduct and a description of how you check your own suppliers and customers.