The new German Supply Chain Due Diligence Act

The German Supply Chain Due Diligence Act is a new building block in the field of ESG. It creates far-reaching new obligations for certain companies. To that extent, it is thus also a part of corporate governance. However, this is only one part of ESG, essentially the "G" in the context of the term ESG. Moreover, ESG goes beyond this approach, driven also by social change. Customers are increasingly paying attention to sustainability, avoidance of environmental damage, and minimum social standards, as also shown by the significantly increased number of "Fairtrade" products. But what does the LkSG mean for companies and entrepreneurs, and who does it apply to?

Aim of the LkSG

The Supply Chain Due Diligence Act came into force on 01.01.2023. It establishes a series of obligations to comply with human rights and environmental standards. The aim is to strengthen environmental protection and human rights along the supply chain. For companies, it means that they should/must analyze and monitor their supply chains more closely in order to prevent violations of these standards. From 2023 on, affected companies will therefore have to monitor their own business operations and their direct suppliers for compliance with human rights and environmental standards.

Affected Companies

In principle, the law addresses due diligence obligations to companies that generally have at least 3,000 employees in Germany and a head office, principal place of business, a branch office or a registered office in Germany, regardless of their legal form. This means that foreign groups with domestic subsidiaries that employ at least 3,000 employees in Germany are also subject to the LkSG. As of January 1, 2024, this threshold will drop to 1,000 employees, so companies with 1,000 to 3,000 employees should also start iplementing the necessary measures early.

The number of employees must also take into account employees seconded to foreign countries, as well as employees of companies belonging to the group (Section 15 of the German Stock Corporation Act (AktG)). If the parent company has a determining influence on this company, the companies belonging to the group are part of the parent company's own business; the Supply Chain Due Diligence Act therefore also applies to them, irrespective of their own number of employees. In addition, temporary workers are also to be taken into account insofar as their period of employment exceeds six months.

On closer inspection, however, the LkSG can already have significant consequences for small or medium-sized companies in the supply industry, even if they have significantly fewer than 1,000 employees, as they may be part of the supply chains of someone else who in turn falls under the obligation of the Act. The latter will then pass on the obligations to companies in its supply chain.

Content of the law and protected legal interests

The due diligence obligations apply in the supply chains of the company concerned. This includes "all steps in Germany and abroad that are necessary to manufacture the products and provide the services, starting from the extraction of the raw materials to the delivery to the end customer". According to this, the following areas are covered:

• own business operations (domestic and foreign),
• direct suppliers and
• indirect suppliers.

With regard to indirect suppliers, due diligence applies occasion-related. Only when there are substantial indications of possible infringements of rights, a review must be carried out.

According to the LkSG, protected legal assets are human rights and the environment. However, these are not formulated positively in Section 2 Para. 2 and Para. 3 LkSG, but are presented as prohibitions that may not be violated. Paragraph 2 addresses human rights, paragraph 3 environmental risks. The human rights risks that must be addressed can be divided into protection of workers and protection of livelihoods. In principle, Section 2 Para. 2 prohibits, among other things, the following:

• Child labor (as a rule, prohibition of employment of children under 15 years of age),
• forced labor,
• slavery, sexual exploitation,
• disregard of occupational health and safety regulations according to the law of the place of employment,
• withholding of adequate wages,
• use of private or public security forces if they are poorly controlled, thereby violating, inter alia, the prohibition of torture or degrading treatment, 
• contamination of soil, water, air and excessive use of water, 
• unlawful eviction or deprivation of land, forests or waters,
• any action or omission likely to impair a protected legal position in a particularly serious manner and the illegalty of which is obvious (general clause).

Environmental prohibitions include:

• Prohibition on the manufacture of mercury-added compounds,
• Prohibition of the use of mercury in manufacturing processes,
• Prohibition of improper treatment of mercury waste,
• Prohibition of production and use of certain chemicals and persistent organic pollutants,
• Prohibition of non-environmentally sound handling, collection, storage and disposal of waste,
• various bans on the export and import of certain hazardous wastes under the Basel Convention.

Obligations under the LkSG

The duties of effort stipulated by the Act are not duties of success, i.e. the violation of the duty related to human rights or the environment does not yet imply a violation of the duty of effort, as long as the precautions taken were adequate. Thus, no specific success is owed, nor is there any liability under a guarantee. However, reasonable measures must be taken to prevent a breach from occurring. The other side of this coin is that a breach of a duty of care can also exist if human rights or environmental standards are not violated, but no adequate measures have been taken. The decisive factor is therefore the suitability of the measure with sufficient probability to prevent violations of protected legal rights. Nothing legally or factually impossible is required in this regard. They must be appropriate (relativity of the standard of duty). In this respect, reasonableness forms the corrective for the far-reaching duties of care. The criteria for this are:

• type and scope of the entrepreneurial activity,
• influence of the company on the "violator",
• the severity of the violation that can typically be expected,
• reversibility or probability of a violation
• and the nature of the company's contribution to the cause.

Since the focus is ultimately on the company's ability to influence, the due diligence requirements are also lower for indirect suppliers.

Catalog of duties

The catalog of obligations is presented in Section 3 and is specified in Section 4 to 10. According to this, affected entrepreneurs are obligated to the following:

• Establishment of a risk management system,
• Definition of an internal responsibility,
• regular performance of risk analyses,
• issuing a policy statement,
• implementing preventive measures in their own business area and towards direct suppliers,
• taking corrective action,
• setting up a complaints procedure,
• implementing due diligence obligations towards indirect suppliers,
• Documentation and reporting requirements.

