German Supply Chain Act
Contents
German Supply Chain Act (LkSG) at a glance
The German Supply Chain Due Diligence Act (LkSG), in force since 2023, aims to prevent and address human rights violations and environmental damage connected to the business activities of large companies headquartered or registered in Germany, including through their foreign branches and global supply chains. To this end, companies in scope of the law have to conduct human rights and environmental due diligence broadly (while not fully) in line with the international UN and OECD standards.
A public supervisory authority (BAFA) is responsible for enforcing the law. It can receive complaints from affected persons and notifications, including anonymous, from anyone. The LkSG also introduces legal standing of qualified NGOs and unions on behalf of victims in German civil courts. However, it does not create any new, LkSG-specific legal basis to claim damages from companies in court (civil liability).
So far, affected people and their representatives have therefore focused on the new BAFA channel and other non-judicial pathways under the LkSG to seek improvements in situations of corporate human rights and environmental abuse.
Some LkSG provisions are currently under legislative review or have already been weakened or suspended in practice. This is for an interim period until the EU’s Corporate Sustainability Due Diligence Directive (CSDDD) is transposed into German law and then applicable from July 2029 on. See here for civil society critique of recent developments.
Which companies fall under the German Supply Chain Act?
The law applies to companies that:
- have their central administration, main place of business, administrative headquarters, registered office, or a branch office in Germany, and
- employ at least 1000 workers in Germany (including German employees temporarily posted abroad).
This means that the law might also cover foreign companies with a larger branch in Germany.
The law is not limited to a specific legal form or type of company. It applies broadly to any organisation registered in Germany that predominantly carries out business or commercial activities and meets the threshold of 1,000 employees.
If you are concerned that a company possibly covered by the LkSG may be connected to (local) risks and harms but you need to find out more about potential connections, you can refer to basic guidance here.
How to check if a company is covered
There is no publicly available list of companies that are covered by the LkSG. You can take the following steps to try and determine whether the law applies:
- Check online whether the company meets the criteria. It can be helpful to search for information online whether the company is registered in Germany and has at least 1000 employees in Germany. The German Company Register ("Unternehmensregister"), for instance, features large companies' annual reports, which usually specify employee numbers.
- Seek out support. If you are unsure whether the company is covered under the law, you can find information on how to reach out to someone for support in our legal assistance directory and list of helpdesks, for instance.
If the company does not meet the above criteria, the law cannot be applied.
You can explore alternative remedy pathways here, or answer a few questions to receive suggestions for what pathways may be most appropriate for your specific situation here.
What are companies expected to do?
Companies in scope of the LkSG must conduct due diligence to prevent and address human rights and certain environmental harms that they are connected to through their global operations and supply chains.
A company's supply chain under the LkSG includes all steps in Germany and abroad that are necessary to produce its products and provide its services, "starting from the extraction of the raw materials to the delivery to the end customer".
Therefore, in-scope companies’ due diligence obligations generally apply to risks and harms occurring:
- in the company’s own business area;
- at its subsidiaries;
- at its direct suppliers (contractual partners);
- at its indirect suppliers (e.g. suppliers of direct suppliers) – if the company has substantiated knowledge of possible violations in such part(s) of its supply chain.
Substantiated knowldge means actual indications of violations, which can include media and NGO reports, as well as other information considered common knowledge, or which a company receives directly, including through complaints mechanisms or more informal channels. The law does not intent substantiated knowledge to be a major hurdle. Sending relevant information to the company can already establish it.
Are 'downstream' risks and harms covered?
Human rights or environmental risks and harms in a company's ('upstream') supply chain of production and raw materials sourcing would typically be covered by the LkSG.
- Example: working conditions in mines or factories
It is BAFA's interpretation that ('downstream') risks and harms occuring after production and delivery to the end-customer are generally not covered by the LkSG. However, the legal text as such is less clear-cut and allows for a different interpretation, for instance where negative impacts originate in product design and distribution.
- Example: health impacts of pesticides
Protected human rights and environmental standards
Section 2 of the LkSG spells out a range of human rights risks or harms that companies in scope of the law need to prevent, minimise or end as part of their due diligence obligation. These include:
- child labour;
- modern slavery and forced labour;
- discrimination;
- the unlawful taking of land;
- violations of local occupational health and safety rules if this gives rise to accidents and health hazards;
- the hiring or use of abusive security forces;
- the withholding of an adequate living wage;
- infringements on the right to form trade unions and workers' representations;
- harmful soil change or air and water pollution that affects people’s health and livelihoods.
