Supply Chain Act update: What applies to suppliers with fewer than 1,000 employees?

Who is affected by the Supply Chain Act?

Under the Supply Chain Due Diligence Act (LkSG), only a company is directly obligated that, as a rule, has at least 1,000 employees in Germany and has its head office, principal establishment, administrative seat or registered seat in Germany.^[1] A manufacturing operation with 400 or 800 employees is therefore not an addressee of the law. It cannot receive fines under the LkSG and is not required to conduct its own risk analyses under Section 5 LkSG or to set up a complaints procedure. According to the BAFA's presentation, companies outside the scope of application are only indirectly affected: the law impacts them only if they are in a direct or indirect supplier relationship with an obligated company.^[2]

In practice, the law still becomes relevant for smaller suppliers, namely through the business relationship with obligated large customers. These must implement their due diligence obligations within their own area of business and towards their direct suppliers, and in doing so they also approach mid-sized companies that themselves fall below the threshold. Typical forms are questionnaires, self-disclosures and codes of conduct, so-called Codes of Conduct. The BAFA points out that obligated companies are to cooperate with suppliers in fulfilling their due diligence obligations, even if those suppliers are not themselves obligated under the LkSG.^[2]

• Questionnaires on working conditions, environmental topics and risk standards in the supplier's own operation
• Self-disclosures about the supplier's own procurement, for example on raw material sources or upstream stages
• Codes of Conduct that the customer wants to agree contractually
• Evidence of the supplier's own training, controls or certifications in the context of human rights and environmental due diligence

The distinction between cooperation and shifting of obligations is important. The law places the due diligence obligations on the obligated company. Towards direct suppliers, it provides, among other things, for contractual assurances that the supplier complies with the required human rights and environmental expectations and addresses them appropriately along the supply chain, as well as appropriate contractual control mechanisms (Section 6(4) LkSG).^[3] The large customer's statutory responsibility is thereby not transferred to the mid-sized company. On this point the BAFA clarifies that transferring obligations under the LkSG to suppliers is not permissible and that obligated companies must fulfil the due diligence obligations under their own responsibility.^[2]

For the management of a manufacturing SME, this means: the task is not to build an in-house compliance system modelled on the LkSG, but to provide traceable, robust answers to customer enquiries and a realistic assessment of one's own supply chain. Conversely, the BAFA recommends that obligated companies request from suppliers only the information they actually need for an appropriate risk analysis.^[2]

When does the CSDDD apply?

The EU supply chain directive, the Corporate Sustainability Due Diligence Directive (CSDDD), was originally planned as the successor to the German LkSG with a considerably broader scope of application. With the Omnibus I package, the EU has postponed its application and substantially reduced the circle of directly obligated companies. Following an agreement with Parliament in December 2025, the Council finally adopted the package on 24 February 2026.^[4]

For the target group the consequence is clear: a threshold of more than 5,000 employees and more than EUR 1.5 billion in worldwide net revenue lies far above what even larger German suppliers in mechanical engineering and manufacturing typically achieve. The vast majority of companies below this size remain only indirectly affected even after 2029 — namely as a supplier to a company that falls under the Corporate Sustainability Due Diligence Directive (CSDDD). Germany must implement the directive by 26 July 2028; the coalition committee announced a 1:1 implementation on 2 July 2026.^[4][6]

Is the Supply Chain Act sensible?

Whether the Supply Chain Act is sensible depends on how one weighs the trade-off between protection claims and administrative burden. On one side stands the protection claim: the Supply Chain Act (LkSG) for the first time regulates corporate responsibility for compliance with human rights along the supply chain and is oriented on the United Nations Guiding Principles on Business and Human Rights of 2011. The act itself lists as protected legal positions, among others, prohibitions of child labour, forced labour, discrimination in employment, violations of freedom of association, inadequate occupational safety and environmental damage.^[7]

On the other side stands the relief argument. The federal government and business associations consider the bureaucratic burden, especially for small and medium-sized enterprises, to be too high. This explains the rollbacks of 2025: the annual reporting obligation is to be abolished and supervisory practice has been scaled back. The federal government explicitly justifies the amendment with the goal of relieving companies of bureaucracy.^[8] The act itself formulates the due diligence obligations as an obligation of reasonable effort, not an obligation of result: companies must respond to risks in a reasonable manner, graduated according to their ability to exert influence and their contribution to the cause.^[9]

• In favour: for the first time there is a legal basis for human rights due diligence along the supply chain, graduated according to ability to influence and contribution to the cause^[10]
• Against: indeterminate legal terms such as "appropriate measures", little practical experience and a very broad scope of application that presupposes a high degree of transparency across the entire chain^[5]
• Still open: the obligation of effort remains in place even after the planned relief amendment; the protection claim is not abolished, only its enforcement is reduced^[11]

Editorial assessment: whether the act in this form is the right instrument depends on how one evaluates what contribution binding obligations make compared with voluntary approaches, and how much administrative burden one is willing to impose on small and medium-sized enterprises. Both positions are represented by associations and the federal government; a final judgement cannot be derived from the current legal situation alone.