Basically, a distinction can be made between documentation and reporting obligations, the obligation to conduct risk analyses and preventive measures.

Documentation and reporting obligations

The starting point of all obligations is a policy statement pursuant to Section 6 (1) of the LkSG, which defines the basic strategy. This in turn forms the basis of the risk analysis. It describes the procedure by which the duties of care are to be fulfilled.

The fulfillment of the due diligence obligations must be continuously documented by the contractors. The documentation must be kept for a period of seven years.

In addition, companies are required to publish annual reports, which must be published on the company's website for a period of seven years four months after the end of the fiscal year. In addition, this report must be submitted to BAFA (Bundesamt für Wirtschaft und Ausfuhrkontrolle - Federal Office of Economics and Export Control). The minimum disclosures are not mandatory in the report if it is plausibly shown that no risks have been identified (comply or explain).

Risk analysis

The obligation to conduct a risk analysis is already known, for example, from the Money Laundering Act. According to the LkSG, the risk analysis is also the starting point for determining concrete (adequate) measures. It is used to determine the relevant risks and its results must be passed on to the managers.

The risk analysis covers the company's entire business operations, so that subsidiaries dependent on the Group are also included. In addition, direct suppliers must also be included; indirect suppliers, on the other hand, are only included in the case of circumvention constellations (e.g. straw man business). In this case, the indirect supplier is also considered to be a direct supplier.

Preventive measures

Based on lit. a) and lit. b), preventive measures must be taken. As described above, a distinction must be made between direct and indirect suppliers. Preventive measures are only required in the company's own business area and vis-à-vis direct suppliers; in the case of indirect suppliers, in accordance with Section 9 (3) of the LkSG, only in the event of substantiated knowledge. The complaints procedure, on the other hand, which is also required, must be designed in such a way that risks from indirect suppliers can also be pointed out.

Preventive measures are designated by the law only by way of example, such as

• Implementing the human rights strategy outlined in the policy statement,
• Implementation of training courses,
• Implementing appropriate sourcing strategies and purchasing practices,
• Implementation of risk-based monitoring measures.

Companies must also appoint a human rights officer. The management must regularly obtain information on the work of this officer at least once a year.

Risk management

Risk management serves to ensure compliance with due diligence requirements and is to be implemented in all business areas. Its task is to identify risks, prevent them, minimize or end their extent. If necessary, the measures taken are to be further developed.

Risk management also includes an internal or external complaints procedure. This must enable whistleblowing and effectively protect whistleblowers from punishment and discrimination. In this respect, there are parallels with the Whistleblower Protection Act, particularly with regard to protecting the identity of the whistleblower. It must be reviewed annually and updated if necessary. The complaints management system also needs a complaints officer who not only confirms receipt but can also offer a procedure for mutual settlement. There must be rules of procedure in text form that is publicly available.

Remedial action

Insofar as breaches of duty are identified, appropriate defensive measures must be taken without delay. Here again, a graduated standard of care applies; a distinction must be made between the company's own business area and direct suppliers on the one hand and indirect suppliers on the other.

In the company's own domestic business area, the remedial action must lead to an end of the infringement. Abroad and in the case of group companies, the measure must only generally lead to the termination of the infringement. With regard to direct suppliers, various escalation levels are provided for, which only lead to termination of the business relationship as a last instrument. In the case of indirect suppliers, on the other hand, no remedial action is regularly expected due to a lack of influence.

Remedial actions are to be monitored and their effectiveness reviewed and updated annually.

Consequences of violations

The Supply Chain Compliance Act does not provide any civil liability, but it does contain various administrative offenses with fines of up to

• EUR 8 million or
• 2% of the average annual turnover from the last three financial years, if the annual turnover exceeds EUR 400 million, and
• a possible exclusion from public tenders for up to three years.

The BAFA is responsible for monitoring the due diligence requirements. The authority acts ex officio and can issue removal orders, enter premises and demand information in the event of violations. As a regulatory authority, it is also entitled to take measures under the German Code of Criminal Procedure (StPO) within the scope of investigative measures.

As well, it is clarified that a violation of the Supply Chain Sourcing Obligations Act does not give rise to any liability under civil law. However, civil liability established independently of this law remains unaffected. But Section 11 LkSG offers the possibility of legal standing for trade unions and NGOs. These can represent affected parties if they claim that their protected legal position has been violated. However, this does not include environmental risks. Which legal positions are ultimately covered by this is unclear, because the LkSG does not create any enforceability under civil law, nor does it itself trigger any liability under civil law. Rather, BAFA is responsible for investigating violations and administrative remedies would be available, but not civil remedies. In this respect, the scope of application is likely to be small and cover few unusual/unlikely cases.

Conclusion and outlook

With the Supply Chain Compliance Act, the legislator has created a new benchmark that needs to be surpassed. In doing so, the motto should not be " it wobbles, but it does not fall." From a legal point of view, breaches of the duties of care arising from the Act do not result in liability for the managers (managing directors/board members) or the company. However, there is the threat of partly severe fines. Those who only do the minimum can also quickly lose the favor of the customer. And from a legislative point of view, the current LkSG will not be the last word. In the future, there may be (further) tightening. A proposal for a directive has already been drafted at the European level (EU Supply Chain Due Diligence Act). Anyone who believes that the German legislator is taking a special approach here will be disappointed. Especially since France and the Netherlands have already enacted comparable laws, as has Great Britain. The legislator is therefore likely to "add to the list" rather than "mitigate the situation."