Particularly serious and obvious corporate violations of other rights are also covered if these rights are enshrined in 11 internationally recognised human and labour rights instruments listed in the law’s annex:
- International Covenant on Civil and Political Rights
- International Covenant on Economic, Social and Cultural Rights
- all ILO core labour conventions (and one protocol) except for no. 155 and 187
The LkSG obliges in-scope companies to conduct due diligence on certain environment-related risks or harms in their operations and supply chains, taken from three international conventions:
- Minamata Convention on Mercury;
- Stockholm Convention on Persistent Organic Pollutants;
- Basel Convention on the Control of Transboundary Movements of Hazardous Wastes and Their Disposal.
Companies in scope of the LkSG do not have to guarantee successful prevention and termination of (all) human rights or environmental risks and harms in their supply chains. They are only obliged to take “appropriate measures” to this effect. This is called an obligation of means or effort (versus an obligation of result).
The LkSG requires successful termination of violations in a company’s own business area, especially in its German operations and “usually” in branches abroad. In contrast, depending on context, a company's serious measures targeting risks and harms at supplier level may be considered “appropriate” even if they do not fully or immediately prevent or mitigate these.
Due diligence under the LkSG in detail
1. Establishing a risk management system
Companies must establish an effective risk management system to identify, prevent, minimise and end human rights and environmental risks in their operations and supply chains. The system should be integrated into relevant business processes and help companies continuously monitor risks and assess whether their measures are effective.
The LkSG states that companies need to give due consideration to the interest of their own employees, employees in the supply chain, and other directly affected stakeholders when establing and implementing their risk management system. This means they should consult and meaningfully engage with such stakeholders.
2. Designating a responsible person or persons within the company
Companies must designate one or more responsible persons within the company to oversee compliance with the law and monitor risk management. This is often referred to as appointing a Human Rights Officer. Senior management must also be informed regularly about the work carried out and the identified risks.
3. Conducting regular risk analysis
Companies must identify and analyse human rights and environmental risks in their own business area (including foreign branches) and at direct suppliers. Risk analyses must generally be carried out annually and also whenever there is a significant change in business activities or when new risks become known.
If a company has substantiated knowledge (see above) of possible harms at the level of indirect suppliers deeper down in the supply chain, it must also carry out risk analysis there. This reactive logic, if applied too rigidly, contradicts the international UN and OECD standards, which require proactive risk identification by companies across their whole supply and value chains.
Where companies cannot tackle all human rights and environmental impacts at once, the LkSG allows them to prioritise, based on the severity of impacts among other factors. BAFA has made clear that companies should prioritise risks across their supply chain in an integrated manner, also considering those at indirect suppliers (if there is substantiated knowledge). Risks deeper down in the supply chain are often among the most severe.
4. Issuing and updating a policy statement
Companies must adopt and publish a policy statement on their human rights strategy. The statement should describe the company’s due diligence procedures, specify priority risks, and explain the expectations placed on employees and suppliers regarding human rights and environmental standards.
5. Laying down preventive measures
Companies must take preventive measures in their own business operations and in relation to direct – and, if there is substantiated knowledge, also indirect – suppliers. These measures may include training, supplier codes of conduct, contractual safeguards, audits, purchasing practices adjustments or other actions designed to reduce identified risks.
6. Taking remedial action
Where a company identifies an actual or imminent human rights or environmental violation, it must take appropriate remedial action without delay. The aim should be to prevent, end or minimise the violation. Depending on the situation, this could include working with suppliers to improve conditions, implementing corrective measures, or, in serious cases, terminating business relationships as a last resort.
The law’s section on remedial action mainly spells out potential action to mitigate and end abuse, rather than measures to provide restitution for victims and compensate them for harm. However, remediation in that sense is not alien to the LkSG: elsewhere the legal text states that efforts taken by a company to “repair the damage” can be taken into account by the supervisory authority (BAFA) when calculating and issuing fines for non-compliance.
7. Establishing a complaints procedure
Companies must also establish an accessible complaints procedure through which individuals, trade unions, NGOs and others can report human rights or environmental risks and violations connected to the company or its supply chain. This procedure should be available to both internal or external persons. It must be accessible, confidential and impartial, and protect anyone filing complaints from discrimination or retaliation.