What is the current status of the Supply Chain Act?

The Supply Chain Act (LkSG) continues to apply unchanged until the legislator amends it or replaces it through implementation of the Corporate Sustainability Due Diligence Directive (CSDDD).^[12] The federal cabinet adopted a draft amendment to the act on 3 September 2025 (printed paper 21/2474); the Bundestag debated it in first reading on 16 January 2026 and referred it to the committees. It is intended to abolish the reporting obligation retroactively and reduce the catalogue of fine provisions, but had not been passed by mid-October 2026. On 2 July 2026, the coalition committee additionally resolved to restrict the LkSG from autumn onwards to large corporations with 5,000 or more employees and EUR 1.5 billion in annual revenue.^[13] Until a law is passed, the threshold of 1,000 employees remains in force.^[14][6]

1. 3 September 2025: The federal cabinet adopts the draft of a law amending the LkSG (printed paper 21/2474)^[14]
2. Autumn 2025: On instruction, BAFA stops reviewing company reports and only imposes fines for particularly serious human rights violations^[14]
3. 16 January 2026: First reading in the Bundestag, referral to the committees under the lead of the Committee on Labour and Social Affairs^[13]
4. 2 July 2026: The coalition committee decides to limit the scope of application to companies with 5,000 or more employees and 1.5 billion euros in annual revenue^[6]
5. 26 July 2028: Deadline for transposing the CSDDD into national law; companies apply it from 26 July 2029 onwards^[4]

The transition logic behind this: The federal government plans to replace the LkSG with a law that implements the CSDDD and, until then, to adapt it to relieve companies.^[12] For suppliers, the current status means: customer inquiries arising from their major customers' due diligence obligations continue, because the obligations of the companies in scope are not suspended.

What changes were made to the Supply Chain Act?

The government draft of 3 September 2025 targets two points: the reporting obligation, which is to be abolished retroactively from the 2023 reporting period, and the fine provisions. The internal company documentation obligation, by contrast, would remain in place.^[14]

For suppliers with fewer than 1,000 employees, this relief amendment would change nothing directly, because these obligations never applied to them anyway. Indirectly, however, the change would be noticeable: obligated major customers would no longer have to produce public reports, but their risk analyses, prevention and remediation processes and their complaints procedure would remain in place. The demand on the supply chain — questionnaires, codes of conduct and contractual assurances — does not disappear as a result.^[11]

Which companies are affected by the Supply Chain Act?

The scope of application of the LkSG was introduced in two stages and is based on the number of employees usually employed in Germany. The decisive factor is that the head office, principal establishment, administrative seat or registered seat is located in Germany; foreign companies are covered if they have a branch office in Germany with a correspondingly large number of employees. In corporate groups, the employees of all group companies in Germany are counted at the parent company.^[1]

The reach into the depths of the chain is graduated. The due diligence obligations cover the company's own business area and its direct suppliers. Indirect suppliers — that is, operations in the deeper tiers of the supply chain, down to the raw material supplier — are only included once the obligated company has substantiated knowledge, meaning concrete indications that make a violation of a human rights or environmental obligation appear possible. It must then carry out a risk analysis for that specific occasion, anchor preventive measures with the party causing the violation, and implement a concept to prevent, end or minimise it.^[15]

To put the sanctions under the current law into context: depending on the violation, fines of up to 800,000 euros are possible; for companies with average annual revenue of more than 400 million euros, certain violations can result in fines of up to 2 percent of average annual revenue.^[16] Once a fine of 175,000 euros becomes final, a company can additionally be excluded from public contracts for up to three years.^[17] The supervisory practice of BAFA has significantly restricted these options since autumn 2025, and the government draft would shrink the catalogue of fine provisions further.

What is the Supply Chain Act, explained simply?