8. Documenting and reporting on due diligence measures
Companies must continuously document how they fulfil their due diligence obligations and publish an annual report on their website and submit it to the competent authority. They must also document the fulfilment of their obligations and keep this documentation for seven years. In practice, companies are currently not fined for violations of these duties. However, many companies still report (and have to report) on due diligence measures under EU sustainability reporting rules.
You can normally find companies’ LkSG reports (try “Bericht zum LkSG” in your search bar) and sustainability reports (try “sustainability report”) online.
What can I do if a company does not meet the obligations?
If a company does not comply with its obligations (for example, it does not act after gaining substantiated knowledge of a human rights violation in the deeper supply chain), any concerned party (such as individuals, communities, trade unions or NGOs) can hold the company accountable under this law through certain pathways.
It can be helpful to seek support if you consider taking action. You may consider contacting NGOs for guidance or seeking legal advice from lawyers experienced in corporate accountability and/or the LkSG. They can help you understand your options, support the collection of evidence, assist in submitting complaints, and connect you with others. Explore our legal assistance directory here.
Jump to...
1. Engaging with the company
Companies in scope of the LkSG are obliged to engage with their employees, employees in the supply chain and other rights- and stakeholders directly affected by its commercial activities and to duly consider their interests. Even if it is on the company to initiate such dialogue, contacting other NGOs who are already in touch with the company, or using the complaint mechanism, can be a way to actively demand it.
Involving Germany-based buyers covered by the LkSG in ongoing negotiations with local suppliers has in some cases been an effective way for unions and other stakeholders to foster improvements of working conditions and new agreements.
2. Using the company's complaints channel(s)
Every company covered by the LkSG must have a complaints mechanism in place that allows individuals, NGOs, trade unions and other stakeholders to report human rights or environmental risks or non-compliance related to the company’s own business area or supply chain free of charge. Complainants do not necessarily have to be directly affected themselves.
To file a complaint, you usually need to contact the company through one of its official channels. You may find this information on the company’s website, through business or multistakeholder initiatives that it is part of, or in production sites if the channel is announced on posters, for instance.
You can also try and type the company name and “grievance mechanism” or “whistleblowing system” into your internet search bar to find a channel for filing a complaint. The company will usually, or at least it should, provide information on how this process works, how your data is being handled, and how you are protected.
Where possible, you should explain:
- what happened or what risk you identified;
- where and when the risk or harm occurred; and
- which company operation or supplier is involved.
You should provide any supporting information or evidence if this is safe enough.
Before filing a complaint and/or engaging with a company, it is important to consider any possible safety concerns for yourself and others. Again, it might be helpful to reach out to someone for advice if you are unsure.
After filing the complaint with the company, it should acknowledge receipt, review the matter and then respond to you.
Possible outcomes
The law does not prescribe any specific outcomes for complaints with companies. The outcome depends on the case.
However, the company must properly examine the complaint, discuss the facts with the complainant, and try to find a plausible solution.
Filing a complaint with a company can also make sense where the risk or harm occurs at indirect suppliers of that company deeper down in the supply chain and complainants are concerned whether the company has substantiated knowledge of it.
3. Submitting a notification or complaint to the supervisory authority (BAFA)
BAFA is the German supervisory authority responsible for supervising and enforcing the LkSG. Anyone can submit information or reports about suspected LkSG violations by companies to BAFA free of charge. Depending on your role/situation and on whether you wish to stay anonymous, your submission will be treated by BAFA as general notification or formal complaint.
The authority (BAFA) prefers if notifications and complaints are submitted through its online form, which can be found here, but email or other means of communication are also accepted. The online form is available in English, German, French and Spanish.
The reported harm must be ongoing or imminent, and/or have occurred after January 2023, when the LkSG became applicable. Please note that the threshold for employees was higher (3,000) in the law's first year of application (2023), which means fewer companies were in scope.
General notifications
Even if you are not directly affected nor representing someone affected, or if you want to stay anonymous, you can report (imminent) human rights or environmental harms and any non-compliance with LkSG obligations to BAFA. Your submission will then be treated as notification rather than complaint. BAFA may still examine the information and decide whether to act on its own initiative. If they take initiative on their own, you will not receive any feedback on the outcome.