The Supply Chain Act obliges large companies to ensure that human rights and environmental standards are upheld in their supply chains, graduated according to their ability to exert influence. It is based on the United Nations Guiding Principles on Business and Human Rights. The legislator expects companies to run a process of "due diligence in business terms", not to guarantee a specific outcome.^[11]

• Risk management and risk analysis: identify which parts of your own production and supply chain carry particularly high human rights and environmental risks^[5]
• Policy statement: a statement on human rights strategy endorsed by company management and embedded in business processes^[5]
• Preventive and remedial measures: for example, contractual human rights clauses with suppliers, training and risk-based controls; prompt remediation once violations have occurred^[5]
• Complaints procedure: a mechanism through which affected parties and whistleblowers can draw attention to possible violations^[11]
• Documentation: continuous internal documentation of the measures taken; the public reporting obligation is to be dropped under the government draft^[11]

For suppliers with fewer than 1,000 employees, this yields a simple logic of action: no reports of their own, no fine liability of their own, but credible answers to customer enquiries. This presupposes that the operation knows its own chain, knows where its critical upstream products come from, and can give credible information on working conditions, environmental issues and existing controls. Those who answer in a structured way here, rather than responding to questionnaires ad hoc, reduce both effort and dependence on individual major customers.^[5]

Legal status of this article, 15 October 2026: the LkSG in its current version, the government draft of 3 September 2025 (not yet passed), the decision of the coalition committee of 2 July 2026 and the amended CSDDD applying from 26 July 2029. How the German legislator will implement the CSDDD in detail remained open at the time of writing. You can find further analysis in the Industry section on GoMaschine:

• Dual sourcing: strategy, advantages and disadvantages in procurement
• Machinery Regulation 2027: changes for manufacturers

Frequently asked questions

Does the Supply Chain Act apply to suppliers with fewer than 1,000 employees?

No, it does not apply directly. Since 1 January 2024, the LkSG has obligated companies with usually at least 1,000 employees in Germany. Smaller suppliers are nevertheless indirectly affected, because obligated customers request information via questionnaires, self-disclosures and codes of conduct in order to meet their own obligations.

Is the Supply Chain Act being abolished?

No, as of mid-October 2026 it remains in force. On 3 September 2025 the federal government adopted a draft intended to remove the reporting obligation and reduce the fine provisions; it has not been passed. In the long term, the LkSG is to be replaced by implementation of the EU Corporate Sustainability Due Diligence Directive (CSDDD).

From when does the EU Supply Chain Directive CSDDD apply?

Following the decisions on the Omnibus I package, affected companies apply the CSDDD from 26 July 2029. Only companies with more than 5,000 employees and annual revenue of more than EUR 1.5 billion are covered. Member states have until 26 July 2028 to transpose the directive into national law.

Do suppliers with fewer than 1,000 employees have to submit reports?

No. The reporting obligation is directed only at obligated companies anyway and, under the government draft, is to be abolished retroactively from the 2023 reporting period. The BAFA has already stopped reviewing company reports since autumn 2025. Suppliers must, however, remain able to answer customer enquiries.

What happens in the event of violations of the Supply Chain Act?

Under current law, fines of up to EUR 800,000 may be imposed depending on the violation, and up to 2 percent of annual revenue for very large companies. The government draft would shrink the catalogue from thirteen to four provisions. Even today, the BAFA imposes fines on instruction only for particularly serious human rights violations.

Can major customers transfer their LkSG obligations to suppliers?

No. Transferring obligations under the LkSG to suppliers is not permissible. Obligated companies must fulfil their due diligence obligations on their own responsibility and proceed on a risk basis, meaning they may request only the information they actually need for an appropriate risk analysis.

Which companies are directly affected by the Supply Chain Act?

Since 1 January 2023, companies with usually at least 3,000 employees in Germany; since 1 January 2024, those with at least 1,000 — in each case headquartered or with their main administration in Germany or with a domestic branch office. Temporary agency workers count if their deployment exceeds six months.

Will the Supply Chain Act soon apply only from 5,000 employees?

That is planned, but not yet law. On 2 July 2026 the coalition committee decided to limit the LkSG to companies with 5,000 or more employees and EUR 1.5 billion in annual revenue. Until a law is passed, the threshold of 1,000 employees remains in force.

Sources

1. § 1 LkSG – Anwendungsbereich
2. bafa.de
3. § 6 LkSG – Präventionsmaßnahmen
4. Clifford Chance: Omnibus I concludes CSDDD and CSRD reforms (24.02.2026)
5. ihk.de
6. epo.de: Koalitionsausschuss zum Lieferkettengesetz (02.07.2026)
7. gesetze-im-internet.de
8. bundesregierung.de
9. gesetze-im-internet.de
10. ihk.de
11. offenbach.ihk.de
12. BMAS: Gesetz zur Änderung des LkSG
13. Deutscher Bundestag: Erste Lesung, 16.01.2026
14. BT-Drucksache 21/2474 (Regierungsentwurf, 29.10.2025)
15. § 9 LkSG – Mittelbare Zulieferer
16. § 24 LkSG – Bußgeldvorschriften
17. § 22 LkSG – Ausschluss von der Vergabe