Points to consider when submitting notifications & complaints to BAFA
- Try and explain how the risk or harm is connected to one or several companies in scope of the law (registered in Germany, at least 1000 employees in Germany), even if has occurred at the level of direct or indirect suppliers. However, this is not strictly necessary and naming the supplier(s) may suffice, for instance. BAFA will take its own steps to investigate and evaluate the situation and any connections.
- Try and detail how the suspected harm falls into one of the categories of risk and harm spelled out in section 2 of the LkSG, or constitutes particular serious corporate abuse of other rights enshrined in one of the international instruments from the LkSG’s annex. Again, such a detailed legal argument is not strictly required.
- Describe the facts of the harm as clearly and comprehensively as possible.
Formal complaints
Formal complaints to BAFA can be filed if:
- you have suffered harm because a company in scope of the law did not, to your best knowledge, comply with its due diligence obligations;
- you fear that you may suffer harm for that reason; or
- you are acting on behalf of a person or community affected in such a way (representatives need a formal power of attorney).
It is generally necessary to name at least one affected individual, or otherwise the submission will be treated as general notification (see above) without any official feedback loop with BAFA.
Preparing the complaint
Before submitting a complaint, it is helpful to collect as much relevant information and evidence as possible, including details about the company/companies involved, the alleged harm or risk, affected individuals or communities, and any supporting documentation. However, this is no strict requirement as BAFA will also investigate and a lot of company-related information may not be easily accessible.
The authority has so far treated information confidentially and, for instance, redacted (blackened) the names of complainants whenever companies requested access to the files. However, there is no 100% guarantee as BAFA has to weigh the risks and interests when taking such decisions.
Complaints procedure
After submission, BAFA reviews the information provided and decides whether further action is necessary. The authority will inform complainants twice:
- once their request for action has been accepted (or rejected)
- once the investigation and assessment have been completed (there is no definitive timeline of how long this can take)
In some cases, BAFA may contact those who have submitted a complaint to seek additional information or clarification during the review process. In practice, this depends on the case and how actively complainants are requesting such updates.
It can make sense for complainants to request access to the files to know where the process stands. Requesting access is relatively straightforward and does not necessarily have to be done by a lawyer.
Possible outcomes
If BAFA finds the company has not fulfilled its obligations under the LkSG, it can require a company to:
- conduct a proper human rights risk analysis;
- establish or improve its complaints mechanism;
- adopt preventive measures for risks at the level of suppliers;
- implement remediation measures where violations and harms have occurred.
Companies may be required to mitigate and remedy violations within a specified timeframe.
If a company fails to comply with BAFA's orders, the authority can use administrative enforcement measures, including coercive fines, to ensure compliance.
BAFA can impose fines of up to €8 million or up to 2% of annual global turnover for large companies.
Companies receiving significant fines may be barred from participating in public procurement procedures for up to three years.
Further information
Disciplinary complaint against BAFA by ASTAC
In 2025, the Ecuadorian trade union Asociación Sindical de Trabajadores Agrícolas y Campesinos (ASTAC) filed a complaint under the LkSG to BAFA against a company and later challenged BAFA’s handling of the process. ASTAC argued that BAFA had treated complainants unfairly, including by creating excessive barriers to accessing case files and information about the procedure.
ASTAC submitted a disciplinary complaint to the supervising ministry, the German Federal Ministry for Economic Affairs and Energy (BMWE), in September 2025, arguing that BAFA’s approach was unlawful and made it harder for affected workers to participate effectively. In March 2026, the ministry found in ASTAC’s favour and instructed BAFA to improve its approach, including by considering electronic access to files, providing clearer information to complainants, and reducing unnecessary redactions.
According to BAFA’s latest public annual report (2024, available in German only), 290 complaints were filed in 2024 via the authority’s mechanism, most of which were deemed unrelated to the law. Of 48 remaining cases, six had been concluded by the end of 2024, with no breach of LkSG obligations found or allegations not verifiable, according to BAFA. Nevertheless, some of the documented, positive LkSG impacts likely relate to action taken by BAFA either in response to complaints or on its own initiative. At the same time, CSOs have alleged procedural barriers (see example above) and slow or inadequate follow-up by an authority that, according to recent reporting, appears to be increasingly understaffed.